Solved: WAN Link monitoring with LMS?

aabdullah25 · ‎03-17-2008

Hi

We have LMS 2.5 with CM, DFM, IPM, RME. We have LAN and remote branches connected thru MPLS. Frequently WAN link goes down. We want to know when there is a link failure thru alerts. Is it possible to monitor WAN links using LMS? If yes, how to do that. I have seen before CiscoWorks Whatsup Gold will do this functinality.

Your valuable advice is most welcome. Thanks in advance.

Regards,

Abdullah

Joe Clarke · ‎03-22-2008

You can use EEM together with IP SLA and object tracking to either down the interface or send a syslog (or both) when you can no longer ping a host over the WAN link. For example, define an IP SLA collector to ping a host that should be reachable:

ip sla 1

icmp-echo 10.1.1.1

ip sla schedule 1 life forever start-time now

Then, track the reachability of that collector:

track 1 rtr 1 reachability

Then, use EEM to detect when the collector has changed state to down, and send a syslog message. You can also shutdown the interface here, but DFM will ignore that since an interface that is admin down is not considered to be in use and thus unmanageable.

event manager applet watch_wan

event track 1 state down

action 1.0 syslog msg "WAN interface has gone down" priority errors

Then you can define an RME syslog Automated Action under RME > Tools > Syslog > Automated Actions to watch for messages with the following attributes:

Facility : HA_EM

Severity : 3

Mnemonic : LOG

Text : *WAN has gone down*

The automated action can trigger an email which can alert your operators.

Alternatively, you can remove LMS from the equation, and have the router send an email directly when the IP SLA collector goes down. Just change the action 1.0 to:

action 1.0 mail server 1.1.1.1 to email@company.com from email@company.com subject "WAN has gone down" body " WAN interface is no longer passing traffic"

Where 1.1.1.1 is your company's SMTP server.

View solution in original post

Joe Clarke · ‎03-18-2008

First, LMS 2.5 is relatively old, and you should consider upgrading to LMS 2.6 which is freely downloadable from Cisco.com.

You can use DFM to monitor the status of interfaces. DFM relies on SNMP polling and ICMP to determine link status and IP reachability. If DFM detects that an interface has gone down, it will register an event in its Alerts and Activities Display. that event can also be wrapped into an email, trap, or syslog notification.

aabdullah25 · ‎03-19-2008

Hi

Thanks for the update. You are right that when the interface goes down, we can set the alert. But, in our setup we are using Ethernet connection which is coming from WiMax and this never goes down unless WiMax power adapter is switched off.

Since LMS is a management software, but our IT Manager wants to see on the screen when link goes down (like in Whatsup Gold). I tried to convince with this, but he says that Cisco told that this is possible and check for that. I tried with Mini-RMON under CiscoView, but this also monitors only interface.

Kindly suggest any workaround for my situation.

Thanks

Joe Clarke · ‎03-19-2008

What version of code is this edge device running? You may be able to cobble together a solution using IP SLA and object tracking.

aabdullah25 · ‎03-21-2008

Hi

I am extremely sorry for delay in reply. The IOS running at the edge router is Adv Enterprise 12.4(15)T3.

This SLA and object tracking is used for tracking failed ethernet links and/or to enable backup links. How we can link this with LMS?

Regards

Joe Clarke · ‎03-22-2008

You can use EEM together with IP SLA and object tracking to either down the interface or send a syslog (or both) when you can no longer ping a host over the WAN link. For example, define an IP SLA collector to ping a host that should be reachable:

ip sla 1

icmp-echo 10.1.1.1

ip sla schedule 1 life forever start-time now

Then, track the reachability of that collector:

track 1 rtr 1 reachability

Then, use EEM to detect when the collector has changed state to down, and send a syslog message. You can also shutdown the interface here, but DFM will ignore that since an interface that is admin down is not considered to be in use and thus unmanageable.

event manager applet watch_wan

event track 1 state down

action 1.0 syslog msg "WAN interface has gone down" priority errors

Then you can define an RME syslog Automated Action under RME > Tools > Syslog > Automated Actions to watch for messages with the following attributes:

Facility : HA_EM

Severity : 3

Mnemonic : LOG

Text : *WAN has gone down*

The automated action can trigger an email which can alert your operators.

Alternatively, you can remove LMS from the equation, and have the router send an email directly when the IP SLA collector goes down. Just change the action 1.0 to:

action 1.0 mail server 1.1.1.1 to email@company.com from email@company.com subject "WAN has gone down" body " WAN interface is no longer passing traffic"

Where 1.1.1.1 is your company's SMTP server.

aabdullah25 · ‎03-22-2008

Hi Clarke,

Thnaks for your support. I tried IP SLA and direct e-mail from router without LMS. I shutdown the WAN interface and found it was excellently working, got the mail from mail server. I will rate this post.

Thanks

Abdullah

Muhammad Zeeshan Sanaullah · ‎04-24-2010

Hi Joe,

I want a little help in modifying the applet. The applet should check the track status after every 15 minutes and generate the syslog message.

So if the link is continously down, after every 15 minutes a syslog message should be generated.

Thanks

Zeeshan

vadalisri · ‎03-22-2008

I think LMS 3.0 is latest version

regards

Kaushik