MRTG VPN tunnels Cisco ASA
MRTG VPN tunnels Cisco ASA
This post was written for ASA 7.X and has likely changed.
Problem: Every time a tunnel disconnects and reconnects, it is a assigned a new OID number, presumably based on something similar to the ifIndex. This means that I constantly have to remove and re-add tunnels as they drop and reconnect. It also means that the historical data gathered on the connection is lost each time.
Solution: Use some shell scripting and snmp to determine the proper OID for each peer.
This script runs every 5 minutes from crontab (runs on the mrtg machine)
/opt/Scripts/remote-vpn.sh
#!/bin/sh
# VPN to our remote site
#
#
# Remember to replace Public with your snmp community name and 192.192.192.192 with your Peer IP Address
XYZ=`snmpwalk -v1 -c Public 10.50.100.2 1.3.6.1.4.1.9.9.171.1.2.3.1 |grep 192.192.192.192 | awk -F’.’ ‘{print $10}’ | awk ‘{print $1}’`
# Replace Public with your snmp community name and 10.10.10.1 with your ASA IP Address
snmpget -v1 -c Public 10.10.10.1 1.3.6.1.4.1.9.9.171.1.2.3.1.19.$XYZ | awk ‘{print $4}’ > /tmp/xyz.txt
snmpget -v1 -c Public 10.10.10.1 1.3.6.1.4.1.9.9.171.1.2.3.1.27.$XYZ | awk ‘{print $4}’ >> /tmp/xyz.txt
This is the config you’d need in your mrtg config to check the contents of /tmp/xyz.txt (We have a 45Mb circuit so 47185920 MaxBytes will vary according to your bandwidth)
Crontab
0-59/5 * * * * /opt/Scripts/remote-vpn.sh
0-59/5 * * * * env LANG=C /usr/bin/mrtg /opt/mrtg/mrtg.cfg
This is just my method to work around the dynamic OID assigned in the Cisco ASA (Pix). If you have a better/cleaner method please email me and I’ll post it.
Use at your own risk. As always, please test before telling your boss that you have it working!
Update: It sounds like Cisco has changed some of the way the ASA does VPN, this may or may not work for you, depending on version, but might still be a good starting point.
As an Amazon Associate I earn from qualifying purchases. Read our Privacy Policy for more info.
I cant look at your MRTG config. It looks like Dropbox has deleted the content. Anyway can you post it to your site? If its too long I wouldnt mind a copy.
Thanks!
NHawkins
It looks like it got moved. I’m looking for it and will get it posted asap.
Does this still work? Im trying to do this in MRTG now but I cant seem to get it to work.
I don’t think so, unless you are running v6 or 7 code at the latest.