Monitoring Cisco IWAN

phillyflapjak

Hello All,

We will be implementing Cisco IWAN in our company soon and i was wondering if Solarwinds has the ability to monitor IWAN?

So if the router were to failover to the IWAN we more than likely wont get notified because its such a seamless process we would like to know if a connectivity is degraded because we were never alerted.

I hope this makes sense any help will be greatly appreciated

Thanks

jkrenzien

Depending on what exactly what peices of IWAN you are implementing you can monitor it in SolarWinds with NPM. We are currently running serveral peices of IWAN and monitoring is easy for most of it. That said I will try to give you an idea of what I have implemented and where I have seen any issues.

Cisco Cloud Web Security - If you are using this you be aware that there is very little monitoring that can be done outside of their web console for it. You can ping your CWS servers, but no health, netflow, netpath. I have had several discussions with Cisco's product devs and I don't think this will be changing any time soon.

DMVPN - To create alerts on the health of your DMVPN clouds I suggest creating an alerts based on routing neighbor and matching your DMVPN hub's IP (create an alert for each DMVPN cloud) and set the scop of the alert to all of your spoe DMVPN routers. this way if your tunnel isn't passing traffic but is still showing up/up you will be alerted of the issue (The tunnel will show up/up as long as the source interface is up/up)

AVC - This is going to be a tougher section to handle properly, but it should still be mostly possible. With the latest update to NTA we can now utilize the nbar2 data the routers can send and there is your visability. PfR monitoring will be the difficult portion. PfR should be able to send syslog/trap to SolarWinds for alerting and reporting within NTA will give some historical view of the traffic paths. Maybe a combination between Cisco embeded event manager watching for a syslog message about a traffic class out of policy and then waiting for it to be back in policy for a specified time and then sending a custom syslog/trap to SolarWinds to alert on. But I would only go that far if that is something that is really needed (but there are tools that will let you see that information in a gui as well. I am not familiar with them though.

Firewall - I have no experience with monitoring firewall details in SolarWinds, but the zone based firewalls for IWAN shouldn't be much different than ASA monitoring.

WAAS - This is a part that we have not implemented at all so I am giving my best guess here. This would depend on your WAAS implementation I would expect a WAAS appliance to allow for more in depth monitoring than an router based implementation.

Those are the only IWAN specific items that I can think of. If I missed one let me know and I will give you any information I have. On a side note if you are implementing CWS do yourself a huge favor and make sure that there is through testing done. If each of your users will ALWAYS have their own IP, user level authorization is easy, it you use anything were the users may share an IP it becomes much more difficult. There are solutions, but we spent a year, after purchase, trying to figure out one way to make it all work and ended up using 2 methods in the end.