Alarms for the Cisco ISA 3000

This chapter gives an overview of the alarm system in the ISA 3000, and also describes how to configure and monitor alarms.

About Alarms

You can configure the ISA 3000 to issue alarms for a variety of conditions. If any conditions do not match the configured settings, the system triggers an alarm, which is reported by way of LEDs, syslog messages, SNMP traps, and through external devices connected to the alarm output interface. By default, triggered alarms issue syslog messages only.

You can configure the alarm system to monitor the following:

  • Power supply.

  • Primary and secondary temperature sensors.

  • Alarm input interfaces.

The ISA 3000 has internal sensors plus two alarm input interfaces and one alarm output interface. You can connect external sensors, such as door sensors, to the alarm inputs. You can connect external alarm devices, such as buzzers or lights, to the alarm output interface.

The alarm output interface is a relay mechanism. Depending on the alarm conditions, the relay is either energized or de-energized. When it is energized, any device connected to the interface is activated. A de-energized relay results in the inactive state of any connected devices. The relay remains in an energized state as long as alarms are triggered.

For information about connecting external sensors and the alarm relay, see Cisco ISA 3000 Industrial Security Appliance Hardware Installation Guide.

Alarm Input Interfaces

You can connect the alarm input interfaces (or contacts) to external sensors, such as one that detects if a door is open.

Each alarm input interface has a corresponding LED. These LEDs convey the alarm status of each alarm input. You can configure the trigger and severity for each alarm input. In addition to the LED, you can configure the contact to trigger the output relay (to activate an external alarm), to send syslog messages, and to send SNMP traps.

The following table explains the statuses of the LEDs in response to alarm conditions for the alarm inputs. It also explains the behavior for the output relay, syslog messages, and SNMP traps, if you enable these responses to the alarm input.

Alarm Status

LED

Output Relay

Syslog

SNMP Trap

Alarm not configured

Off

—

—

—

No alarms triggered

Solid green

—

—

—

Alarm activated

Minor alarm—solid red

Major alarm—flashing red

Relay energized

Syslog generated

SNMP trap sent

Alarm end

Solid green

Relay de-energized

Syslog generated

—

Alarm Output Interface

You can connect an external alarm, such as a buzzer or light, to the alarm output interface.

The alarm output interface functions as a relay and also has a corresponding LED, which conveys the alarm status of an external sensor connected to the input interface, and internal sensors such as the dual power supply and temperature sensors. You configure which alarms should activate the output relay, if any.

The following table explains the statuses of the LEDs and output relay in response to alarm conditions. It also explains the behavior for syslog messages, and SNMP traps, if you enable these responses to the alarm.

Alarm Status

LED

Output Relay

Syslog

SNMP Trap

Alarm not configured

Off

—

—

—

No alarms triggered

Solid green

—

—

—

Alarm activated

Solid red

Relay energized

Syslog generated

SNMP trap sent

Alarm end

Solid green

Relay de-energized

Syslog generated

—

Defaults for Alarms

The following table specifies the defaults for alarm input interfaces (contacts), redundant power supply, and temperature.

Alarm

Trigger

Severity

SNMP Trap

Output Relay

Syslog Message

Alarm Contact 1

Enabled

Closed State

Minor

Disabled

Disabled

Enabled

Alarm Contact 2

Enabled

Closed State

Minor

Disabled

Disabled

Enabled

Redundant Power Supply (when enabled)

Enabled

—

—

Disabled

Disabled

Enabled

Temperature

Enabled for the primary temperature alarm (default values of 92°C and -40°C for the high and low thresholds respectively)

Disabled for the secondary alarm.

—

—

Enabled for primary temperature alarm

Enabled for primary temperature alarm

Enabled for primary temperature alarm

Configure Alarms

To configure alarms for the ISA 3000, perform the following steps.

Procedure

Step 1

Configure severity for one or all alarm contacts.

alarm contact {contact_number | all} severity {major | minor | none}

Example:

ciscoasa(config)# alarm contact 1 severity major

Enter a contact number (1 or 2) or enter all to configure all alarms. Enter major, minor or none as the severity. The default is minor.

