topic Re: asa vti interface snmp statistics problem in Network Security

asa vti interface snmp statistics problem

DraganSkundric87318 — Wed, 31 Jan 2024 17:56:06 GMT

hi,

my SNMP mgmt systems does not read interface traffic stats. Everything is on zero. What could be a problem?

Re: asa vti interface snmp statistics problem

MHM Cisco World — Wed, 31 Jan 2024 18:04:28 GMT

Share the config

MHM

Re: asa vti interface snmp statistics problem

DraganSkundric87318 — Thu, 01 Feb 2024 07:34:38 GMT

config is simple, nothing special

nameif TU1
ip address aaaaa
tunnel source interface outside
tunnel destination AAAAA
tunnel mode ipsec ipv4
tunnel protection ipsec profile PPPPPP
!

intereseting thing is that ther is no stats even over cli command

# sh int outside
Interface "outside", is up, line protocol is up

Traffic Statistics for "outside":
150225833416 packets input, 88955620772911 bytes
141435662470 packets output, 93475314152425 bytes
414327832 packets dropped
# sh int tu1
Interface Tunnel1 is up, line protocol is up
Hardware is Virtual Tunnel Description:
MAC address N/A, MTU 1500
IP address
Tunnel Interface Information:
Source interface: outside

Mode: ipsec ipv4 IPsec profile:

Re: asa vti interface snmp statistics problem

MHM Cisco World — Thu, 01 Feb 2024 19:09:21 GMT

Not config of VTI config of snmp

Anyway

Did you enable trap linkup linkdown?

If no add this command and shut not shut the tunnel and check snmp

MHM

Re: asa vti interface snmp statistics problem

DraganSkundric87318 — Fri, 02 Feb 2024 08:56:57 GMT

why would I do trap linkup linkdown? My mgmt system is reading stats for other interfaces without that command.

Re: asa vti interface snmp statistics problem

tvotna — Fri, 02 Feb 2024 09:13:23 GMT

@DraganSkundric87318, of course, this doesn't make any sense )

But if you don't see stats in the CLI, you'd never get them via SNMP, right? Do you at least see "interface tunnel" via SNMP if you poll ifMib? Anyway, this looks very much like a software caveat, if you will, but I'm not aware of any enhancement requests here.

You can try to use CISCO-IPSEC-FLOW-MONITOR-MIB instead: https://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&step=2&mibName=CISCO-IPSEC-FLOW-MONITOR-MIB

Refer to cipSecTunnelTable and cipSecEndPtTable, but this is a bit complicated.

Re: asa vti interface snmp statistics problem

MHM Cisco World — Fri, 02 Feb 2024 09:18:45 GMT

Just for troubleshooting' are snmp detect up down of VTI or not.

MHM

Re: asa vti interface snmp statistics problem

tvotna — Fri, 02 Feb 2024 09:22:26 GMT

@MHM Cisco World, FYI, SNMP polling and SNMP traps are little bit different things )

Re: asa vti interface snmp statistics problem

DraganSkundric87318 — Fri, 02 Feb 2024 09:26:45 GMT

yes I can see interfaces over mgmt :-)) ... I just wandered if anyone else hit that wall

Re: asa vti interface snmp statistics problem

MHM Cisco World — Fri, 02 Feb 2024 09:30:21 GMT

Just wait @tvotna I knew that polling is different than trap

I need to see if SNMP totally not see anything related VTI.

From there we decide next step

MHM