PaloAlto Monitor IPSEC S2S tunnels

Feature Requests
1

Hi Guys,

I was wondering to know whether in librenms we can have the option of checking what IPsec tunnels are up/down the same way as we have for BGP sessions?

2

How can I add the page in the Overview TAB for IPSEC Tunnels

3

Need some research because PAN OS has limited SNMP support. I’m interested too by the question.

4

This is old but interesting:

The Palo Alto Networks firewall currently doesn’t have SNMP OIDs to monitor IPSec tunnel status, so network management systems cannot rely on SNMP protocol to receive notifications when the IPSec tunnel on the Palo Alto Networks firewall changes it’s status.

5

By The way, it’s not only this, BGP also isn’t showing in the bgp session tab

6

Do they provide their own BGP MIB?

7

Yep, I found their MIB Tables on their site

8

Let me check Monday but didn’t find in my Friday search.

9

Specifically for BGP data?

10

Please advise if we can monitor bgp sessisons and IPSEC tunnel
For ipsec tunnels it would be nice to have seperate tab as we have for bgp sessions

11

Is the mib specifically for BGP?

12

Actually I didn’t try to set it, I just saw the MIB on Palo-Alto side, was wondering to know if anyone set it

13

I checked this morning the BGP is only available with SNMP traps. So at this time it’s not possible to use it with LibreNMS.

IPSEC is available in the MIB under panGlobalCountersTunnelInspect, not sure but should appears like other interface?

14

Is there possibility to add tunnel tab as we have BGP tab on the upper pannel

15

Hey guys, any changes to have bgp monitored in palo or still no MID for that? :frowning:

16

Hi Guys,

I’ve asked Palo Engineering to have this request, still waiting on the ETA
In the meantime PAN-TRAPS MIB has a number of BGP peer traps that can be sent to LibreNMS and you can use these to build alert rules on LibreNMS. The traps are:

  • panROUTINGRoutedBGPPeerEnterEstablishedTrap
  • panROUTINGRoutedBGPPeerLeftEstablishedTrap
  • panROUTINGRoutedBGPPeerFailedTrap
  • panROUTINGRoutedBGPPeerRestartedTrap
  • panROUTINGRoutedBGPPeerRestartFailedTrap

To generate these traps from the firewall, you have to setup the Device/Log Settings/System Logs to filter for the BGP logs and specify the SNMP Trap Receiver (LibreNMS). To filter the logs, specify Type=Routing and Event equal to one of the types below. You can check your system logs for BGP events to validate these are correct.

Event Types:

  • routed-BGP-peer-enter-established
  • routed-BGP-peer-left-established
  • routed-BGP-peer-mp-extension-negotiate
  • routed-BGP-peer-failed
  • routed-BGP-peer-restarted
  • routed-BGP-peer-restart-failed
3 Likes
17

Hello all, any movement on this? Or is the ability to get VPN counts not possible via SNMP?