Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How to monitor Cisco IPsec VPN with Nagios? I want to check if a user can connect to VPN.

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Try to do the following if you can:

  • Test the authentication backend - does your vpn authenticate against radius? if so, setup nagios with the radius plugin.
  • Check for gaps in VPN login times. If you are running a busy vpn server, most likely you see a login at least once every 10 minutes during business hours. I have a custom nagios plugin that queries the radius accounting database, and checks to see if anyone has successfully logged in in the past 10 minutes.

The above 2 'extra' checks have been invaluable.

share|improve this answer
add comment

Use the check_snmp command to get back the connection info, which will be specific to your device/setup but in general follows the traditional Nagios methodology. Find the OID you need then set a warning/critical threshold -- so in my instance it looks like:

check-snmp!.1.3.6.1.4.1.3076.2.1.2.17.1.1.0!COMMUNITY!22!24

My warning/critical thresholds on the end (22, 24) are based on the number of DHCP addresses I've allowed this VPN server to allot to remote clients. The OID I'm querying tells me how many are currently in use and tracked (this pool is thereby specific to this VPN device and not given out by another daemon/etc.)

share|improve this answer
add comment

While answers so far are useful, I'd start simple and check whether the cisco device is accessible externally. Have an external monitoring node outside of your network check the device and see if it's accessible.

Then if you want more detail throw in the RADIUS checks internally.

I've often got carried away with monitoring 5+ items internally when one simple external check would have caught 99% of the errors picked up by a combination of the items internally.

share|improve this answer
    
absolutely true, but his question was "check if a user can connect" not "check if the box is up". This distinction is the exact reason for the checks I described. We have a number of site to site vpns and it is trivial to test remote connectivity to them, but that doesn't tell you if new users are able to connect. –  Justin Jan 2 '10 at 22:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.