Question

A service provider NOC uses an SNMPv2c-based monitoring platform to poll edge routers. Security policy requires that the read-only community string can retrieve only the interface (IF-MIB) subtree and must be denied access to all other MIB objects. On a Cisco IOS device, which configuration approach correctly enforces this restriction?

Accepted Answer

Create an SNMP view that includes only the ifTable OID subtree and bind that view to the RO community string using the 'snmp-server community view RO' command.

Answer

Apply an inbound extended ACL on the management interface matching UDP 161 sourced only from the IF-MIB OID range.

Answer

Configure an SNMPv3 group with authPriv and map it to the community string using 'snmp-server group ... v2c priv'.

Answer

Set 'snmp-server community <string> RO' and rely on the default read view, which automatically restricts polling to enabled MIBs only.