Unknown reporting device

How do you learn the ip address of a device that MARS interprets as "Unknown reporting device"? Seems like it should be easy, but I cannot find it.

Create a report with 'Unknown Device Event Type' under Events and 'Unknown Event Report' as Query type -> Result format.

Similar Messages

TACACS+ packet from unknown Network Device or AAA Client

Hi all,
I can't perform login using the credential set at ACS server, From the log it shown:
"Failure Reason: 13017 Received TACACS+ packet from unknown Network Device or AAA Client"
I know there's some changes on TACACS+ part for new catalyst IOS, so i refer the guide and this is my config snipet:
aaa group server tacacs+ TAC_PLUS
server name AUTH
tacacs server AUTH
address ipv4 10.10.21.251
key xxxxxx
aaa authentication login TAC_PLUS group tacacs+ local line
aaa authorization exec TAC_PLUS group tacacs+ none
aaa authorization commands 15 default if-authenticated
aaa accounting update periodic 1
aaa accounting exec TAC_PLUS start-stop group tacacs+
aaa accounting network TAC_PLUS start-stop group tacacs+
aaa accounting connection TAC_PLUS start-stop group tacacs+
My platform is
- C6500 running on IOS 12.2 (33) SXJ1
- ACS 5.2.0.26
Need guidance on this, thanks
Noel

Hello,
Is the appropriate IOS IP address defined on the Network Devices and AAA Clients for the ACS? If yes, which IP address is reported on the ACS Failure that includes the error "TACACS+ packet from unknown Network Device or AAA Client"? Is the ACS reporting the IP address as unknown when it is already defined appropriately?
Regards.

Presario V5094EA, usb device malfunctioned, unknown usb device

product: presario V5094EA running win XP,
hi am having a roblem with the usb ports on my laptop they were working fine up untill two weeks ago when they just decided to stop working,
now every time i plug something in they first find new hardware then it reports back a device has malfunctioned, unknown usb device, whether its a memory stick or my usb modem
i have formatted the hard drive reinstalled all the drivers from the recovery discs,
i even tried the information in an earlier post about disconnecting the battery for a period which i did for half an hour, but got the same response when i connected it all back up.
am beginning to think this could be hardware related does any one have any ideas before i go buy a new motherboard,
the laptop is about 6 years old now so well out of warranty,
thanks in advance
alan

It should do a progress reading with percentages. If it ran all the way through and did not say anything was corrupt then I am afraid you have a hardware issue going.

Disk won't mount - Unknown USB Device (Link in Compliance Mode)

I have an HP Envy DV7 (dv7-7243cl ) with Windows 8 Pro x64. My Western Digital 2 terabyte My Book USB3.0 external drive periodically won't mount ( sometimes it will, sometimes it won't). The drive has its own power source.
When this happens Windows device manager shows - Unknown USB Device (Link in Compliance Mode). This can happen if the system is up and running and I plug the drive into the USB port or on system startup where the drive is already plugged in.
Any clue how to fix this?
Other details:
Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
12 Gig memory
Intel(R) HD Graphics 4000
System board 181C 52.24
Bios F.26

Well, the problem is that - as outlined in one of the articles I linked to - some USB devices will not work in Safe Mode; that may have to do with the fact the Safe Mode is only meant to be a troubleshooting tool, not a regular way of booting up. Did you have the USB devices attached while upgrading to 10.6? That would also be a problem - I unplug everything except keyboard and mouse.And, did you repair permissions after the upgrade? If not, do it now.
And, the other problem is the fact that you wait 1 - 2 years before addressing the issue; when you had it in for the last repair and it still exhibited the same problems afterwards, you should would have taken it back, possibly with some screenshots, exact notes of how/when/error messages, etc. and insisted on having it fixed or replaced.
So, I'd run the Apple Hardware Test (after you make sure that you have a complete backup) - instructions here:
http://support.apple.com/kb/HT1509
Report back with whatever messages you wind up with.

