Monitoring CDP neighbor changes

We have a redundant layer 2 connection between two sites that the provider now for the second time has made a configuration change with so the link doesn't forward traffic but still has link up in both ends.

The only way I can see that I can detect this situation is by monitoring CDP changing.

Is there any standard way of detecting CDP changes?

Find more posts tagged with

Alert

cdp

Accepted answers

All comments

chris.engstrom

Does your equipment support:

cdp log adjacency changes

superfly

If the link is still up, wouldn't CDP still show the neighbour?

What is shown in the log of the device? If something is logged, you could forward that to the Syslog Viewer and create an alert of that.

svindler

No, "cdp log adjacency changes" is not supported

svindler

Problem is that the provider equipment is still up in both ends but they broke the tunnel between the two interfaces on their two devices due to human error.

So my two devices can't see each other.

jswan

There's a complex Cisco CDP MIB available to SNMP, but unfortunately I get "OID not supported" when I try to query most of the interesting entries with the Solarwinds UnDP tool.

I think your best bet would be to try writing an EEM policy to send a syslog message when the CDP table changes, then alert on that syslog message. Here's a page that shows the basic idea:

https://supportforums.cisco.com/docs/DOC-24529

I don't have a switch handy to test it, but your policy would look something like this:

event manager applet cdp-send-syslog

event neighbor-discovery interface x/x cdp update

action 1.0 syslog msg "CDP state change!"

You'll need pretty recent code to make this work.

svindler

I made a setup using your hint and a few other tips, so I had a handful of mails in my inbox this morning from one of my switches.

Thank you for sending me in the right direction.

rschroeder

svindler, would you mind sharing your setup that monitors and alerts on CDP neighbor status?

Rick Schroeder

svindler

rschroeder, this should get you started.

It requires an email server that allows you to send emails without authentication.

As you can see in the reply from jswan above, you could use syslog instead.

event manager environment email_server 192.168.0.25

event manager environment email_to nwalert@example.com

event manager session cli username "eemuser"

event manager applet cdp-neighbor-down

description track device down from cdp event

event neighbor-discovery interface regexp Ethernet cdp delete

action 1.0 info type routername

action 2.0 mail server "$email_server" to "$email_to" from "eem@$_info_routername" subject "$_nd_cdp_entry_name Down" body "$_event_pub_time: $_nd_cdp_entry_name Down at $_nd_local_intf_name"

action 3.0 syslog msg "$_nd_cdp_entry_name down at $_nd_local_intf_name"

event manager applet cdp-neighbor-up

description track device up from cdp event

event neighbor-discovery interface regexp Ethernet cdp add

action 1.0 info type routername

action 2.0 mail server "$email_server" to "$email_to" from "eem@$_info_routername" subject "$_nd_cdp_entry_name Up" body "$_event_pub_time: $_nd_cdp_entry_name Up at $_nd_local_intf_name"

action 3.0 syslog msg "$_nd_cdp_entry_name up at $_nd_local_intf_name"

sja

what about going up over layer 2 and use netpath or ipsla ?

Should be easy to alert if the path/tunnel is not available?

/sja

svindler

Hi sja

Thanks for your suggestion but layer 3 works fine through the connection that was configured correct. Problem was that the provider two times misconfigured one of the two layer 2 connections. That was only detected when the correctly configured link went down.

And since the provider did not have proper monitoring of configuration changes, I wanted to monitor that the reduncancy that we pay for is actually there before the primary link goes down.

The two layer 2 connections bridge between the same vlan in both ends.

We are also monitoring on layer 3 but a failure here should normally mean that BOTH links are down.

sja

Okay

so cron job?

that ask and expects the same mac ?

I don't expect that Cisco cope to support L2 ping

Catalyst 6500 Release 12.2SX Software Configuration Guide - Layer 2 Traceroute Utility [Cisco Catalyst 6500 Series Switc…

hope that helps...