MuckNet

While troubleshooting a VOIP problem in one of my clients office environment, I decided I would install mrtg , allowing me to be up and running in 5 minutes, monitoring their network traffic.

Turns out it wasn’t that easy. Sure enough I got MRTG installed and reading data from the cisco ASA 5505 in short order. But shortly thereafter I noticed that the data just didn’t look right. All of the interfaces had almost identical data. The ifInOctets, and ifOutOctets were darn near the same across all three interfaces. Looking at the interface statistics from the CLI confirmed the strange numbers I was getting via SNMP were simply not valid.

Turns out there is a Bug (CSCsi15805) in the 7.2 OS which causes the SNMP iftable to return statistics for the total number of untagged vlan packets, instead of per vlan statistics.

The text of the bug is as follows:

Symptom:
ifTable byte and packet counters are incorrect.

Conditions:
SNMP query on 5505

Workaround:
Use “show interface” CLI command.

Further Problem Description:
SNMP doesn’t properly recognize the EtherSVI and a logical subinterface, so returns aggregate physical inteface stats.

The Fix? Upgrade to ASA OS 7.2.3 or Interim Release 7.2.2.22. This is the first time I’ve ever used the SOHO version of the PIX/ASA, and so far I’m not impressed. I’ve already run into at least two disappointing features/bugs. Given the choice I’d buy a used 515 or 515E.

2 hours later, I’m where I thought I would be an hour and 55 minutes ago.

Cheers! If you find this useful, please let me know!