"Unknown USB Device"

I got my 2GB nano last Monday. I could successfuly install it on my laptop and upload some songs to it. That done, I wrapped it again and gave it to my wife, so she and the kids could "surprise" me for my Birthday. Yesterday I got it,listened to the "sample songs that came with it", and today I tried to upload some more songs, but to no avail. Everytime I plug it in, all I get is an error message from windows, stating "Unknown USB Device". I tried everything from the iPod support site and from Windows help, but the nano simply won't be recognized. Oh, I tried to hook it up to my desktop at home as well, but nada as well. Same message.
Is my cable fried? Is my iPod connector fried? Can someone pinpoint the problem?
To worsen things even further, I live in Brazil, where the first nanos won't be around until Christmas, and support is but a dream...
Help!
Ruy

These steps should help you with the 'Unknown USB Device' issue, Ruy:
First, make hidden folders visible. Open My Computer and choose Tools/Folder Options/View tab. Click on 'Show hidden files and folders' and click OK.
In the Add New Hardware Wizard, have it search in C:\windows\inf for usbstor.inf. This file is required for windows to properly configure the driver. If Windows finds the driver there, you're done.
If Windows does not find the proper driver there, copy usbstor.sys from C:\windows\servicepack\i386 to C:\windows\system32\drivers.
If you can't find the usbstor.inf file on your system, you can get it here: usbstor.inf
After copying the usbstor.inf driver file to C:\Windows\inf, right-click on My Computer and choose Manage.'
Click on the button labeled 'Device Manager.'
Click to open the list under 'Universal Serial Bus Controllers.'
Right click on any mass storage devices with the exclamation icon next to them and select 'Update Driver.'
Check the option 'Install from a list or a specific location' and then click to continue.
Check next to 'Include this location in the search' and enter 'C:\windows\inf'.
Click on 'Next' and follow the steps to complete the driver installation wizard.

Unknown USB Device when MuVo TX plugged in USB P

The following message came up when I plugged in my MuVo TX in a USB Port
Using WIndows XP
USB attached has malfunctioned
Windows does not recognize it
Unknown USB Device
Does this mean that I have a faulty player? When I first bought it on January 2 2005
I installed approx 25 songs and it works perfect. Now that I want to change these songs
to new ones, my MuVo TX is not recognized by Windows XP. Tried several other
computers with same results.
Can any one suggest a fix?
Thanks

If other PCs are giving the same error, then I think you can be sure the player is at fault somehow.
Have you tried the recovery process? Download the latest driver (if required) and firmware from http://www.nomadworld.com/downloads/drivers. Install the driver file (if required). After you have installed the driver, press and hold the PLAY button, continue holding the button while inserting the player into the USB port for about 0-5 sec. Run the firmware update file and check/tick the 'Format Data Area' check box and click on 'Start'.
If this doesn't help then I think you can be sure the player is faulty.

CS-MARS: Report of inactive reporting devices?

Hi,
Is there a report or a way to create a report in CS-MARS(5.3.3), to list the actual inactive reporting devices. The report I found list only a graph with the amounth of inactive devices in time. I like to see a list with devicenames (or IP addresses). We have over 500 devices in MARS.
Hope someone can help me out.
Regards, Robbert

Test with a query first:
query type: "Destination IPs ranked by Sessions"
Events: "Inactive CS-MARS reporting device"
Time Range: last 1 hour
You'll probably want to exclude some devices using a != in the device column.
If the query looks right, click "save as report".

MARS 6.0.5 with ACS SE 4.2.1 both as an AAA authentication server and as a reporting device

Hi all,
I want to use the ACS SE to authenticate MARS users. As per the User Guide: Admin -> System Setup -> Authentication Configuration -> AAA Server Configuration -> Add. I only have two options: "Add AAA server on new host" and "Add AAA server on existing host". There is no "Add AAA server on an ACS SE appliance" option. Ok, so I add an AAA server on a new host, using the IP address of the ACS SE as the access/reporting/interface IP. I add the "Generic AAA Server" application to the host, I add the AAA server as the primary AAA server in the "Authentication Method", I configure the MARS as a RADIUS client on the ACS SE, and everything works as expected. MARS users authenticate without any issues.
The problem is that I want to use the ACS SE as a reporting device, also.
I can not add it as an "ACS SE 4.x" device, because the reporting IP is already in use by the AAA host created earlier.
Another approach is to install the ACS SE Remote Agent on a computer, but I'm not sure how it works. Let me know if this is correct:
- on the ACS SE, I don't configure syslog logging to the MARS appliance. Instead, I add the remote agent in the Network Configuration, and I configure remote logging to the remote agent
- on the MARS appliance, I add the remote agent as an "ACS SE 4.x" device.
- but then, how do I configure the remote agent to send syslog to the MARS?
Does this sound right?
Another unrelated question: is there a way to use the SNMP agent inside CS ACS from MARS? There is no place to configure an SNMP community string neither under host configuration, nor under ACS SE 4.x configuration.
Any help appreciated. Thanks!

