This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

OID for ASA-5520 for VPN connections / a different spin

jamesfclark over 13 years ago

Hi, I've seen a few post about monitoring VPN connections, and I haven't been able to figure out how to get the exact info I am looking for. I've tried a number of OIDs, and get partial info, but never correct.

If I am in Cisco ADSM and I go to monitoring / VPN / VPN Stats / VPN sessions... I have 2 numbers I'm looking for The total of the first page (Ras connections, or desktop clients) and second the number of Lan to Lan connections.

When I use all the OIDs I've tried so far, it seems to get confused with the IPSecoverNatT and the IPSecOverUDP for the regual connections and one of my site to site shows IPSECoverLANtoLAN and the other IPSECoverLANtoLANNATT

When ever I try it I seem to get the overNATTs no problem. but I'd liek to build it so I get the RAS over either with out the LANtoLAN and the LANtoLAN total number whether they are LANtoLAN or LANtoLANnatT?

Still on the newer side of this, but when walk the tree and test anything close to what I need I either get incorrect info or OID not supported. Can anyone out there shed some light? I've spent too many hours at night obsessing on this, so now it's time to ask for help.

Thanks,

James

Top Replies

0 lchance over 13 years ago

we just got the Cisco ASA 5540 which is replacing our Cisco VPN 3xxx Concentrators. as soon as i can i will try to MIB walk it and see if i can provide any help to you.
i do have our VPN sessions monitored on the 3xxx Concentrators using various OIDs to show IPSec LAN-to-LAN and OverNAT-T .etc plus Tunnel Count and Session Count.
but i don't know the ASA well enough yet but maybe real soon. maybe someone else will chime in with some info for you.
what i did with the Concentrator OIDs is build poller groups based on the tables and then put it together in the Node Details view. and you can create reports and publish these too.
Cancel
Vote Up 0 Vote Down

Cancel
0 dclick over 13 years ago

I dont know if you have made any progress with this, but there are a couple of UDP pollers in the Content Exchange that will allow you to, at the least, graph the number of current (Active) sessions of your vpn sessions - I have ours set to so WebVPN, AnyConnect, IPSec and IPSec L2L.
Here are the OID's I am using on a Cisco ASA5520 -

IPSec L2L
CISCO-REMOTE-ACCESS-MONITOR-MIB:crasL2LNumSessions
1.3.6.1.4.1.9.9.392.1.3.29
IPSec
CISCO-REMOTE-ACCESS-MONITOR-MIB:crasIPSecNumSessions
1.3.6.1.4.1.9.9.392.1.3.26
SSL VPN (AnyConnect)
CISCO-REMOTE-ACCESS-MONITOR-MIB:crasSVCNumSessions
1.3.6.1.4.1.9.9.392.1.3.25
WebVPN
CISCO-REMOTE-ACCESS-MONITOR-MIB:crasWebvpnNumSessions
1.3.6.1.4.1.9.9.392.1.3.38
Cancel
Vote Up +1 Vote Down

Cancel
0 aLTeReGo over 13 years ago

For anyone who's interested I've created a Universal Device Poller for the ASA to monitor VPN sessions using the information above. It's available in the content exchange at the link below. Enjoy.
Cancel
Vote Up +4 Vote Down

Cancel
0 JasonKV over 11 years ago in reply to dclick

Correction.
CISCO-REMOTE-ACCESS-MONITOR-MIB:crasSVCNumSessions
1.3.6.1.4.1.9.9.392.1.3.25

Should be
1.3.6.1.4.1.9.9.392.1.3.35
Cancel
Vote Up 0 Vote Down

Cancel
0 nickzourdos over 7 years ago

OID 1.3.6.1.4.1.9.9.392.1.3.1 worked for our ASASM's, which is included in aLTeReGo's UnDP Nice work
Cancel
Vote Up +1 Vote Down

Cancel
0 alansmith over 3 years ago in reply to aLTeReGo

aLTeReGo
I am unable to find your oid suggestions can you share them please?
Cancel
Vote Up 0 Vote Down

Cancel