2

We have a customer, who rarely experiences NAT/PAT pool exhaustion on their Cisco Firepower NGFW 4110. While syslog will helpfully notify us that there's an immediate problem, we would really like to do something preemptive before the accident happens.

After long searches I found this thread on the Cisco community forums:

https://community.cisco.com/t5/network-security/how-to-monitor-ip-nat-pool-for-asa-firepower-asa-appliance/td-p/4156426

Now I know they are talking about ASA on Firepower, but for the heck of it, I tried the SNMP OID that was mentioned further down to see if we could maybe check those counters and create alerts based on them. My problem is though, that I really cannot see any resemblance between the actual CLI output and the SNMP polling output. I know he wrote that results might be dynamically different, whatever that means, but I have IP address NATs with 20K connections on CLI, whereas SNMP is telling me 5, so erm...

Does anyone have any experience with the SNMP OID's?

  • 1.3.6.1.2.1.123.1.4.1.11 is a HEX-STRING of the IP address
  • 1.3.6.1.2.1.123.1.4.1.19 is the amount of ports utilized currently

Maybe someone can explain how it all works together?

1.3.6.1.2.1.123.1.4.1.11 example output (most IP addresses are repeated):

enter image description here

1.3.6.1.2.1.123.1.4.1.19 example output:

enter image description here

1 Answer 1

1

I'm not sure if this info applies to the Firepower OS (I think your model runs FXOS) but it might help:

https://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=1.3.6.1.4.1.9.10.77.1.2.1

You can get MIB information files from Cisco but it requires a support contract:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/mib/b_FXOS_4100_9300_MIBRef/about_cisco_fxos_mib_files.html

The method I would use to control NAT session issues would be to simply limit the concurrent sessions for each user. Most likely you are looking at an abuse issue where single users are opening unusually large numbers of translations/connections by using something like bittorrent or network attacks. If you limit the number of connections per client you can prevent the problem without worrying about the monitoring.

You can limit concurrent connections via a few policy map settings that are optional:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/firewall/asa-914-firewall-config/conns-connlimits.html

Not sure if that feature is exposed in the firepower device manager or other GUI platform for Firepower. You might have to use the flex config command line interface to do it.

https://www.cisco.com/c/en/us/td/docs/security/firepower/730/fdm/fptd-fdm-config-guide-730/fptd-fdm-advanced.html#concept_53C22C306B57480D99DB905E90D5FDC9

1
  • Hello and thank you for taking the time to write up an answer. While I don't feel like it answers my questions, I really appreciate the links and information. I've not yet had time to look into the MIBs, as there are a lot of them, but I might be able to find some help. I cannot accept your answer, but i'll leave an upvote.
    – Cow
    Dec 1, 2022 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.