Palo Alto Firewall Template V0.01

[mr007619]

So why not make my first post to the community a template?? Been a lurker around here for the past couple of months - so much great information and so many smart people it's amazing.

I found out about Cacti a few months ago and finally decided it was time to start playing with it even though I'm in an Enterprise environment and we have "Enterprise" monitoring tools that aren't open source and you obviously don't have the flexibility in doing what you want as you do here.

Anyway - this is my first run at Palo Alto Firewalls - it's only providing session table stats (% utilized, TCP, UDP, Total). Suggestions/feedback appreciated - if anyone would like more data included in the template I will maintain and update it as my contribution.

Thanks!

V02 added 04/19/2012 - Includes MP/DP CPU.
V03 combined session graphs and fixed V02 issues.

palo_alto.jpg (62.24 KiB) Viewed 29385 times

[ashi]

Hi. Thanks for the PAN template.

I've got a request (since you kindly offered ) - Is there a way to watch QoS stats through SNMP OIDs and graph them through your template?

Thanks again.

A

[jofficer]

Was just about to start working on my own template when I stumbled upon yours. I just installed and wanted to say thanks for sharing. I'll let you know if I have any problems, or can extend it in anyway.

Cheers,
joey

[mr007619]

Hi. Thanks for the PAN template.

I've got a request (since you kindly offered ) - Is there a way to watch QoS stats through SNMP OIDs and graph them through your template?

Thanks again.

A

Ashi,

PAN's MIB is pretty limited - I don't see any way to graph QoS stats via a query. You'd probably have to write a script to login and grab that data since it doesn't seem to be available via SNMP.

[preki]

Hi all.

You can also try my Palo Alto FW template for sessions and temperatures.

Regards,

Preki

[samu5ka]

Hi guys. I have tried to import these into Cacti but receive a XML hash error. Has anyone else experienced this?

[preki]

Hi guys. I have tried to import these into Cacti but receive a XML hash error. Has anyone else experienced this?

My Cacti is 0.8.7g, maybe you have differnet version ?

[samu5ka]

Ok. I am on 0.8.7e still so will upgrade and try again. Thanks.

[bitcore]

Attached are graph & data templates for the PA CPU's. We have a PA5020. I'm not sure if the OID's are different for each model. PANOS 4.1.1, Cacti 0.8.7

Note: The temperature graphs for the v0.01 template are way off, I suspect I have a different model than the OP's.

[preki]

Hi !

I have some modifications on my template, based on PA-4020 & 4060 models.

Have fun

[shoelessfarmer]

Here are a few other templates I created which may be of interest.

I created a few Cacti Templates which allow you to quickly and easily monitor Palo Alto Networks firewalls with SNMP. There are 5 different templates corresponding to the 5 different Firewall families, PA-200, PA-500, PA-20xx, PA-40xx, PA-50xx.

Using these with Cacti (http://www.cacti.net), these Host templates will monitor the following sets variables, create historical graphs of these variables (example Graphs will be added to a followup post):

Traffic the firewall is passing through each selected interface(s)
The number of Active Sessions (TCP, UDP and ICMP)
The number of Concurrent Sessions (aggregate of Active Sessions)
Session Utilization Percentage – Based on the PAN Firewall Model
Temperature of the Firewall
Uptime of the Firewall

If you know of other OIDs which you feel the broader community would like monitored, I would be happy to add them to the templates.



Hope these help,
Shoelessfarmer

[shoelessfarmer]

Here are a few of the sample graphs for my templates:

[mr007619]

V0.02 attached, added MP/DP CPU. I still prefer the graphs separate so I'm keeping my template as is =). MP/DP is combined.

[mr007619]

So I made a couple of mistakes with V0.02, fixed mistakes and I realized that separating the graphs isn't as cool as I thought. Combined TCP/UDP and concurrent sessions and MP/DP CPU issues fixed.

palo_alto.jpg (62.24 KiB) Viewed 29418 times

[hassan1]

I tried to import your template for Palo Alto PA-5000 in to my Cacti 0.8.7b unfortunately I received the following error message:“Import error xml hash version does not exist”

A search on the forum reviews that I have to upgrade to the latest version of Cacti.

My plan is to upgrade to the latest version of Cacti but in the short term, is they any chance you can please export your template for my version on Cacti?