Using Cisco ASA VPN as a dependancy

Hi,

I work for an MSP that has a centralized SoalrWinds platform which monitors our customers environments which are all reached via a site to site VPN.

We are trying to setup our alerting so that if the VPN to the customer does down we don't get flooded with alerts for every node.

Where we manage the firewall at the remote end I have been able to create a dependency on that object but that doesn't apply to all our customers.

Ideally I would like to be able to make the specific VPN tunnel on our local ASA a parent to the related customer object group so that if this goes down the nodes will just be unreachable and we just get alerted to the VPN being down.

Can anyone advise how I might be able to achieve this? Apologies if this has been posted in the wrong place.

Thanks,

Tom

Find more posts tagged with

site to site vpn

dependences

monitoring vpn

manual dependencies

Accepted answers

All comments

mesverrum

You can use any monitored object as the parent of a dependency, so just add those tunnels to NPM and select them the same as you had been doing to routers. Just when you are picking the parent there will be a drop down that says node, change it to interface.

tomgreaves

Hi, thanks for the response. Can you please advise me how to add the tunnels as objects, these can be seen on the site to site vpn tab on the ASA's node details page but they don't show when I list resources, only the physical interfaces do?

mesverrum

Maybe the ASA behaves differently that Cisco routers, because list resources on a router with a tunnel definitely shows up as a type of interface. If the ASA doesn't have them under list resources then you may very well be in a bind.

christopher.t.jones123

i believe you can create a group and in the group add a SitetoSite Tunnel as a member of that group, then use that group as the parent.

mesverrum

I just checked and it does not appear that ASA tunnels are selectable for group membership or for dependency parents.

I imagine that using some sql trickery a workaround could be built, but I havenn't tested this idea out.

You would need to create some kind of placeholder node to represent the VPN connection. I'd try setting it to an external node so it never actually gets polled. Then create a sql query that maps the asa tunnel to the dummy node, and an alert action that sets the node status to down when the tunnel is not up. Then use the dummy as the parent of the group dependency, and there you go. Not sure if this kind of hackery is something you are into, but its just an idea off the top of my head to work around the fact that ASA tunnels don't count as available objects for dependencies.

I'd probably also create a feature request to try to get SW to just fix the issue on their end.