CSCtc36391 - ASA snmp object crasUsername should be readable

[MarecekSK]

Hello,
we are using Cisco Adaptive Security Appliance Software Version 9.14(2)4 on FPR4K-SM-12S. Can anyone else confirm that the bug was not removed in this newer version?

oss@domainame.com:~$ snmpwalk -c **** -v 2c X.X.X.X 1.3.6.1.4.1.9.9.392.1.3.21.1.1
SNMPv2-SMI::enterprises.9.9.392.1.3.21.1.1 = No Such Instance currently exists at this OID

Our customer is trying to get a list of sucessfull connected VPN users from SNMP MIB.

ASA-KE-HQ# sh snmp oid | grep crasUser
[758] .1.3.6.1.4.1.9.9.392.1.3.21.1.1 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasUsername

[balaji.bandi]

Do you have latest MIB downloaded ?  - https://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&mibName=CISCO-REMOTE-ACCESS-MONITOR-MIB

is your customer looking only active sessions ?  then try 1.3.6.1.4.1.9.9.392.1.1

[MarecekSK]

I think, you recommended the wrong OID to me. Because these OIDs(1.3.6.1.4.1.9.9.392.1.1) only inform about the maximum values supported for groups users and sessions. 

ASA-KE-HQ# sh snmp oid | grep 1.3.6.1.4.1.9.9.392.1.1
[720] .1.3.6.1.4.1.9.9.392.1.1.1 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasMaxSessionsSupportable
[721] .1.3.6.1.4.1.9.9.392.1.1.2 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasMaxUsersSupportable
[722] .1.3.6.1.4.1.9.9.392.1.1.3 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasMaxGroupsSupportable
[723] .1.3.6.1.4.1.9.9.392.1.1.4 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasNumCryptoAccelerators

I recommended to our client to use one of the attributes crasGroup, crasLocalAddress or crasISPAddress that contains the information about the username, but in decimal format and then convert it to ASCII. 

ASA-KE-HQ# sh snmp oid | grep crasUser|crasGroup|crasLocalAddress|crasISPAddr$
[758] .1.3.6.1.4.1.9.9.392.1.3.21.1.1 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasUsername
[759] .1.3.6.1.4.1.9.9.392.1.3.21.1.2 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasGroup
[764] .1.3.6.1.4.1.9.9.392.1.3.21.1.7 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasLocalAddressType
[765] .1.3.6.1.4.1.9.9.392.1.3.21.1.8 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasLocalAddress
[766] .1.3.6.1.4.1.9.9.392.1.3.21.1.9 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasISPAddressType
[767] .1.3.6.1.4.1.9.9.392.1.3.21.1.10 CISCO-REMOTE-ACCESS-MONITOR-MIB::crasISPAddress

Our customer wants to monitor sucessfully authenticated users based on usernames. 

[balaji.bandi]

Apologies I have typed wrong : (here is good details).

https://community.cisco.com/t5/security-documents/asa-ra-vpn-user-information-using-snmp/ta-p/3108476