topic Re: Firepower Anyconnect VPN sessions SNMP monitoring in Network Security

Firepower Anyconnect VPN sessions SNMP monitoring

voipleo — Fri, 21 Feb 2020 17:54:38 GMT

We're using FTD 2100 with FMC, need to get active RA VPN sessions counter over SNMP.

Information I've found is related to ASA and not suitable for FP.

Can anybody share useful FP OIDs or point to documentation links?

Re: Firepower Anyconnect VPN sessions SNMP monitoring

Marvin Rhoads — Tue, 11 Feb 2020 14:08:09 GMT

Have you tried the ASA OIDs?

Assuming you are SNMP polling the diagnostic interface (not enabled by default), it should be the LINA/ASA code that is responding to your system - not the FTD or FX-OS parts of the system.

Re: Firepower Anyconnect VPN sessions SNMP monitoring

voipleo — Fri, 21 Feb 2020 11:14:52 GMT

Enabling diagnostic interface it turned out we can use ASA-compatible SNMP mibs.

crasSVCNumSessions = 1.3.6.1.4.1.9.9.392.1.3.35.0 is the counter of RA VPN sessions.

Thanks for help, it was not so obvious from documentation.

Re: Firepower Anyconnect VPN sessions SNMP monitoring

Marvin Rhoads — Fri, 21 Feb 2020 11:28:49 GMT

You're welcome - you're right the documentation falls a bit short in this area.

Re: Firepower Anyconnect VPN sessions SNMP monitoring

ifdwolf1 — Mon, 23 Mar 2020 19:36:04 GMT

Is there something you need to enable on the FTD or in FXOS?

I am trying to poll using that OID but all I get is:

SNMPv2-SMI::enterprises.9.9.392.1.3.35.0 = No Such Object available on this agent at this OID

Re: Firepower Anyconnect VPN sessions SNMP monitoring

voipleo — Mon, 23 Mar 2020 20:50:40 GMT

Yes, you need set up in FMC the IP for diagnistic interface which hosts aside management interface and do SNMP to that address.

Re: Firepower Anyconnect VPN sessions SNMP monitoring

kapydan88 — Sun, 24 May 2020 21:08:00 GMT

If i understood correctly, i can use this oid for accounting of remote anyconnect users? Is it possible to use it to see in Zabbix accounts of users who are currently connected to anyconnect?

Re: Firepower Anyconnect VPN sessions SNMP monitoring

Marvin Rhoads — Mon, 25 May 2020 08:30:15 GMT

Support vareis by platform and version but you may be able to retrieve the usernames from here:

crasUsername

1.3.6.1.4.1.9.9.392.1.3.21.1.1

Reference:

http://www.mibdepot.com/cgi-bin/getmib3.cgi?win=mib_a&r=cisco&f=CISCO-REMOTE-ACCESS-MONITOR-MIB-V1SMI.my&v=v1&t=tree

Re: Firepower Anyconnect VPN sessions SNMP monitoring

Rene Mueller — Tue, 15 Dec 2020 16:39:33 GMT

Hi,

we just replaced our ASA with a FTD 2110 and FMC, so this is completely new for me. I just enabled Diagnostic Interface via FMC with an IP in the same Subnet as the FXOS Management IP. However, I cannot ping it and also SNMP cannot reach it. How can I setup a Default Route for the Diagnostic Interface?

Do I need to import a new MIB file to my Monitoring or can I just use the one I used for ASA?

Re: Firepower Anyconnect VPN sessions SNMP monitoring

voipleo — Wed, 16 Dec 2020 15:48:10 GMT

Hi,

I understand your confusing. Try to look at this thread https://community.cisco.com/t5/network-security/fp-diagnostic-interface-setting-up/td-p/4028172

Re: Firepower Anyconnect VPN sessions SNMP monitoring

kapydan88 — Mon, 21 Dec 2020 08:26:31 GMT

Hello.

Good link, thanks.

Re: Firepower Anyconnect VPN sessions SNMP monitoring

admin_cs — Sat, 29 Oct 2022 04:29:36 GMT

hi, please tell me how to do it? in zabix and ftd?