Re: EEM Senario

Sorry, another thought ...

Any chance you can use IPSLA? This would tell if a device is 'silent but
listening' and whether it is able to respond.

Can you link a second EEM script to IPSLA?

HTH,

Andrew

.
On Thu, Jan 14, 2010 at 10:35 PM, ALL From_NJ <all.from.nj_at_gmail.com> wrote:

> Good evening,
>
> Unfortunately I cannot help you much ... but perhaps this site will help /
> show you an example.
>
>
> http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6815/product_promotion0900aecd8055c188.html
>
> There are some links off of the eem page. They also list the netpro
> community, although I have not searched this for EEM. HTH,
>
> Andrew Lee Lissitz
>
>
>
>
> On Thu, Jan 14, 2010 at 9:58 PM, Bud DeWayne <bdewayne_at_telecomsys.com>wrote:
>
>> Hey group - Got a question:
>>
>>
>>
>> Here is the requirement. A silent device connected to a MAR (Mobile Access
>> Router) does not respond to icmp, snmp, any routing protocols, tcp, http,
>> nothing, nada. This device is 100% completely silent to providing any
>> sort of
>> response. The only thing that can be seen is if you apply an access list
>> based on the source address of this silent device and log it to see when
>> there
>> is activity.
>>
>>
>>
>> The MAR connects to a 3845 and here is the catch; there needs to be a way
>> to
>> A) detect which "silent device" is sending traffic and B) add a static
>> route
>> as soon as its detected to allow for return traffic to get back to the
>> "silent
>> device". For informational purposes consider that the MAR has a default
>> route
>> to the 3845 and the MAR does not support EEM. Part A can be done quite
>> easily,
>> for example:
>>
>>
>>
>> First, create the access-list:
>>
>>
>>
>> Access-list 30 permit 10.0.0.5 log
>>
>> access-list 30 permit any
>>
>>
>>
>> Second, apply the access-list:
>>
>>
>>
>> interface FastEthernet 0/0
>>
>> description Connection to MAR Router
>>
>> ip address 172.16.1.1 255.255.255.252
>>
>> ip access-group 30 in
>>
>>
>>
>> Third, create the EEM Applet:
>>
>>
>>
>> Event manager applet silent_dev_detector
>>
>> Event syslog pattern "10.0.0.5"
>>
>> Action 1.0 cli command "ip route 10.0.0.5 255.255.255.255
>> 172.16.1.2"
>>
>> Action 2.0 syslog msg "Silent Device 1 Online"
>>
>>
>>
>> As soon as the syslog comes up and says "Jan 14 21:31:26.012 EST:
>> %SEC-6-IPACCESSLOGNP: list 30 permitted 0 10.0.0.5 -> 192.168.0.1, 12
>> packets"
>> it will then immediately match the "10.0.0.5" pattern add the static route
>> allowing the return traffic hit 10.0.0.5.
>>
>>
>>
>> Now comes part B:
>>
>>
>>
>> Since the syslog will report a steady stream of this message once every 5
>> minutes it can be used as a constant that the device is still active, but
>> what
>> happens when the device is turned off? By the mere absence of the syslog
>> messages occurring will indicate that the silent device has been removed
>> from
>> the network. In turn, there needs to be a way for EEM to detect this and
>> to
>> remove the static route.
>>
>>
>>
>> How would you automate that process with EEM? CLI method is preferred,
>> but
>> tcl would be acceptable as well.
>>
>>
>> Blogs and organic groups at http://www.ccie.net
>>
>> _______________________________________________________________________
>> Subscription information may be found at:
>> http://www.groupstudy.com/list/CCIELab.html
>>
>>
>>
>>
>>
>>
>>
>>
>
>
> --
> Andrew Lee Lissitz
> all.from.nj_at_gmail.com
>

-- 
Andrew Lee Lissitz
all.from.nj_at_gmail.com
Blogs and organic groups at http://www.ccie.net