Monitoring Node with Multiple IP's

Here is the issue

We have several Cisco 4507 core switches in remote sites. These core switches have several IPs associated with them. When discovering them in Orion, I would use its 10.x.x.x. address. However, it sends its syslog messages through its VLAN1 IP which is a 172.x.x.x

I rediscoved the switch with its VLAN1 IP, and it immediatley began sending its syslog events to Orion and all seemed well. Then I went into the Orion websites SNMP trap viewer and noticed that we are no longer getting SNMP traps that normally come from the 10.x.x.x IP.

I believe it is a view limitations issue, becasue on the Orion website I am able to view the syslog events coming from the switch with its 172.x.x.x IP, but cannot view any SNMP traps coming from its 10.x.x.x IP.

If I go on the actual Orion server, and pull up the trap viewer, I see traps from the 10.x.x.x address, and I also see syslogs from the 172.x.x.x IP.

I hope this post isnt too confusing but I would GREATLY appreciate some help with this.

Thanks!

Find more posts tagged with

multiple_ips

Accepted answers

All comments

qle

Forgive my ignorance but why not have Orion monitor both IP addresses? Granted, there will be a lot of overlap but it would solve your problem, no?

AlbanyMike

qle,

Thanks for your suggestion, as always! I had thought of that, but it would get pretty messy. This core switch is one of our main nodes and is involved in a ton of the reports and alerts that i have configured. I had added in the node a second time and you are right, I was getting my syslog from the 172 IP and I was getting traps from my 10. IP. However, it messed up all my grouping, alerts, etc. All nodes added to our Orion must have a custom property filled out to appear on the website.

My next stab in the dark is going to be to change the way Orion monitors the node (Static IP) and change it to dynamic IP. I am working up the nerve to make this change, as this is a very important switch and do not want to loose any stat collecting. I think I will give it a try 10 minutes before closing time, and initiate some syslog and snmp traps and see what I come up with.

I am still confused as to why on the orion website, I can only see syslog events coming from the 172 IP, and no traps coming from the 10. IP. However, on the Orion server, I see syslog from 172, and traps from 10. (10. does not have a host name, as that column is left blank)

Thanks again for your suggestion.

thurgoodj187

couldn't you use the "logging source-interface" command?

Network_Guru

couldn't you use the "logging source-interface" command?

Yes this is the best practice.
You should setup a loopback on routers and use a management VLAN IP for switches.
These should be set as the source for Syslog, Traps, Tacacs, etc.
Otherwise things will break when a vlan or interface goes down on a device.
As you have discovered this also affects how syslogs and traps are displayed in Orion.

KevinMcKloud

The problem is not within Orion, just use this command:

snmp-server trap-source [interface] <-- For Traps

logging source [interface] <-- For Syslog

aLTeReGo

Why not use the "logging source-interface" command and the "snmp-server trap-source" to manually determine which IP address the syslog and snmp trap messages are coming from?

AlbanyMike

Thanks for the answer on this one guys. "snmp-server trap-source" command did the trick.

Thanks again!