13 Replies Latest reply on Oct 7, 2016 4:02 PM by xakello

    ASA failover monitoring and alert setup

    irelandt

      I currently have a UnDP setup to monitor OID: 1.3.6.1.4.1.9.9.147.1.2.1.1.1.4

      This is displayed on my node details page and looks like this:

      However here is my first issue:

      1) The above image was pulled from my device named pix-primary, this device I know for a fact is running as the standby pix as this has already failed over to pix-secondary. So in reading the OID output above it is telling me that "(this device)" is the Active unit, this is untrue as this PIX has already failed over to the secondary and pix-primary should be the standby unit now. Or am I reading this wrong?

      2) If I setup an alert to email me when the status changes how would I setup the reset trigger? So status changes and an alert is sent, when the status changes back that too is a status change, so this alert will always trigger and never reset. Is that correct?

        • Re: ASA failover monitoring and alert setup
          netlogix

            I have this problem too, but I never did anything about it.

            The problem is the IP address switched and you are always polling the active node with the IP you are using.

            I was thinking about finding a way to poll the serial number through some OID and alert when it's not the primary serial number.

          • Re: ASA failover monitoring and alert setup
            smargh

            To give you an idea of how to do this, I have a similar situation with alerting on HSRP states. The way I did this is with two custom properties on nodes, which specifies what the active & standby IPs are, and then use a "Custom Node Poller Custom SQL Alert" for the alert criteria. The query looks up the labels so that it knows which value relates to which row.

            In your instance, with a very slight query change, you could probably do it without the need for a custom property. Something like...

            INNER JOIN
                CustomPollerLabels ON CustomPollerStatus.CustomPollerAssignmentID = CustomPollerLabels.CustomPollerAssignmentID
              AND
                CustomPollerStatus.RowID = CustomPollerLabels.RowID
            WHERE ( (CustomPollerLabels.Label = 'Primary unit')
                AND (CustomPollerStatus.Status = 'Standby unit')
            )

            Note that I have NOT tested the above criteria, and I'm not very good with SQL - it might need another condition so that blank or error rows aren't matched.


            This is the HSRP query which I use:

            INNER JOIN
                CustomPollerLabels ON CustomPollerStatus.CustomPollerAssignmentID = CustomPollerLabels.CustomPollerAssignmentID
              AND
                CustomPollerStatus.RowID = CustomPollerLabels.RowID
            WHERE (
                (CustomPollers.UniqueName = 'cHsrpGrpStandbyState')
            AND (CustomPollerLabels.Label = Nodes.HSRP_Active_IP)
            AND NOT (CustomPollerStatus.Status = 'active')
            )

            See attached image for what the web page poller looks like for my HSRP state.

             

            Please note that everything after WHERE must be enclosed with parentheses, because otherwise the reset condition won't work - Orion just puts a "NOT" after the WHERE for the reset trigger, so if you don't enclose everything in brackets it will just make the first condition negative, rather than every condition.

            • Re: ASA failover monitoring and alert setup
              irelandt

              Ok I think I got it working. What I did was setup the alert to send me an email when the status changes on the UnDP.

              Then for the reset I just set it to reset when the status is not empty (which is always true) and reset after 2 hours.

              This way the alert will always reset after 2 hours regardless, but we will still get alerts when the status changes and when it changes back.

              Hopefully this works, I haven't been able to test it yet as I don't really want to failover a firewall just to test this alert, but it seems like it will work.

                • Re: ASA failover monitoring and alert setup
                  smargh

                  For the trigger definition, did you do [status] [has changed] ? That won't work - "has changed", as far as I'm aware, is for uptime only.

