cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
949
Views
0
Helpful
5
Replies

SNMP Authentication failure

I am seeing these authentication failure messages in the logs of the switches.
2y20w: %SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host aa.aa.aa.aa
2y20w: %SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host bb.bb.bb.bb

I have two applications (observium and ntopng) 
But both aa.aa.aa.aa and bb.bb.bb.bb observium/ntopng servers can successfully read the metrics from the switch. 

Configuration on the switch:-
snmp-server community public RO

result when I run snmpwalk:-

snmpwalk -v 2c -c public x.x.x.x 1.3.6.1.2.1.1.3
iso.3.6.1.2.1.1.3.0 = Timeticks: (3273494533) 378 days, 21:02:25.33

Why I am seeing this and how do I fix this issue ?

 

5 Replies 5

Hi

 The reason you see it because you probably have this line here on the switch:

" logging snmp-authfail"

If you remove this line, the logs will desapear. But, a better idea is try to identify who is causing this. Probably observium or ntopng is trying to access the switch with a different SNMP community or fetching some information that does not exist on the switch.

 PS. Avoid communicaty named public.

Thank you for your reply Flavio. I understand "logging snmp-authfail" will fix the issue but we want to understand why this error messages are getting generated even though I see the data on observium and ntopng servers without any problem. 
Also, we don't use public as community string, I used this as an example. 

 

Once thing I would do on this situation is span the switch uplink port to some other port and use Wireshark to identify the who is triggering this log.

Considering this is SNMPv2, you probably can see the community and probably the OID called.  

Can I see the snmp config?

Sanitized the content. This is my SNMP config. 

logging snmp-authfail
snmp-server engineID local XXXXXXXXXXXXXXXXXXXXXXXX
snmp-server community public RO
snmp-server location AA IDC (ABC) [00.0000000000, 00.0000000000]

Review Cisco Networking for a $25 gift card