Monitoring Cisco ASA VPN Traffic/State

[lpossamai]

Hi all,

I've got a Zabbix 3.4 server running and a Cisco ASA 5520. I am trying to monitor the traffic over a site-to-site VPN connection. I came across this POST (https://www.zabbix.com/forum/zabbix-...ec-vpn-tunnels), but as it is quite old, I decided to ask the question again...

Do you guys know how I can monitor a VPN Traffic through Zabbix using SNMP v2?

Cheers

[lpossamai]

So.... after spending some time I managed to get this working with the query_asa_lan2lan.pl script.

My Setup 2018:

Zabbix 3.4
CentOS 7 64 Bits


1. download it from this thread.
2. Copy the script to the "externalscripts" folder in your Zabbix Server. Usually "/usr/lib/zabbix/externalscripts/"
3. Install any Perl dependencies you may need

use POSIX;
use Switch;
use Net::SNMP;

4. Test your script

perl /usr/lib/zabbix/externalscripts/query_lan2_lan_cisco_final.pl community ASA_IP_ADDRESS ASA get RX PEER_IP_ADDRESS

Example:

My ASA FW IP: 192.168.1.1
VPN Peer IP Address: 203.120.120.12

perl /usr/lib/zabbix/externalscripts/query_lan2_lan_cisco_final.pl public 192.168.1.1 ASA get RX 203.120.120.12

5. Create a new Template via the Web Interface
6. Inside that new template, create a new Item as follow:

The key value is:

query_lan2_lan_cisco_final.pl["community","cisco-asa-ip","ASA","get","RX","peer-ip-address"]
query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.120.120.12"]

[kernbug]

So.... after spending some time I managed to get this working with the query_asa_lan2lan.pl script.

Cool guide, thank you.

[lpossamai]

UPDATE:

To get a better-looking graph, you may wanna tweak Zabbix.

When creating the Item, go to the Preprocessing tab and add:

Units = bps
Change per second
Custom Multiplier | Value is 8.



The graph before the change looked like:


After the change it is looking like:

[Paulo Santos]

Hi.

Is it possible run this script in zabbix_proxy enviroment?

Tks

PS