This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Monitor VPN Tunnel

FormerMember over 16 years ago

I'm trying to use the Custom MIB Poller to monitor the status of a VPN tunnel on a Cisco ASA. Has anyone figured out how to do this?

I've found the following OID in the CISCO-REMOTE-ACCESS-MONITOR-MIB but the Custom MIB configuration wizard only lets me enter the first portion into the system. It appears that the OID is made up of the OID plus a three digit number which is unique to each tunnel. Thus, I cannot enter the ??? portion of the OID so as to look at that particular tunnel.

1.3.6.1.4.1.9.9.171.1.2.3.1.7.???

Any ideas?

Top Replies

chandler-bing over 9 years ago in reply to cobrien1 +2

I've found this to be a good resource for Cisco ASA's: http://www.activexperts.com/admin/mib/Cisco/CISCO-IPSEC-FLOW-MONITOR-MIB/objects/ I've so far been monitoring (& graphing) in/out bandwidth for each…

0 Mithrilhall over 16 years ago
What interface is your tunnel?

sh ip int bri
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 16 years ago in reply to Mithrilhall

It terminates on the "Outside" interface.
Cancel
Vote Up 0 Vote Down

Cancel
0 SW44302 over 16 years ago in reply to FormerMember

Wouldn't it be easier to just monitor the device on the other end of the tunnel?
Cancel
Vote Up 0 Vote Down

Cancel
0 jbaulsir over 16 years ago

Because there are the possibility of multiple VPN tunnels, the three digits would indicate which one, this requires the GET TABLE functionallity which is not supported in 8.1 and from some other threads, wont be in 8.5 either, maybe 9.0? I really would like GET TABLE to monitor my servers (Disks, Logicial partitions, Arrays, Temperature sensors, etc)

I monitor my VPNs (only one per ASA) by monitoring (at the far end) the inside interface on the ASA and the outside interface on the edge router so if the ASA goes down but the edge router stays up, I know its the VPN and if the edge router goes down then everything is down.

JB
Cancel
Vote Up 0 Vote Down

Cancel
0 alij over 16 years ago in reply to jbaulsir

Hello,

I am also having problem with monitoring of VPN tunnels on our Cisco VPN concentrator, we have around 24 LAN-to-LAN IPSEC VPN tunnels and I want to monitor the bytes received and transmit for each tunnel, please tell me which OID will do this? I have Cisco VPN Concentrator 3020 series

Thanks,

Ali
Cancel
Vote Up 0 Vote Down

Cancel
0 jkoebel over 16 years ago in reply to alij

We are using a Cisco ASA running version 8.0.x code and would like to gather stats on each of the ~100 tunnels we have active. These tunnels terminate with vendors and other organizations so we would be unable to monitor the remote side other than up/down status. It would be nice to be able to have Orion provide detailed reporting on each connection entry. Anybody from Solarwinds have anything, yes or no, or coming soon?
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 16 years ago in reply to jkoebel

Get Table functionality is coming in the next major Orion release.
Cancel
Vote Up 0 Vote Down

Cancel
0 jkoebel over 16 years ago in reply to FormerMember

Denny, thanks for the quick response and you have made my day. I'm happy it's in the works.

jk
Cancel
Vote Up 0 Vote Down

Cancel
0 chris.schear over 16 years ago

This is what I've been doing with my ASA VPN tunnels... For each tunnel I setup, I determine an IP address on the remote side that the IT staff will allow me to ICMP poll, at a minimum. Ideally, I get them to allow me public/RO access to some key resource on their end that should "always be up". I then monitor that IP address and as a Node, give it Custom Properties that describe it as a site-to-site VPN, etc.
Cancel
Vote Up 0 Vote Down

Cancel
0 aly.elnokali over 16 years ago in reply to chris.schear

Hii faced the same problem i have multiple VPN on the router and i need to monitor their status, i used 2 MIBs, this one 1.3.6.1.4.1.9.9.171.1.3.2.1.5 to get the peer address of the VPN, and anther one to show its status, but unfortunately it chooses one randomly VPN session to monitor. I need to monitor all the active session. Does anyone have any idea ??
Cancel
Vote Up 0 Vote Down

Cancel