VPN Tunnel monitoring

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

Anyone done anything to monitor bandwidth used by individual VPN tunnels on either a router or firewall? We have SEVERAL customers that connect to us via VPN tunnels and we'd like to be able to see the traffic each generates. None of the templates I've seen thus far will do this - since I want more than just the number of sessions, but instead a graph like an ordinary interface for "bits/sec Total Bandwidth".

I'm pretty sure CiscoWorks can do this (at least for the concentrators) but I'm not sure what it uses and our installation of CiscoWorks is java-junk...

vanc · Joined: 02 Mar 2006 Posts: 30 Location: Boston MA USA

I don't know that you will be able to get that via snmp interface statistics. You can try doing a snmpwalk and check if your tunnel defs are shown individually.

We graph our ipsec with all tunnels on the single interface, but our VPN GW is a linux box.

If I was to start graphing the individual traffic with our device I would look into writing a script to read the values from iptables, which I believe that I have seen some templates for in past topics.

Hope that helps a little bit.

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

I appreciate the response.

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

What do you think of these?

adp · Joined: 25 Apr 2006 Posts: 2

On all routers we use for this, the tunnels are created just like an interface. Adding the router to cacti, just shows the Tunnel interfaces just like any other interface. Do you have a different config?

cheers,
arthur

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

These are Cisco 2600 routers. Templates available for the concentrators are also kind of lame - only providing number of associations and the like. That's generally okay though, since most of their connections aren't LAN-to-LAN. The connections on the routers, however, are a different story.

The tunnels on the routers are defined as isakmp policies/SAs - as best I can figure. I can find those in the MIBs...I think - just not their more detailed info. On these routers, the closest I've found to a "sh int" command for the tunnels would have to be:

adp · Joined: 25 Apr 2006 Posts: 2

Are you doing dynamic user-based tunnels? Or site-to-site tunnels? As these are (can) normally configured like

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

dbrummer · Joined: 19 Apr 2006 Posts: 29 Location: Las Vegas, NV

I use a Cisco VPN 3000 concentrator for lan-to-lan sessions. I wrote a perl script that you may be interested in. The script takes inputs of community, host, session ip and rx or tx. Based on the session ip you provide the script, it will search for the corresponding lan-to-lan session and grab the OID index and return either rx or tx ocets received/transfered. Let me know if you're interested in it.

-Dan

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

VERY!!! If you don't want to post the to the community, feel free to send private message!

I've even played in perl before, so maybe I or one of my cohorts can look at what you've done in regards to these routers/firewalls.

Did I mention we also have firewalls managing LAN-to-LAN VPNs? Can't find a "tunnel interface OID" for them either...

dbrummer · Joined: 19 Apr 2006 Posts: 29 Location: Las Vegas, NV

See attached. I appologize for how dirty and ugly the script is, but it works.

Note: I had to make the script like this because the OID index for lan2lan sessions change whenever a session is disconnected/reconnected.

UPDATE: Added Graph Template

-Dan

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

Cool.

Can you describe the parameters a little more? Perhaps provide an example CLI statement?

What is the "sessionip" in 3000 concentrator terminology?

Actually, while I'm still not sure what some of those parameters (sessionip, rx/tx) refer to exactly, it looks like the RX and TX data templates, under "Custom Data", should have the SessionIP and Flow checkboxes checked so that you define them when applying 'em to a device?

dbrummer · Joined: 19 Apr 2006 Posts: 29 Location: Las Vegas, NV

Yea the session IP is the Peer IP of the LAN2LAN session. I took out my data from the exported graph template so you are correct with the per-device settings.

If you have the web administration enabled for the VPN3000 you can see the peer ip for the lan2lan session under the monitoring->sessions.

-Dan

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

what about rx/tx parameters?

dbrummer · Joined: 19 Apr 2006 Posts: 29 Location: Las Vegas, NV

lan2lansessions.pl community host ip tx will return the TX bytes (alActiveSessionOctetsSent OID) from the device while lan2lansessions.pl community host ip rx will return the RX bytes (alActiveSessionOctetsRecvd OID).