Cannot discover VIP - 'Existing model ...found' error

Products

• DX NetOps
• CA Performance Management - Usage and Administration

Issue/Introduction

We have 2 Checkpoint Firewall devices added to Spectrum 

Lets say FW1 with IP: 192.0.2.2 and FW2 with IP: 192.0.2.3.
The 2 Firewalls are configured as HA (Active-Passive).
Currently the Active one is FW2.

I need to monitor Checkpoint IDC status using a watcher.
The watcher need to be configured on the VIP as the attributes return values only on the active FW device which is FW2 for now.

The problem is when I'm trying to add the VIP (which have IP: 192.0.2.73) to Spectrum we receive error: "error discovering the device 192.0.2.73, existing model FW2 of type CheckpointFirewall  was found at 192.0.2.73 etc...."

Environment

Release : 22.2

Cause

Out Of the Box Spectrum does not monitor those parameters by polling (via SNMP get-request) the VIP.

Resolution

You can either
1. create a custom Watch to monitor the proprietary Checkpoint OIDs ( That would need to be done on the 2 SNMP capable devices as in the example on the community page. See Additional Information )

OR

2. configure the Checkpoint device to send traps when the thresholds are crossed for those parameters.

2.1. The Pingable is the way to monitor the VIP status and have a model to correlate with traps if such arrive.

2.2 Spectrum can process traps on a Pingable model. Spectrum reads the agent address or source IP address from the trap and looks for the model in the Spectrum database that has that IP address assigned. If one is found, Spectrum will process the trap on that model.

For an snmp managed device, Spectrum reads the IP address in the ipAddressTable and ipAddrTable MIBs and populated the deviceIpAddressList attribute ID 0x12a53 with these values. Spectrum queries these MIBs once an hour to keep the deviceIpAddressList up to date.

I believe that In this instance, the VIP address is not in the ipAddressTable and ipAddrTable MIBs of the device so the deviceIpAddressList attribute id 0x12a53 will not be populated with this IP address.

2.3 ref:
How to configure the cluster to send SNMP Trap upon failover

 

Additional Information

This KB should help with the cluster monitoring configuration:

How to managed a shared virtual ip between two devices in Spectrum

This topic should help as well with a watch config:

Watch on a value that changes