You don't need to configure Remote Agent for logging from ACS SE to MARS. Remote Agent functionality is to send syslog messages to a windows host because ACS SE is an appliance which can't hold too many of the loggings as it grows. Remote Agent logging is also only supported on ACS SE.
You can log syslog messages directly from ACS SE to MARS as follows:
http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/device/configuration/guide/cfgAaaSv.html#wp914601
This is the configuration on ACS SE:
http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/device/configuration/guide/cfgAaaSv.html#wp914172
SNMP is not supported for ACS SE:
http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/compatibility/local_controller/dtlc60x.html#wp75381
Here is a little reading on Remote Agent for ACS SE:
http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/remote_agent/rawo.html
Hope the above helps.

13017 Received TACACS+ packet from unknown Network Device or AAA Client

I am adding new routers to our Corporate network for a new MPLS network. I am getting 13017 Received TACACS+ packet from unknown Network Device or AAA Client errors for these new routers. They are added to ACS 5.4.0.30 correctly just like all of our other devices. We have never had real routers on the network before, just switches and access points. Is there something special I need to set in ACS for these to work and authenticate correctly? I can only access the currently with built in login locally.
One of the new router configs
Current configuration : 2370 bytes
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname T666
boot-start-marker
boot-end-marker
enable secret 5 $1$h7b3$.T2idTKb9H98BQ8Op0MAC/
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa session-id common
clock timezone CST -6
clock summer-time CDT recurring
ip cef
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
voice-card 0
crypto pki trustpoint TP-self-signed-2699490457
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2699490457
revocation-check none
rsakeypair TP-self-signed-2699490457
username netadmin privilege 15 secret 5 $1$SIR2$A3MpShVNeAOlTPyLZESr..
interface FastEthernet0/0
ip address 10.114.2.1 255.255.255.0
ip helper-address 10.30.101.4
duplex auto
speed auto
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
interface Serial0/1/0
ip address X.X.X.X 255.255.255.252
no fair-queue
service-module t1 timeslots 1-24
service-module t1 remote-alarm-enable
service-module t1 fdl ansi
no cdp enable
router bgp 65065
no synchronization
bgp log-neighbor-changes
network 10.114.2.0 mask 255.255.255.0
neighbor X.X.X.X remote-as 209
neighbor X.X.X.X default-originate
default-information originate
no auto-summary
ip forward-protocol nd
ip bgp-community new-format
ip http server
ip http authentication aaa
ip http secure-server
ip tacacs source-interface FastEthernet0/0
no logging trap
tacacs-server host 10.30.101.221 key 7 1429005B5C502225
tacacs-server host 10.30.101.222 key 7 1429005B5C502225
tacacs-server directed-request
control-plane
banner exec ^CC
C
Login OK
^C
banner motd ^CC
C
** UNAUTHORIZED ACCESS TO THIS SYSTEM IS PROHIBITED. USE OF
** THIS SYSTEM CONSTITUES CONSENT TO MONITORING AT ALL TIMES.
** RUAN Transport Corporation
** Network Services
** [email protected]
** 515.245.2512
^C
line con 0
line aux 0
line vty 0 4
exec-timeout 30 0
transport input all
line vty 5 15
exec-timeout 30 0
scheduler allocate 20000 1000
end
T666#

AAA Protocol > TACACS+ Authentication Details
Date :
September 19, 2014
Generated on September 19, 2014 10:21:27 AM CDT
Authentication Details
Status:
Failed
Failure Reason:
13017 Received TACACS+ packet from unknown Network Device or AAA Client
Logged At:
Sep 19, 2014 10:21 AM
ACS Time:
Sep 19, 2014 10:21 AM
ACS Instance:
acs01
Authentication Method:
Authentication Type:
Privilege Level:
User
Username:
Remote Address:
Network Device
Network Device:
Network Device IP Address:
10.114.2.1
Network Device Groups:
Access Policy
Access Service:
Identity Store:
Selected Shell Profile:
Active Directory Domain:
Identity Group:
Access Service Selection Matched Rule :
Identity Policy Matched Rule:
Selected Identity Stores:
Query Identity Stores:
Selected Query Identity Stores:
Group Mapping Policy Matched Rule:
Authorization Policy Matched Rule:
Authorization Exception Policy Matched Rule:
Other
ACS Session ID:
Service:
AV Pairs:
Response Time:
Other Attributes:
ACSVersion=acs-5.3.0.40-B.839
ConfigVersionId=359
Device Port=59840
Protocol=Tacacs
Authentication Result
Steps
Received TACACS+ packet from unknown Network Device or AAA Client
Additional Details
DiagnosticsACS Configuration Changes

