This article applies to PRTG Network Monitor 19 or later
How to Use the SNMP Cisco ASA VPN Traffic Sensor with IKEv2
Error Code PE123: Workaround
When using the SNMP Cisco ASA VPN Traffic sensor, you may observe that establishing the VPN tunnel with IKEv1 works fine whereas IKEv2 throws the error message:
There is no active connection for this remote IP address. The reason might be an issue with Cisco's SNMP component. The data that PRTG receives from the device is incorrect. To resolve this issue, see https://kb.paessler.com/en/topic/59643. (code: PE123)
This seems to be a bug in Cisco’s SNMP component. The data that PRTG receives from the device via SNMP is simply incorrect. For example, when adding a new sensor, you will see that the Remote IP is actually your local IP address and the Sensor Name is the remote IP. This is also the reason why PRTG sees this as a "User to LAN" connection. On "LAN to LAN", the remote IP and the sensor name are identical. We have done some testing, but it is impossible for us to automatically detect this.
However, there is also some good news. We created a device template that you can use to "manually" add the sensor. Follow the steps below:
- Download the device template and unzip it to the \devicetemplates subfolder of your PRTG installation.
- Open the file with a text editor. You will find three places where we put [RemoteIP]. Replace [RemoteIP] (including the brackets) with the actual remote IP of the VPN connection you want to monitor.
- In the PRTG web interface, open the device settings and set the Sensor Management to Automatic sensor creation using specific device template(s).
- A list of device templates appears. You can only check CiscoASAVPNTunnel [RemoteIP].
- Now, just start the auto-discovery for this device and it will add a sensor for this connection.
If you want to add multiple sensors, you can
- either copy the <create> element and use one per sensor you want to add,
- or you can add the sensors one after the other, edit the template, and run the auto-discovery each time.
In both cases, you need to make sure that you change the id attribute in the <create> element because there can only be one sensor per device with a specific create-id.
Example: Editing the Device Template
See the following screenshot for an example of how to edit the template to create multiple (in this case, two) sensors. We highlighted the sections that you have to change in comparison to the "original" template. You have to insert the same remote IP into each <create> element twice. Also, you have to edit the ID.
Click to enlarge.
Add comment