Smarts IP: Receive Interface down notifications for IKE Tunnels on ASA used as VPN concentrator

Products

• VMware

Issue/Introduction

Symptoms:




Receive Interface down notifications in Smarts IP for IKE Tunnels on ASA used as VPN concentrator

Environment

VMware Smart Assurance - SMARTS

Cause

When Smarts discovers an ASA firewall, it discovers the IPSec connections that are currently active on the firewall as interfaces and starts to monitor them. When the ASA is being used as a VPN concentrator, the connection is dynamic. When a user disconnects from their VPN session, the IPSec tunnel is torn down. Smarts seeing this interface as being gone during polling and cuts a ticket for the interface being down.

Resolution

Smarts IP Manager is behaving as designed. However, the following sections present two options to prevent an interface down from being generated in this condition.

Unmanage the interface
You can do this in either of the following ways:

• Right-click and select "Unmanage"
• Create a custom ASL file to unmanage the interfaces.

Do not create the interface
You can prevent an interface from being created. See 10571  for more information on how to do this.