Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am new to the open source network access control solution called Packetfence.

I am currently diagnosing Packetfence log files remotely.

The network seemed to be running smoothly with Packetfence, until around the 5th-6th of March. Now, when the Packetfence service is started, the network on the destination stops working.

There are 50+ switches and 500+ PCs and devices that access the network so it is not possible to diagnose this issue in other ways than looking at log files.

Some errors from the log file:

  • Mar 05 17:14:34 pfsetvlan(22) ERROR: error creating SNMP v2c read connection to 172.17.250.19: No response from remote host '172.17.250.19' (pf::SNMP::connectRead)

  • ERROR: could not convert dot1dBasePort into ifIndex in any VLAN. Setting trapType to unknown (pf::SNMP::Cisco::parseTrap)

  • Mar 06 08:41:01 pfsetvlan(5) INFO: mac trap received on 172.17.250.90 ifindex 11 which is uplink and we don't manage uplinks (pf::vlan::doWeActOnThisTrap)

  • INFO: doWeActOnThisTrap returns false. Stop mac handling (main::handleTrap)

  • Mar 06 08:41:04 pfdhcplistener(3617) INFO: could not resolve 172.17.4.120 to mac in ARP table (pf::iplog::ip2macinarp)

 

  1. Why do these error messages occur?
  2. What can I do to continue searching for the problem?
share|improve this question

1 Answer 1

The first error is the one you should focus on. Most of the operations in PacketFence require proper SNMP access and failure to create a proper read connection will propagate failures to the other components.

You can troubleshoot your SNMP reads with something like:

/usr/local/pf/bin/pfcmd_vlan -switch 10.0.0.15 -getAlias -ifIndex 12 -verbose 4

You could also troubleshoot with snmpwalk directly:

snmpwalk -v 2c -c <community> 10.0.0.15 IF-MIB::ifAlias

Most likely causes:

  • wrong SNMP read / write community configured on switch
  • wrong SNMP read / write community configured in PacketFence's switches.conf
  • no route to the switch's management IP (IP configured in switches.conf)
  • firewall in between PacketFence and switch blocking the traffic

Note: Wrong community string will behave exactly as if you can't reach the switch. This is how SNMP was designed.

share|improve this answer
    
i executed the above command with my switch ip but displays nothing. plus there is no firewall ,iptables or SE Linux enabled on machine. –  Ahmed Saad Apr 27 '12 at 10:10
    
@ oliveir, one more thing the switches.conf file does not have the normal vlan community string which is 10. –  Ahmed Saad Apr 28 '12 at 20:44
    
There could still be ACLs or firewall elsewhere between the server and your switches. –  Olivier Bilodeau Apr 30 '12 at 19:34
    
@AhmedSaad, normalVlan and community string are two different concepts. Don't mix them up. normalVlan has nothing to do with your current problem. Community strings are defined with the following two parameters in switches.conf under SNMP version 1 or 2c (SNMPv3 configuration differs): SNMPCommunityRead and SNMPCommunityWrite. –  Olivier Bilodeau Apr 30 '12 at 19:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.