Community Archive (Customer) asked a question.

February 14, 2018 at 9:42 PM
Cisco VPN active monitor

[Imported from community.whatsupgold.com/library. Contributor: Neil Behagg. See attached PDF for full details.]

 

This script is for monitoring Cisco VPN tunnels using SNMP. To use it, create an active monitor using vb script and paste the code in. On the device you wish to monitor, create a new interface from the device properties general page, and give the new interface the IP address of the VPN endpoint. Then, assign the active monitor to that device and set it to use the interface you have just created.

  • 7 answers
  • 756 views

  • Community Archive (Customer)

    I would verify the OIDs first using the MIB Walker, and adjust them as needed.

    Even though the OID is 1.3.6.1.4.1.9 (ISO.Org.DOD.Internet.Private.Enterprise.Cisco) even though your Device might be made by Cisco, the OIDs change from device to device, model to model, and even sometimes firmware updates ... If your device isn't a Cisco, then most definitely the OIDs are wrong ... the number after the 1.3.6.1.4.1. specifies the manufacturer. For example 9 is Cisco 311 is Microsoft.

  • Community Archive (Customer)

    This is not working on ASAs, it is polling my ASA Outside interface and throwing error that VPN tunnel is not active, where in real there are many tunnels active. so not sure if code provided here is wrong or it is a OID issue.​

  • Community Archive (Customer)

    ​This script works for IKEv1 tunnels but not IKEv2.  Does anyone know of a method for monitoring IKEv2 tunnels?

  • Community Archive (Customer)

    Got it working, kind of, but required a slightly altered script for just those 2 tunnels. For some reason with OID .....8, "strValue" would get filled with garbage for certain tunnels. Other tunnels "strValue" would fill with the proper hex IP. Bad vars look like:

     

    strValue = �žW�

    strValue = 6•fŸ

     

    Good vars were colon separated hex IP's even though the SNMPWALK output didn't have the colons.

  • Community Archive (Customer)

    I am having a slight problem implementing this. We have 6 tunnels active on an ASA5525. Four of them return the proper peer IP on SNMPWALK .....7. These four are working to active monitor. Two of them return a 10.x.x.x IP that exist nowhere though. The next OID .....8 does return all 6 correct peer IPs but lists them in HEX IP format.

     

    I tried changing the octet strings to Hex(strOctet1), etc and putting spaces (" ") between them instead of "." It seems to convert to HEX IP by the test output, but I might be doing this in the wrong order. Can anyone advise please? Here is the SNMP output:

     

    OID=.1.3.6.1.4.1.9.9.171.1.2.3.1.7.42696704, Type=OctetString, Value=10.X.X.X

    OID=.1.3.6.1.4.1.9.9.171.1.2.3.1.7.57004032, Type=OctetString, Value=10.Y..Y.Y

     

    OID=.1.3.6.1.4.1.9.9.171.1.2.3.1.8.42696704, Type=OctetString, Value= XX XX XX XX                                    

    OID=.1.3.6.1.4.1.9.9.171.1.2.3.1.8.57004032, Type=OctetString, Value= XX XX XX XX

  • Community Archive (Customer)

    I tried this vbscript on WUG v19. Monitored device is an ASA. I verified OID provided by Neil with SNMP MIB Walker tool and it returned active VPN L2L connections as expected (I am wondering if VPN remote connections can be retrieved as well).

     

    Then I followed these steps:

     

    1-Create a new active monitor: Settings>Library>Monitors>+ActiveMonitor. Copy/paste code in it, selected script type, selected IsolatedProcess.

     

    2-Create another network interface to ASA device: 

     

    DeviceProperties>IP Address >ConfigureNetworkInterfaces>AddNetworkInterface. Set VPN-peer-IP to this interface.

     

    3-Add active monitor to ASA device:

     

    Device Properties>AddMonitor>ActiveMonitor. Selected monitor created in step1, and assigned network interface created in step2.

     

    Once enabled the monitor I got the error: 

     

    "VPN End Point is {VPN-peer-ip} VPN Tunnel NOT ACTIVE"

     

    Since I can reach ASA with snmp walk tool and it returned correct values, it doesnt seem to be an access issue. 

  • OIS Infrastructure OIS (Wisconsin State Laboratory of Hygiene)

    Here is our version of the script for IKEv2; be sure to update "strIPEndPoint" for the target device:

     

    1. Option Explicit
    2.  
    3. Dim strIPEndPoint
    4. Dim intResult, strResult
    5. Dim strOID, objSNMP, objSNMPResult, objComResult, strValue
    6. Dim boolError, boolSNMPErr, strError, strMaxOID, nDeviceID, strHostname
    7. Dim intCharPos, intLength, strOctet1, strOctet2, strOctet3, strOctet4
    8.  
    9. strIPEndPoint = "IPaddress of target device"
    10.  
    11. strError = strError & "IPsec Tunnel peer IP is " & strIPEndPoint & chr(10)
    12.  
    13. strOID = "1.3.6.1.4.1.9.9.171.1.2.3"
    14.  
    15. set objSNMP = CreateObject("CoreAsp.SnmpRqst")
    16. nDeviceID = Context.GetProperty("DeviceID")
    17. set objComResult = objSNMP.Initialize(nDeviceID)
    18. intResult = 1
    19. boolError = False
    20.  
    21. If objComResult.Failed Then
    22. boolError = True
    23. strError = strError & "Error initialising SNMP. " & chr(10)
    24. End If
    25.  
    26. If boolError = False Then
    27. strMaxOID = "1.3.6.1.4.1.9.9.171.1.2.4"
    28. While strOID < strMaxOID
    29. set strResult = objSNMP.GetNext(strOID)
    30. strValue = strResult.GetPayload
    31. strOID = strResult.GetOID
    32. If strOID < strMaxOID then
    33. If strValue = strIPEndPoint Then
    34. strError = strError & " - IPsec Tunnel detected. " & chr(10)
    35. intResult = 0
    36. strOID = strMaxOID
    37. End If
    38. End If
    39. Wend
    40. If intResult = 1 Then
    41. strError = strError & " - IPsec Tunnel NOT detected. " & chr(10)
    42. End If
    43. End If
    44.  
    45. Context.SetResult intResult, strError
    46.  
    47. Set objSNMP = Nothing
    48. Set objComResult = Nothing
    49. Set objSNMPResult = Nothing