Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I want to monitor packet loss on my ASA 5505 VPN endpoints using SNMP. This is so I can graph the rates in Cacti and/or get alerts in Nagios.

However, I am not sure what SNMP values I should use to measure packet loss.

In the ASA I can run sh interface Internet stats to show traffic statistics for the interface connected to the Internet. This shows 1 minute and 5 minute drop rates.

  • Are these measures an indicator of packet loss?
  • Are there SNMP values I can access that correspond to those values?
  • Should I be looking at different values?
  • Is the ASA even able to measure packet loss?
share|improve this question
Should you be experiencing packet loss on a firewall interface in the first place? – ewwhite Sep 28 '12 at 13:23
I have links I know are often lossy, and I know that an ASA at a site where the VPN tunnel was not performing well showed drop rates for sh interface Internet. I want to better understand which sites have lossy links at problem levels so I can do something about it. – dunxd Sep 28 '12 at 13:42

1 Answer

up vote 0 down vote

Google for "cacti cisco ASA template". That will tell you which OIDs you need.

Mind you that the SNMP indexes for VPN interfaces don't exist unless the tunnel is up!

share|improve this answer
Thanks - the ASA templates I have for Cacti don't actually gather this, but the standard Interface templates gather Errors/Discards. But since ewwhite's comment above I am wondering whether I am barking up the wrong tree here. – dunxd Sep 28 '12 at 14:55
Well, watching for them would be good regardless, but yes, if VPN packets are being dropped, you have bigger problems. – adaptr Sep 28 '12 at 14:56
If packets are lost en route, does the ASA know? I know packets are discarded when the buffer fills up, but what about errors? Is that related to packet loss? – dunxd Sep 28 '12 at 14:59
An IPsec VPN is simply a method of sending encrypted IP-in-IP packets. Both the outer layer (normal IP) and inner (encrypted) packets can contain transmission errors. HOWEVER, since the encapsulated, encrypted packets are both error-checked internally AND have to match for decryption to work, as well as being verified on the outer, plain IP layer... if there are errors in those, something is very, very wonky. For one, the odds of getting a bad VPN packet to CRC on the outer layer are near-zero to begin with. The odds of a correct VPN packet not checking out in plain IP are zero. – adaptr Sep 28 '12 at 15:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.