How to use cacti with checkpoint-fw1 snmpd ?

[Kenny]

Hi everyone,

Just out of curiosity I've tried to get cacti to poll a Checkpoint FW1-host, which runs both snmp-daemons (the net-snmp and checkpoint's own snmp, running at udp-port 260).
Cacti will poll the net-snmp of the FW just fine, but it can't poll the checkpoint-snmpd of the FW. Somehow it won't use port 260. I have looked at and tried every solution that has been posted for these issues, but i cannot get past this port-issue. Even the snmp.php wasn't safe for these experiments as this has

Code: Select all

function cacti_snmp_get($hostname, $community, $oid, $version, $username, $password, $port = 161, $timeout = 500, $environ = SNMP_POLLER) {
        global $config;

built into the script. I've changed the $port = 161 into $port, but that didn't do it either.

Has anyone ever succeeded in using cacti to poll both snmpd's on one host?

Thanx in advance,

Kenny

[Kenny]

Well, I've created a script that will get the data for me:

(This is the OID for the current number of connection a Check Point has in its state-table)

Code: Select all

snmpget -v 1 -c public $1:260 .1.3.6.1.4.1.2620.1.1.25.3.0 | awk '{print $4}'

where $1 is the variable for the hostname that is needed for the snmpget.

I've created a data-input method, a graph template and a data template, added the method to the monitored host, but still I get an empty graph.

In the cacti.log is see

Code: Select all

12/02/2004 02:03:04 PM - CMDPHP: Poller[0] Host[11] CMD: /data/www/cacti-0.8.6b/scripts/fw-connections.ksh hostname, output: U

and a snoop (cacti runs on a Solaris-box) on the interface reveals this only "normal" snmp traffic (on port 161) and not the scripted snmpget to port 260.

Does anyone have a suggestion to get this right?

[Guest]

Finally we decided to make a quick hack to get around this port-issue. We made a perl-script to collect the OID-data and put that into the rra.

Code: Select all

#!/usr/bin/perl

my $host = $ARGV[0];

chomp $host;

$output = `/usr/local/bin/snmpget -v 1 -c public $host:260 .1.3.6.1.4.1.2620.1.1.25.3.0 | awk '\{print \$4\}'`;
chomp($output);
print $output;

Now we see the graph getting nice colors...

If anyone has a solution to get cacti to poll a checkpoint-node on udp-port 260 (with all the bells and whistles - e.g. indexed queries and graphs with nice colors), please make it public. I know that there is a demand for such queries by those who don't know how to code (like me )

Kenny

[jcaesar]

If anyone has a solution to get cacti to poll a checkpoint-node on udp-port 260 (with all the bells and whistles - e.g. indexed queries and graphs with nice colors), please make it public. I know that there is a demand for such queries by those who don't know how to code (like me )

Kenny

I'm pretty sure this will be fixed in 0.8.7 when you can turn off Host Down Detection on a per-host basis. Because the Check Point SNMP daemon doesn't return anything for the SysDescr.0 OID, cacti considers the host to be down and won't attempt to poll the device.

[yardus9]

My solution was just to create a new host with the same IP but using the alternative SNMP port #.
I am just adding this to this thread for people that are trying to poll on port 260, but dont care that the graphs are not on the same hosts.

[Kenny]

I've tried that also, cloned the host and changed the snmp-port to 260. That didn't work in my situation, though...
Cacti just didn't use the new port, only 161. This is probably because of what jcaesar said about checkpoint's snmpd.

[Kenny]

Besides all this, it's just plain annoying that checkpoint's snmpd doesn't return all tha data that's available in the MIB.
Not that a non-fw module must return the (for example) floodgate-stats even if that's not installed, but still...

For instance: if I want to get the number of users that are logged on to a policy server of a VPN-1, I get no results (well, a "0") even though I know that more than 60 users are logged in.
This happens on the host itself, and from the command-line of the polling station. Of course Checkpoint's own Smartview Status (R55) can get these numbers just fine, but it's not useful to look at this screen all day for a analysis of the usage of a policy server...

