I want to perform monitoring of my network infrastructure, can this safely be done with SNMPv2?

Question

I need to perform monitoring of my network infrastructure but I'm wondering if using SNMPv2 is secure? What are the weaknesses of SNMPv2?

Answer 1

If SNMPv3 is not an option you can do some things to help secure SNMPv2 better.

1. Don't enable the Read-Write string. There are very few reasons to enabled it.
2. Choose community strings that are more complex and remove any that are 'private' or 'public'.
3. Use an access-list on the community string to restrict what IP addresses can poll the device.
4. Do not enable 'system-shutdown' option.
5. Use a different community string for SNMP traps vs the polling SNMP string.

Answer 2

SNMPv2 should not be used especially if SNMPv3 is available. There are some basic flaws in SNMPv2, predominantly the use of community strings which are sent over the network in an unencrypted form to query the network infrastructure.

Also it's based on a community string instead of a separate username/password combination, SNMPv2 (and 1 for that matter) cannot provide any assurance of confidentiality, integrity nor authenticity.

SNMPv3 is a lot better in regard to security,SNMPv3 includes three important services: authentication, privacy, and access control (Figure 1). To deliver these services in a flexible and efficient manner, SNMPv3 introduces the concept of a principal, which is the entity on whose behalf services are provided or processing takes place. Read more about it on the cisco website.

Answer 3

Whereas SNMPv3 is significantly more secure than v2, you can at least mitigate some of the risk of implementing v2 by restricting access with an ACL. I would also advise against creating a read/write v2 community.