ASA5525 with FTD issue with monitoring

Ruzanna Zohrabyan — Fri, 21 Feb 2020 15:56:41 GMT

Hello dear everybody,

I am not sure I have opened the discussion at the correct category, but anyway.

Our company implemented network monitoring system recently, and there is a problem with Cisco ASA discovery proccess. Actually the device was discovered, but partially. Especially was discovered all network Interfaces (Physical, Portchannels with subinterfaces), but doesn't discovered all IP addresses of Port Channel's subinterfaces, only two of them.

It seems the ASA even doesn't sent all IP addresses to NMS. I have attached snmpwalk file.

ASA 5525 with FTD (Cisco Firepower Threat Defense, Version 6.2.2.1 (Build 73), ASA Version 9.8(2)10) --- enabled SNMPv2

NMS --- Micorfocus NNMi 10.50

What can be the core reason of this issue?

Thanks in advance!

Re: ASA5525 with FTD issue with monitoring

Marvin Rhoads — Wed, 04 Jul 2018 08:07:32 GMT

How many interface addresses are there? I see 7 in the snmpwalk output:

.1.3.6.1.2.1.4.20.1.1.10.0.242.254 : IpAddress: 10.0.242.254
.1.3.6.1.2.1.4.20.1.1.10.0.252.254 : IpAddress: 10.0.252.254
.1.3.6.1.2.1.4.20.1.1.10.111.231.1 : IpAddress: 10.111.231.1
.1.3.6.1.2.1.4.20.1.1.172.15.22.100 : IpAddress: 172.15.22.100
.1.3.6.1.2.1.4.20.1.1.192.168.10.1 : IpAddress: 192.168.10.1
.1.3.6.1.2.1.4.20.1.1.192.168.12.1 : IpAddress: 192.168.12.1
.1.3.6.1.2.1.4.20.1.1.192.168.13.1 : IpAddress: 192.168.13.1

Re: ASA5525 with FTD issue with monitoring

Ruzanna Zohrabyan — Wed, 04 Jul 2018 08:56:09 GMT

Hello Marvin Rhoads, there are much more subinterfaces. From the same snmpwalk output you can see:

