Skip to content

Commit b9bd75d

Browse files
Pierre-L42buraizu
authored and
lucastemb
committed
[NDMII-3540] Collect metrics and options data for Cisco IPsec VPN tunnels (#38467)
Co-authored-by: Bryce Eadie <[email protected]>
1 parent 43bb154 commit b9bd75d

File tree

8 files changed

+288
-21
lines changed

8 files changed

+288
-21
lines changed

‎pkg/collector/corechecks/snmp/internal/checkconfig/buildprofile.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ func (c *CheckConfig) BuildProfile(sysObjectID string) (profiledefinition.Profil
7171
profile.Device.Vendor = rootProfile.Device.Vendor
7272
}
7373
profile.Metadata = updateMetadataDefinitionWithDefaults(profile.Metadata, c.CollectTopology, c.CollectVPN)
74+
profile.Metrics = updateMetricsDefinitionWithDefaults(profile.Metrics, c.CollectVPN)
7475

7576
return profile, profileErr
7677
}

‎pkg/collector/corechecks/snmp/internal/checkconfig/buildprofile_test.go‎

Lines changed: 37 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,14 @@ func TestBuildProfile(t *testing.T) {
9292
mergeMetadata(mergedMetadata, profile1.Metadata)
9393
mergedMetadata["ip_addresses"] = LegacyMetadataConfig["ip_addresses"]
9494

95+
vpnTunnelsMergedMetadata := make(profiledefinition.MetadataConfig)
96+
for k, v := range mergedMetadata {
97+
vpnTunnelsMergedMetadata[k] = v
98+
}
99+
mergeMetadata(vpnTunnelsMergedMetadata, VPNTunnelMetadataConfig)
100+
mergeMetadata(vpnTunnelsMergedMetadata, RouteMetadataConfig)
101+
mergeMetadata(vpnTunnelsMergedMetadata, TunnelMetadataConfig)
102+
95103
mockProfiles := profile.StaticProvider(profile.ProfileConfigMap{
96104
"profile1": profile.ProfileConfig{
97105
Definition: profile1,
@@ -123,7 +131,8 @@ func TestBuildProfile(t *testing.T) {
123131
},
124132
Metadata: LegacyMetadataConfig,
125133
},
126-
}, {
134+
},
135+
{
127136
name: "static",
128137
config: &CheckConfig{
129138
IPAddress: "1.2.3.4",
@@ -140,7 +149,8 @@ func TestBuildProfile(t *testing.T) {
140149
StaticTags: []string{"snmp_profile:profile1"},
141150
Metadata: mergedMetadata,
142151
},
143-
}, {
152+
},
153+
{
144154
name: "dynamic",
145155
config: &CheckConfig{
146156
IPAddress: "1.2.3.4",
@@ -158,7 +168,8 @@ func TestBuildProfile(t *testing.T) {
158168
StaticTags: []string{"snmp_profile:profile1"},
159169
Metadata: mergedMetadata,
160170
},
161-
}, {
171+
},
172+
{
162173
name: "static with requested metrics",
163174
config: &CheckConfig{
164175
IPAddress: "1.2.3.4",
@@ -185,15 +196,17 @@ func TestBuildProfile(t *testing.T) {
185196
Metadata: mergedMetadata,
186197
StaticTags: []string{"snmp_profile:profile1"},
187198
},
188-
}, {
199+
},
200+
{
189201
name: "static unknown",
190202
config: &CheckConfig{
191203
IPAddress: "1.2.3.4",
192204
ProfileProvider: mockProfiles,
193205
ProfileName: "f5",
194206
},
195207
expectedError: "unknown profile \"f5\"",
196-
}, {
208+
},
209+
{
197210
name: "dynamic unknown",
198211
config: &CheckConfig{
199212
IPAddress: "1.2.3.4",
@@ -204,6 +217,25 @@ func TestBuildProfile(t *testing.T) {
204217
expectedError: "failed to get profile for sysObjectID \"3.3.3.3\": no profiles found for sysObjectID \"3." +
205218
"3.3.3\"",
206219
},
220+
{
221+
name: "VPN tunnels metadata and metrics",
222+
config: &CheckConfig{
223+
IPAddress: "1.2.3.4",
224+
ProfileProvider: mockProfiles,
225+
ProfileName: "profile1",
226+
CollectVPN: true,
227+
},
228+
expected: profiledefinition.ProfileDefinition{
229+
Name: "profile1",
230+
Version: 12,
231+
Metrics: append(metrics, VPNTunnelMetrics...),
232+
MetricTags: []profiledefinition.MetricTagConfig{
233+
{Tag: "location", Symbol: profiledefinition.SymbolConfigCompat{OID: "1.3.6.1.2.1.1.6.0", Name: "sysLocation"}},
234+
},
235+
StaticTags: []string{"snmp_profile:profile1"},
236+
Metadata: vpnTunnelsMergedMetadata,
237+
},
238+
},
207239
} {
208240
t.Run(tc.name, func(t *testing.T) {
209241
profile, err := tc.config.BuildProfile(tc.sysObjectID)

