Why do I get this "AAA-W-REJECT: New http connection for user cisco, source 10.1.30.132 destination 10.1.30.139 REJECTED" constantly?

[redgasgiant]

Hi, 

Whenever I log on to any of our sg350x switches I constantly am bombarded by these %AAA-W-REJECT: New http connection for user cisco, source 10.1.30.132 destination 10.1.30.139  REJECTED  popups. 

Why is the 10.1.30.132 switch even trying to connect to the 139 switch? 

Is this related to findit? 

[Mark Elsen]

  - Check if this thread applies to your case :

           https://community.cisco.com/t5/network-access-control/aaa-authorization-of-sf302-08mpp-issue/td-p/2556695

 M.

[redgasgiant]

Thanks but we are not using radius on our network, those settings are all at defaults or turned off. 

I see that I can turn the popups off and adjust the logging threshhold, but I'd like to understand these notifications. 

Do the discovery services trigger these? 

[Mark Elsen]

 - Since you are not using radius what kind of 'aaa authorization configuration' are you using then ?

   M.

[redgasgiant]

Hi M, thank for the reply.

I am using defaults, honestly not sure what they are. Switch is brand new, I only have one user cisco/cisco. 

I don't see any AAA setting in GUI to screen shot for you. 

In CLI i have found the AAA settings and have tried  "aaa authentication login authorization default none" and "aaa authentication enable authorization default none" which, is no good for security. But I still see the AAA reject messages coming from other SG350x's. 

I did also find that I can stop seeing those AAA rejects(and accepts) by using the "no aaa logging login" command.  
But I'm still confused why I see the other switches attempting to connect to each other. 

[Mark Elsen]

 - Try removing AAA-settings on the switch and the others , if not needed, check if this helps.

  M.