SNMP Trap for IPSec Tunnel Flap

[Elie Bassil]

Hello,

We have a scenario where on a router we have multiple VPN Tunnels (IPSec) established, this router is configured to send SNMP traps (find attached SNMP config). The problem is that once one of the Tunnels goes down, we are receiving an SNMP trap for it which is being interpreted by our SNMP software as:

IPsec Phase-1 IKE Tunnel Stopped (GARBAGE to GARBAGE)

Where "GARBAGE" is just some random characters. My question is: Should the trap include the Peer IP of the Tunnel that flapped? If yes why are we getting Garbage value instead.

10x,

E.B:.

[Elie Bassil]

After opening a TAC case the issue was related to:

CSCsq41969   Bug Details Incorrect   cikePeerLocalAddr & cikePeerRemoteAddr in cikeTunnelStop trap
Symptom: Incorrect IP addresses displayed. Conditions: It is observed for the cikePeerLocalAddr and cikePeerRemoteAddr objects when sent with the cikeTunnelStop trap. But for cikeTunnelStart the value shown   was correct. Workaround: Not available.