.1.3.6.1.2.1.2.2.1.2.3 : OCTET STRING- (ascii): Adaptive Security Appliance 'GigabitEthernet0/0' interface
.1.3.6.1.2.1.2.2.1.2.4 : OCTET STRING- (ascii): Adaptive Security Appliance 'GigabitEthernet0/1' interface
.1.3.6.1.2.1.2.2.1.2.5 : OCTET STRING- (ascii): Adaptive Security Appliance 'branches' interface
.1.3.6.1.2.1.2.2.1.2.6 : OCTET STRING- (ascii): Adaptive Security Appliance 'atminput' interface
.1.3.6.1.2.1.2.2.1.2.7 : OCTET STRING- (ascii): Adaptive Security Appliance 'ha-link' interface
.1.3.6.1.2.1.2.2.1.2.8 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm' interface
.1.3.6.1.2.1.2.2.1.2.9 : OCTET STRING- (ascii): Adaptive Security Appliance 'PA-ASA' interface
.1.3.6.1.2.1.2.2.1.2.10 : OCTET STRING- (ascii): Adaptive Security Appliance 'atmoutput' interface
.1.3.6.1.2.1.2.2.1.2.11 : OCTET STRING- (ascii): Adaptive Security Appliance 'cplane' interface
.1.3.6.1.2.1.2.2.1.2.13 : OCTET STRING- (ascii): Adaptive Security Appliance 'Management0/0' interface
.1.3.6.1.2.1.2.2.1.2.15 : OCTET STRING- (ascii): Adaptive Security Appliance 'n3k_trunk' interface
.1.3.6.1.2.1.2.2.1.2.16 : OCTET STRING- (ascii): Adaptive Security Appliance 'ucs_mgmt' interface
.1.3.6.1.2.1.2.2.1.2.17 : OCTET STRING- (ascii): Adaptive Security Appliance 'vmware_mgmt' interface
.1.3.6.1.2.1.2.2.1.2.18 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Prometey_Guest' interface
.1.3.6.1.2.1.2.2.1.2.19 : OCTET STRING- (ascii): Adaptive Security Appliance 'bviatm' interface
.1.3.6.1.2.1.2.2.1.2.20 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Orbeli' interface
.1.3.6.1.2.1.2.2.1.2.21 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Kievyan' interface
.1.3.6.1.2.1.2.2.1.2.22 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Davtashen' interface
.1.3.6.1.2.1.2.2.1.2.23 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Erebuni' interface
.1.3.6.1.2.1.2.2.1.2.24 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Nzhdeh' interface
.1.3.6.1.2.1.2.2.1.2.25 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Tumanyan' interface
.1.3.6.1.2.1.2.2.1.2.26 : OCTET STRING- (ascii): Adaptive Security Appliance 'servers' interface
.1.3.6.1.2.1.2.2.1.2.27 : OCTET STRING- (ascii): Adaptive Security Appliance 'dvr' interface
.1.3.6.1.2.1.2.2.1.2.28 : OCTET STRING- (ascii): Adaptive Security Appliance 'swift_global' interface
.1.3.6.1.2.1.2.2.1.2.29 : OCTET STRING- (ascii): Adaptive Security Appliance 'swift_local' interface
.1.3.6.1.2.1.2.2.1.2.30 : OCTET STRING- (ascii): Adaptive Security Appliance 'lan' interface
.1.3.6.1.2.1.2.2.1.2.31 : OCTET STRING- (ascii): Adaptive Security Appliance 'voip' interface
.1.3.6.1.2.1.2.2.1.2.32 : OCTET STRING- (ascii): Adaptive Security Appliance 'cbanet_local' interface
.1.3.6.1.2.1.2.2.1.2.33 : OCTET STRING- (ascii): Adaptive Security Appliance 'dmz' interface
.1.3.6.1.2.1.2.2.1.2.34 : OCTET STRING- (ascii): Adaptive Security Appliance 'cbanet' interface
.1.3.6.1.2.1.2.2.1.2.35 : OCTET STRING- (ascii): Adaptive Security Appliance 'mgmtgw' interface
.1.3.6.1.2.1.2.2.1.2.36 : OCTET STRING- (ascii): Adaptive Security Appliance 'arca_local' interface
.1.3.6.1.2.1.2.2.1.2.37 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm123' interface
.1.3.6.1.2.1.2.2.1.2.38 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm103' interface
.1.3.6.1.2.1.2.2.1.2.39 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm101' interface
.1.3.6.1.2.1.2.2.1.2.40 : OCTET STRING- (ascii): Adaptive Security Appliance 'bviatm' interface
.1.3.6.1.2.1.2.2.1.2.41 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm102' interface
.1.3.6.1.2.1.2.2.1.2.42 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Paronyan' interface
.1.3.6.1.2.1.2.2.1.2.43 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Kasyan' interface
.1.3.6.1.2.1.2.2.1.2.44 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Azatutyun' interface
.1.3.6.1.2.1.2.2.1.2.45 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Gyumri' interface
.1.3.6.1.2.1.2.2.1.2.46 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Kotayq' interface
.1.3.6.1.2.1.2.2.1.2.47 : OCTET STRING- (ascii): Adaptive Security Appliance 'SSID_Evocabank_Vanadzor' interface
.1.3.6.1.2.1.2.2.1.2.48 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm_local' interface
.1.3.6.1.2.1.2.2.1.2.49 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm104' interface
.1.3.6.1.2.1.2.2.1.2.50 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm105' interface
