topic Re: FTD 2110 HA SNMP Monitoring in Network Security

FTD 2110 HA SNMP Monitoring

Nikhil5 — Tue, 04 Aug 2020 17:42:34 GMT

Hello Experts,

I need your help.

We have 2 FTD 2110 devices configured in HA and managed from FMC. My requirement is to monitor high availability state and whenever failover happens, device should generate SNMP trap.

Device is already configured with SNMP version, community, hosts etc. SNMP polling and trap is working for other health modules only HA monitoring is not working.

Please suggest if this is possible and how to achieve ?

Thank you.

Re: FTD 2110 HA SNMP Monitoring

Marvin Rhoads — Tue, 04 Aug 2020 18:41:03 GMT

What interface are you using to poll currently? The HA bit would have to be monitored from the LINA subsystem (diagnostic interface).

Re: FTD 2110 HA SNMP Monitoring

Nikhil5 — Wed, 05 Aug 2020 08:35:07 GMT

Thank you for your response. Yes, we are using "Diagnostic" interface. Attaching snap for the same.

Re: FTD 2110 HA SNMP Monitoring

Marvin Rhoads — Wed, 05 Aug 2020 12:13:46 GMT

OK, that's correct.

I don't believe a failover event will generate an SNMP trap. However it does create a a syslog event (and we can set syslog events to be sent as traps).

However you should be able to poll the device(s) for failover status. Try using OID 1.3.6.1.4.1.9.9.147.1.2.1

Re: FTD 2110 HA SNMP Monitoring

Nikhil5 — Wed, 05 Aug 2020 14:03:08 GMT

Thank you for your suggestion, I will ask our NMS team to configure the given OID and will then check polling status.

Please can you confirm regarding syslog, "we can set syslog events to be sent as traps", what dose it mean?

Re: FTD 2110 HA SNMP Monitoring

Marvin Rhoads — Thu, 06 Aug 2020 18:33:18 GMT

I mean sometimes there's not a built-in trap that gives us the visibility we need but there exists a syslog message. In these cases we can tell the ASA or FTD device to send that syslog message as a trap to the configured SNMP server.

Details on how to do that can be found here:

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw-virtual/215560-configure-snmp-syslog-traps-for-asa-and.html#anc8

Re: FTD 2110 HA SNMP Monitoring

Nikhil5 — Fri, 07 Aug 2020 08:10:44 GMT

Thank you, i will try this one and will let you know the outcome.

Re: FTD 2110 HA SNMP Monitoring

Nikhil5 — Mon, 24 Aug 2020 13:41:43 GMT

Thank You for your help.

We can monitor the HA in two ways -

Configure manual watches in the Spectrum server and they will monitor HA using below OIDs -

cfwHardwareStatusValue 1.3.6.1.4.1.9.9.147.1.2.1.1.1.3.
cfwHardwareStatusDetail 1.3.6.1.4.1.9.9.147.1.2.1.1.1.4.

or, we can configure Syslog SNMP traps as explain in the above comment.