‎pkg/collector/corechecks/snmp/internal/checkconfig/config_metadata.go‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -247,8 +247,8 @@ var TopologyMetadataConfig = profiledefinition.MetadataConfig{
247247
},
248248
}
249249

250-
// VPNMetadataConfig contains VPN tunnels metadata
251-
var VPNMetadataConfig = profiledefinition.MetadataConfig{
250+
// VPNTunnelMetadataConfig contains VPN tunnels metadata
251+
var VPNTunnelMetadataConfig = profiledefinition.MetadataConfig{
252252
"cisco_ipsec_tunnel": {
253253
Fields: map[string]profiledefinition.MetadataField{
254254
"local_outside_ip": {
@@ -263,6 +263,24 @@ var VPNMetadataConfig = profiledefinition.MetadataConfig{
263263
Name: "cipSecTunRemoteAddr",
264264
},
265265
},
266+
"status": {
267+
Symbol: profiledefinition.SymbolConfig{
268+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.51",
269+
Name: "cipSecTunStatus",
270+
},
271+
},
272+
"life_size": {
273+
Symbol: profiledefinition.SymbolConfig{
274+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.8",
275+
Name: "cipSecTunLifeSize",
276+
},
277+
},
278+
"life_time": {
279+
Symbol: profiledefinition.SymbolConfig{
280+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.9",
281+
Name: "cipSecTunLifeTime",
282+
},
283+
},
266284
},
267285
},
268286
}
@@ -337,7 +355,7 @@ func updateMetadataDefinitionWithDefaults(metadataConfig profiledefinition.Metad
337355
mergeMetadata(newConfig, TopologyMetadataConfig)
338356
}
339357
if collectVPN {
340-
mergeMetadata(newConfig, VPNMetadataConfig)
358+
mergeMetadata(newConfig, VPNTunnelMetadataConfig)
341359
mergeMetadata(newConfig, RouteMetadataConfig)
342360
mergeMetadata(newConfig, TunnelMetadataConfig)
343361
}

‎pkg/collector/corechecks/snmp/internal/checkconfig/config_metric.go‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,79 @@ func GetMappedValue(index string, mapping map[string]string) (string, error) {
7676
}
7777
return index, nil
7878
}
79+
80+
// VPNTunnelMetrics contains VPN tunnels metrics
81+
var VPNTunnelMetrics = []profiledefinition.MetricsConfig{
82+
{
83+
MIB: "CISCO-IPSEC-FLOW-MONITOR-MIB",
84+
Table: profiledefinition.SymbolConfig{
85+
OID: "1.3.6.1.4.1.9.9.171.1.3.2",
86+
Name: "cipSecTunnelTable",
87+
},
88+
Symbols: []profiledefinition.SymbolConfig{
89+
{
90+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.10",
91+
Name: "cipSecTunActiveTime",
92+
},
93+
{
94+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.27",
95+
Name: "cipSecTunHcInOctets",
96+
},
97+
{
98+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.40",
99+
Name: "cipSecTunHcOutOctets",
100+
},
101+
{
102+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.32",
103+
Name: "cipSecTunInPkts",
104+
},
105+
{
106+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.45",
107+
Name: "cipSecTunOutPkts",
108+
},
109+
{
110+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.36",
111+
Name: "cipSecTunInAuthFails",
112+
},
113+
{
114+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.48",
115+
Name: "cipSecTunOutAuthFails",
116+
},
117+
{
118+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.38",
119+
Name: "cipSecTunInDecryptFails",
120+
},
121+
{
122+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.50",
123+
Name: "cipSecTunOutEncryptFails",
124+
},
125+
},
126+
MetricTags: profiledefinition.MetricTagConfigList{
127+
{
128+
Tag: "tunnel_index",
129+
Index: 1,
130+
},
131+
{
132+
Tag: "local_outside_ip",
133+
Symbol: profiledefinition.SymbolConfigCompat{
134+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.4",
135+
Name: "cipSecTunLocalAddr",
136+
},
137+
},
138+
{
139+
Tag: "remote_outside_ip",
140+
Symbol: profiledefinition.SymbolConfigCompat{
141+
OID: "1.3.6.1.4.1.9.9.171.1.3.2.1.5",
142+
Name: "cipSecTunRemoteAddr",
143+
},
144+
},
145+
},
146+
},
147+
}
148+
149+
func updateMetricsDefinitionWithDefaults(metrics []profiledefinition.MetricsConfig, collectVPN bool) []profiledefinition.MetricsConfig {
150+
if collectVPN {
151+
metrics = append(metrics, VPNTunnelMetrics...)
152+
}
153+
return metrics
154+
}

