topic Re: Prisma SDWAN ION monitoring in Prisma SD-WAN Discussions

Prisma SDWAN ION monitoring

Filip_Elsen — Fri, 04 Apr 2025 09:35:13 GMT

Hi,

We have deployed several branches, unfortunately monitoring the branch ION by snmp doesn't seem to work out. Response times of ION's on snmpwalk are high (up to 10sec). We were recommened to use api monitoring instead.

I've generated auth keys etc and can querry SCM (api.strata.paloaltonetworks.com......).

Unfortunately I cannot find any relevant documentation on how to querry ION: cpu, memory, up/down, etc.

Does anyone has experience with this?

Thank you,

Filip

Re: Prisma SDWAN ION monitoring

ecraig — Fri, 04 Apr 2025 12:45:41 GMT

Go here to find API documentation:

https://pan.dev/sdwan/api

Here are details on the system point metrics call:
https://pan.dev/sdwan/api/post-sdwan-v-2-0-api-monitor-sys-point-metrics/

You might find this prior post helpful:

https://live.paloaltonetworks.com/t5/prisma-sd-wan-discussions/inability-to-prisma-access-sd-wan-metrics-via-api-endpoints/m-p/615923#M205

Re: Prisma SDWAN ION monitoring

James.McCutcheon — Sun, 06 Apr 2025 00:18:25 GMT

What firmware are you running? We've just updated out 1200-S's to 6.5.1 and have found SNMP performance and returns much, much better. Definitely agree it was pretty flaky in earlier versions.

Re: Prisma SDWAN ION monitoring

Filip_Elsen — Mon, 07 Apr 2025 07:15:43 GMT

We're on 6.3.1-b6, because of the best behavior with redundanccy & fail-to-wire. We've verified the behavior of several versions, the differences are quite huge!

On this version, ION's fail to respond in a consistent way, making monitoring not reliable.

By TAC we were advised to change the TTL to 10sec, which is impossible on the monitoring platform.

We've been trying to achieve something via API calls, (pand.dev etc), but this isn't straight foward at all.

Re: Prisma SDWAN ION monitoring

Filip_Elsen — Fri, 18 Apr 2025 08:03:53 GMT

Running 6.5.1, in which timeframe are the ION's responding to snmpwalk?

Are they responding consistently ?

In 6.3.1-b6 we sometimes received no return. Tac advised us to set the TTL to 10sec, which isn't possible in our monitoring systems.

Thank you,