Incident : inactive cs-mars reporting device

Hi all,
I am new to MARS, just started the deployment. I have some querries,
- Will a minimum of SNMP RO community and log diversion from a reporting device be enough for the MARS to build incidents and sessions. Or is it that we have to provide telnet/ssh session to the MARS
- I have added some devices using the RO community (switches and routers). I am seeing this message (inactive cs-mars reporting device) although from one of the device I am sending netflow events that are appearing on the MARS.
- How can I verify that a particular device is sending logging information to the MARS.
Thanks in advance.

You should be able to get the raw logs from
Admin -> System Maintenance -> Retrieve Raw Messages
Select the device and the time range and click Submit.

Inactive CS-MARS reporting device (again)

I created a drop rule, dest and src ip's are "ANY", and the hostnames as seen in MARS. I chose to "drop" as action...not "log to db only". The event is "Inactive CS-MARS reporting device, device is "ANY", severity is "ANY", time range is "ANY" I clicked apply, submit and activate.
How come on my Summary | dashboard screen I still see these incidences. I was hoping this would stop. Is this expected behavior, or have I done something incorrectly?
Thanks,
Bob

I've solved that problem including "ANY" and "0.0.0.0" in the source address. CS-MARS doesn't understand that ANY must include 0.0.0.0.
Concerning to the dashboard you'll see the events for a time, and previous incidents will be saved in the incident list. Since you add "0.0.0.0" in source address, you won't see any inactive cs-mars event. The most important issue filtering that event is that it is a very high amount of events and all reports must be created using "!=Inactive CS-MARS reporting device".
As I told you, from now you won't see that event any more.
Good luck!!
ps: Please, rate the post.

Disk utility reports "Device could not be opened" - error when trying to format a new drive in a Mac Pro 1,1

MacPro 1,1 Quadcore 3 GHz (2006 "Woodcrest")
32 GB RAM
ATI Radeon HD 5770
OS X 10.7.5 Lion
I have encountered the following behavior when trying to format a new drive with disk utility. This description has also been send via the Mac Pro feedback as a bug report to Apple.
On searching the web and forums with this particular error message and behaviour I could not find any usful results. So maybe the following description may be helpful for some users.
Best regards.
1. Drive Bay 1 contains the original 250 GB Startupdisk. It works without errors.
2. Drive Bays 3 and 4 contain each a WD Caviar Black 2 TB SATA 3 HDD. They work without errors.
3. I have purchased a third WD Caviar Black 2 TB HDD.
4. In Drive Bay 2 there has been a Seagate 750 GB HDD, which worked in conjunction with all the other drives without error.
5. I exchanged the Seagate HDD in Drive Bay 2 with the new WD Caviar Black 2 TB HDD.
6. On starting the system, it will report to initialize the new drive.
7. On trying to initialize the new drive with disk utility it reports the error [translated from German] "Erasing of the volume has failed. The device could not be opened."
8. I thought that the drive is faulty. Thus I created an RMA-Case at WD. They exchanged the drive without problems.
9. On getting the exchanged WD Caviar Black 2 TB drive I put it in Drive Bay 2 as before.
10. On trying to erase and format the exchange drive I got the same error message "Drive could not be opened."
10.1 On selecting the physical drive in the devices list, disk utility reports all information in the bottom area of its window as usual, e. g. hard disk description, connection bus, type and place, capacity, write status, SMART-status, partition scheme.
10.1 On leaving that drive selected in the devices list and clicking the info-button, disk utility will also report additional information as usual, e. g. Name, Type, partition scheme, media-identification, media name, media type, device tree, … , number of relocated sectors, etc.. All this information appears to be valid, as can be compared to the other devices information inside the other Drive Bays. Also the disk numbering scheme appears to be standard - 4 HDDs give the numbering disk0, disk1, disk2, disk3.
10.2 From that information I conclude that the SATA-bus and connectors electrically work properly, the drive has spun up and can be accessed by the system normally.
11. I powered down the computer, took out the HDDs from Drive Bays 3 and 4 and put the caddy with the new exchange drive in Drive Bay 4 [Maybe, I could have also just left it alone in Drive Bay 2, or 3].
12. After powering on the system, disk utility will quick format the exchange drive without any error message. Also, when erasing again by selecting the option to write zeros to the drive, disk utility will finish without error.
13. After disk utility finished formatting, I put back the original drives into Drive Bay 3 and 4 and put the now newly formatted drive back into Drive Bay 2.
14. After switching on the computer the system start and login proceeds without any error message. All drives appear as expected on the desktop.

