Monitor VPN on Cisco ASA, Palo Alto, and other firewalls with NPM

3/24/2020 8:26 AM

4/4/2022 3:20 AM

This article provides information on monitoring VPN tunnels on Cisco ASA, Palo Alto, and other firewalls. 

Network Performance Monitor

Monitor VPN tunnels on ASA firewalls
Before getting started, read about monitoring VPN tunnels on ASA firewalls with NPM in the SolarWinds Customer Success Center.

SolarWinds recommends CLI polling 
When polling Site-to-Site VPN tunnels, CLI polling helps filter data polled through SNMP, and then displays only relevant results. Without CLI polling, you might see failed access attempts from outside as failed tunnels. Reference the following commands for CLI polling when CLI is enabled for Cisco ASA.

Used commands:

• enable
• show run interface
• show firewall
• show asp drop flow
• show mode
• show context
• show failover state
• show version | include Serial
• show running-config crypto map
• show module
• show failover
• changeto system
• show clock

The following pollers are used to obtain VPN information through SNMP:

Site-to-Site VPN SNMP poller

• Status poller
  • Poller type: N.VPN_SiteToSite_Status.SNMP.CiscoAsa
  • Poll Interval is node status interval (10 minutes by default)
  • Polls phase 1 data (local, remote IP address, start time), errors for phase 1 (time of occurrence and local and remote IP addresses) and errors for phase 2 (time of occurrence and local and remote IP addresses)
• Detail poller 
  • Poller type: N.VPN_SiteToSite_Detail.SNMP.CiscoAsa
  • Poll interval is node statistics interval (10 minutes by default)
  • Polls phase 1 data (active tunnels), phase1 errors and phase2 errors

Remote Access VPN SNMP poller

• Poller Type: N.VPN_RemoteAccess.SNMP.CiscoAsa

Monitor VPN tunnels on Palo Alto firewalls
Before getting started, read about monitoring Palo Alto firewalls with NPM in the SolarWinds Customer Success Center:

Reference the following API calls to gather information through the REST API:

• Site-to-Site VPN Polling
  Request example:
  https://{Firewall IP Address}/api/?type=op&cmd=<show><vpn><flow/></vpn></show>&key={API key}
  The result of this API call will obtain the "Site-to-Site tunnels basic poll response."
• GlobalProtect VPN Polling
  Request example:
  https://{Firewall IP Address}/api/?type=op&cmd=<show><global-protect-gateway><current-user></current-user></global-protect-gateway></show>&key={API key}
  The result of this API call will obtain the "Site-to-Site tunnels basic poll response."

For more information on Palo Alto API calls, please visit the official documentation site for Palto Alto. 
https://docs.paloaltonetworks.com/ (©2020 Palo Alto Software, available at https://www.paloalto.com/, obtained on March 24, 2020).

Available VPN reports
SolarWinds provides the following out-of-the-box reports that you will find in the Orion Web Console under Reports > All Reports.

• VPN Site-to-Site Tunnel History - Last 30 Days
• VPN Remote Access Tunnel History - Last 30 Days

Additionally, you can create custom web-based reports for these devices by creating a custom report on ASA firewalls or Palo Alto firewalls. Learn more here.

Monitor VPN tunnels on other devices
There are instances in which devices are different than the supported Palo Alto or Cisco ASA devices. For these devices, you can create custom pollers to obtain the required information. However, the manufacturer should provide the OIDs that send the required information since SolarWinds will not be able to provide it. After identifying which OIDs are required to obtain the information, we can then create the UnDP pollers. 

Learn how to create UnDP pollers, custom poller alerts, and then UnDP web-based reports from the following KB articles:
Important: Follows these steps in sequence.

1. Create UnDP pollers  
2. Create a custom poller alert in Orion
3. Create a web-based report from a UnDP

NOTE: This applies for other client-based VPN's you will also need to create a UnDP to poll the information you require.