topic Constant Failed Attempts from ASYNC ports in Network Access Control

Constant Failed Attempts from ASYNC ports

daniel.diaz — Mon, 11 Mar 2019 01:36:57 GMT

Our ACS 4.2 Failed Attempts log is being filled by "noise" on the async (tty0/tty1) from both our routers and switches. We have modems attached to our routers primarily on the console ports, in addition we have the aux port of our router connected to the console port of our LAN switch so we can reverse telnet into the switch. Both router & switch are TACACs enabled. In the user-name field of the ACS log, we get "noise" such as "interface up and down", "Press RETURN to get started", which the authen-failure-code indicates invalid characters or "ACS user unknown" in username field. What would cause this? I know misconfigured modems can cause echo issues but why a switch console port?

Constant Failed Attempts from ASYNC ports

Gregory Smith — Wed, 22 Aug 2012 18:43:16 GMT

Daniel, did you ever get this resolved. We are seeing the same issue.

Constant Failed Attempts from ASYNC ports

daniel.diaz — Wed, 22 Aug 2012 21:18:00 GMT

Gregory, I believe we did as we don't see the constant logging. We disabled the modem auto-discovery on the Aux port which I believed resolved the issue but we also disabled Banner Login and set the no exec command on the aux port, so I will have to go back and check my notes but you can try these in the mean time.

Re: Constant Failed Attempts from ASYNC ports

Jagdeep Gambhir — Wed, 22 Aug 2012 22:09:33 GMT

Dan/Greg,

This issue occurs when terminal server device (like c2509, c2511 or other) connect to it and which is sending junk to console or aux lines of the Router/Switch.

What may happen wrong with Terminal Server config:

= Incorrect speed for the line (which is connected to console of the router)

= possibly "exec" is running on that line on Terminal Server, thus sending unexpected prompt to the router console/aux.

When you want to allow only an outgoing connection on a line, use the *no**exec* command.The *no exec* command allows you to disable the EXEC process for connections which may attempt to send unsolicited data to the router.

(For example, the control port of a rack of modems attached to an auxiliary port of router.) When certain types of data are sent to a line connection, an EXEC process can start, which makes the line unavailable.

The user will still be able to access the console of the device and be authenticated as well. This puts extra burden on ACS and you may see some latency with legitimate authentications.

Let me know if you have any question.

Regards,

~JG

Do rate helpful posts

Re: Constant Failed Attempts from ASYNC ports

paheeradan.nagulan — Wed, 15 May 2024 22:26:27 GMT

Thank you for the explanation Jagdeep!