cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1757
Views
0
Helpful
6
Replies
Highlighted

snmp alarm "Interface 0" always shows down

Hi,

One of our snmp monitoring applications keeps throwing up these interface down messages on various devices, the most recent being

on a ASA box, the specific error or interface down staement is :-

Adaptive Security Appliance "0" Interface - Down

Interface0.jpg

I'm not sure if this is specific to ASA type devices or not, but its causing some problems on our monitoring desk, as they see it as a pucka interface thats went down and red alarms that need some attention.

I guess the question is, what is "Interface 0" ? what does it relate to + lastly are these important alarms that we should know about or should we be trying to filter out these alarms.

Any help would be much appreciated.

Thanks.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Highlighted

Hi Morgan,

Interface is actually down on your ASA as per your logs.

It is not a false alert.

Explanation:

1. From snmpwalk output

     a. INterface 0 ifdescrip value is 2.

         interfaces.ifTable.ifEntry.ifDescr.2 : DISPLAY STRING- (ascii):  Adaptive Security Appliance '0' interface

http://www.oidview.com/mibs/0/IF-MIB.html

     b. interfaces.ifTable.ifEntry.ifOperStatus.2 : INTEGER: down

         Please find below link for more details (Check Values row)

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=1.3.6.1.2.1.2.2.1.8&translate=Translate&submitValue=SUBMIT&submitClicked=true

Ameya

View solution in original post

Highlighted

Hi Morgan,

This is actually expected and cannot be disabled. The Interface0 is used for internal communications only and will always be shown as shutdown.

Since every interface, physical or logical, must be identified via SNMP also, it will always generate LinkDown alerts from SNMP monitoring tools.

The only available workarounds for this are:

1) Disregard the alerts/ Disable the monitoring of that interface in your monitoring tool.

2) Create an SNMP View to block the access to this interface's data.

Hope this helps.

Luis

View solution in original post

6 REPLIES 6
Highlighted
Beginner

Hi Morgan,

1.Obtailn snmpwalk data for ASA host.

2. You will get ifdescrp values of each interface available in ASA.

3. Say for interface 0 ifdescrip value is 7(in your output it is 2), use this value while configuring snmp host in your         monitoring GUI.

Please share snmpwalk response.

Ameya

Highlighted

Hi There,

snmpwalk response attached as text file.

Thanks.

Highlighted

Hi Morgan,

Interface is actually down on your ASA as per your logs.

It is not a false alert.

Explanation:

1. From snmpwalk output

     a. INterface 0 ifdescrip value is 2.

         interfaces.ifTable.ifEntry.ifDescr.2 : DISPLAY STRING- (ascii):  Adaptive Security Appliance '0' interface

http://www.oidview.com/mibs/0/IF-MIB.html

     b. interfaces.ifTable.ifEntry.ifOperStatus.2 : INTEGER: down

         Please find below link for more details (Check Values row)

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=1.3.6.1.2.1.2.2.1.8&translate=Translate&submitValue=SUBMIT&submitClicked=true

Ameya

View solution in original post

Highlighted

Hi Morgan,

This is actually expected and cannot be disabled. The Interface0 is used for internal communications only and will always be shown as shutdown.

Since every interface, physical or logical, must be identified via SNMP also, it will always generate LinkDown alerts from SNMP monitoring tools.

The only available workarounds for this are:

1) Disregard the alerts/ Disable the monitoring of that interface in your monitoring tool.

2) Create an SNMP View to block the access to this interface's data.

Hope this helps.

Luis

View solution in original post

Highlighted

Hey Morgan,

Disregarding the alert is a viable workaround, you may even go about disabling the alert(so that a down status is not shown even if it is down)

Please rate if helpful.

Ameya

Highlighted

Guys,

Many thanks for all the helpfull replies, this has answered my question :-) I can now go back to our firewall people and explain about Interface 0 etc.

Thanks again.

Content for Community-Ad