4 Replies Latest reply on Aug 24, 2016 11:24 AM by Craig Norborg

    Need assistance with NPM alert for EIGRP Routing Neighbors

    brian.trotter@polypore.net

      We have a DMVPN network of around 20 routers.

      We have an alert setup so that when one of our three "hub" routers loses a route to one of the routing neighbors, it will email us.

      The problem is that the email only lists the IP address of the routing neighbor, not the Node Name.

      I am trying to figure out how to get the alert to list the Node Name of the router instead of its IP.

       

       

      This is the message in the Email action:

       

      EIGRP neighbor ${N=SwisEntity;M=NeighborIP}  has gone down for longer than configured threshold.

      ${N=SwisEntity;M=Router.Nodes.DisplayName}

      ${N=SwisEntity;M=NeighborID}

       

      When I try to insert a variable in to the message, I have no option to select a Neighbor Node Name. I can only select from Neighbor ID GUID and Neighbor IP.

      When I view the Network tab for the DMVPN Hub Router in Orion and scroll down to look at Routing Neighbors, it displays both the Name and IP of the neighbors.

      How can I modify the alert to show the name instead?

       

      I have attached an image of the alert trigger condition and the email action.

        • Re: Need assistance with NPM alert for EIGRP Routing Neighbors
          Craig Norborg

          Good idea!  Try something like this, a Custom SWQL query based off the IP address of the neighbor leveraging the NodeIPAddresses table...

           

          EIGRP neighbor ${N=SwisEntity;M=NeighborIP} (${N=SWQL;M=SELECT NIP.Node.Caption FROM Orion.NodeIPAddresses NIP WHERE (IPAddress = '${N=SwisEntity;M=NeighborIP}')}) has gone down for longer than configured threshold

           

          Node Name: ${N=SWQL;M=SELECT NIP.Node.Caption FROM Orion.NodeIPAddresses NIP WHERE (IPAddress = '${N=SwisEntity;M=NeighborIP}')}

           

          ${N=SwisEntity;M=Router.Nodes.DisplayName}

          ${N=SwisEntity;M=NeighborID}

          2 of 2 people found this helpful
          • Re: Need assistance with NPM alert for EIGRP Routing Neighbors
            Craig Norborg

            Glad to be of help, thinking of integrating it into our environment too, so thanks for your initial legwork on it!

            • Re: Need assistance with NPM alert for EIGRP Routing Neighbors
              Craig Norborg

              You may or may not find this of interest.  Kind of leveraged the alerts you were producing to create a resource for our DMVPN.

               

              SELECT NIP.Node.Caption AS [Device], AA.AlertObjects.EntityCaption AS [IP Address], NIP.Node.DetailsUrl AS [_LinkFor_Device], AA.AlertObjects.RelatedNodeCaption AS [Lost EIGRP To], NIP.Interface.IfName, AA.TriggeredDateTime AS [Alert Time]

              FROM Orion.AlertActive AA

              JOIN Orion.NodeIPAddresses NIP ON (AA.AlertObjects.EntityCaption = NIP.IPAddress)

              WHERE (AA.AlertObjects.AlertConfigurations.Name = 'EIGRP neighbor down on DMVPN')

              ORDER BY NIP.Node.Caption

               

              If you go to "Customize Page" and then add a resource of "Custom Query" type and pop this in it should work.   I should note that my configuration name is "EIGRP neighbor down on DMVPN", you will need to change the WHERE clause to reflect the name of your Alert.

               

              So, we have dual DMVPN hubs, and each hub has a Tunnel interface for the primary links at the remote sites and another Tunnel interface for the Secondary links at the remote sites.   So, a remote site with two physical links has two tunnels, lets say Tunnel10 and Tunnel20.   Tunnel10 has the source interface of the primary link, and connects to both hub routers on their primary tunnels.   Tunnel20 has the source interface of the secondary link, and connects to both hub routers on their secondary tunnels.    So, on a remote site that has 2 physical links, and 2 tunnel interfaces I end up with 4 EIGRP neighbors.   That way if one of the physical interfaces on a remote router fails, that router still has tunnels to both DMVPN hubs that I have.   If I had 3 DMVPN hub routers, I'd have 6 EIGRP neighbors with this setup.

               

              But, this resource lists all the routers that have active alerts (using your alert), and shows what tunnel the alert is on.   So, lets say RemoteRouterA is showing loss of EIGRP on both Tu10 and Tu20, its not a huge deal most likely since each physical interface on the remote routers should still have an EIGRP neighbor on them.  However, if RemoteRouterA is showing loss of EIGRP on Tu10 on two lines, that can be a problem which is most likely loss of connectivity on the remote interface.  

               

              This is useful for me because most of our circuits are DIA links, which instead of getting the status of T1's, all I see is an "up" connection to the remote cable-modem or Cienna box.

               

              The Alerts are useful, but as I said a single EIGRP neighbor being lost on a remote interface isn't that bad, its when two are lost that I can be pretty sure the link is down.

               

              Let me know if you find it useful?

              1 of 1 people found this helpful