But this is getting slightly off-topic, i think

[Gedu]

Well, fortunately Checkpoint Secureplatform NG AI R55 answers to checkpoint specific queries from standard snmp port

But I'm having trouble graphing accepted/rejected/dropped packets, as the counter resets to -2^31 When the counter is positive I can get graphs out of it. Infact this seems more like RRDtool problem, as the correct counter value can be seen in rrdtool dump, but it just can't calculate correctly.

And I have tried to get this work on interface level, but cacti just doesn't seem to understand the indexing In fact I think it just doesn't like the .0 that all the answers have in the end of OID. I have tried to get index using regexp, but it only indexes only the interfaces, but not the interface counters!

Has anybody succesfully got FW1 Secureplatform to graph even global counters of accepted/rejected/dropped packets?

[Kenny]

I have seen the same with FP2 on Solaris (and the version is irrelevant, i presume). If I push the rulebase to the firewall, i get a huge spike in the cacti-graph. The values rise from 20m to 8.0M for just a short peak (2 or 3 pollig-cycles).

Secureplatform is "just" Linux with FW-1 onto it, with some Checkpoint-added value. So if they decided to incorporate the Checkpoint-MIB into the normal snmp, of course it will reply with the correct answers...

BTW, it's not possible AFAIK to get the polling to use another port with the new 0.8.6.c, but hey, I am still a impatient nOOb.

A friend told me one time that patience is a virtue, so i can wait...

Kenny

[mgraves]

Has anybody succesfully got FW1 Secureplatform to graph even global counters of accepted/rejected/dropped packets?

I have been hacking at this for a few days now and I have something that can read some MIB's from a Checkpoint Secureplatform NG. I don't think that the interface specific counters are working correctly. They may be guage instead of counter registers but I don't have any documentation that tells me one way or another.

Comments / Suggestions?

[pbulteel]

If people are still having problems doing this - you can run both snmp daemons and poll them through the net-snmp daemon by adding the following to your config file

proxy -v 1 -c <b>your_community</b> localhost:<b>Your_port</b> <b>Your OID</b>

For example - to poll squid I used.

proxy -v 1 -c public localhost:3401 .1.3.6.1.4.1.3495.1

I don't remember where I found this, but it was probably on here somewhere....

This might be a good thing to put in an FAQ or something (how to poll other snmpd running on my host)

-P

[grodno5]

which config file are you talking about?
i downloaded cacti_cp.zip. It looks like it is getting data on port 260(NG-FW), but not getting any .rrd and not getting graphed anything. At the same time Interface statistics which is port 161 doesn't work.
is there any way that i can use both ports at the same time?

[pbulteel]

This is in the snmpd.conf file of your net-snmp install.

In this case something like

proxy -v 1 -c your_community localhost:260 .1.3.6.1.4.1.2620.1.1.25.3.0 (or whatever the node is you want)

I can dont have a box with FW-1 or NG-FW to test this - so maybe it doesn't work. It's just an example that works when talking to Squid and I'm testing with other snmpds on the same machine.

-P

[hypatia]

I've installed the above templates, but am getting only a solid line at zero on my graphs. All data is zero. However, The data is being read correctly from the firewall. Here's a line from my cacti.log:

Code: Select all

 04/22/2005 12:25:23 PM - CMDPHP: Poller[0] Host[41] SNMP: v2: 10.1.1.1, dsname: fwPktAcceptedIn, oid: .1.3.6.1.4.1.2620.1.1.25.5.1.5.1.0, output: 7666404

Whe I do a rrdtool dump on the data base I get this:

Code: Select all

<!-- 2005-04-22 12:25:00 EDT / 1114187100 --> <row><v> 0.000000000
0e+00 </v><v> 0.0000000000e+00 </v><v> 0.0000000000e+00 </v><v> 0.0000000000e+00 </v><v> 0
.0000000000e+00 </v><v> 0.0000000000e+00 </v><v> 0.0000000000e+00 </v><v> 0.0000000000e+00
 </v></row>

It's all zeros. Where is my data getting lost? Does anyone have an idea?

Thanks,
Hypatia

[simonmag]

I have tries to import the XML file into CACTI and am getting 'XML ERROR cacti version does not exist'

Any ideas?