Recently, a co-worker asked if it is possible to obtain the counters shown in the output from the command “show service-policy” on a Cisco ASA. I did not know the answer so I had to do a little bit of digging…
The list of MIBs supported by the Cisco ASA is documented here.
Based on a quick reading of that document, it seemed like CISCO-UNIFIED-FIREWALL-MIB could have provided this information, *if* it had been completely implemented. However, there is a documented caveat for CISCO-UNIFIED-FIREWALL-MIB at the above page:
“Limited support for objects under cuFwConnectionGrp and cuFwUrlFilterGrp.”
And an snmpwalk confirmed that the information is not there:
paris@bethlehem[1]:~$ snmpwalk -m CISCO-UNIFIED-FIREWALL-MIB -Os -v2c -c ****** 1.2.3.4 ciscoUnifiedFirewallMIB cufwConnGlobalNumResDeclined.0 = Counter64: 0 Connections cufwConnGlobalNumActive.0 = Gauge32: 168 Connections cufwConnGlobalConnSetupRate1.0 = Gauge32: 2 Connections per second cufwConnGlobalConnSetupRate5.0 = Gauge32: 0 Connections per second cufwConnSetupRate1.udp = Gauge32: 1 Connections Per Second cufwConnSetupRate1.tcp = Gauge32: 0 Connections Per Second cufwConnSetupRate5.udp = Gauge32: 0 Connections Per Second cufwConnSetupRate5.tcp = Gauge32: 0 Connections Per Second cufwUrlfRequestsNumProcessed.0 = Counter64: 0 Requests cufwUrlfRequestsProcRate1.0 = Gauge32: 0 Requests per second cufwUrlfRequestsProcRate5.0 = Gauge32: 0 Requests per second cufwUrlfRequestsNumAllowed.0 = Counter64: 0 Requests cufwUrlfRequestsNumDenied.0 = Counter64: 0 Requests cufwUrlfRequestsDeniedRate1.0 = Gauge32: 0 Requests per second cufwUrlfRequestsDeniedRate5.0 = Gauge32: 0 Requests Per Second cufwUrlfRequestsNumCacheAllowed.0 = Counter64: 0 Requests cufwUrlfRequestsNumCacheDenied.0 = Counter64: 0 Requests cufwUrlfRequestsNumResDropped.0 = Counter64: 0 Requests cufwUrlfRequestsResDropRate1.0 = Gauge32: 0 Requests Per Second cufwUrlfRequestsResDropRate5.0 = Gauge32: 0 Requests Per Second cufwUrlfNumServerTimeouts.0 = Counter64: 0 cufwUrlfNumServerRetries.0 = Counter64: 0 paris@bethlehem[1]:~$
That does not mean that another MIB cannot provide the information we are looking for. However, the “sh snmp-server oidlist” command doesn’t show any promising OIDs so it seems like we are out of luck.
Useful References
https://supportforums.cisco.com/document/7336/snmp-mibs-and-traps-asa-additional-information