ASA-5520 Failover Monitoring

I apologize if this has already been addressed in a prior post but I was not able to locate it.

Is there a way to setup an alert to trigger when an ASA is setup in failover mode and the Primary failovers to standby or vice versa? We need to be alerted when this occurs and I wasnt sure if there is a MIB or other alerting procedure that would would alert our network team when this occurs.

thanks,

Dan

Find more posts tagged with

Alerts

Accepted answers

All comments

Yann

Hi Dan,

This thread might help you: Custom Pollers - Cisco ASA Failover status

Thanks,

Yann

ddutton44

Thanks Yann. I appreciate the help. This appears to be more complex than I originially thought. I guess one way to do that would be to monitor an increase in traffic on the interfaces but I would like something to say hey, your on the standby/active node now.

Perhaps support may have an answer.

regards,

Dan

Questionario

Thats exactly what you can do with those OIDs, no?

Just check on the OID's, like .4.6 on the IP of your failover address, if this shows Standby Unit then you know a failover has happened!

I think thats much easier than tracking increasing traffic and will not create false positives... :P

mgibson

Yes, It is complex (but you will get better the more you do it), I was able to set up the undp as in the above referenced thread and here is the custom poller alert i use, to test, you can change the numeric status = 9 and insure the alert fires, then change it back to 10 when your ready to use it. Otherwise you will have to wait for an actual failover event.

Type of Property to Monitor = Custom Node Poller

OID is equal to 1.3.6.1.4.1.9.9.147.1.2.1.1.1.3

Row ID is equal to 6

Numeric Status is equal to 10

smargh

I use two custom SQL alerts for this. I have two node custom properties - one is for inputting the active IP for that node, and the other is for the standby units where I put in the standby IP. The alerts basically check whether the active or standby IP is correct for the current state of the poller for that node. This way, I can have two global alerts (one for "active node isn't active!", another for "standby isn't in standby!") which I never need to edit - I just assign the cHsrpGrpStandbyState poller to the device and type in the IP(s) into the relevant custom attribute.

If you use a different technology than HSRP, then perhaps you could modify this method to whatever you use.

The extra INNER JOIN at the top is purely so that I can look for the poller name in the criteria.

There might be a better way Please edumacate me if so.

INNER JOIN
    CustomPollerLabels ON CustomPollerStatus.CustomPollerAssignmentID = CustomPollerLabels.CustomPollerAssignmentID
AND
    CustomPollerStatus.RowID = CustomPollerLabels.RowID
WHERE (
    (CustomPollers.UniqueName = 'cHsrpGrpStandbyState')
AND (CustomPollerLabels.Label = Nodes.HSRP_Active_IP)
AND NOT (CustomPollerStatus.Status = 'active')
)

#############################

INNER JOIN
    CustomPollerLabels ON CustomPollerStatus.CustomPollerAssignmentID = CustomPollerLabels.CustomPollerAssignmentID
AND
    CustomPollerStatus.RowID = CustomPollerLabels.RowID
WHERE (
    (CustomPollers.UniqueName = 'cHsrpGrpStandbyState')
AND (CustomPollerLabels.Label = Nodes.HSRP_Standby_IP)
AND NOT (CustomPollerStatus.Status IN ('standby','initial'))
)