Cisco ASA: Tunnel Phase-2 global incoming traffic Health Monitor

Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase2GlobalIncomingTraffic.1.1 (AggregateMonitor)

This monitor catches Xian events that notifies when the Tunnel Phase-2 global incoming traffic if has changed its state.

Knowledge Base article:

Summary

Phase-2 Tunnel global incoming traffic is over threshold.

The number of all active Phase-2 Tunnels incoming Kbits per second is above the maximum threshold configured in Xian Network Manager 2012.

Causes

There is a high amount of octets being received by all active Phase-2 Tunnels.

Resolutions

Review the tunnels and sessions that are running into them in order to close the less priority sessions.

Additional

Monitors the traffic received on all active IPsec Phase-2 IKE Tunnels, detecting when the average traffic is above normal values.

Element properties:

Target

Jalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase2ElementContainer

Parent Monitor

System.Health.PerformanceState

Algorithm

WorstOf

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Low

Alert Auto Resolve

True

Remotable

True

Accessibility

Public

Alert Message

Tunnel Phase-2 global incoming traffic Alert

{0}

Source Code:

<AggregateMonitor ID="Jalasoft.Xian.SmartManagementPacks.CiscoASA.TunnelPhase2GlobalIncomingTraffic.1.1" Accessibility="Public" Enabled="true" Target="ThirdParty_Cisco!Jalasoft.Xian.Common.Types.ThirdParty.Cisco.JsXCiscoASATunnelsPhase2ElementContainer" ParentMonitorID="SystemHealth!System.Health.PerformanceState" Remotable="true" Priority="Normal">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="TunnelPhase2GlobalIncomingTraffic_AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Low</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Params/Param[3]$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <Algorithm>WorstOf</Algorithm>

</AggregateMonitor>