Cisco ASA: Tunnel Phase-1 global total dropped packets Health Monitor

Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1GlobalTotalDroppedPackets.1.1 (AggregateMonitor)

This monitor catches Xian events that notifies when the Tunnel Phase-1 global total dropped packets if has changed its state.

Knowledge Base article:

Summary

Phase-1 Tunnel global total dropped packets is over threshold.

The number of discarded incoming and outgoing packets by all active IPsec Phase-1 IKE Tunnels is above the maximum threshold configured in Xian Network Manager 2012.

Causes

It may be due to duplicate identifiers.

Resolutions

Check your tunnels definitions, and be sure that for each tunnel you have defined between two given routers, there is a unique identifier.

Additional

Monitors the total number of packets dropped by all active IPsec Phase-1 IKE Tunnels during received and sent processing.

Element properties:

Target

Jalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1ElementContainer

Parent Monitor

System.Health.PerformanceState

Algorithm

WorstOf

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Low

Alert Auto Resolve

True

Remotable

True

Accessibility

Public

Alert Message

Tunnel Phase-1 global total dropped packets Alert

{0}

Source Code:

<AggregateMonitor ID="Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1GlobalTotalDroppedPackets.1.1" Accessibility="Public" Enabled="true" Target="ThirdParty_Cisco!Jalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1ElementContainer" ParentMonitorID="SystemHealth!System.Health.PerformanceState" Remotable="true" Priority="Normal">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="TunnelPhase1GlobalTotalDroppedPackets_AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Low</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Params/Param[3]$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <Algorithm>WorstOf</Algorithm>

</AggregateMonitor>