SNMP Community Strings - Complete Guide
1. What is an SNMP Community String?
An SNMP Community String acts like a password in SNMPv1 and SNMPv2c. It controls access between a:
- SNMP Manager (e.g., PRTG, Zabbix, SolarWinds)
- SNMP Agent (e.g., Router, Switch, Linux Server)
It determines whether the manager can only view device data (read-only) or modify settings (read-write).
2. Types of Community Strings
| Type | Permissions | Default Example | Use Case |
|---|---|---|---|
| Read-Only (RO) | Can retrieve data | public | Monitoring tools |
| Read-Write (RW) | Can modify configurations | private | Automated tasks (e.g., Ansible) |
⚠️ Security Risk: Default strings like public and private are well-known and should be changed immediately.
3. How SNMP Community Strings Work
Example SNMP query from a Linux-based monitoring server:
snmpget -v 2c -c public 192.168.1.1 sysDescr.0-v 2c: SNMP version 2c-c public: Community string
The SNMP agent on the device validates the string. If it matches an RO string, it returns the value:
sysDescr.0 = Cisco IOS XE Software, Version 17.06.014. Configuring Community Strings (Cisco IOS Example)
Step 1: Enable SNMP Agent with Strings
Router(config)# snmp-server community MyROString RO
Router(config)# snmp-server community MyRWString RWStep 2: Optional – Restrict by Source IP (Using ACL)
Router(config)# access-list 10 permit 192.168.1.100
Router(config)# snmp-server community MyROString RO 10Step 3: Verify Configuration
Router# show snmp communityCommunity name: MyROString
Storage type: nonvolatile
Access: Read-only
IP ACL: 105. Security Risks & Best Practices
⚠️ Risks
- Default strings are easily guessable.
- Data is sent in plaintext over the network.
- Read-Write strings allow unauthorized configuration changes.
✅ Best Practices
- Use complex strings like
N3tM0n!t0r2023 - Apply Access Control Lists (ACLs) to restrict SNMP managers by IP
- Use SNMPv3 for secure, encrypted communication
- Disable SNMP entirely if not needed
6. Testing Community Strings
Using snmpget (Linux)
snmpget -v 2c -c MyROString 192.168.1.1 sysDescr.0Using snmpwalk (To fetch full MIB tree)
snmpwalk -v 2c -c MyROString 192.168.1.17. Community Strings vs SNMPv3
| Feature | SNMPv1/v2c | SNMPv3 |
|---|---|---|
| Authentication | Community string | Username + Password |
| Encryption | No (plaintext) | Yes (AES/DES) |
| Access Control | RO / RW | Role-based views |
| Security Level | Low | High |
8. Common Misconfigurations
- ❌ Using default strings (public/private)
- ❌ No ACLs to restrict querying devices
- ❌ Using RW strings for basic monitoring (use RO)
Troubleshooting Tips
Check SNMP service:
Router# show snmpTest string from SNMP Manager:
snmpget -v 2c -c MyROString 192.168.1.1 sysDescr.09. Advanced: SNMP Views (Restrict Access)
To limit visibility to specific SNMP objects (like interface data only):
Router(config)# snmp-server view MyView ifEntry included
Router(config)# snmp-server community MyROString view MyView RO10. Summary
- Community Strings = Shared password for SNMPv1/v2c
- RO = Read data only | RW = Change configs
- Never use default values in production
- Secure with ACLs and migrate to SNMPv3 where possible