Detected an unauthorized user attempting to access the SNMP interface

[DCIM_Support]

I have a customer that is receiving a cascade of alerts when his monitor servers ping his network management card.

I know he can disable this alert but then he won't be able to receive notification in the event of a genuine malicious attack.

Is there any way to put is server on a white list to prevent these nuisance e-mails. 

(CID:128065151)

[DCIM_Support · Accepted solution]

Dear Adrian Carroll,

As Steven Marchetti correctly answered, a similar question :

Your first best bet would be to stop the scanning with incorrect credentials...

I.e., in your case, your 3-rd party monitoring server should poll the NMC by the SNMP protocol with the correct community strings (see the settings inside the NMC in the SNMP section).

I hope this is what you need.

With respect.

(CID:128065174)

[DCIM_Support]

Hi ,

The path given by Steven is the path from the DCE. Is there a way to find out the correct community strings from the NMC itself?

(CID:128065951)

[DCIM_Support]

Dear Adrian Carroll,

...Is there a way to find out the correct community strings from the NMC itself?

Yes, of course.

I explain for SNMPv1: in order for NMC not to flood you with e-mail messages about unauthorized SNMP access attempts, you need to specify the correct Read-only Community Name on your 3-rd party monitoring server for your NMC (please, contact the administrators of this 3-rd party monitoring server).

For example, you need login to the web-GUI of your NMC along the path as in my screenshot (for SNMPv1):

And then we'll see, that for this NMC Read-only Community Name = public (this is the default value, I did not change it, although I could do it). Now, this value, i.e. public must be specified on the 3-rd party monitoring server to poll this your NMC.

If on your 3-rd party monitoring server to poll this NMC is specified the incorrect value of Read-only Community Name, it causes a lot of e-mail messages from the NMC about unauthorized SNMP access attempts.

I hope I understood you correctly and it will help you.

If there are more questions, please ask.

(CID:128065948)

[DCIM_Support]

That's great. Thank you very much for your assistance.

(CID:128065943)

[DCIM_Support]

Ok, thanks for the feedback 😀.

(CID:128065938)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.