Solved: Problem between ASA 5510 - CiscoWorks

Rattlesnake_bac · ‎05-12-2010

Hello,

the following problem appeared when i enabled syslog on ASA-5510 : every minute it generates 8-10 messages with the following text:

incoming SNMP request (736 bytes) from IP address <CiscoWorks' IP address> Port 2946 Interface "inside" exceeds data buffer size, discarding this SNMP request.

I have read that it could be a problem with pollers, so first i made separate poller only for the ASA, then disabled it completely but these messages keep arriving.

I also searched if there is an option to reduce this size in CiscoWorks, but haven't found any.

Do you have any suggestions on how to eliminate this problem, because it floods the syslog server really quickly, or maybe some command that i can enter on ASA's CLI to expand its buffer size?

Thanks in advance.

P.S. I am currently running LMS version 3.2

Joe Clarke · ‎05-12-2010

It would be helpful to see a packet capture of these SNMP packets to see what application is generating them.

View solution in original post

Joe Clarke · ‎05-12-2010

It would be helpful to see a packet capture of these SNMP packets to see what application is generating them.

Rattlesnake_bac · ‎05-13-2010

Well, i ran packet capture and i noticed the following:

IF-MIB::ifInDiscards.11 (1.3.6.1.2.1.2.2.1.13.11): unSpecified

IF-MIB::ifOutErrors.11 (1.3.6.1.2.1.2.2.1.20.11): unSpecified

IF-MIB::ifInErrors.11 (1.3.6.1.2.1.2.2.1.14.11): unSpecified

IF-MIB::ifOutDiscards.10 (1.3.6.1.2.1.2.2.1.19.10): unSpecified

There is a poller template called "Interface errors" containing these four variables, but it can't be disabled or deleted since it's created by the system.

I temporarily disabled all the pollers using this template but the SNMP requests keep running.

EDIT: After reloading the server with CiscoWorks on it the SNMP requests stopped. Now everything's fine. Thanks for your support.