snmp: SNMP Security access violation

[oog]

I have a HP procurve 4000 that's been acting funny past few days and losing network connectivity for several minutes. I checked the logs and this is what I got.

'W snmp: SNMP Security access violation' and lists the offending ip address. It looks like this is causing the switch to go down. I scanned the offender and found nothing.

What could be causing this? And do I look for?


-oog

[G. Vrijhoeven]

Hi oog,

Did you configure a list of systems ( mac adresses) that are allowed to connect to the switch. The traps indicate that a system that is not allowed is trying to access the switch. Corrective action can be identifying the traspasser and adding it to the access list/ removing it from the network.

HTH,

Gideon

[oog]

Hey gideon, there is no access list implemented on the switch and the 'trespasser's' ip address is not listed under trap receivers.

The switch lost its snmp and became unmanageable again this morning. It's physically up though. I finally decided to reboot the switch. The procurve 4000 is now manageable again and telnetting to the switch seems less sluggish than before. We deployed over 200 hp procurves and it's only the second time I've seen this happen. Most are running firmware 8.22 which eventually will be upgraded to 9.19.

It looks like the snmp access violation error and the switch losing its snmp had no corrolation.

Also, I visited the machine('trespasser') that's been causing the snmp access violation on our switch and found nothing unusual. Machine is used by a harmless user used for billing purposes. The machine's ip address shows up several times on the procurve logs on several switches in the same network. Could this be virus related?

Btw, thanks for your quick response.


-oog

[G. Vrijhoeven · Accepted solution]

Hi agian,

Sorrie but went home...

I found some links for you that might interest you:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=289586

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=127671

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=251506

And a Cisco link that might give you some extra insight.

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_1_13/config/port_sec.htm


HTH,

Gideon

[oog]

thanks for the links.


-oog

[Ardon Vos]

Hi,

Just go to the command prompt and enter:
setmib 1.3.6.1.2.1.16.9.1.1.3.236 -i 1

This will turn the Logs off.

[Ardon]

Hi Oog,

Second and more important question. What makes you believe that these messages are causing the loss of network connetivity?

\Ardon

[Marc Villeneuve_1]

Hi. In ALL CASE, when you have a problem, be sure that you have the latest FIRMWARE.

I had this problem last month and HP told me to update the switch... and it solve my case.

At any time, before doing anything, be sure you have the latest version.

Have a good day.

Marc