Cisco ASA: UDP open ports Health Monitor

Jalasoft.Xian.SmartManagementPacks.CiscoASA.UDPOpenPorts.1.1 (AggregateMonitor)

This monitor catches Xian events that notifies when the UDP open ports has changed its state.

Knowledge Base article:

Summary

UDP open ports is over threshold.

The total number of open UDP ports is above the maximum threshold configured in Xian Network Manager 2012.

Causes

Among common causes, an operating system could have opened unnecessary ports as part of a default install. Opening only the necessary ports to avoid the system to be compromised is recommended.

Resolutions

Run a port scanning software confirming exactly what UDP ports this device accept connections and what application or process is using every port.

Additional

Monitors the number of UDP open ports on the device.

Element properties:

Target

Jalasoft.Xian.Common.Elements.ThirdParty.Cisco.JsXCiscoASASnmpDeviceElement

Parent Monitor

System.Health.PerformanceState

Algorithm

WorstOf

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Low

Alert Auto Resolve

True

Remotable

True

Accessibility

Public

Alert Message

UDP open ports Alert

{0}

Source Code:

<AggregateMonitor ID="Jalasoft.Xian.SmartManagementPacks.CiscoASA.UDPOpenPorts.1.1" Accessibility="Public" Enabled="true" Target="ThirdParty_Cisco!Jalasoft.Xian.Common.Elements.ThirdParty.Cisco.JsXCiscoASASnmpDeviceElement" ParentMonitorID="SystemHealth!System.Health.PerformanceState" Remotable="true" Priority="Normal">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="UDPOpenPorts_AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Low</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Params/Param[3]$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <Algorithm>WorstOf</Algorithm>

</AggregateMonitor>