SNMPv3

What is SNMPv3?

SNMPv3 (Simple Network Management Protocol version 3) is the secure version of the SNMP protocol, adding user-based authentication, encryption and fine-grained access control to the monitoring and management of network equipment. Where SNMPv1 and SNMPv2c only know a community string sent in plain text, SNMPv3 works with named users, cryptographic keys and views that determine which data a user may read or change. This makes SNMPv3 the usual choice for monitoring switches, routers, firewalls and other OT equipment in networks where cybersecurity matters.

SNMPv3 provides authentication, encryption and access control, but only when you configure it at the highest security level (authPriv) with modern algorithms.

🧠 How does SNMPv3 work?

SNMPv3 is not a new protocol but a new architecture around the same messages (Get, GetNext, GetBulk, Set, Trap, Inform and Report). The IETF published this architecture in December 2002 as RFC 3411 to RFC 3418; together they form Internet Standard STD 62. Two components provide the security:

• User-based Security Model (USM, RFC 3414) - checks per message who the sender is, whether the content was altered in transit and whether the message is fresh. USM also handles encryption.
• View-based Access Control Model (VACM, RFC 3415) - determines per group of users which parts of the MIB tree (views) may be read, written or sent as a notification.

By default, communication runs over UDP: the agent on the device listens on port 161, and the management server receives notifications (traps and informs) on port 162.

Every SNMP entity has a unique snmpEngineID. In addition, an agent keeps two counters: snmpEngineBoots (number of restarts) and snmpEngineTime (seconds since the last restart). A manager learns these values through a two-step discovery. It first sends an unauthenticated request, to which the agent replies with a Report message containing its engine ID. It then sends an authenticated request with boots and time set to zero, and the reply carries the agent’s current boots and time values. Only then does normal authenticated traffic follow.

🔐 Which security levels and algorithms does SNMPv3 offer?

SNMPv3 has three security levels, which you set per user:

The algorithms have been extended over the years:

With HMAC-MD5-96 and HMAC-SHA-96 the computed code is truncated to 12 bytes (96 bits). The RFC 7860 variants use longer codes, for example 192 bits for SHA-256.

🔧 How does USM protect against eavesdropping and replay?

USM combines three mechanisms:

• Key derivation and localisation - the password is repeated to a string of 1,048,576 bytes and hashed. That result is then combined with the device’s engine ID. Each device therefore gets its own localised key, even if you use the same password everywhere. RFC 3414 requires passwords of at least 8 characters.
• Integrity and origin - an HMAC over the entire message proves that it comes from a known user and has not been altered.
• Timeliness - a message is only accepted if its boots and time values fall within a window of 150 seconds. A recorded Set message therefore cannot be replayed later.

Which side is authoritative depends on the message type. For Get, Set and Inform, the receiver is authoritative. For a trap, the sender is. This is why a trap receiver must know the engine ID of every sending device, while an inform works through discovery. Informs are also acknowledged, so a notification is not silently lost.

🏭 How is SNMPv3 used in OT networks?

• Monitoring network equipment - port status, error counters and ring redundancy of industrial switches and managed switches
• Status of equipment near the field - power supplies, temperature and connection status of drives, HMIs and firewalls
• Notifications - informs on link loss, a restart or a power supply fault in critical OT equipment
• Inventory - reading type, firmware version and serial number for the asset inventory
• Detection - forwarding failed SNMP authentications to a SIEM, alongside Syslog messages
• Segmented management - one management server per zone in line with the Purdue Model, passing only summarised data to IT

SNMPv3 helps meet requirements from IEC 62443-3-3, such as identification and authentication (SR 1.1 and 1.2), authorisation enforcement (SR 2.1), communication integrity (SR 3.1) and information confidentiality (SR 4.1). The standard does not prescribe SNMPv3, but SNMPv1/v2c meets none of these requirements.

🔍 What is the difference between SNMPv2c and SNMPv3?