If anyone is reading this still looking for what caused the issue and how to fix it here is what I discovered.
The antivirus program our company uses, Bitdefender Antivirus Plus, was causing some of the PDF files not to open. After troubleshooting the different modules and settings the culprit was..
Scan SSL in Privacy Control Settings. Turning it OFF solved the problem and all the PDF files that previously would not open now open just fine. This issue has been sent to Bitdefender for them to review. If you use a different antivirus program and are having this issue try locating the Scan SSL setting and see if turning it off solves the problem.

Unknown firewire device

Hello,
I've had some recent freezes (usually during logout from one account to another or shutting down). After a hard reboot, startup is long and external drives will not mount at times. After, switching cables and ports for the external drives (2 firewire, 1 usb (timemachine) it seemed to alleviate the problem but not entirely. After checking system profiler, my firewire bus lists my 2 external drives plus this:
Unknown Device:
Manufacturer: Unknown
Model: Unknown
Maximum Speed: Up to 400 Mb/sec
Connection Speed: Unknown
After ejecting the existing firewire drives, profiler still says this 'unkown device' is on the firewire bus.
Could this be related to recent freezes and drives not mounting properly?
Any thoughts would be appreciated -- thanks much.
Quad g5
6GB RAM

Hi. Seem to remember some discussion a while back about it being a good idea to disconnect any FW400 devices and reset the FireWire bus before any heavy FW800 work, such as cloning - because the combined FW800/400 bus on the G5 can get stuck at the 400 speed...
Anyway, after the hard Shutdowns, you could try running Disk Utility > Verify Disk to check for directory problems - if any are found you can use the 10.5 retail disk in this process
http://docs.info.apple.com/article.html?path=DiskUtility/10.5/en/duh1018.html
and reset the FireWire (last bit on the page here)
http://docs.info.apple.com/article.html?artnum=88338
Good Luck.

K7n420pro + ME: unknown USB device

Hey,
I have a problem with the USB Contoller. When
I connect my ISDN PABX to the controller, Windows ME just tells: " unknown device". I have the latest CAPI driver from the PABX manufacturer... Connecting an USB mouse makes no problem.
The PABX is ok, it works fine with other system boards(and ME or XP)
Any idea??? IRQ conflict?
k7n420 pro, BIOS 2.6 or 2.3: same problem
latest Nvidia nForce System Driver 2.29
1 GHz AMD Duron CPU
onboard gaphic
128 MB RAM x2 (256 Total)
Seagate ST340016A 40 GB
Windows ME or Windows 98: same problem
ISDN PABX: xi420i (German Telekom)

Hi Richard,
yes I tried so. Windows: "The specified location does not contain information about your hardware."
I have tried the hints from Microsoft's kb Q142984 - no solution.
Kim

X-Fi Extreme Music sometimes unknown hardware device

Using Windows Media Center 2005 on a Dell Dimension 550 I am having the following problem:
This dell came pre-installed with this X-Fi card and as far as i know it had no problems. Because of other reasons I had to do a clean install of this PC using the official media center cd. I had installed the X-FI using the drivers from Dell wich worked fine.
A couple of hours everything went fine.. a couple of reboots, shutdowns.. kept having sound. Then for some reason i came into windows and i had an unknown device and no sound ! Re-installing drivers did nothing and pointing this unknown device to the right drivers said they didn't match ! Then suddenly the sound card popped right back in. The card sometimes even pops out & in changing users (randomly).
I have tried creative drivers and dell drivers but it's the same thing. Also i changed PCI slots but still the same !
Any other ideas ?

Have you enabled digital IO in one of the tabs on "Speakers" settings? If not, that is youre problem.

Unknown reporting device

Similar Messages

Maybe you are looking for