After upgrading to Spectrum 23.3.11+ Cisco devices are generating false Management Agent Lost Alarms
Article ID: 386181
Updated On:
Products
Issue/Introduction
We have noticed an excessive amount of events and alarms for Management Agent Lost for Cisco devices yet the device responds. These are 0x10d00 and 0x10daa:
0x10d00
{d "%w- %d %m-, %Y - %T"} - Device {m} of type {t} is no longer responding to primary management requests (e.g. SNMP), but appears to be responsive to other communication protocol (e.g. ICMP). (event [{e}])
0x10daa
{d "%w- %d %m-, %Y - %T"} - Device {m} of type {t} is no longer responding to primary management requests (e.g. SNMP), but appears to be responsive to other communication protocol (e.g. ICMP). This condition has persisted for an extended amount of time. An alarm will be generated. (event [{e}])
When reviewing a tcpdump or sniffer trace, there are packets for IpAdEntAddr with community@vpls_<vrf context instance>
For example:
public@vpls_Spec1
public@vpls_spec2
Cause
VRF configuration is not fully enabled on the Cisco devices.
Resolution
Configure VRF properly on the Cisco devices so that polling the IPaddress table with the community@vpls_<contextname> works.
If you are not using the VRF context data, you can disable Spectrum from polling it.
1. Add read_vrf_interfaces=false to the SS/.vnmrc
2. Create a search for ModelType Name equal to CiscoVrfContextApp
3. Select all, right click - Attribute Editor
4. Select the Add on User Definded
5. Search for VrfSupportEnable and move it to the right.
6. Set VrfSupportEnable to no on all CiscoVrfContextApp. You can select the "Set As Default" so that any newly created models will have this disabled by default.
3. Restart the SpectroSERVER
In 24.3.7 and above the default value for read_vrf_interfaces will be false and if you change VrfSupportEnable to No (or Yes) on the CiscoVrfContextApp model it will not require a SpectroSERVER restart.
Feedback
