LOGIN-3-TOOMANY_AUTHFAILS

[tristian1]

I'm getting several of these errors on a daily basis. I've run 'login on-failure log' but I'm not seeing any failures in the logs. How can there be too many authentication failures when there are no authentication failures being logged?

The full log lines look like this.

001729: .Nov 25 15:58:26.506 EST: %LOGIN-3-TOOMANY_AUTHFAILS: Too many Login Authentication failures have occurred in the last one minute on the line 6.
001730: .Nov 25 15:59:36.762 EST: %LOGIN-3-TOOMANY_AUTHFAILS: Too many Login Authentication failures have occurred in the last one minute on the line 7.

Any help to at least get me looking in the right direction would be greatly appreciated.

[nspasov]

A couple of questions/requests:

1. What type of device is this and is it facing the internet or your internal network

2. Are you using any sort of a AAA server

3. Can you attach a copy of the config

Also, here is a good link on how to log failed and successful authentications:

https://aaronwalrath.wordpress.com/2010/06/01/monitoring-authentication-attempts-on-cisco-routers-with-syslog/

Hope this helps!

Thank you for rating helpful posts!