Cisco ASA: Tunnel Phase-1 incoming traffic Health Monitor

Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1IncomingTraffic.1.1 (AggregateMonitor)

This monitor catches Xian events that notifies when the Tunnel Phase-1 incoming traffic if has changed its state.

Knowledge Base article:

Summary

Phase-1 Tunnel incoming traffic is over threshold.

The number of Phase-1 Tunnel incoming Kbits per second is above the maximum threshold configured in Xian Network Manager 2012.

Causes

There is a high amount of octets being received by this Phase-1 Tunnel.

Resolutions

Review the sessions that runs into the Phase-1 Tunnel in order to close the less priority sessions.

Additional

Monitors the traffic received on an IPsec Phase-1 IKE Tunnel, detecting when the average traffic is above normal values.

Element properties:

TargetJalasoft.Xian.Common.Elements.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1Element
Parent MonitorSystem.Health.PerformanceState
AlgorithmWorstOf
CategoryStateCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityLow
Alert Auto ResolveTrue
RemotableTrue
AccessibilityPublic
Alert Message
Tunnel Phase-1 incoming traffic Alert
{0}

Source Code:

<AggregateMonitor ID="Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase1IncomingTraffic.1.1" Accessibility="Public" Enabled="true" Target="ThirdParty_Cisco!Jalasoft.Xian.Common.Elements.ThirdParty.Cisco.JsXCiscoASATunnelsPhase1Element" ParentMonitorID="SystemHealth!System.Health.PerformanceState" Remotable="true" Priority="Normal">
<Category>StateCollection</Category>
<AlertSettings AlertMessage="TunnelPhase1IncomingTraffic_AlertMessage">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Low</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Params/Param[3]$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<Algorithm>WorstOf</Algorithm>
</AggregateMonitor>