Cisco ASA: Tunnel Phase-1 global outgoing dropped packets Health Monitor

Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1GlobalOutgoingDroppedPackets.1.1 (AggregateMonitor)

This monitor catches Xian events that notifies when the Tunnel Phase-1 global outgoing dropped packets if has changed its state.

Knowledge Base article:

Summary

Phase-1 Tunnel global outgoing dropped packets is over threshold.

The number of discarded outgoing packets by all active IPsec Phase-1 IKE Tunnel is above the maximum threshold configured in Xian Network Manager 2012.

Causes

It may be due to duplicate identifiers.

Resolutions

Check your tunnels definitions, and be sure that for each tunnel you have defined between two given routers, there is a unique identifier.

Additional

Monitors the total number of packets dropped by all active IPsec Phase-1 IKE Tunnels during sent processing.

Element properties:

TargetJalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1ElementContainer
Parent MonitorSystem.Health.PerformanceState
AlgorithmWorstOf
CategoryStateCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityLow
Alert Auto ResolveTrue
RemotableTrue
AccessibilityPublic
Alert Message
Tunnel Phase-1 global outgoing dropped packets Alert
{0}

Source Code:

<AggregateMonitor ID="Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1GlobalOutgoingDroppedPackets.1.1" Accessibility="Public" Enabled="true" Target="ThirdParty_Cisco!Jalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1ElementContainer" ParentMonitorID="SystemHealth!System.Health.PerformanceState" Remotable="true" Priority="Normal">
<Category>StateCollection</Category>
<AlertSettings AlertMessage="TunnelPhase1GlobalOutgoingDroppedPackets_AlertMessage">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Low</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Params/Param[3]$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<Algorithm>WorstOf</Algorithm>
</AggregateMonitor>