I'm looking for Cisco OIDs for monitoring Cisco ASA series. Is the CISCO-UNIFIED-FIREWALL-MIB enough? What are the statistics and status indicators I should gather?

I'm interested in :

  • Resource consumption (CPU utilization/memory usage)
  • Current Active Connections
  • Active VPN Tunnels - Items: AnyConnect (SSL client), WebVPN (SSL clientless), IPsec, IPsec L2L, etc.
  • RAS Sessions (Total)
  • Traffic in/out (packets/bytes)
  • IKE Dropped Packets
  • IKE Traffic (bits/sec)

closed as too broad by Ron Maupin Apr 18 at 22:50

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Quite open ended question, but I'd certainly always for all firewalls poll session count and set up alarm long before hitting limit. – ytti Aug 21 '13 at 16:12
  • @JohnTube, if you can limit the scope of the question to monitoring a class of events (such as drops for out of sequence packets), or measuring a specific subsystem (such as cpu utilization of each cpu core) we can consider reopening... at this point, we don't know enough about the environment to do anything more than give you a generic list of OIDs that we personally like... a fair question on other discussion boards, but stack exchange looks for specific material in questions – Mike Pennington Aug 21 '13 at 16:51
  • Are you only interested in SNMP, or will CLI counters be useful too? – Mike Pennington Aug 22 '13 at 10:20
  • SNMP only. Preferably objects must not be table entries nor traps/notifications. I'm limited to a 3rd party NMS. – JohnTube Aug 22 '13 at 10:26