2848 switch - snmp: SNMP Security access violation from ....

[Cristian Iconomu]

Hi all,

We have a problem with a 2848: we are unable to get anything via snmp. It keeps giving snmp security error, no matter the host.
Here is the config:
___________________________________________
Startup configuration:

; J4904A Configuration Editor; Created on release #I.08.56

hostname "YYY-2"
ip default-gateway 192.168.0.254
snmp-server community "public" Unrestricted
snmp-server community "yyy" Unrestricted
snmp-server host 192.168.0.189 "public" All
snmp-server host 192.168.0.3 "yyy" Critical
vlan 1
name "DEFAULT_VLAN"
untagged 1-48
ip address 192.168.0.115 255.255.255.0
ip igmp
exit
fault-finder bad-driver sensitivity high
fault-finder bad-transceiver sensitivity high
fault-finder bad-cable sensitivity high
fault-finder too-long-cable sensitivity high
fault-finder over-bandwidth sensitivity high
fault-finder broadcast-storm sensitivity high
fault-finder loss-of-link sensitivity high
fault-finder sensitivity high
fault-finder sensitivity high
ip authorized-managers 192.168.0.189 255.255.255.0
ip authorized-managers 192.168.0.3 255.255.255.0
stack join 0004ead4bf00
spanning-tree
ip ssh version 1-or-2
password manager
password operator
_____________________________

Anyone any ideas? I've done all according to manuals and forum threads in regards to the settings. What am I missing?
I try to discover the switch via toptools and another software with no result.

Thanx in advance

[Cristian Iconomu]

Me again.
I just noticed the authentication access task "Web-Auth" Primary login is "ChapRadius"...

[Frank Benke_1]

you need to fix the chapRadius and therefore activate "local" user accounts for login. Otherwise you need to switch to snmp version 3 to use proper authentication and encryption.

your ip-authorized managers shoud have a 32 bit netmask or you can permit 192.168.0.0 / 255.255.255.255 .

password manager / password operator refer to local accounts being configured. but with chapRaqdius you don't use this setting.

hope this helps

regards

frank

[Cristian Iconomu]

Thanks Frank,

That's exactly my problem, but I cannot figure out how to change from chap-radius to local for web-auth... It's maybe just me, but I can't find the proper command line to do that, and I've checked help for almost all commands...
I've tried also using 255.255.255.255 mask... I still get the security error.
So... what do I do wrong?