‎pkg/collector/corechecks/snmp/internal/report/report_device_metadata.go‎

Lines changed: 38 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,15 @@ const topologyLinkSourceTypeLLDP = "lldp"
3535
const topologyLinkSourceTypeCDP = "cdp"
3636
const ciscoNetworkProtocolIPv4 = "1"
3737
const ciscoNetworkProtocolIPv6 = "20"
38+
3839
const inetAddressUnknown = "0"
3940
const inetAddressIPv4 = "1"
4041

42+
var ciscoIPsecStatusByValue = map[string]string{
43+
"1": "active",
44+
"2": "destroy",
45+
}
46+
4147
var supportedDeviceTypes = map[string]bool{
4248
"access_point": true,
4349
"firewall": true,
@@ -609,10 +615,15 @@ func buildVPNTunnelsMetadata(deviceID string, store *metadata.Store) []devicemet
609615
}
610616

611617
vpnTunnelIndexes := store.GetColumnIndexes("cisco_ipsec_tunnel.local_outside_ip")
612-
if len(vpnTunnelIndexes) == 0 {
613-
log.Debugf("Unable to build VPN tunnels metadata: no cisco_ipsec_tunnel.local_outside_ip found")
614-
return nil
618+
if len(vpnTunnelIndexes) > 0 {
619+
return buildCiscoIPsecVPNTunnelsMetadata(vpnTunnelIndexes, deviceID, store)
615620
}
621+
622+
log.Debugf("Unable to build VPN tunnels metadata: no indexes found")
623+
return nil
624+
}
625+
626+
func buildCiscoIPsecVPNTunnelsMetadata(vpnTunnelIndexes []string, deviceID string, store *metadata.Store) []devicemetadata.VPNTunnelMetadata {
616627
sort.Strings(vpnTunnelIndexes)
617628

618629
vpnTunnelStore := NewVPNTunnelStore()
@@ -628,11 +639,34 @@ func buildVPNTunnelsMetadata(deviceID string, store *metadata.Store) []devicemet
628639
localOutsideIP := net.IP(store.GetColumnAsByteArray("cisco_ipsec_tunnel.local_outside_ip", strIndex)).String()
629640
remoteOutsideIP := net.IP(store.GetColumnAsByteArray("cisco_ipsec_tunnel.remote_outside_ip", strIndex)).String()
630641

642+
statusValue := store.GetColumnAsString("cisco_ipsec_tunnel.status", strIndex)
643+
status, exists := ciscoIPsecStatusByValue[statusValue]
644+
if !exists {
645+
status = "unknown"
646+
}
647+
648+
lifeSize, err := strconv.ParseInt(store.GetColumnAsString("cisco_ipsec_tunnel.life_size", strIndex), 10, 32)
649+
if err != nil {
650+
lifeSize = 0
651+
}
652+
lifeTime, err := strconv.ParseInt(store.GetColumnAsString("cisco_ipsec_tunnel.life_time", strIndex), 10, 32)
653+
if err != nil {
654+
lifeTime = 0
655+
}
656+
631657
vpnTunnelStore.AddTunnel(devicemetadata.VPNTunnelMetadata{
632658
DeviceID: deviceID,
633659
LocalOutsideIP: localOutsideIP,
634660
RemoteOutsideIP: remoteOutsideIP,
635-
Protocol: "ipsec",
661+
Status: status,
662+
Protocol: devicemetadata.IPsec,
663+
RouteAddresses: []string{},
664+
Options: devicemetadata.VPNTunnelOptions{
665+
IPsecOptions: devicemetadata.IPsecOptions{
666+
LifeSize: int32(lifeSize),
667+
LifeTime: int32(lifeTime),
668+
},
669+
},
636670
})
637671
}
638672

0 commit comments

Comments
 (0)