The extra management effort is real, but it mainly arises during initial setup. With templates in the management system and central configuration management, SNMPv3 remains manageable even across hundreds of switches.

⚙️ How do you set up SNMPv3 step by step?

1. Take inventory of which devices use SNMP and which versions and algorithms they support. Older OT equipment sometimes only supports MD5 and DES.
2. Disable SNMPv1 and v2c and remove default communities such as public and private as part of hardening.
3. Create users per role, for example a read-only monitoring user and a separate administrator with write access, in line with RBAC. Choose authPriv with SHA-256 (or at least SHA-1) and AES-128.
4. Use separate, long passwords for authentication and encryption, and store them in a password vault.
5. Restrict views with VACM: give monitoring read access only to the MIB branches it needs and disable Set where it is not required.
6. Restrict the network path with an ACL on the device, a separate management VLAN and firewall rules, so that only the management server can reach UDP 161.
7. Prefer informs over traps for critical notifications, and check that every device has a unique engine ID. Cloned configurations with the same engine ID are a well-known pitfall.
8. Test and monitor: use the usmStats counters and your network monitoring to confirm that no authentication or time window errors occur.

To go further, SNMP can also run over SSH (RFC 5592, ports 5161 and 5162) or over TLS and DTLS (RFC 6353, ports 10161 and 10162). RFC 9456 added TLS 1.3 support in November 2023. These transport models are still rarely supported in OT equipment, so USM with authPriv remains common practice.

🇪🇺 Why does SNMPv3 matter for NIS2 and the Dutch Cybersecurity Act?

The Dutch Cybersecurity Act (Cyberbeveiligingswet), the national implementation of NIS2, has been in force since 15 August 2026. Organisations within its scope must take appropriate measures, including secure network management and the use of cryptography. Management protocols that send passwords in plain text sit poorly with those obligations. US configuration guidelines for network devices, such as the DISA STIGs, likewise require SNMPv3 with SHA authentication and AES encryption. An audit of an OT network therefore often checks first whether SNMPv1/v2c is still active.

❓ Frequently asked questions

Which SNMPv3 security level should I use?

For SNMPv3, always use the authPriv level, in which messages are both authenticated and encrypted. Choose authNoPriv only if a device does not support encryption, and preferably within an isolated management network. The noAuthNoPriv level offers no protection.

Is SNMPv3 with MD5 and DES still secure?

No, SNMPv3 with MD5 and DES is considered outdated. DES uses a key of only 56 bits and MD5 is deprecated. Choose SHA-2 (RFC 7860) or at least SHA-1 for authentication, and AES-128 for encryption.

Which ports does SNMPv3 use?

SNMPv3 uses the same UDP ports as earlier versions: 161 for requests to the agent and 162 for traps and informs. Over SSH these are ports 5161 and 5162, and over TLS or DTLS ports 10161 and 10162.

What is an SNMPv3 engine ID?

The engine ID is a unique identifier of each SNMPv3 entity. The device uses the engine ID to localise keys, so that the same password produces a different key on every device. If you change the engine ID, you usually have to recreate the SNMPv3 users.

Why do I get a “not in time window” error with SNMPv3?

SNMPv3 only accepts messages whose boots and time values lie within 150 seconds of the agent’s own values. The error occurs after a restart or with a cloned engine ID, until the manager resynchronises. A unique engine ID per device prevents most cases.

Can I run SNMPv1/v2c and SNMPv3 at the same time?

Technically an agent can support all versions at once, but the insecure community string access then remains in place. Use such a mixed set-up only temporarily during the migration to SNMPv3. Afterwards, disable SNMPv1 and v2c completely.

📌 In summary

SNMPv3 is the secure standard for network monitoring and management in IT and OT networks, provided it is configured with authPriv, SHA-2 or SHA-1, and AES. With named users, localised keys, a time window against replay and views per group, SNMPv3 prevents management data and passwords from crossing the network unprotected. This makes it an auditable foundation for security in line with IEC 62443 and the Dutch Cybersecurity Act.