Failed Attempts

[mark.edwards]

Hi, I have a number of routers that are constantly creating failed authentication attempts in our ACS logs. Sometime the username is a part of the router banner or a part of a console message that is in the log file. We have secured CON and AUX ports with TACACS and I think console messages are somehow being sent to CON and AUX ports. These messages are appearing as failed attempts on the ACS log as the username is not known. Is this a common error? The below is a part of the router config.

line con 0

session-timeout 30

exec-timeout 15 0

password <removed>

login authentication CON_0

line aux 0

exec-timeout 15 0

login authentication AUX_0

[MARK BAKER]

I have seen this error when terminal servers are used to connect to router con and aux ports. The banner was comming from the terminal server. I had to turn off the banner and exec on the terminal server port that was connected to the routers to fix the problem.