cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1935
Views
0
Helpful
2
Replies
Highlighted
Beginner

Using SNMP to monitor connection states on a FW

I've been doing some reading around and it appears to be reasonably simple to monitor the connection rate and total connections through an ASA. However, I'm looking to be able to monitor the number of connections and their states at a given time - i.e. as per the output available from 'show conn'

Has anyone achieved this using this using SNMP? I've not managed to spot a OID that would make this available?

As a last resort I could script this via SSH etc but it's not really the most elegant of solutions :-)

Andy.

2 REPLIES 2
Highlighted
Cisco Employee

Hi Andrew,

I dont have an ASA to try this on, but I believe the CISCO-FIREWALL-MIB would be the one you need. Specifically, the cfwConnectionStatTable (1.3.6.1.4.1.9.9.147.1.2.2.2), looks like the one which will contain information on each connection, similar to the "show conn" CLI command.

Hope this helps,

Luis

Highlighted

Hi Luis,

Thanks for the response. Unfortunately that OID gives the current & max count of connections but does not actually return the state of those connections -

[XXXXXXX@xxx-xxxx-xxxxx-001 ~]$ snmpwalk -v 2c -r 1 -t 1 -c xxxxxxxxx xxx.xx.xx.xxx 1.3.6.1.4.1.9.9.147.1.2.2.2
SNMPv2-SMI::enterprises.9.9.147.1.2.2.2.1.3.40.6 = STRING: "number of connections currently in use by the entire firewall"
SNMPv2-SMI::enterprises.9.9.147.1.2.2.2.1.3.40.7 = STRING: "highest number of connections in use at any one time since system startup"
SNMPv2-SMI::enterprises.9.9.147.1.2.2.2.1.4.40.6 = Counter32: 0
SNMPv2-SMI::enterprises.9.9.147.1.2.2.2.1.4.40.7 = Counter32: 0
SNMPv2-SMI::enterprises.9.9.147.1.2.2.2.1.5.40.6 = Gauge32: 8681
SNMPv2-SMI::enterprises.9.9.147.1.2.2.2.1.5.40.7 = Gauge32: 8716
[XXXXXXX@xxx-xxxx-xxxxx-001 ~]$

I may need to look at options for scripting this via the CLI.

Andy.

Content for Community-Ad