Have a dialer - which interface should I monitor

kentravis

Hi, I have a Cisco Router I have configured to work with a DSL modem via a dialer. I also have a GRE SSL VPN tunnel. I wish to monitor the traffic coming in from the Internet. Should I monitor the outside interface (GE 0/1), or the dialer, or does it mater?

Thanks,

Ken

cnorborg

Any one of them can work, but that also depends on how you're monitoring it too..

If you monitor the Ge0/1, you'll get the dialer traffic, as well as the rest of it.  The dialer traffic should be rather small, so probably not a lot of different in how much traffic.   If you're monitoring with Netflow (ie: NTA), you will see very few types of traffic, the little bit of dialer traffic and probably GRE tunnel traffic.   Monitoring this interface will also let you know if the physical link goes down, lets say if the modem you have attached loses power completely.   But, this interface can be up without you having an active connection to the Internet also.

Monitoring the Dialer interface will get you similar traffic as above, probably minus a little bit for the dialer traffic that you won't see by monitoring this interface.  Netflow will see mainly your GRE traffic and nothing else.   Monitoring this interface will let you know whether your connection to the Internet is up I believe, lets say your provider accidentally deletes your credentials and you can't reauthenticate, the GE0/1 interface would be up, but this one should be down.   This is a good place to put an ACL to restrict traffic to your GRE tunnel too, if that's all you have going over it that is.

Monitoring the tunnel should once again be similar in traffic amounts.   Netflow data will be much more robust, rather than seeing everything as simple GRE traffic, you will see the traffic contained inside the tunnel broken out into its different types of traffic.  

Try monitoring them all and see what results you like!!