Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Report inbound connections to firewall

Does anyone have a report to show number of connections per hosts to a firewall? I have been looking into Report Writer, seen an option, Count of termination Address but report shows 0. Before I look into SQL query, thought i would ask, thanks

Find more posts tagged with

Accepted answers

All comments

cahunt

You should be able to chart it out with the gui.

There are statistics tables that holds a count for connections.

ASA_ConnectionStatistics_Detail, _Hourly and _Daily as well.

I would have to do a test, but first thought it they are using the 'crasNumUsers' OID to poll for this value. Which is what I used to poll for manually before the ASA integration.

Object crasNumUsers

OID 1.3.6.1.4.1.9.9.392.1.3.3

-CharlesH

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

Precursor : Cisco ASA Active VPN Connections

ckocian

I hear SolarWinds is doing away with Report Writer, I looked at Manage Reports from All Settings and ran report to get just a total. I am looking for detail to see if many connections are arriving from a single IP to help identify an attack. Not sure if this is possible with SolarWinds, thanks for the info so far. If you have any other suggestions I can look at let me know, I'll keep looking, thanks

Messaging FW Connections

Summary of Orion Objects:

Datasource 1

Summary of Time Periods:

Past Hour (2:57 PM - 3:57 PM Sep 5, 2018)

Custom Table for Datasource 1 from Past Hour (2:57 PM - 3:57 PM Sep 5, 2018)

DATE TIME	CONNECTIONS IN USE	WEIGHT	FAILED RATE
9/5/2018 3:02:55 PM	11659 connections	600	7.037968E+07
9/5/2018 3:03:45 PM	6501 connections	600
9/5/2018 3:12:55 PM	12191 connections	600	3.263621E+07
9/5/2018 3:13:45 PM	6124 connections	600
9/5/2018 3:22:55 PM	6170 connections	600	6.623038E+07
9/5/2018 3:23:45 PM	3440 connections	600
9/5/2018 3:32:55 PM	5993 connections	600	3.150232E+07
9/5/2018 3:33:45 PM	3530 connections	600
9/5/2018 3:42:55 PM	7766 connections	600	6.452407E+07
9/5/2018 3:43:45 PM	5320 connections	600
9/5/2018 3:52:55 PM	6473 connections	600	6.069966E+07
9/5/2018 3:53:45 PM	3882 connections	600

cmatrask

Hi Charles,

How can you do this with a Cisco FTD?

Thanks much,

Cheryl

cmatrask

I wish Solarwinds would keep Report Writer. It has helped me out quite abit when I needed specific reports when the Web interface Report Management tool could help.

I hear you!

Cheryl

cahunt

cmatrask, I am not 100% sure, you might want to do a scan of the device if you are able.

So far I have not been able to find the full detail that you are looking for. I do not have one of my own at the moment to scan, but you might try tuning into 1.13.6.1.4.1.9.9.826.0.x.x for a scan/walk (starting at 1.13.6.1.4.1.9.9.826, or ...826.0.) if a full walk does not get the desired results in your return... X values I am unsure of, but it indicates a data structure is present to hold some detail. The naming is similar enough to the ASA'a that I think the devil is in there somewhere.

FPR4100/9300 series

CISCO-FIREPOWER-MIB.my

CfprAaaSession

1.3.6.1.4.1.9.9.826.0.x.x