[revisited] Nokia IP Firewall Checkpoint Template V0.2

[lamerz]

I did have snmp and csnmpd running at the same time. I needed to set up a proxy in Net-SNMP on the firewall to query the Checkpoint mib.
KMH

Hello,
May you describe how you configured that proxy ? Thank you in advance.

You need to put this in your snmpd.conf and restart snmpd:
proxy -v 1 -c public localhost:260 .1.3.6.1.4.1.2620

You only need this with NetSNMP, since Nokia IPSO 3.8 (?) this proxy is already configured; just start cpsnmpd with cpconfig.

[yanhannet]

can't get any data when i use the oid .1.3.6.1.4.1.2620......
but could get from oid 1.3.6.1.4.1.94. ....
device : nokia 350 470 750
i want to monitor them ,but i didn't the oid detail ...
can you help me ?

[kharford]

This is what I puit in my snmpd.conf file:

proxy -v 1 -c public localhost:260 .1.3.6.1.4.1.2620


Now you must have the Checkpoint SNMP daemon running on port 260 for this to work


KMH

[poezie]

Hi

Can you please help as we are getting graphs in all the other vies but nothing is getting graphed in the Rejected graph has anyone got any ideas ?

Thanks

[gandalf]

You may derive the OID from the resource/snmp_queries/ XML template: .1.3.6.1.4.1.2620.1.1.25.5.1.11 and .1.3.6.1.4.1.2620.1.1.25.5.1.12. Please try to snmpwalk against them from command line to see, whether the device responds. Or set Settings->Logging Level to DEBUG for one polling cycle and find those OIDs in log/cacti.log along with the results
Reinhard

[vinx]

Hello All,

I downloaded template and script.

I tried to monitor my Checkpoint firewall, but it shows empty graph.

SNMP is working:

Code: Select all

SNMP Information
System: IPSO firewall 3.8.1-BUILD028 releng 1518 12.02.2004-222502 i386
Uptime: 6383809
Hostname: firewall
Location:
Contact: 

but nothing appears in the graph.
Any idea?

[Pumpi]

vinx,

have you enabled the Checkpoint SNMP daemon with cpconfig on your enforcement points (firewalls) ?

Otherwise you will get only Nokia IPSO related informations via SNMP.

Pumpi

[vinx]

vinx,

have you enabled the Checkpoint SNMP daemon with cpconfig on your enforcement points (firewalls) ?

Do you know how to do?

[vinx]

vinx,

have you enabled the Checkpoint SNMP daemon with cpconfig on your enforcement points (firewalls) ?

Do you know how to do?

Ok, stupid question. I found it.

my question is... how to set the ro community name?

[barahona]

Hi,

First, very good work with the graphical templates, thanks for sharing it.

I cant generate working graphs. Two problems found:

- fwIfTable graph is not creating rrd nor asking snmp questions. I have checked everything that I know but I have no idea why is not working. Not really sure how to check if the OIDs from the XML have been imported correctly (no error appeared after importing).

- Connections/CPU Usage/Memory Usage/Packets accepted/Packets dropped/Packets logged/Packets rejected graphs have not OIDs but after add them to the Data Templates are working.

Debian 3.1
Cacti 0.8.6h (debian package)

Any help will be really apreciated.

[gandalf]

Some users reported that they had to import twice. Not sure on this. But you may try.
Then, please post the firewall XML file of ./resource/snmp_queries. And perhaps a screenshot would help
Reinhard

[barahona]

Some users reported that they had to import twice. Not sure on this. But you may try.
Then, please post the firewall XML file of ./resource/snmp_queries. And perhaps a screenshot would help
Reinhard

Just now, I have been able to make it work. It seems that some kind of inconsistence was on my cacti database in the table data_template_data. Probably because I had imported the templates around 10 times but now really sure why.

After delete all the templates from cacti and manually deletions in the table data_template_data (glups ) of any rest of the template, importing the templates again and some time and coffee later graphs was its working.

Very nice work. Thanks.

[barahona]

Hi,

I noticed that every time a policy is charged in the FW, the snmp counters of checkpoint regarding drops/accepts/rejects etc. are resets as well. This breaks all graphics (a huge peak) and become the graph unusable.

cacti 0.8.6h
rrdtool 1.0.49

Is only happened to me? :(

Has anybody how to avoid it?

Thanks in advance.

[gandalf]

Has anybody how to avoid it?

You may set some MAXIMUM value for the data source. All readings exceeding this will be interpreted as NaN. When doing so, remember to rrdtool tune all existing files to apply this change
Reinhard

[barahona]

Has anybody how to avoid it?

You may set some MAXIMUM value for the data source. All readings exceeding this will be interpreted as NaN. When doing so, remember to rrdtool tune all existing files to apply this change
Reinhard

Thanks for the quick response lvm.

I read another solution using DERIVE instead COUNTER with "Maximum Value" equals to cero. I have testing it and seems that works as I espected, but not sure about the implications.

Could be that configuration right?

Best regards.