                  This is what the TriggerQuery SQL will be in your AlertDefinitions table for this alert:

                  SELECT DISTINCT CustomPollerAssignment.CustomPollerAssignmentID AS NetObjectID,
                    CustomPollerAssignment.AssignmentName AS Name
                  FROM CustomPollerStatus INNER JOIN
                       CustomPollerAssignment ON CustomPollerStatus.CustomPollerAssignmentID = CustomPollerAssignment.CustomPollerAssignmentID
                       LEFT OUTER JOIN
                       CustomPollers ON CustomPollerAssignment.CustomPollerID = CustomPollers.CustomPollerID
                  WHERE (CustomPollers.UniqueName = 'cHsrpGrpStandbyState')
                  AND (CustomPollerStatus.Status = CustomPollerStatus.Status)
                  AND ((SELECT     COUNT(*) AS Expr1
                            FROM    AlertValueChanges
                            WHERE  (TableName = 'Nodes') AND (FieldName = 'LastBoot')) > 0)
                  AND (NodeID IN  (SELECT     NodeID
                                     FROM      AlertValueChanges
                                     WHERE    (TableName = 'Nodes')
                                     AND (FieldName = 'LastBoot')
                                     AND (DATEDIFF(s, Changed, GETDATE()) < 60 * 1.2)))

                • Re: ASA failover monitoring and alert setup
                  irelandt

                  Yes I have it setup as a Custom Node Poller alert and set to trigger when the status has changed.

                  Looking at the CustomPollerStatus table in my Netperfmon database the status column for this custom node poller actually reflects the values of "active unit" and "standby unit".

                  Given that I believe the alert will trigger as setup, since the failover will cause those statuses to change.

                  I did something very similar to that when i setup an alert to monitor BGP status on my routers and that worked.

                  • Re: ASA failover monitoring and alert setup
                    familyofcrowes

                    how do you monitor the mac address?  is it native to NPM or a custom poller.... 

                    thanks

                      • Re: ASA failover monitoring and alert setup
                        jrich

                        Did you ever find this out? Whenever I go into alert manager and try to build an alert for this event the only status's available are Unknown, Up, Down, Warning, Shutdown, Testing, Unmanage, Unplugged, Unreachable.  Where is the status for changed?

                          • Re: ASA failover monitoring and alert setup
                            shuth

                            Hi jrich,

                             

                            The status "changed" can be found by modifying the logic condition "is equal to". I don't have anything available to test the actual alert itself with at the moment but this is where you can configure the alert.

                             

                              • Re: ASA failover monitoring and alert setup
                                jrich

                                Hi Shuth,

                                 

                                Thanks for the reply.  We went a little different way with the logic and did Vendor Icon Contains Cisco ASA and then, under the Interface property monitor did Physical Address has changed.  This way we didn't have to deal with custom pollers.  Solarwinds detects that the interface's physical address has changed when the ASA fails over if the interface is monitored (before we implemented this) now I think this might work when that event occurs.  It is too bad Solarwinds doesn't tell us what is actually generating that event so we can just tell it to alert off of that event.  It would have been way more intuitive.

                                • Re: ASA failover monitoring and alert setup
                                  crzyr3d

                                  I'm finding that the "has changed" only works with last boot, IOS Version, and IOS Family as it states when you select it under interface.  It actually states that in the first line.  Can't believe I overlooked it so many times when trying to put the alert together.  I managed to create this alert that watches the physical address, when it's not equal to what it's normal state physical address.  Down fall, yes, you will get two alerts and you must maintain it if either the interface names change or the physical address should change permanently but I've tested this and it works.  I'm posting on the Content Exchange forum. look for ASA Failover.AlertDefinition under NPM.  I've also attached it.

                            • Re: ASA failover monitoring and alert setup
                              njoylif

                              another option is to see this content share

                              it has UnDPs, a report, and SQL stored procedure that you'd run as you saw fit.

                              part of the challenge is that the IP follows the unit, so which ever unit is active, it has the IP address of the "primary"

                              • Re: ASA failover monitoring and alert setup
                                xakello

                                Hello,

                                 

                                I have a similar scenario in my network.

                                 

                                I have two ASA 5515 NGFW with the Cisco Adaptive Security Appliance Software Version 9.2(3) in FailOver mode and Routing Mode.

                                 

                                I needed an alert that notifies me when the secondary equipment was in active mode.

                                Additionally when the primary equipment retake the role of active also notified me.

                                 

                                Solution in NPM 11.5.3

                                 

                                The alert settings allows you to set variables for trigger and restart. So, I added the Alert Definition that provides crzyr3d but i modified with only one condition with one of the MAC addresses and the reset with the other MAC address.