Cisco Prime Alarms

[aidei0001]

Hi, 

I keep getting this "Device 'IP Address' Authentication failed for request from
'IP Address" in Cisco Prime. Please has any one had this issue before. Please advise on how you resolved it?

Many thanks in advance

[marce1000]

 - Was the device entered with correct credentials in Prime; remove the device from Prime and re-enter it but issue 'verify credentials' first (e.g.).

M.

[Harrie Hendriks]

I have the same problem:

Device '10.10.X.X'. Authentication failed for request from '52.73.169.169'.

The Management address of te switch is a private range 10.10.X.X

The address 52.73.169.169 is an external adres and was found 3622 times in de AbuseIPdb.

The VTY and the SNMP port are protected with an acl, what is ending eith a deny any any log

The acl give not a hit, but how can the hacker be ask for authentication?

[marce1000]

 - Depends on how the ACL is setup, does it for instance block the unwanted private addresses only ? You may for instance try to replay what the hacker is doing from your home internet connection and check if that works too or not. If needed you may need to enforce your perimeter firewall policy.

 M.

[Harrie Hendriks]

The ACL are as followed.

access-list 99 permit X.X.1.0 0.0.0.255

access-list 99 permit 192.168.1.0 0.0.0.255

access-list 99 deny any log

snmp-server community rw-name rw 99

snmp-server community ro-name rw 99

line vty 0 4   |  line vty 5 15

  access-class 99 in

Is there a third method for 'connecting' the switch.

[marce1000]

                      > Is there a third method for 'connecting' the switch.

 Can't confirm or deny - you could let an nmap scan let loose on it (e.g.). I also advise to disable http and https server/services

 M.