CWLMS 3.1 send a message Layer 3 to not deployed devices

[jorgelina.abraham]

We ´re detected that the CWLMS3.1 send a message of layer 3, we don´t know exactly the protocol, may be be a SNMP message. This message is sending

to a family devices belong to other customer, ZTE. They are access ADSL devices that deny the packet.
These devices are no declared, we do not pretend manage with CWLMS.
Why this occurr ? We do not want that CWLMS send message to these devices.
What can I do for solving this issue?
Here we show one of these devices:

AAP11D$ show access-l
AclStatus      : enable   
DiscardPacketCount: 84         ---> amount of access fail
DiscardIPAddr  : 200.43.9.157   --> IP of CWLMS
index Src Ip           Src Mask        aclCount  port
----------------------------------------------------------------
1      172.18.4.15     255.255.255.255 active    
2     172.18.4.128    255.255.255.224 active   
3     172.18.4.200    255.255.255.255 active   
4     200.43.9.0      255.255.255.224 active   
5     190.227.215.10  255.255.255.255 active   
6      172.49.77.1     255.255.255.255 active

Thanks in advance!

Best regards,

[Derek Clothier]

Hi,

     I suspect that LMS is trying to discover this device .  Most likely it is being seen as a CDP Neighbour of a device that you manage with LMS, and then LMS is trying to read CDP MIB information from the device using snmp. Depending on what Discovery Modules you have enabled in your LMS System, it could be being discovered by other mechanisms though eg ping sweep.  If you go to Common Services -> Device and Credentials -> Device Discovery and click on the number beside 'Unreachable Devices'  :

* Do you see this device listed ?

NB If the device has multiple IP addresses, it may be listed with any of it's configured IP Addresses, not neccesarily it's Management IP address.

* If the device is listed, what appears as the 'Found by modules' for this device ?

    Stopping LMS from attempting to discover this device will depend on which module(s) have attempted to discover it.

Regards

Derek Clothier

[jorgelina.abraham]

Hi Derek!

The items in "Device Discovery Summary" are empty. Here attach the screenshot.
The point is that the devices was load to DCR by means of file .CSV imported.
The devices have CDP disable, by security reason.

Best regards,and have a nice weekend!

[Derek Clothier]

Hi Jorgelina,

     Thank you for telling me the device was imported to DCR from a csv file. I can see from the screen shot you posted that Discovery is not running , so this rules out Discovery as the source of the traffic to the device. Once a device is added to DCR however, unless you have changed some of the settings, the device is automatically added to other LMS modules such as Campus Manager , Resource Manager Essentials and Device Fault Manager. These other modules will be attempting to access the device in order to learn more about the device.  Typically access is attempted via snmp, but RME may be attempting to Telnet or SSH into the device depending on settings you have configured for Config Archive.

    If as you said in your initial post, you do not manage this device with LMS, is there any reason why you can't just delete this device from DCR ?

    If for some reason you must keep this device in DCR, you will need to do the following for each LMS module that the device is currently seen in :

1. Disable the automatic addition of DCR devices to the module. eg for RME

* Go to RME -> Admin -> Device Mgmt -> Device Management Settings

* Untick 'Enable Auto Mode'

* Click 'Apply'

2. Delete the device from the modukle eg for RME

* Got to RME -> Devices -> Device Management -> RME Devices

* Select the device

* Click 'Delete'

    The downside of the above, is that by disabling automatic addition of devices to each of the LMS modules, when ever you add a new device to LMS you will need to manually add it to each of the modules.

     Let me know how you get on.

Regards

Derek

[jorgelina.abraham]

Hi Derek:

The point is that the devices was load to DCR by means of file .CSV imported.
But the devices that send undesired message not are included in DCR  8/

Therefore I can´t eliminate the device from DCR, because it is not in the list..!!

Tell me if you need more information or screenshot,

Thanks in advance

Best regards,

Jorgelina

[Derek Clothier]

Hi Jorgelina,

     Sorry, I mis understood you. When you said devices had been loaded to DCR from a csv file, not by discovery, I thought you meant the device in question was in the csv file and hence had been added to DCR.

    So if the device isn't in DCR, then LMS shouldn't be polling it.  Do you have other Network Management applications installed on the LMS server ?

     The only other thing I can think of, is to start a packet capture on your LMS server to capture traffic to/from the device in question, let this run for a couple of days so that any pattern in the taffic can be seen, and then send me the packet capture. It shouldn't be a large capture file.  Hopefully the type of traffic will give some clues as to what's happening.

     If you have LMS installedon a windows server, then you would need to download and install wireshark.  When you run the capture, configure a capture filter 'host '  eg host 10.10.10.10

     If you have LMS installed on Solaris then you can just perform a snoop from the cli - % snoop -o file.cap host

eg snoop -o file.cap host 10.10.10.10

where file.cap is the name of the capture file, you can use any file name you like.

Regards

Derek