Step 2

Configure triggers for one or all alarm contacts.

alarm contact {contact_number | all} trigger {closed | open}

Specifying open will trigger an alarm when a contact which is normally closed (normal electrical connectivity), is open, or when current stops flowing.

Specifying closed will trigger an alarm when the contact which is normally open (no electrical connectivity), is closed, or when current starts flowing.

For example, if a door sensor is connected to an alarm input, its normally open state has no electrical current flowing through the contacts. If the door is opened, electrical current flows through the contacts, activating the alarm.

Example:

ciscoasa(config)# alarm contact 1 trigger open

Enter a contact number (1 or 2) or enter all to configure all alarms. Enter open or closed to specify the trigger. The default is closed.

Step 3

Enable relay, system logger and SNMP traps for alarm contacts.

When the relay is enabled, and an alarm condition arises, the relay is energized and the device attached to the relay is activated. When the relay is energized, the alarm out LED glows solid red.

  • Enable relay for the input alarm.

alarm facility input-alarm contact_number relay

Example:

ciscoasa(config)# alarm facility input-alarm 1 relay

Enter a contact number (1 or 2). By default, relay for alarm inputs is disabled.

  • Enable system logger.

alarm facility input-alarm contact_number syslog

Example:

ciscoasa(config)# alarm facility input-alarm 1 syslog

Enter a contact number (1 or 2).

  • Enable SNMP traps.

alarm facility input-alarm contact_number notifies

Example:

ciscoasa(config)# alarm facility input-alarm 1 notifies

Enter a contact number (1 or 2).

Step 4

(Optional) Specify a description for input alarm contacts.

alarm contact contact_number | description string

Example:

ciscoasa(config)# alarm contact 1 description Door_Open

The contact_number specifies the alarm contact for which the description is configured. The description may be up to 80 alphanumeric characters long and will be included in syslog messages.

To set the default description to the corresponding contact number use the no alarm contact contact_number description command.

Step 5

Configure power supply alarms.

Note 

Redundant power supply has to be enabled for the power supply alarms to work.

See the following commands for configuring power supply alarms:

  • power-supply dual

    This command enables dual power supply.

  • alarm facility power-supply rps disable

    This command disables the power supply alarm. In its default state, this alarm is disabled. If the alarm is enabled, use this command to disable it.

  • alarm facility power-supply rps notifies

    This command sends power supply alarm traps to an SNMP server.

  • alarm facility power-supply rps relay

    This command associates the power supply alarm to the relay.

  • alarm facility power-supply rps syslog

    This command sends power supply alarm traps to a syslog server.

Step 6

Configure temperature thresholds.

alarm facility temperature {primary | secondary}{high | low} threshold

Example:


ciscoasa(config)# alarm facility temperature primary high 90
ciscoasa(config)# alarm facility temperature primary low 40
ciscoasa(config)# alarm facility temperature secondary high 85
ciscoasa(config)# alarm facility temperature primary low 35

For the primary temperature alarm, valid threshold values range from –40°C to 92°C. For the secondary temperature alarm, valid threshold values range from –35°C to 85°C. If a temperature threshold is configured for the secondary alarm, only the secondary alarm will be enabled.

Use the no form of each command to disable or revert to default values. Using the no form of the commands for the primary alarm will not disable the alarm and will revert to the default values of 92°C for the high threshold, and –40°C for the low threshold. Using the no form of the command for the secondary alarm will disable it.

Step 7

Enable SNMP traps, relay and system logger for temperature alarms.

See the following commands for enabling relay, SNMP traps, and syslogs for temperature alarms:

  • alarm facility temperature {primary | secondary} notifies

    This command sends primary or secondary temperature alarm traps to an SNMP server.

  • alarm facility temperature {primary | secondary} relay

    This command associates the primary or secondary temperature alarm to the relay.

  • alarm facility temperature {primary | secondary} syslog

    This command sends primary or secondary temperature alarm traps to a syslog server.

Use the no form of each command to disable relay, SNMP traps and syslogs.

