Nokia IP Firewall Checkpoint Template

eos · Post by **eos** » Wed Oct 19, 2005 9:03 am

Hi,

I'm trying to use the nokia xml template to graph memory on some firewall (ipso 3.

.
My problem is to get the real memory usage.
I have openned the 260 port whith cpsnmp-start command.
I made some tests and compare it with vmstat, ps -aux , fw ctl pstat, voyager, clish and cacti (snmp).
None of these give me the same result (I tend to say snmp is right, but I have no way to prouve it). The difference between those results is really important.
We contact Nokia support, as privilegied custumers, with no result.

Does anyone have feedback about it ?
What is really graphed via snmp ?? (physical memory used , system memory, kernel memory ..... )

thanks in advance for answers

Post by **gandalf** » Wed Oct 19, 2005 9:15 am

lightningbit wrote:D:/Wwwroot/cacti/scripts/checkpointNG.pl fwsplat01.mycompany.com .1.3.6.1.4.1.2620.1.6.7.1.4.0,
output: U

But even those entries do not belong to my template! There is NO script in my template at all. And CPU data is gathered from following OIDs:
IDLE: .1.3.6.1.4.1.2620.1.6.7.2.3.0
SYSTEM: .1.3.6.1.4.1.2620.1.6.7.2.2.0
USAGE: .1.3.6.1.4.1.2620.1.6.7.2.4.0
USER: .1.3.6.1.4.1.2620.1.6.7.2.1.0
Please try to snmpwalk these OIDs from your firewall and post the results
Reinhard

Post by **gandalf** » Wed Oct 19, 2005 10:35 am

TO ALL!
I just discovered a problem concerning the templates I provided. Please make sure, that

Code: Select all

SYSTEM: .1.3.6.1.4.1.2620.1.6.7.2.2.0

ist set (see Data Template: Firewall - Proc System).
If you have to correct the OID, please make sure to "Clear Poller cache".
Reinhard

cmarsot · Post by **cmarsot** » Thu Oct 20, 2005 11:32 am

For host availability script .. take a look here http://forums.cacti.net/viewtopic.php?t ... ailability

I forget to specify this ... Sorry !

lightningbit · Post by **lightningbit** » Fri Oct 21, 2005 10:59 am

lvm wrote:
lightningbit wrote:D:/Wwwroot/cacti/scripts/checkpointNG.pl fwsplat01.mycompany.com .1.3.6.1.4.1.2620.1.6.7.1.4.0,
output: U
But even those entries do not belong to my template! There is NO script in my template at all. And CPU data is gathered from following OIDs:
IDLE: .1.3.6.1.4.1.2620.1.6.7.2.3.0
SYSTEM: .1.3.6.1.4.1.2620.1.6.7.2.2.0
USAGE: .1.3.6.1.4.1.2620.1.6.7.2.4.0
USER: .1.3.6.1.4.1.2620.1.6.7.2.1.0
Please try to snmpwalk these OIDs from your firewall and post the results
Reinhard

Reinhard,

I know your template does not use the script (you told me last time, the post you are referring to is my first try with the Nokia script, not the checkpoint one.

As said I'm now using your script, which works much much better
except for the CPU (as explained in another post)

so I did the SNMP walk of the IOD's you told ... the results are ... emtpy :

C:\>snmpwalk -v1 -c public fw01.mycompany.com .1.3.6.1.4.1.2620.1.6.7.2.3.0

C:\>snmpwalk -v1 -c public fw01.mycompany.com .1.3.6.1.4.1.2620.1.6.7.2.2.0

C:\>snmpwalk -v1 -c public fw01.mycompany.com .1.3.6.1.4.1.2620.1.6.7.2.4.0

C:\>snmpwalk -v1 -c public fw01.mycompany.com .1.3.6.1.4.1.2620.1.6.7.2.1.0

C:\>

no results.....

Post by **gandalf** » Fri Oct 21, 2005 10:08 pm

Please make sure that both snmp agents are running: checkpoints and nokias. As I'm not the fw admin, I don't really know how to start them. Our fw admin told me, there would be nothing else than to strat both; nothing to be configured or the like. But as long as the snmpwalk fails, you won't get any results in cacti. So this has at least been cleared out now.
Reinhard

lightningbit · Post by **lightningbit** » Tue Oct 25, 2005 6:14 am

Hi,

yes, both agents are running

Code: Select all

# ps -ef | grep snmp
root      4044     1  0 Oct12 ?        00:00:00 /opt/CPshrd-R55/bin/cpsnmpd -p 260
root      4556     1  0 Oct12 ?        00:02:16 /usr/sbin/snmpd -s -l /dev/null -P /var/run/snmpd -a -c /etc/snmp/snmpd.users.conf 161
root      4560     1  0 Oct12 ?        00:00:02 /usr/sbin/cpsnmpagentx
root     20606 20539  0 13:09 pts/0    00:00:00 grep snmp

I actually didn't try with SNMP v 2c but there is a test :

C:\>snmpwalk -v2c -c public fw01.mycompany.com .1.3.6.1.4.1.2620.1.6.7.2.1.0
SNMPv2-SMI::enterprises.2620.1.6.7.2.4.0 = No Such Instance currently exists at this OID

L.

Post by **gandalf** » Tue Oct 25, 2005 10:38 am

Sorry, I can't help on this. What about asking Nokia Suppport?
Reinhard

lightningbit · Post by **lightningbit** » Tue Oct 25, 2005 10:43 am

ah but as I explained in my first posts... I'm not using Nokia but secure platform

(although the mib should be the same)

L.

Post by **gandalf** » Wed Oct 26, 2005 11:06 am

Forgive me, due to the title of the post, I've missed that

Reinhard

TFC · Post by **TFC** » Fri Oct 28, 2005 1:35 am

Hi,
Are these packets infos (accepted rejected, logged and dropped) are COUNTER or GAUGE?

Post by **gandalf** » Fri Oct 28, 2005 9:43 am

TFC wrote:Hi,
Are these packets infos (accepted rejected, logged and dropped) are COUNTER or GAUGE?

COUNTER

Reinhard

vincent.kilchoer · Post by **vincent.kilchoer** » Fri Feb 03, 2006 11:19 am

Good morning,

I've made some test and I've see that only the nokia snmp agent is running.

Any body knows how to enable the checkpoint agent?

Regards,

Vincent

eos · Post by **eos** » Fri Feb 03, 2006 11:33 am

vincent.kilchoer wrote:Good morning,

I've made some test and I've see that only the nokia snmp agent is running.

Any body knows how to enable the checkpoint agent?

Regards,

Vincent

for my memory try you have to find a file nammed cpsnmpd
If I remember right, run cpsnmpd start

good luck,
eos

ioiioi · Post by **ioiioi** » Sat Feb 04, 2006 6:13 am

can this template be used for checkpoint R55 AI?
I installed this version on win2k srv platform.

Cacti

Nokia IP Firewall Checkpoint Template

IPSO firewall

Re: Using the NOKIA scripts for SPLAT

host availability

Re: Using the NOKIA scripts for SPLAT

Nokia IP Firewall Checkpoint Template

Re: Nokia IP Firewall Checkpoint Template

Who is online