Nokia IP Firewall Checkpoint Template

[philuxe]

For the moment it seems the CPU templates reports incorrect values and legends.
IPSO version : 3.9 build 41
Checkpoint NG AI R55 (last hotfix)
Checpoint SNMP daemon turned on.

Regarding the dropped, accepted and looged value I still dont undertsand what dos that mean exactly.
Sometimes I get 200 for current logged, I cant imagine the firewall dropping 200 connection per second while the last check. The status tracker should confirm that but thats not the case. Unfortunatly the checkpoint MIB is not clear ...

See attached screenshots.

[gandalf]

The dropped.jpg shows an average value of about 0.2 drops/sec. (m denotes milli!).
Reinhard

[philuxe]

ok so it means the graph indicates the drope rate :

In other words the average indicates we have one drope every 221.87 ms.

Am I right ?

[poezie]

Hi

I need help as I have imported all successfully but when I try and do the specific checkpoint graphs I do not no graph data ( boxes with red x). I am new to cacti and not 100% sure why this is not working.

When I try and click on the wrench by the graph it looks for a rrd file that hasn't been created from what I can see.

Please help

Thanks

[gandalf]

When editing the device, does it show a red "snmp error" in the upper left corner? In this case, you do not have snmp access to the firewall
Reinhard

[poezie]

Hi

Definatley have SNMP read as the Interface Traffic graphs are working 100%

It is just the Checkpoint Graphs that are not geting graphed ?

Thanks

Here is the inforamtion from the graph, when I do a search on the machine it doesn't appear that these rrd file have been created

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="Firewall Name - Checkpoint Firewall-1 Interface |query_ifDescr| Filter Statistics" \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=-100 \
--vertical-label="Packets / Second" \
--slope-mode \
DEF:a="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktAcceptedIn:AVERAGE \
DEF:b="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktAcceptedOut:AVERAGE \
DEF:c="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktRejectedIn:AVERAGE \
DEF:d="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktRejectedOut:AVERAGE \
DEF:e="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktDroppedIn:AVERAGE \
DEF:f="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktDroppedOut:AVERAGE \
DEF:g="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktLoggedIn:AVERAGE \
DEF:h="/usr/share/cacti/site/rra/firewallname_fwpktrejectedout_133.rrd":fwPktLoggedOut:AVERAGE \
CDEF:cdeff=b,-1,* \
CDEF:cdefbd=d,-1,* \
CDEF:cdefcb=f,-1,* \
CDEF:cdefcj=h,-1,* \
HRULE:0#000000:"" \
AREA:a#00FF00:"Accepted In" \
GPRINTLAST:" Current\:%8.2lf%s" \
GPRINTAVERAGE:"Average\:%8.2lf%s" \
GPRINTMAX:"Maximum\:%8.2lf%s\n" \
AREA:cdeff#00FF00:"Accepted Out" \
GPRINTLAST:"Current\:%8.2lf%s" \
GPRINTAVERAGE:"Average\:%8.2lf%s" \
GPRINTMAX:"Maximum\:%8.2lf%s\n" \
AREA:c#FF0000:"Rejected In" \
GPRINT:c:LAST:" Current\:%8.2lf%s" \
GPRINT:c:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:c:MAX:"Maximum\:%8.2lf%s\n" \
AREA:cdefbd#FF0000:"Rejected Out" \
GPRINT:d:LAST:"Current\:%8.2lf%s" \
GPRINT:d:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:d:MAX:"Maximum\:%8.2lf%s\n" \
AREA:e#4444FF:"Dropped In" \
GPRINT:e:LAST:" Current\:%8.2lf%s" \
GPRINT:e:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:e:MAX:"Maximum\:%8.2lf%s\n" \
AREA:cdefcb#4444FF:"Dropped Out" \
GPRINT:f:LAST:" Current\:%8.2lf%s" \
GPRINT:f:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:f:MAX:"Maximum\:%8.2lf%s\n" \
LINE2:g#F5F800:"Logged In" \
GPRINT:g:LAST:" Current\:%8.2lf%s" \
GPRINT:g:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:g:MAX:"Maximum\:%8.2lf%s\n" \
LINE2:cdefcj#F5F800:"Logged Out" \
GPRINT:h:LAST:" Current\:%8.2lf%s" \
GPRINT:h:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:h:MAX:"Maximum\:%8.2lf%s\n"

Any help would be great as we wold love to get these graphs working

[riz]

have you run cpconfig and enabled the CP snmp daemon?

[gandalf]

Please find an updated ressource at [revisited] Nokia IP Firewall Checkpoint Template V0.2
Reinhard

[galamayur]

Hi,
I am getting error while importing the nokia.xml file.

Error: XML parse error


thanks in advance

regards
Mayur

[galamayur]

Hi

I have imported the checkpoint template.. & added my FW's

but unable to see the graph...;...


Regards
mayur

[gandalf]

Please post a screenshot of your problem
Reinhard

[galamayur]

Hi,

After installing the above given template, the appropriate graphs are not been plotted.

Attaching the snapshots of the generated graphs.


Regards,
Mayur

[gandalf]

Please make sure to use the updated Templates at [revisited] Nokia IP Firewall Checkpoint Template V0.2
Reinhard

[moe_szyslak]

Hi,

does anyone know the MIB for memory usage under NOKIA IPSO ? When I try the MIB (for example)

.1.3.6.1.4.1.2620.1.6.7.4.4.0

I got the following error message

SNMPv2-SMI::enterprises.2620.1.6.7.4.4.0 = No Such Instance currently exists at this OID


Greeting
Moe

[Tibo]

Hello.

I have the same issue and for an unknown reason it seems that 1.3.6.1.4.1.2620 and sub-oid don't exist on my Nokia (i'm using IPSO 4.2).

For the CPU, I use this OID: .1.3.6.1.4.1.94.1.21.1.7.1.0
For the disk space, I use this one: .1.3.6.1.2.1.25.2.3.1.6

I don't really know why the OID 1.3.6.1.4.1.2620 doesn't work on mine as well... if you have any clue?