ASA - Adaptive Security Appliance

Overview

Cisco ASA provides firewalling, segmentation, VPN, and security-edge services in the WxCDI network path.

Monitoring

Method

Prometheus SNMP Exporter through network-prometheus.

Metrics Collected

• HA and failover state
• Interface state, utilization, errors, and drops
• CPU, memory, connections, and VPN/tunnel health
• SNMP target and scrape health

Grafana Dashboards

• WxCDI ASA Dashboard

Logging

Log Source

ASA devices forward firewall syslog and SNMP traps through the regional ingress services.

Splunk Index

firewall_syslog for syslog and snmp_traps for traps.

Key Log Queries

index=firewall_syslog device_type="asa" device_name="<device_name>"

Alerting

Grafana Alert Rules

Alert Name	Severity	Description
ASA device health	Varies	Metric-based device and interface conditions.
Scrape down	Critical	Detects loss of the ASA SNMP target.

Splunk Alerts

Alert Name	Severity	Description
ASA firewall events	Varies	Security and device events from firewall_syslog.

Notification Flow

ASA → Grafana/Splunk → EMS (KeepHQ) → [notification channels]

Inventory

• Repository: asa-inventory
• Update Method: Generated from the managed Ansible inventory.
• Update Cadence: On inventory change through pull request.