Monitoring Alarms

See the following commands to monitor alarms:

Procedure

  • show alarm settings

    This command displays all global alarm settings.

    ciscoasa> show alarm settings
Power Supply
         Alarm                   Disabled
         Relay                   Disabled
         Notifies                Disabled
         Syslog                  Disabled
Temperature-Primary
         Alarm                   Enabled
         Thresholds           MAX: 92C                MIN: -40C
         Relay                   Enabled
         Notifies                Enabled
         Syslog                  Enabled
Temperature-Secondary
         Alarm                   Disabled
         Threshold  
         Relay                   Disabled
         Notifies                Disabled
         Syslog                  Disabled
Input-Alarm 1
         Alarm                   Enabled
         Relay                   Disabled
         Notifies                Disabled
         Syslog                  Enabled
Input-Alarm 2
         Alarm                   Enabled
         Relay                   Disabled
         Notifies                Disabled
         Syslog                  Enabled

  • show environment alarm-contact

    This command displays all external alarm settings.

    ciscoasa> show environment alarm-contact
ALARM CONTACT 1
   Status:      	not asserted
   Description: 	external alarm contact 1
   Severity:    	minor
   Trigger:     	closed
ALARM CONTACT 2
   Status:      	not asserted
   Description: 	external alarm contact 2
   Severity:    	minor
   Trigger:     	closed

  • show facility-alarm status [info | major | minor]

    This command displays all alarms based on severity specified.

    The output displays the following information:

    Column

    Description

    Source

    Device from which the alarm was triggered. This is usually the hostname configured on the device.

    Severity

    Major or minor

    Description

    Type of alarm triggered. For example, temperature, external contact, redundant power supply etc.

    Relay

    Energized or de-energized

    Time

    Timestamp of the triggered alarm

    		 
    ciscoasa> show facility-alarm status info
Source      Severity    Description                                     Relay                 Time
ciscoasa   minor        external alarm contact 1 triggered  Energized          06:56:50 UTC Mon Sep 22 2014 
ciscoasa   minor        Temp below Secondary Threshold De-energized            06:56:49 UTC Mon Sep 22 2014 
ciscoasa   major       Redundant pwr missing or failed    De-energized        07:00:19 UTC Mon Sep 22 2014 
ciscoasa   major        Redundant pwr missing or failed    De-energized        07:00:19 UTC Mon Sep 22 2014
    ciscoasa> show facility-alarm status major
Source      Severity    Description                                     Relay                 Time
ciscoasa    major       Redundant pwr missing or failed    De-energized     07:00:19 UTC Mon Sep 22 2014 
ciscoasa   major        Redundant pwr missing or failed    De-energized     07:00:19 UTC Mon Sep 22 2014
    ciscoasa> show facility-alarm status minor
Source      Severity    Description                                     Relay                 Time
ciscoasa   minor        external alarm contact 1 triggered  Energized          06:56:50 UTC Mon Sep 22 2014 
ciscoasa   minor        Temp below Secondary Threshold De-energized     06:56:49 UTC Mon Sep 22 2014

  • show facility-alarm relay

    This command displays all relays in energized state.

    ciscoasa> show facility-alarm relay
Source      Severity    Description                                     Relay                 Time
ciscoasa   minor        external alarm contact 1 triggered  Energized          06:56:50 UTC Mon Sep 22 2014

History for Alarms

Feature Name

Platform Releases

Description

Alarm ports support for the ISA 3000

9.7(1)

The ISA 3000 now supports two alarm input pins and one alarm out pin, with LEDs to convey alarms’ statuses. External sensors can be connected to the alarm inputs. An external hardware relay can be connected to the alarm out pin. You can configure descriptions of external alarms. You can also specify the severity and trigger, for external and internal alarms. All alarms can be configured for relay, monitoring and logging.

We introduced the following commands: alarm contact description, alarm contact severity, alarm contact trigger, alarm facility input-alarm, alarm facility power-supply rps, alarm facility temperature, alarm facility temperature high, alarm facility temperature low, clear configure alarm, clear facility-alarm output, show alarm settings, show environment alarm-contact.

We introduced the following screens:

Configuration > Device Management > Alarm Port > Alarm Contact

Configuration > Device Management > Alarm Port > Redundant Power Supply

Configuration > Device Management > Alarm Port > Temperature

Monitoring > Properties > Alarm > Alarm Settings

Monitoring > Properties > Alarm > Alarm Contact

Monitoring > Properties > Alarm > Facility Alarm Status