[revisited] Nokia IP Firewall Checkpoint Template V0.2

Post by **gandalf** » Wed May 17, 2006 11:09 am

Please read the docs at http://www.rrdtool.org for those types (they are really good).
Reinhard

barahona · Post by **barahona** » Wed May 17, 2006 11:31 am

lvm wrote:Please read the docs at http://www.rrdtool.org for those types (they are really good).
Reinhard

True, is more complete than the man info, especially the "NOTE on COUNTER vs DERIVE"

By the way, I mistyped in my last post were talking about:

[...] with "Maximum Value" equals to cero [...]

should be MINIMUM.

Sorry for the noise in the forum and thanks for the help.

Post by **gandalf** » Wed May 17, 2006 1:50 pm

Feel free to ask again, if in trouble. That's why we're here

Reinhard

vincent.kilchoer · Post by **vincent.kilchoer** » Wed May 24, 2006 2:01 am

Hi.

I'm running checkpoint over 2 IP350 & 2 IP380

I've successfully installed the template. Start SNMP from IPSO + cpconfig.

But nothing is graphed. When I check my device on cacti, I can see that cacti can talk with the firewall (No snmp error message).

I think I've a problem with my CheckPoint SNMP config. Anyone can help me?

Vincent

kill9 · Post by **kill9** » Tue Jun 20, 2006 5:15 pm

Very nice. I have the firewall graphs working against fw-1 on a Windows box as well. The resource queries would need some heavy tweaking, but they're not critical.
Now I just need to sort the graph spikes on policy load...

sstruyf · Post by **sstruyf** » Mon Jun 26, 2006 6:21 am

I installed the template, but i can't see any interfaces to graph.
i have 2 nokia ip560's.

HG · Post by HG » Fri Jun 30, 2006 9:06 am

Thanks for your scripts.

Just one question, do you know how to get number of vpn client connect ?

I can't find something clear in the Checkpoint MIB

Best regards

HG

eliniaws · Post by **eliniaws** » Mon Jul 31, 2006 2:40 pm

Hi,

I am trying to get these graphs working however I have a few issues. I dont seem to be able to poll any data. I am sure this is to do with my checkpoint setup. I am a unix admin, my network guy is a cisco man so between us we are finding it very difficult to ascertain where and what we need to set up. We have enabled snmp through the nokia web interface and also using cpconfig on the firewall but I still dont get any data from the firewalls when polling. The standard snmp daemon is running on port 161. Any help greatly appreciated.

Some version info below

IPSO 3.9.x
Cacti 0.8.6.h
Redhat AS

Post by **gandalf** » Tue Aug 01, 2006 11:03 am

So you're at a quite better point than me (not being a Cisco guy nor a Nokia one). You may read the thread thoroughly. There was a post on how to activate some snmp proxy for nokia/checkpoint.
You may get the OIDs from the template. Please try to snmpwalk them. If no data is seen, your configuration may be not correct.
Reinhard

eliniaws · Post by **eliniaws** » Wed Aug 02, 2006 5:37 am

Thanks,

Yes i had seen the post in question and it was the same as my snmpd.conf proxy setting. However, I had assumed that the community string 'public' was set for the internal cp snmpd (as i dont remember setting this to our standard one), so in the end...all I had to do was change the procy statement to have our community string and hey presto everything worked. What a pain for me !!

Post by **gandalf** » Wed Aug 02, 2006 7:35 am

eliniaws wrote:.. What a pain for me !!

Fine, though, that you published your struggle to help other readers avoiding the same ...
Reinhard

Kenny · Post by **Kenny** » Mon Aug 07, 2006 5:02 am

I don't know if this helps, but for the templates to work (on Nokia's IP platform at least) you have to use IPSO-version 3.7 or above. These have the SNMP-proxy setup preconfigured, so you can use the Checkpoint OID's without the need for opening port 260 on your firewall.

Kenny · Post by **Kenny** » Mon Aug 07, 2006 5:04 am

HG wrote:Thanks for your scripts.

Just one question, do you know how to get number of vpn client connect ?

I can't find something clear in the Checkpoint MIB

Best regards

HG

Try OID .1.3.6.1.4.1.2620.1.9.5.0

This will get you the connected clients to the policy server (VPN-users).
See below for my template. I dunno if this will work on another setup, and it's not very sophisticated (just a graph and data-template).

steven_JP · Post by **steven_JP** » Tue Oct 17, 2006 9:08 pm

Hi

When I try and the cacti_host_template_checkpoint_firewall_116.xml, I get
"Notice: Undefined index: oid_index in /var/www/html/cacti/lib/data_query.php on line 156

Notice: Undefined index: oid_index in /var/www/html/cacti/lib/data_query.php on line 159

Warning: Variable passed to each() is not an array or object in /var/www/html/cacti/lib/data_query.php on line 181

Warning: Variable passed to each() is not an array or object in /var/www/html/cacti/lib/data_query.php on line 515

Warning: Cannot add header information - headers already sent by (output started at /var/www/html/cacti/lib/data_query.php:156) in /var/www/html/cacti/host.php on line 77
"
Any ideas ? THANKS

Post by **gandalf** » Fri Oct 20, 2006 9:35 am

Please make sure to configre php for allowing uploads

Code: Select all

grep upload php.ini
; Whether to allow HTTP file uploads.
file_uploads = On
; Temporary directory for HTTP uploaded files (will use system default if not
;upload_tmp_dir =
; Maximum allowed size for uploaded files.
upload_max_filesize = 2M

Reinhard

[revisited] Nokia IP Firewall Checkpoint Template V0.2

nokia ip560

Who is online