# SNMP: Arista EOS versus Aruba AOS-S

## Arista EOS

Source: [Arista EOS — SNMP](https://www.arista.com/en/um-eos/eos-snmp)
Retrieved: 2026-05-01

v1/v2c surface (Cisco-style grammar):

```
snmp-server community public ro
snmp-server community private rw
snmp-server location "Synthetic Lab Rack 7"
snmp-server contact "noc@example.net"
snmp-server host 10.0.0.250
```

v3 USM:

```
snmp-server user monitor netadmin v3 auth sha $9$fake$authHash$1 priv aes256 $9$fake$privHash$1
snmp-server user readonly readonly v3 auth sha256 $9$fake$authHash$2 priv aes $9$fake$privHash$2
```

Arista accepts the full SHA family (`sha`, `sha224`, `sha256`,
`sha384`, `sha512`) and `aes` / `aes192` / `aes256` for priv.

## Aruba AOS-S

Source: [Aruba ArubaOS-Switch 16.10 Management and Configuration Guide for 2930F/2930M/3810/5400R](https://www.arubanetworks.com/techdocs/AOS-S/16.10/MCG/2930F-3810-5400/index.htm)
Retrieved: 2026-04-30

v1/v2c surface — quoted community + AOS-S-named access keyword:

```
snmp-server community "public" Operator
snmp-server community "private" Manager unrestricted
snmp-server location "Building 7 Floor 3"
snmp-server contact "noc@example.com"
snmp-server host 10.0.0.5 community "public"
```

Access keywords: `Operator` (read-only by default) and `Manager`
(read-write).

v3 USM:

```
snmpv3 user "monitor-usr" auth sha "AUTHP4SS" priv aes "PR1VP4SS"
snmpv3 group "auth-priv-grp" user "monitor-usr" sec-model ver3
```

Aruba accepts only `md5` / `sha` for auth and `des` / `aes` for
priv — the full SHA-256/384/512 family is **not modelled**.

## Cross-vendor mapping

The canonical surface is `CanonicalSNMP` with `community`,
`location`, `contact`, `trap_hosts`, and `v3_users`.

Arista -> Aruba round-trip details:

* `community`: Arista `ro` -> Aruba `Operator`; Arista `rw` ->
  Aruba `Manager`.  Quote-tolerant on the community string
  (Aruba quotes by convention; Arista emits bare; codec normalises
  on parse and re-quotes on Aruba render).
* `location` / `contact`: opaque free-text round-trips cleanly.
* `trap_hosts`: Arista's `snmp-server host <addr>` emits as
  Aruba's `snmp-server host <addr>` (community defaults).
* `v3_users` — **partial degradation**:
  - Arista's `sha224` / `sha256` / `sha384` / `sha512` auth
    protocols collapse to plain `sha` on Aruba (which only
    models SHA-1).  The auth_protocol enum value normalises but
    the actual hashing differs — Aruba's SHA-1 KDF will not
    accept Arista's SHA-256+-derived passphrase blob.
  - Arista's `aes192` / `aes256` priv ciphers collapse to plain
    `aes` (AES-128) on Aruba.  Same passphrase incompatibility.
  - The opaque auth/priv passphrase blobs are NOT cross-
    compatible because USM keys are salted with vendor-specific
    engineID-derived constants (separately from the
    protocol-strength downgrade).

Operator must re-key v3 users on the target device.

The Arista kitchen-sink (`ks-leaf-01`) exercises this matrix
exhaustively — `monitor` user with `auth sha priv aes256`,
`readonly` user with `auth sha256 priv aes`.  Both downgrade to
Aruba's narrower protocol enum and both require operator
re-keying.

Disposition for `community` / `location` / `contact` /
`trap_hosts`: **good**.

Disposition for `v3_users`: **lossy** (auth/priv protocol
downgrade for SHA-256+ / AES-192+ users; engineID-derived
passphrase salt incompatibility on top of that).
