Authentication Failure Event

[Rob Buxton]

I'm getting the following under Informational Events:
An authenticationFailure trap signifies that the sending protocol entity is the addressee of a protocol message that is not properly authenticated. While implementations of the SNMP must be capable of generating this trap, they must also be capable of suppressing the emission of such traps via an implementation- specific mechanism.

There are three per Server, it doesn't happen all the time and not to all Servers. I can see two bursts of three within 6 minutes and then noting for a couple of hours.
I've disabled various protocols but I've no idea what's triggering it.
Servers showing these events are a mix of W2000 and W2003.

Anyone seen this?

[Ivan KOVAC]

Hello

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00800a9405.shtml

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t3/dtitraps.htm

I.

[Rob Buxton]

Ivan,
Thanks for the pointers.
I'm seeing these Events for Servers, not Cisco devices. Or, are you saying it could be a Cisco device doing the SNMP interrogation.
The info does seem to suggest it is some kind of SNMP Polling so I'll open up the SNMP on one of the Servers and see if it gets identified that way.

[Joel Rubenstein · Accepted solution]

Rob,

By default SIM is configured to ignore all authentication traps. This is configured in the SNMP trap settings for the rfc1215 mib. On windows servers it is configured in the SNMP service security settings.

I had enabled one of my SIM servers to process these authentication traps and saw that the windows servers seem to generate bursts of them so I finally just turned it off.

[Rob Buxton]

Ah, the penny drops, I enabled this as I was having some issues with traps being generated from our EVA.
I obviously forgot to disable it again.

[Rob Buxton]

As per previous post