How to Configure SNMP on H3C Switches (SNMPv2c & SNMPv3)

Simple Network Management Protocol (SNMP) is one of the most widely used protocols for monitoring and managing network devices such as switches, routers, firewalls, and wireless controllers. Whether you use SolarWinds, PRTG, Zabbix, ManageEngine OpManager, or another Network Management System (NMS), SNMP enables these tools to collect performance statistics, monitor device health, and receive alerts.

This guide explains how to configure SNMP on H3C switches using both SNMPv2c and SNMPv3. While SNMPv2c is still common in many production environments, SNMPv3 is recommended for new deployments because it offers authentication and encryption for improved security.

What is SNMP?
Why Configure SNMP?
SNMP Versions Explained
Prerequisites
SNMPv2c Configuration
SNMPv3 Configuration
Configure SNMP Traps
Verification Commands
Troubleshooting
Security Best Practices
Frequently Asked Questions
Conclusion
Related Articles

What is SNMP?

SNMP (Simple Network Management Protocol) is a standard protocol used to monitor and manage network devices remotely.

It allows administrators to:

Monitor CPU utilization
Monitor memory usage
View interface bandwidth
Monitor link status
Receive fault notifications (Traps)
Collect historical performance statistics
Integrate devices with Network Monitoring Systems

Without SNMP, network administrators would need to manually log into each switch to check its health and performance.

Why Configure SNMP?

Configuring SNMP provides several operational benefits:

Centralized monitoring
Faster troubleshooting
Automatic alert generation
Capacity planning
Performance monitoring
Reduced downtime
Better network visibility

SNMP Versions Explained

Version	Authentication	Encryption	Recommended
SNMPv1	No	No	No
SNMPv2c	Community String	No	Existing Networks
SNMPv3	Username + Password	Yes	Yes

Recommendation: Use SNMPv3 whenever possible because it provides authentication and encryption, making it significantly more secure than SNMPv1 or SNMPv2c.

Prerequisites

Before configuring SNMP, ensure that:

You have administrator privileges.
The switch IP address is reachable.
The monitoring server IP address is known.
Firewall rules permit UDP ports 161 and 162.
ACLs are planned to restrict SNMP access.

Example Network

+----------------------+
| Monitoring Server    |
| 192.168.1.100        |
+----------+-----------+
           |
           |
      UDP 161 / UDP 162
           |
+----------+-----------+
| H3C Switch           |
| 192.168.1.10         |
+----------------------+

Step 1: Configure an ACL

Restricting SNMP access using an Access Control List (ACL) prevents unauthorized systems from querying the switch.

acl number 2091

rule 5 permit source 192.168.1.100 0

Explanation

Only the monitoring server at 192.168.1.100 is allowed to communicate with the switch using SNMP.

Step 2: Configure the SNMP Community

Create a read-only SNMP community.

snmp-agent community read Cisco acl 2091

Explanation

Creates a Read-Only community
Community name: Cisco
Access restricted using ACL 2091

Read-only access is recommended because monitoring systems generally do not need configuration privileges.

Step 3: Configure Contact Information

snmp-agent sys-info contact Network Administrator

This helps identify the administrator responsible for the switch.

Step 4: Configure Device Location

snmp-agent sys-info location Data Center Rack 12

Useful for large organizations managing hundreds of devices.

Step 5: Enable SNMP

snmp-agent

This command activates the SNMP service on the switch.

Step 6: Configure Trap Receiver

snmp-agent target-host trap address udp-domain 192.168.1.100 params securityname Cisco

This enables the switch to send SNMP traps to the monitoring server.

Examples of SNMP traps include:

Interface down
Interface up
Power failure
Fan failure
Authentication failure
Temperature alarm

SNMPv3 Configuration (Recommended)

Configure an SNMPv3 user with authentication and privacy.

snmp-agent

snmp-agent group v3 NetworkGroup privacy

snmp-agent usm-user v3 NetAdmin

authentication-mode sha StrongPassword123

privacy-mode aes128 SecurePassword123

snmp-agent usm-user v3 NetAdmin group NetworkGroup

SNMPv3 provides:

User authentication
Message integrity
Data encryption
Better protection against unauthorized access

Verify the Configuration

Run the following commands:

display current-configuration | include snmp

Displays all configured SNMP settings.

display snmp-agent

Displays SNMP operational information.

display acl 2091

Confirms that the ACL is configured correctly.

You should also test polling from your Network Management System to verify successful communication.

Common Troubleshooting

Unable to Poll the Switch

Possible causes:

Incorrect community string
ACL blocking access
SNMP service disabled
Wrong SNMP version
Firewall blocking UDP 161

SNMP Traps Not Received

Check:

UDP Port 162
Trap destination IP
Monitoring software configuration
Firewall rules
Routing between devices

Authentication Failure

Verify:

Community string
Username (SNMPv3)
Password
Authentication method
Encryption settings

Security Best Practices

Follow these recommendations to secure your SNMP deployment:

Prefer SNMPv3 instead of SNMPv2c.
Restrict SNMP using ACLs.
Avoid default community names such as public and private.
Use strong authentication passwords.
Enable encryption when using SNMPv3.
Allow only trusted monitoring servers.
Periodically review SNMP logs.
Disable SNMP if it is not required.

Frequently Asked Questions

Which UDP ports does SNMP use?

UDP 161 for polling
UDP 162 for traps

What is a Community String?

A community string acts like a password for SNMPv1 and SNMPv2c devices.

What is the difference between Read-Only and Read-Write communities?

Read-Only communities allow monitoring only.

Read-Write communities permit configuration changes and should be used only when absolutely necessary.

Should I use SNMPv2c or SNMPv3?

SNMPv3 is recommended because it provides authentication, encryption, and significantly better security.

Can I configure multiple SNMP managers?

Yes. Multiple monitoring servers can receive SNMP data and traps if configured appropriately.Conclusion

SNMP remains one of the most effective methods for monitoring enterprise networks. By configuring SNMP correctly on H3C switches, administrators can integrate their devices with popular Network Management Systems, automate monitoring, receive alerts, and improve network visibility.

Although many organizations continue to use SNMPv2c for compatibility, SNMPv3 should be the preferred choice for new deployments because it provides strong authentication and encrypted communication. Always protect SNMP access with ACLs, use secure credentials, and verify the configuration after deployment to ensure reliable monitoring.

Networklearner

Wednesday, 7 May 2014