Hi, > wouldn't the IP of the host it speaks of in the logs? or does it just say > "failed log in from somewhere out on the network"…? > > my logs have a src… > > %SEC-6-IPACCESSLOGP: list denied tcp 88.243.16.148(3900) -> 10.142.7.1(23), > 1 packet
the device is on a legit bit of network so will be allowed by the current VTY/management plane ACLs ... AAA system sees query from the switch not from the originator of the login. its trivial i know that (which is the frustrating part! :-) ) however, scanning some login/security docs on cisoc.com tonight has been a nice refresher of some other things that need to be put onto a work schedule! :-) alan _______________________________________________ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
