Project

General

Profile

Feature #242

VPN collector for ASA 5540

Added by Vladimir Bravov over 9 years ago. Updated almost 9 years ago.

Status:
New
Priority:
Normal
Start date:
11/04/2009
Due date:
09/30/2010
% Done:

90%

Estimated time:
90.00 h
Spent time:
Duration: 331

Description

VPN -collector functionality.

The source data for VPN collector is the VNP syslog stream ,which is coming directly from Cisco VPN systems to the directory /home/nimi/vpn_syslog on nimisrv system via pipe (FIFO) .
The VPN collector code design to perform the following :
1 Close all open sessions ,which are older then 24 hours from current time in case if termination UDP message will be missing .
2 Select from pipe-stream open session messages (type %ASA-4-722051) and define : Start session time , User name , Group, User IP address , Given IP address. Then store in NIMI DB like as an active session.
3 Select from pipe-stream closed session messages ( type %ASA-4-113019) and define : End session time, User name , Receive bytes , Sent bytes, Duration ,Disconnection reason. Then updated active session in NIMI DB .
4 User can have a multiply sessions under one outside IP address , so it can create the situation ,when one IP from outside can handle a few onsite IPs .
It forces to use :user name, User IP, Given IP and duration to define user session and the end of this session, because the session ID doesn’t support for Cisco ASA 5540. (see Cisco TAC 613402939)

5 Check regarding the old active sessions every 24 hours.

VPN_collect.jpg (65 KB) VPN_collect.jpg Vladimir Bravov, 08/04/2010 10:45 AM

History

#1 Updated by Vladimir Bravov almost 9 years ago

The source data for VPN collector is the VNP syslog stream was changed to avoid development system-NIMISRV.
It was set via SNMPBRIDGE for production and development dispatchers (see the attachment pic.)
To deploy it in production in parallel with the old VPN collector we need to make the following:
- make auto-restart ;
- update nimi- make file to include components in tar file and make the autostart;
set monitoring for process on nimisrva and snmpbridge;
-perfom regression test and complex test via development sysyem.



Also available in: Atom PDF