IMHO this is a general CLI design issue.

• set service snmp community foo will allow all IPv4/IPv6 clients to connect
• set service snmp community bar network 172.16.0.0/12 will allow all IPv6 clients to connect but only 172.16.0.0/12 from the IPv4 range
• set service snmp community baz network 2001:db8::/64 will allow all IPv4 clients to connect but only 2001:db8::/64 from the IPv6 range

vyos@vyos# cat /etc/snmp/snmpd.conf  | grep rocommunity
rocommunity bar 172.16.0.0/12
rocommunity6 bar
rocommunity baz
rocommunity6 baz 2001:db8::/64
rocommunity foo
rocommunity6 foo

But what should be the desired behavior?

• When no network or client is speciefied we allow allo but as soon as one network/client is specified we limit it down?

In T1160#31671, @c-po wrote:

But what should be the desired behavior?

• When no network or client is speciefied we allow allo but as soon as one network/client is specified we limit it down?

Sounds right to me.

@danhusan is this your expected behavior?

vyos@vyos# show service snmp
 community bar {
     network 172.16.0.0/12
 }
 community baz {
     network 2001:db8::/64
 }
 community foo {
 }
 community hhhhhh{
     authorization ro
     network 172.16.100.0/24
 }
 listen-address 172.16.254.36 {
 }

resulting in

vyos@vyos#  cat /etc/snmp/snmpd.conf  | grep rocommunity
rocommunity bar 172.16.0.0/12
rocommunity6 baz 2001:db8::/64
rocommunity foo
rocommunity6 foo
rocommunity hhhhhh 172.16.100.0/24