4 Replies Latest reply on Oct 30, 2019 10:36 AM by cmatrask

    Report inbound connections to firewall

    ckocian

      Does anyone have a report to show number of connections per hosts to a firewall? I have been looking into Report Writer, seen an option, Count of termination Address but report shows 0. Before I look into SQL query, thought i would ask, thanks

        • Re: Report inbound connections to firewall
          cahunt

          You should be able to chart it out with the gui.

           

          There are statistics tables that holds a count for connections.

           

          ASA_ConnectionStatistics_Detail, _Hourly and _Daily as well.

           

          I would have to do a test, but first thought it they are using the 'crasNumUsers' OID to poll for this value. Which is what I used to poll for manually before the ASA integration.

           

          Object crasNumUsers

          OID 1.3.6.1.4.1.9.9.392.1.3.3

           

          -CharlesH

          Loop1 Systems: SolarWinds Training and Professional Services

           

           

           

          Precursor : Cisco ASA Active VPN Connections  

          1 of 1 people found this helpful
            • Re: Report inbound connections to firewall
              ckocian

              I hear SolarWinds is doing away with Report Writer, I looked at Manage Reports from All Settings and ran report to get just a total. I am looking for detail to see if many connections are arriving from a single IP to help identify an attack. Not sure if this is possible with SolarWinds, thanks for the info so far. If you have any other suggestions I can look at let me know, I'll keep looking, thanks

               

               

              Messaging FW Connections

               

               

              Summary of Orion Objects: Datasource 1
              Summary of Time Periods: Past Hour (2:57 PM - 3:57 PM Sep 5, 2018)

               

               

              Custom Table for Datasource 1 from Past Hour (2:57 PM - 3:57 PM Sep 5, 2018)

               

               

              DATE TIMECONNECTIONS IN USEWEIGHTFAILED RATEDESCRIPTION
              9/5/2018 3:02:55 PM11659 connections6007.037968E+07
              9/5/2018 3:03:45 PM6501 connections600
              9/5/2018 3:12:55 PM12191 connections6003.263621E+07
              9/5/2018 3:13:45 PM6124 connections600
              9/5/2018 3:22:55 PM6170 connections6006.623038E+07
              9/5/2018 3:23:45 PM3440 connections600
              9/5/2018 3:32:55 PM5993 connections6003.150232E+07
              9/5/2018 3:33:45 PM3530 connections600
              9/5/2018 3:42:55 PM7766 connections6006.452407E+07
              9/5/2018 3:43:45 PM5320 connections600
              9/5/2018 3:52:55 PM6473 connections6006.069966E+07
              9/5/2018 3:53:45 PM3882 connections600

               

              1 of 1 people found this helpful
              • Re: Report inbound connections to firewall
                cmatrask

                Hi Charles,

                How can you do this with a Cisco FTD?

                 

                Thanks much,

                Cheryl