I have noticed that PC Config task on 924 adtran router has high cpu usage. Anyone know about this process?

[technut]

I have a 924 adtran router and yesterday it disconnected internet for a 1 minute or so.  When I checked it out I noticed that PC Config task was utilizing well over 95% of the cpu.  I followed some of the suggestions about enabling RapidRoute and it worked for a while today put PC Config is back at utilizing well over 93% of the cpu.  Does anyone have any ideas on what I should check next to debug this issue?  Also what does PC Config actually do out of curiousity.  I have attached the router config.

[Anonymous]

Last time I saw high 'PC Config' was on a 3448. Someone was hacking snmp.  A bot brute forced a community string and was running a massive amount of requests on the router. Put an acl on snmp access in addition to the community string and haven't had any problems since. Check your logs/event-history and you'll find the culprit.

[technut]

Thanks Caution.  I have looked in the event-history and really did not see anything that stood out to me.  Are there other logs to view within the Adtran router?  I have been monitoring for the past week and I have not had any issues so far.  I will check the acl on snmp access/communitry string.

[Anonymous]

Technut,

Thanks for posting.  I agree that locking down SNMP access is a good idea.  Also, I would normally suggest checking "debug sip stack messages" to see if some type of SIP scanner was attempting to register to the unit.  However, it appears you likely have SIP locked down pretty well.  You may want to make sure that all your permit statements within ACL2, including the ones for SSH and HTTPS, specify only the WAN IP address.

The next thing that you may want to make sure is secured is the "eth 0/1" interface IP address.  I'm concerned that the "InLan" policy is allowing traffic from the internet to reach the unit by that IP address, for things like SIP and DNS-proxy.  Assuming that is a public IP address, you might want to consider adding a discard policy above "allow list InLan" that references an ACL which specifies the eth 0/1 IP address.  Also, you could reconfigure your InLan ACL as follows.

ip access-list extended InLan

  deny ip any host <eth 0/1 IP address> 

  permit ip any  xx.xx.xx.xx X.X.X.X

Thanks!

David

[Anonymous]

Technut,

I just wanted to follow up with you and see if you were able to determine the issue.  Let us know if we can answer any other questions or be of further assistance.

Thanks!

David

[Anonymous]

Technut,

I went ahead and flagged this post as "Assumed Answered".  If any of the responses on this thread assisted you, please mark them as Correct or Helpful as the case may be with the applicable buttons.  This will make them visible and help other members of the community find solutions more easily.  If you still need assistance, I would be more than happy to continue working with you on this - just let me know in a reply.

Thanks!

David