Hello Team, we observe huge number of authentication attempts from Cisco Prime Infrastructure (~28k per day). So anyone please confirm why is it so?

[Gaurish.sadadekar1993]

Hello Team, we observe huge number of authentication attempts from Cisco Prime Infrastructure (~28k per day). So anyone please confirm why is it so?

[Mark Elsen]

 - Were and how are you observing this ? (Provide a screenshot (e.g.))

M.

[Gaurish.sadadekar1993]

Hello Marce,

Our customer is observing this on TACAS server, as per my understanding prime login in devices for restoring the backup & we have  approx. 14000 inventory. We had enabled backup of devices  background task & schedule it for every day. But still login attempts are 28000 on each day is a concern. Kindly help 7 revert on earliest.

[Mark Elsen]

 - Examine, the tacas alert-entry in detail; if it comes from a switch then it could be that the switch or even a number of switches were entered with wrong access-credentials in Prime; if so they should be removed from prime and re-entered again with the correct credentials. If the tacas alert-entries come from the Prime server itself; then it's less clear for me.

M.

[Gaurish.sadadekar1993]

Hello Marce, 

Yes, we have switches with Wrong CLI credentials but very few, can you please confirm how this few switches will may lead to this many login attempts. Or is this any more possibilities for the same.

[Mark Elsen]

  Hmm, that's very difficult to asses , there it might be due to  background actions of Prime, which are not always visible to the end user. I would strongly suggest to enter all switches with correct credentials in Prime. If that is not possible ;  remove the 'bad' switches. Check if the errors on the tacas server persist,

M.