ASDM for multiple ASA monitoring

[anthonyg10]

I have a request from on high to monitor existing ASA firewalls using only ASDM.  The need I have is to be able to monitor multiple devices for a variety of reasons --- from interface traffic to VPN sessions, etc.  I've been using snmp regularly to get what I need, but I don't see a way to get consistent, historical data on multiple devices using ASDM.  At least not in any practical sense.

I wanted to get community feedback on this problem.  It seems running multiple instances of ASDM on a single machine to keep track of more than a couple ASAs at once is wholly impractical.  What does everyone think?

[Philip D'Ath]

You can run multiple copies of ASDM on one machine (have done it many times myself).  I don't think I would open up more than 2 or 3 at once though.  They all look the same.  You have to keep checking the title bar to make sure you are working on the correct one.

It sounds like your needs would be better met using SNMP ...

[anthonyg10]

That's pretty much what I was thinking --- limitations on how many instances I can run, actual historical information on a device, setting up the GUI each time to graph and chart what I need to see... etc.

When I can setup an snmp server and start grabbing traffic and health and VPN info right off the bat and let it run on multiple targets continuously and do it more efficiently, it makes the approach a lot more sensible.

[Samer R. Saleem]

Hi Anthony,

regarding the historical data i think what you need is syslog server which will gather the information for anything you need according to your syslog enabled level 0 - 7

also for the VPN sessions i used event list from the ASA firewall that will send me any information for a VPN sessions to email

that can help you with troubleshooting, documentation, logs.

for the syslog you can use kiwilogs to save the logs into text, with sizes reaches to N of gigabytes

also you can take that log and use logs analyzer to view the data as a graph which is really great.

Hope that helped

Samer.

[Marvin Rhoads]

I agree - wholly impractical.

Like others suggested, use a simple syslog server and I would add an SNMP tool. Something like PRTG can be easily setup to monitor interface traffic VPN sessions etc.

You can monitor up to 100 sensors (i.e individual SNMP elements - managing an ASA could use up several like pinging for uptime, monitoring an interface, monitoring VPN users etc.) with the free version.