Monitoring devices behind a firewall

I need to be able to alert on when a device that is behind a firewall that we do not control stops responding, the problem is the vendor has blocked ICMP and SNMP and will not enable these protocols to be used. The only way of detecting the device is up is via certain ports being open.

I have created a application monitor template and this is working however the node the template is tied to is forever in a state of "down" as orion cannot ping or acquire SNMP information so is showing up as down all the time. Is there anyway to change the conditions that Orion uses to determine a node is down? In this example we would say the node is down when the TCP ports we're monitoring no longer respond.

I have a number of systems that I would like to monitor that have this issue (where the node in question cannot be ping'ed and SNMP will not work but I need to alert on when the TCP port being used drops).

Any ideas?

Thanks

Nigel Brodt-Savage

Find more posts tagged with

orion

application_monitoring

port

tcp

node_status

Accepted answers

All comments

jkobe

I am having the same issue...could someone please advise?

Thanks,

Jon

jswan

If you have access to a Cisco router you could use IP SLA to perform the test, then set up a universal device poller in Orion to alert you when the IP SLA test fails.

Something like this:

ip sla 1
tcp-connect 1.1.1.1 666
tag testTCP
ip sla schedule 1 life forever start-time now

Then set up a UDP to monitor this using the CISCO-RTTMON MIB, and alert on the UDP. It might not be exactly what you want since the node you monitor is the Cisco router, not the actual end device--but it works.

jkobe

Thanks for the tip...unfortunately, my router is a Catalyst 4507 and it seems I cannot create an SLA on it.

I think I will try something else...maybe look at using a different node to run the monitor.

Thanks for your quick response!

Jon

jswan

Unfortunately the Cat 4500 series is one of the few platforms that doesn't support IP SLA. You can get it in recent IP Services images for the Cat 3560/3750, and in almost any router IOS image. We use a spare 1800 series router to do this, but even an old 2600 can handle 15-25 IP SLA operations per second before the CPU gets above 50%. The router doesn't have to actually route the traffic to do the IP SLA tests--my 1800 is hung off one of our core routers and doesn't even have IP routing enabled; it just acts as an end station to do IP SLA tests.