cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2368
Views
0
Helpful
6
Replies

snmp alarm "Interface 0" always shows down

morgan.brownlie
Level 1
Level 1

Hi,

One of our snmp monitoring applications keeps throwing up these interface down messages on various devices, the most recent being

on a ASA box, the specific error or interface down staement is :-

Adaptive Security Appliance "0" Interface - Down

Interface0.jpg

I'm not sure if this is specific to ASA type devices or not, but its causing some problems on our monitoring desk, as they see it as a pucka interface thats went down and red alarms that need some attention.

I guess the question is, what is "Interface 0" ? what does it relate to + lastly are these important alarms that we should know about or should we be trying to filter out these alarms.

Any help would be much appreciated.

Thanks.

2 Accepted Solutions

Accepted Solutions

Hi Morgan,

Interface is actually down on your ASA as per your logs.

It is not a false alert.

Explanation:

1. From snmpwalk output

     a. INterface 0 ifdescrip value is 2.

         interfaces.ifTable.ifEntry.ifDescr.2 : DISPLAY STRING- (ascii):  Adaptive Security Appliance '0' interface

http://www.oidview.com/mibs/0/IF-MIB.html

     b. interfaces.ifTable.ifEntry.ifOperStatus.2 : INTEGER: down

         Please find below link for more details (Check Values row)

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=1.3.6.1.2.1.2.2.1.8&translate=Translate&submitValue=SUBMIT&submitClicked=true

Ameya

View solution in original post

Hi Morgan,

This is actually expected and cannot be disabled. The Interface0 is used for internal communications only and will always be shown as shutdown.

Since every interface, physical or logical, must be identified via SNMP also, it will always generate LinkDown alerts from SNMP monitoring tools.

The only available workarounds for this are:

1) Disregard the alerts/ Disable the monitoring of that interface in your monitoring tool.

2) Create an SNMP View to block the access to this interface's data.

Hope this helps.

Luis

View solution in original post

6 Replies 6

ameya_oke
Level 1
Level 1

Hi Morgan,

1.Obtailn snmpwalk data for ASA host.

2. You will get ifdescrp values of each interface available in ASA.

3. Say for interface 0 ifdescrip value is 7(in your output it is 2), use this value while configuring snmp host in your         monitoring GUI.

Please share snmpwalk response.

Ameya

Hi There,

snmpwalk response attached as text file.

Thanks.

Hi Morgan,

Interface is actually down on your ASA as per your logs.

It is not a false alert.

Explanation:

1. From snmpwalk output

     a. INterface 0 ifdescrip value is 2.

         interfaces.ifTable.ifEntry.ifDescr.2 : DISPLAY STRING- (ascii):  Adaptive Security Appliance '0' interface

http://www.oidview.com/mibs/0/IF-MIB.html

     b. interfaces.ifTable.ifEntry.ifOperStatus.2 : INTEGER: down

         Please find below link for more details (Check Values row)

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=1.3.6.1.2.1.2.2.1.8&translate=Translate&submitValue=SUBMIT&submitClicked=true

Ameya

Hi Morgan,

This is actually expected and cannot be disabled. The Interface0 is used for internal communications only and will always be shown as shutdown.

Since every interface, physical or logical, must be identified via SNMP also, it will always generate LinkDown alerts from SNMP monitoring tools.

The only available workarounds for this are:

1) Disregard the alerts/ Disable the monitoring of that interface in your monitoring tool.

2) Create an SNMP View to block the access to this interface's data.

Hope this helps.

Luis

Hey Morgan,

Disregarding the alert is a viable workaround, you may even go about disabling the alert(so that a down status is not shown even if it is down)

Please rate if helpful.

Ameya

Guys,

Many thanks for all the helpfull replies, this has answered my question :-) I can now go back to our firewall people and explain about Interface 0 etc.

Thanks again.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco