Detected an unauthorized user attempting to access the SNMP

[BillP]

I have a Smart-UPS 2200 RM XL at a remote location sending me SNMPv1 errors.  " Informational - Detected an unauthorized user attempting to access the SNMP interface from 192.168.".  The IP is listed in the access control with Type Read, SNMPv1 is enabled, SNMPv3 is disabled. Network card firmware has been updated to v6.5.0.  I have tried to remove the IP in question and re-add it with no such luck.  I have tried removing the batteries and powering down the unit.  Most recient attempt was to update the firmware of the newtork card. Network card firmware has been updated to v6.5.0.  Any ideas team?

Attached are screen shots I thought might be helpful.  IP addresses, Mac addresses, Serial information, and Community Names have been removed.

1IqWrv1ULtfCvWiNKayqCQ%3D%3D&Rest-Api-Key=d3Bhc3F1aWw6NjM3MzU2MWEtNzYzMC00OTc5LTkyMTAtOTJjYTU0NGEwZWFl.pnga9KDw6SovFM%2B5aLfTinAbg%3D%3D&Rest-Api-Key=d3Bhc3F1aWw6NjM3MzU2MWEtNzYzMC00OTc5LTkyMTAtOTJjYTU0NGEwZWFl.png

sx6ifxOHaxkOuJT1VfuW%2BQ%3D%3D&Rest-Api-Key=d3Bhc3F1aWw6NjM3MzU2MWEtNzYzMC00OTc5LTkyMTAtOTJjYTU0NGEwZWFl.png

UUI1S3r7%2BrOsLv8gg17qew%3D%3D&Rest-Api-Key=d3Bhc3F1aWw6NjM3MzU2MWEtNzYzMC00OTc5LTkyMTAtOTJjYTU0NGEwZWFl.png

8L2DSpbzxvHaaqS2oHRb4g%3D%3D&Rest-Api-Key=d3Bhc3F1aWw6NjM3MzU2MWEtNzYzMC00OTc5LTkyMTAtOTJjYTU0NGEwZWFl.png

[B-DoubleE_apc]

Hi Adam,

Could you have multiple NMS on the same IP that are polling via SNMP? If you've customized the community names to match that of the IP that's listed in the event log, that would be my guess. Could you temporarily change the public2/private2 community names to the default of public/private to see if you still get these attempts?

If it's still happening (or there are no other NMS's running on that machine), then a packet capture between that IP and the NMC might be needed to see what kind of SNMP traffic is being sent to the card.

[BillP]

Matt, thank you for your response.  I apologize for getting back to you so late.  I disabled the SNMP in question and ran WireShark looking for traffic to the UPS.  No traffic, yet I still get an attempt every 4 hours.  

[B-DoubleE_apc]

Hi Adam,

No worries. If I send you my contact information, would you be able to send me the log/configuration files from the NMC so I can take a look and help further?

[BillP]

Matt, i received your information and will be sending you those files soon.  However as a general "what the" moment.  The SNMP in question is Spiceworks and its associated IP.  Every four hours I would get an error from the UPS stating something on that IP was an unauthorized user.  As a test, at 1PM yesterday I shut down Spirceworks, and at 4:14PM when the errors should have happened, it didn't.  8:14PM, 12:14AM, 4:14AM, and now at 8:14AM still no errors.

So here is my confusion, obviously the SNMP attempt is from Spircworks, which is supposed to be allowed.  We have 10+ APC 2200 units spread out around the city, configured the same way as far as SNMP goes, with no issues.  Only this one UPS gives us problems.

[B-DoubleE_apc]

Hi Adam,

Thanks for the extra info, that helps. Would you be able to send me the same debug file from one of the other UPS's you have that is not showing the issue? I'm assuming all of the units are the same model, and running the same revision of NMC firmware?

[BillP]

This is the oldest unit.  And it has a AP9631 my others 2200 have AP9630's 😞  I do have a 1500 with AP9631 would you like that? Or would you rather have the 2200 from the AP9630's?

[B-DoubleE_apc · Accepted solution]

I dont think the NMC model would really matter much here, but for safety sake could you send from the 1500 with the AP9631, and one from the 2200 with the AP9630? I'd rather have too much data than not enough 😄