1
Cisco ASA5520 VPN线路的监控和自动重启
source link: https://bajie.dev/posts/20240107-vpn_monitor/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Cisco ASA5520 VPN线路的监控和自动重启
2024-01-08
2 分钟阅读
Cisco ASA5520 VPN线路的监控和重启
公司从事第三方支付工作，跟很多银行都有合作关系，拉了很多专线直通银行，双方建立VPN，两端都是Cisco的设备，但是，这些线路有时候会莫名其妙的断掉，关键是程序不知道啊，老是重连，一直等到客服反映客户投诉，查一圈程序后才知道。这在生产环境上可是行不通的，找来了所谓Cisco高手，也搞不明白为什么老断，没办法，于是写了两个监控脚本，使用Ping检测VPN对端的状况，一旦Ping不通，就用脚本登陆防火墙，自动重启VPN。
在安装之前，先安装一个能从命令行发送邮件的软件Email来发送报警邮件，否则每台机器都起sendmail，没什么必要:
https://github.com/muquit/mailsend-go
#发送实例
mailsend-go -smtp smtp.126.com -port 25 \
auth \
-user [email protected] -pass xxx \
-from [email protected] -to "[email protected]" \
-sub "Test" \
body -msg 'hello world'
126邮箱这里的密码用的是授权码 授权密码，不是邮箱密码
说明一下场景：
- 210.210.210.3是对端Cisco vpn设备的公网IP
- 192.168.101.99是建立了VPN后，对端服务器的私网IP地址；
- 192.168.1.1是己方Cisco ASA5520的私网地址。
#!/bin/sh
while [ "1" -eq "1" ]
do
live=`ping -c4 "192.168.101.99"|wc -l`
if [ $live -eq 5 ] ; then
/usr/local/bin/mailsend-go -debug -to "[email protected]" -from [email protected] -ssl -port 465 -smtp smtp.qiye.aliyun.com \
auth -user "[email protected]" -pass "xxxxxxxx" \
-sub "vpn断了" body -msg "`date +%Y`年`date +%m`月`date +%d`日 vpn断了！！！" \
-cs "utf-8"
/usr/local/bin/revpn.sh
echo "`date +%Y`年`date +%m`月`date +%d`日 `date +%H`点`date +%M`分
线路不能到达王府井机房，重启VPN。"
sleep 60
fi;
sleep 60
done
以下是用expect自动登录Cisco路由器重启vpn的脚本 revpn.sh
#!/usr/bin/expect
set timeout 30
spawn ssh [email protected]
expect "password:"
send "xxxxxxxx\n"
expect "ASAtoTelecom>"
send "en\n"
expect "Password:"
send "xxxxxxxx\n"
expect "ASAtoTelecom#"
send "clear isakmp sa\n"
expect "ASAtoTelecom#"
send "clear ipsec sa peer 210.210.210.3\n"
expect "ASAtoTelecom#"
send "exit\n"
expect eof
exit 0
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK