https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705353#M1094338 <P>this ip is one of my company user pc , does it mean the user is trying to do some attack?</P> Wed, 19 Oct 2022 06:21:27 GMT baselzind 2022-10-19T06:21:27Z https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705340#M1094335 <P>every now and then i see this message on my core? is it some kind of attack?</P> <P>%SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host X.X.X.X</P> Wed, 19 Oct 2022 06:20:43 GMT https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705340#M1094335 baselzind 2022-10-19T06:20:43Z https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705342#M1094337 <P>&nbsp;</P> <P>&nbsp; - Means snmp request was tried with invalid community , you may configure snmp related acl's on the switch to allow snmp requests from trusted hosts only.</P> <P>&nbsp;M.</P> Wed, 19 Oct 2022 06:01:23 GMT https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705342#M1094337 Mark Elsen 2022-10-19T06:01:23Z https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705353#M1094338 <P>this ip is one of my company user pc , does it mean the user is trying to do some attack?</P> Wed, 19 Oct 2022 06:21:27 GMT https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705353#M1094338 baselzind 2022-10-19T06:21:27Z https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705361#M1094339 <P>&nbsp;</P> <P>&nbsp;- Depends , in worst case the user's device may be infected by virus or malware , it may then also be appropriate to re-image the particular device.</P> <P>&nbsp;M.</P> Wed, 19 Oct 2022 06:32:11 GMT https://community.cisco.com/t5/network-security/snmp-auth-failure-on-a-switch/m-p/4705361#M1094339 Mark Elsen 2022-10-19T06:32:11Z