This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

UDT Polls Generate Authorization Failures on Cisco 2800 Platform

punk over 11 years ago

Several months back, I added about 400 C2811 routers to UDT and watched our other NMS tool (Spectrum) fill up with authentication failure alarms. I confirmed a few details with SolarWinds, then took the issue to Cisco. Over the past month or so, I've worked with TAC and determined that the 2800 series platform fails to create the proper community indexes with respect to the VLANs present on the device. Several revisions of both IOS 12.4.x and 15.x with the same results. TAC also reproduced these results.

Here is an example of a 2811 that does not create indexes properly. The device only has the default VLAN 1 present on it.

UDT-2811-1#sh snmp comm

Community name: ILMI
Community Index: cisco0
Community SecurityName: ILMI
storage-type: read-only active

Community name: <redacted>
Community Index: cisco1
Community SecurityName: <redacted>
storage-type: nonvolatile active

Here is an example from a 2911 that does create them properly, again with only the default VLAN 1 present:

UDT-2911-1#sh snmp comm

Community name: ILMI
Community Index: cisco0
Community SecurityName: ILMI
storage-type: read-only active

Community name: <redacted>
Community Index: cisco1
Community SecurityName: <redacted>
storage-type: nonvolatile active

Community name: <redacted>@1
Community Index: cisco2
Community SecurityName: <redacted>@1
storage-type: nonvolatile active

Note that on the 2911, IOS created "<redacted>@1" internally for VLAN 1 but the 2811 did not. Without this, the 2811 responds with an authentication failure trap when it receives an index request for VLAN 1. At this point, an internal bug has been filed with Cisco and it's over to Development Engineering, who reproduced/confirmed the bug and are working on a fix. I'll update this post once I have a bug ID and fix.

0 cvachovecj over 11 years ago

Thanks, that will be helpful!
Jiri
Cancel
Vote Up 0 Vote Down

Cancel
0 punk over 11 years ago

Cisco bug ID is CSCub19968. You'll need a CCO account to view it. There isn't a lot of detail since it was just filed, and there is no ETA on a fix.
Cancel
Vote Up 0 Vote Down

Cancel
0 punk over 11 years ago

The final word from Cisco, as of this morning, is that VLAN indexing was never a feature on the ISR G1 platform (1800, 2800, 3800) and since they are End of Life (with EoS on Oct. 31st, 2016), there are no plans to add new features. Unfortunately for us, this means 393 Cisco 2811s that cannot be added to UDT due to the authentication alarms that the VLAN index polls create. It's necessary to add the 2811s to UDT in order to pull Layer 3 information for those networks.
Cancel
Vote Up 0 Vote Down

Cancel
0 punk over 11 years ago

I was able to work around this issue by disabling Layer 2 polling on each 2811 via UDT. I wasn't aware of this option until Jiri and Mav pointed it out. When I went down this path before, I was only aware of the option to disable Layer 2 at the Orion level, which had no effect on UDT. Once I disabled L2 at the UDT level, I was still able to pull the necessary L3 data off of the parent routers in question and associate it when their child switches' L2 data.
The option can be found under Admin > Node Management or UDT Settings > Port Management, selecting the node, and clicking on Edit Properties. At the bottom of the form is UDT Node Properties, where you can enable/disable L2 and L3 polling or adjust the polling interval. You can select multiple devices at set the property at once.
Cancel
Vote Up 0 Vote Down

Cancel
0 cvachovecj over 11 years ago in reply to punk

Thanks for posting the solution here.
Jiri
Cancel
Vote Up 0 Vote Down

Cancel