topic Re: Issues Monitoring SNMP cisco firepower FTD-2100 in Network Security

Issues Monitoring SNMP cisco firepower FTD-2100

MedTiti92 — Tue, 17 Mar 2020 14:40:10 GMT

Hi Community!

I'have some issues with monitoring cisco firepower 2100 with snmp in Zabbix. I configure well all snmp in FMC, and i use snmpwalk v2c to poll all interfaces in my zabbix. But the problems, i get others interfaces like : Can you help me for this issues please ! Thank you for advance.

Re: Issues Monitoring SNMP cisco firepower FTD-2100

Marvin Rhoads — Tue, 17 Mar 2020 15:07:54 GMT

Are you querying the FTD appliance management interface or diagnostic interface?

The latter one is the correct method and will report interfaces matching the configuration of the Firepower Threat Defense logical device.

The former queries the chassis and will expose the FXOS interfaces which, as you imply, aren't very useful for most cases.

Re: Issues Monitoring SNMP cisco firepower FTD-2100

MedTiti92 — Wed, 18 Mar 2020 06:40:55 GMT

Thanks for reply !

How to query the Diagnostic interface?

I have this in plateform settings :

Re: Issues Monitoring SNMP cisco firepower FTD-2100

MedTiti92 — Wed, 18 Mar 2020 06:56:14 GMT

My interface disgnostic doesn't have a Address IP !

is There an impact to the production if i give a IP Address to the diagnostic ? And, may I give it in the same subnet of management interface or different subnet of management interface ?

Re: Issues Monitoring SNMP cisco firepower FTD-2100

Marvin Rhoads — Wed, 18 Mar 2020 07:20:48 GMT

When you use the diagnostic interface it needs to be in the same subnet as the management interface and that subnet needs to be distinct from any other interfaces on the appliance (i.e not the same as the one used by Inside - or any other - interfaces).

Defining, enabling and polling it will not affect any production traffic (assuming you already have the distinct subnet).

Re: Issues Monitoring SNMP cisco firepower FTD-2100

MedTiti92 — Wed, 18 Mar 2020 07:30:14 GMT

the Problem is my management interface of the FMC is in the same subnet of the inside interface. So i think to modify the IP of FMC, no ?

Re: Issues Monitoring SNMP cisco firepower FTD-2100

Marvin Rhoads — Wed, 18 Mar 2020 08:09:37 GMT

The FMC address doesn't have to change at all.

In order to manage the interface details using the necessary diagnostic interface, the management (and newly configured diagnostic) interfaces need to be on a different subnet than the management interface is currently is on. Of course that will mean updating the management address of the device in FMC.

You can do that by:

1. first make FMC management inactive,

2. change the address on the device locally (including defining a gateway),

3. edit the device management address in FMC and

4. then re-enable FMC management.

Then configure the diagnostic interface in FMC and add it to the SNMP platform settings. Deply config and then point your Zabbix server to the diagnostic address.

Re: Issues Monitoring SNMP cisco firepower FTD-2100

MedTiti92 — Wed, 18 Mar 2020 13:06:38 GMT

I will do and go back to you when done !

Re: Issues Monitoring SNMP cisco firepower FTD-2100

MedTiti92 — Thu, 22 Jul 2021 12:21:22 GMT

Hi @Marvin Rhoads

I come back to you after this very long time. Hope you are well.

However; i put the diagnostic interface and the management FMC in the same subnets differents on the one in all my others interfaces(inside; outside; DMZ etc ...)

and in my Supervision software i query the diagnostic interface ...but still nothing.