Orionnpm Monitoring Site-to-Site and Remote Access VPN on Cisco Firepower

sigm

After talking with SW support, it looks like Orion doesn't have any monitoring capabilities for Cisco Firepower VPNs (Remote Access or site-to-site). I have requested they add this feature, and the support tech mentioned that SW has had several requests for this basic feature of a FW/VPN device. Are there any other options within SW to get this information? The reporting from the ASAs was great, but I am surprised to find out it is non-existent with the FPR platform. 

ronan.tonilon

Disclaimer:
The content posted herein are provided as a suggestion or recommendation to you for your internal use. The information set forth herein may come from third party website or customers. SolarWinds is not liable for any downtime or any issue that may occur if you perform the following suggestions on the link provided. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.
Please try this first in a lab environment, before implementing to your production.


SolarWinds Technical Support is right, SolarWinds' current support for Cisco Firepower Threat Defense (FTD) platforms is very limited, especially when it comes to VPN monitoring (both Remote Access and Site-to-Site).

This limitation exists because FTD doesn’t expose VPN metrics or session data via traditional SNMP, which is how SolarWinds typically collects performance and status data. Instead, Firepower heavily relies on:

• REST APIs (FMC/FTD API)

• Syslog events

• Smart licensing telemetry

• No direct SNMP OIDs for VPN session tracking like on ASA
  

Workarounds

1. Use Syslog Parsing for VPN Event Monitoring

• Firepower can send detailed VPN logs via Syslog.

• You can configure SolarWinds Syslog Viewer (or Kiwi Syslog if licensed) to:

  • Capture messages such as:

    • Tunnel up/down events

    • Login attempts (for RA VPN)

    • Crypto map failures or timeouts

  • Trigger custom alerts based on regex or keyword matching (e.g., "Tunnel XYZ up")

• Not real-time session counts, but event-driven visibility.

2. Monitor VPN Interfaces or Tunnels via SNMP (Partial)

• Firepower may still expose interface counters via SNMP if configured correctly.

• You can:

  • Use Custom Pollers (UnDP) to poll tunnel interfaces (if they're assigned to a VRF or have unique IPs).

  • Track bandwidth usage or state on logical VPN interfaces (if any are exposed).

• Caveat: This is not equivalent to VPN session visibility like you had with ASA.

3. Custom Integration Using FMC/FTD REST API

If you have access to Cisco FMC or FTD API:

• Use Orion SDK or PowerShell to query FTD API endpoints for:

  • Active RA VPN sessions

  • S2S VPN tunnels and peers

  • User identities (for RA)

• Feed the results back into SolarWinds via:

  • Custom Properties

  • Custom Tables

  • Custom HTML or SWQL dashboard widgets

Cisco Firepower API Reference:

• https://developer.cisco.com/docs/firepower-threat-defense-api/

• https://developer.cisco.com/docs/fmc/

 Limitations vs ASA

Feature	ASA (via SNMP/SolarWinds)	FTD (Firepower)
Site-to-site tunnel visibility	Yes	Not via SNMP
Remote Access VPN sessions	Yes	No SNMP OID
Syslog messages	Full events	Full events
API Access	No API	Full REST API
SNMP support	Traditional OIDs	Very limited

---

Recommendation

If SolarWinds is your core NMS but you require deep VPN visibility from Firepower, you can:

• Use SolarWinds for availability + Syslog-based alerting

• Use a scripted REST API poller that integrates FTD session data back into SolarWinds

• Request SolarWinds to add native support for FTD VPN APIs — which you already did (good move)

---

Optional: Script + Dashboard Integration

If you're interested, I can help you:

• Write a PowerShell or Python script to poll the FTD/FMC API for VPN sessions

• Push that data into SolarWinds custom tables or alerts

• Display it via a Modern Dashboard for visibility

 

Integration suggestion: 

To integrate Cisco Firepower VPN session data into SolarWinds, we’ll use the Cisco FMC REST API (or FTD’s API directly, if FMC isn’t used) and push the results into SolarWinds using the Orion SDK.

Integration Plan: Firepower VPN Monitoring into SolarWinds

Step 1: Pre-Requirements

• ️ Cisco FMC or FTD with API access

• ️ API credentials (basic auth or token-based)

• ️ Orion SDK installed on your server (PowerShell or Python)

  • Orion SDK GitHub (with SWIS examples)

• ️ Custom Table widget or custom properties ready to receive data

Example Use Case: Remote Access VPN Sessions

We’ll:

1. Query the FMC API for current RA VPN sessions

2. Extract: username, peer IP, session duration, device name

3. Push to a SolarWinds custom table or custom property for reporting

 

PowerShell Script Template

# Define credentials and FMC endpoint

$FMCServer = "<a href="https://fmc.example.com">">https://fmc.example.com"</a>

$Username = "apiuser"

$Password = "yourpass"

# Authenticate and get token

$headers = @{

  'Content-Type' = 'application/json'

}

$response = Invoke-RestMethod -Uri "$FMCServer/api/fmc_platform/v1/auth/generatetoken" -Method POST -Headers $headers -Credential (New-Object System.Management.Automation.PSCredential($Username, (ConvertTo-SecureString $Password -AsPlainText -Force))) -SkipCertificateCheck

$token = $response.Headers["X-auth-access-token"]

$domain_uuid = $response.Headers["DOMAIN_UUID"] # required for later calls

# Set auth header

$headers["X-auth-access-token"] = $token

# Call VPN session data (example path - may vary)

$vpnSessions = Invoke-RestMethod -Uri "$FMCServer/api/fmc_config/v1/domain/$domain_uuid/analytics/ra-vpn/sessions" -Headers $headers -Method GET -SkipCertificateCheck

# Sample processing and push into SolarWinds via SWIS (Orion SDK PowerShell)Import-Module SwisPowerShell

$swis = Connect-Swis -Hostname "your-solarwinds-server" -Username "admin" -Password "adminpass"

foreach ($session in $vpnSessions.items) {

  $nodeName = $session.deviceName

  $username = $session.userName

  $peerIP = $session.peerIP

  $duration = $session.duration

  # Option 1: Update custom property

  # Set-SwisObject -SwisConnection $swis -Uri "swis://.../NodeID=123" -Properties @{ CustomProperty1 = $duration }

  # Option 2: Insert into a custom table (need to pre-create schema in SolarWinds DB or use SDK to create it)

}

Displaying in SolarWinds

Option A: Custom Table in Modern Dashboard

• Use SWQL to show:

  • Username

  • Peer IP

  • Session Duration

  • Last Seen Timestamp

• Filter by Device/Node

Option B: Node Custom Properties

• Useful if mapping VPN session counts or status back to specific nodes

Hope this helps.