Monitoring Cisco switches, routers, WLAN controllers and access points

Troubleshooting

Let’s say you’re seeing a lot of emergency or alert level messages in the severity distribution. In that case, you can navigate to Inventory > Devices to get a more granular view of the severity messages by device.

In the screenshot below, there are a lot of high severity events happening on the device, so you can start investigating to see if any recent configuration changes have been made.

Go to Audit > Configuration Change Transactions and enter your device hostname/IP in the Host filter (for example, 127.0.0.1). Here you can monitor and audit any configuration changes users have made. From a troubleshooting perspective, configuration changes can sometimes be the cause of a network issue, and this allows you to easily identify who did what and when. This is also important for security because any unauthorized or unexpected changes could indicate potential security breaches or compliance violations.

As you investigate this host, it might also make sense to take a look at any authentication events happening on it. Go to Security > Authentications to do this. In the screenshot below, you can see authentication events like top connection points and heavily trafficked ports, which can be a sign of a DDOS attack or malware propagation. You can also see all the authentication transactions and identify any authentications happening on the device you're investigating, as well as other devices.

You might also want to review Security Access Control Lists. Navigate to Security > Access Control Lists to see information like protocols by action, top blocked ports, and dropped or rate-limited packets. If you see a lot of traffic to a blocked port, for example tcp://22 as seen below, that could be an indication of a scanning or intrusion attempt. Alternatively, if that is expected traffic and that port is not supposed to be blocked, you can see that here and make adjustments.

You can also see a breakdown of activity by location. So if a lot of blocked or allowed activity is coming from an unexpected location, you can quickly identify that and see which devices that activity is coming from.

You can further investigate alerts at the switching level by navigating to Switching > Switching Dashboard.

Monitoring link connects can help you detect if any unauthorized devices are being plugged into the network, which can help prevent a security incident or breach. On the IT side, understanding when links are connected can help monitor the network load and ensure traffic is being evenly distributed across available links, which in turn prevents a network performance issue from occurring.

You can also monitor for stacking events. When a switch is joining or leaving a stack, that can be an indication of a hardware failure, configuration error, or physical connectivity issue, helping you minimize your downtime by detecting these problems early.

As you continue investigating these devices, it might also make sense to check them from a performance perspective. Here, you can see performance indicators like temperature and power which can help you ensure nothing is overheating or over consuming. If you don’t see any spikes in temperature or power consumption, you can rule that out as a possible cause of any network performance issue. Continuously monitoring these metrics also ensures longevity of the equipment.