.1.3.6.1.2.1.2.2.1.2.51 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm106' interface
.1.3.6.1.2.1.2.2.1.2.52 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm107' interface
.1.3.6.1.2.1.2.2.1.2.53 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm108' interface
.1.3.6.1.2.1.2.2.1.2.54 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm109' interface
.1.3.6.1.2.1.2.2.1.2.55 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm110' interface
.1.3.6.1.2.1.2.2.1.2.56 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm111' interface
.1.3.6.1.2.1.2.2.1.2.57 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm121' interface
.1.3.6.1.2.1.2.2.1.2.58 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm122' interface
.1.3.6.1.2.1.2.2.1.2.59 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm124' interface
.1.3.6.1.2.1.2.2.1.2.60 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm125' interface
.1.3.6.1.2.1.2.2.1.2.61 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm126' interface
.1.3.6.1.2.1.2.2.1.2.62 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm127' interface
.1.3.6.1.2.1.2.2.1.2.63 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm128' interface
.1.3.6.1.2.1.2.2.1.2.64 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm129' interface
.1.3.6.1.2.1.2.2.1.2.65 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm130' interface
.1.3.6.1.2.1.2.2.1.2.66 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm131' interface
.1.3.6.1.2.1.2.2.1.2.67 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm132' interface
.1.3.6.1.2.1.2.2.1.2.68 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm133' interface
.1.3.6.1.2.1.2.2.1.2.69 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm134' interface
.1.3.6.1.2.1.2.2.1.2.70 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm135' interface
.1.3.6.1.2.1.2.2.1.2.71 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm136' interface
.1.3.6.1.2.1.2.2.1.2.72 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm137' interface
.1.3.6.1.2.1.2.2.1.2.73 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm138' interface
.1.3.6.1.2.1.2.2.1.2.74 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm139' interface
.1.3.6.1.2.1.2.2.1.2.75 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm140' interface
.1.3.6.1.2.1.2.2.1.2.76 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm141' interface
.1.3.6.1.2.1.2.2.1.2.77 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm142' interface
.1.3.6.1.2.1.2.2.1.2.78 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm143' interface
.1.3.6.1.2.1.2.2.1.2.79 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm144' interface
.1.3.6.1.2.1.2.2.1.2.80 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm145' interface
.1.3.6.1.2.1.2.2.1.2.81 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm146' interface
.1.3.6.1.2.1.2.2.1.2.82 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm147' interface
.1.3.6.1.2.1.2.2.1.2.83 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm148' interface
.1.3.6.1.2.1.2.2.1.2.84 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm149' interface
.1.3.6.1.2.1.2.2.1.2.85 : OCTET STRING- (ascii): Adaptive Security Appliance 'atm150' interface
.1.3.6.1.2.1.2.2.1.2.86 : OCTET STRING- (ascii): Adaptive Security Appliance 'cbanet128' interface
.1.3.6.1.2.1.2.2.1.2.87 : OCTET STRING- (ascii): Adaptive Security Appliance 'development' interface
.1.3.6.1.2.1.2.2.1.2.88 : OCTET STRING- (ascii): Adaptive Security Appliance 'test' interface
.1.3.6.1.2.1.2.2.1.2.89 : OCTET STRING- (ascii): Adaptive Security Appliance 'bviatm' interface
.1.3.6.1.2.1.2.2.1.2.90 : OCTET STRING- (ascii): Adaptive Security Appliance 'bviatm' interface

and almost all have IP addresses configured

Thanks in advance!

Re: ASA5525 with FTD issue with monitoring

Marvin Rhoads — Wed, 04 Jul 2018 17:18:15 GMT

OK, I see what you're saying.

I don't have one handy to test subinterface polling.

If you have support it may be best to open a TAC case.

Re: ASA5525 with FTD issue with monitoring

Ruzanna Zohrabyan — Wed, 11 Jul 2018 07:18:29 GMT

Hello Marvin Rhoads, unfortunately the ASA isn't covered by active smartnet license.

topic Re: ASA5525 with FTD issue with monitoring in Network Security

ASA5525 with FTD issue with monitoring

Re: ASA5525 with FTD issue with monitoring

Re: ASA5525 with FTD issue with monitoring

Re: ASA5525 with FTD issue with monitoring

Re: ASA5525 with FTD issue with monitoring