5

The network device has been configured with snmpv3 users which uses AES192 as the privacy protocol.But when the following command is executed

snmpwalk -v3 -l authPriv -u user -a SHA -A authpass -x AES256 -X privpass device_ip:161 oid

It throws the following error

Invalid privacy protocol specified after -x flag: AES256

but when i tried using AES128 encryption the snmpwalk worked perfectly fine,which made me think if AES192&256 features are supported if not why was it not included.

Optimus
  • 697
  • 2
  • 8
  • 22

4 Answers4

2

The original SNMP RFC documents do not require those.

Thus, along with other reasons Net-SNMP never supports them,

http://www.net-snmp.org/wiki/index.php/Strong_Authentication_or_Encryption

Update in 2019: In Aug 2018, net-snap 5.8 introduced support for such, please refer to the same link for more info.

Lex Li
  • 60,503
  • 9
  • 116
  • 147
  • @k1eran i have device configured with snmpv3 user.Is there anyway I can send a snmpv3 get request to the device with utility tool similar to net-snmp? – Optimus Sep 18 '15 at 05:16
  • @Optimus You might search on the Internet you might find some SNMP utilities. I am not aware of any. – Lex Li Sep 18 '15 at 09:03
  • According to the article in the link AES 192 and AES 256 were dropped at the last moment.Any idea why it was dropped from the RFC?. Was it not better to have 192/256 encryption than just 128? – Optimus Sep 21 '15 at 05:15
  • @Optimus You will have to resort to IETF archived discussions. I have no idea. – Lex Li Sep 21 '15 at 05:20
1

Net-snmp does not support AES 192 or 256. There are many devices (including most Cisco devices) that do support both 192 and 256 bit AES. Manager side software supporting AES 192 and 256 is available from several sources including SNMP Research, LogMatrix, CA, and others.

David Reid
  • 11
  • 1
1

Even though the original RFC does not require AES192 and AES256, some vendors have implemented them, for example Cisco.

Net-SNMP did not support this until release 5.8 (source):

Does Net-SNMP support AES192 or AES256? The short answer is Yes, starting with release 5.8 AES193 and AES256 are an optional configure option.

Other SNMP libraries, such as SNMP4J, also have support for AES256:

Community
  • 1
  • 1
Benedikt Köppel
  • 4,853
  • 4
  • 32
  • 42
0

Cisco supports a AES 192 and 256, but I have found no public software that supports the related client calls. These versions are in actual use.

Bill Cheswick
  • 634
  • 7
  • 12