We have a UCS system configured for LDAP authentication against Active Directory. Everything is working as expected, but on the DCs we are seeing excessive failed login attempts originating from the fabric interconnect IPs against an invalid domain account. We are seeing anywhere from hundreds to thousands of attempts per day, so I don't believe these are due to invalid GUI login attempts or anything user driven. I've dug through the GUI but cannot find anything that would be using that account. The BindDN is set to use a different account created solely for this purpose. An example from the event log is posted below (192.168.32.12 is the primary FI). Any thoughts?
An account failed to log on.
Security ID: SYSTEM
Account Name: LP-DC02$
Account Domain: CO
Logon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Admin
Account Domain: CO
Failure Reason: Unknown user name or bad password.
Sub Status: 0xc000006a
Caller Process ID: 0x1dc
Caller Process Name: C:\Windows\System32\lsass.exe
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
Why do you need native HA: The native HA feature allows two Cisco DCNM
appliances to run as active and standby applications, with their
embedded databases synchronized in real time. Therefore, when the active
DCNM is not functioning, the standby DCNM will...
This document will provide screenshots to outline the steps to setup
TACACS+ configuration to ACI and also the configuration required on
Cisco ACS server. Please find the official Cisco guide for configuring
TACACS+ Authentication to ACI:
Is it supported or NOT supported? It's a frequently asked question.
Before APIC, release 2.3(1f), transit routing was not supported within a
single L3Out profile. In APIC, release 2.3(1f) and later, you can
configure transit routing with a single L3Out pr...