topic Cacti - Templates in Automation/API Discussions

Cacti - Templates

kklein — Mon, 19 Mar 2012 22:52:35 GMT

Hello Palo Alto Community,

I created a few Cacti Templates which allow you to quickly and easily monitor Palo Alto Networks firewalls with SNMP. There are 5 different templates corresponding to the 5 different Firewall families, PA-200, PA-500, PA-20xx, PA-40xx, PA-50xx.

Using these with Cacti (www.cacti.net), these Host templates will monitor the following sets variables, create historical graphs of these variables (example Graphs listed below):

Traffic the firewall is passing through each selected interface(s)
The number of Active Sessions (TCP, UDP and ICMP)
The number of Concurrent Sessions (aggregate of Active Sessions)
Session Utilization Percentage – Based on the PAN Firewall Model
Temperature of the Firewall
Uptime of the Firewall

If you know of other OIDs which you feel the broader community would like monitored, I would be happy to add them to the templates.

Once cacti is installed on your favorite OS, you simply connect to the Cacti web interface and import these host templates. Then you can add devices for Cacti to SNMP Poll/Monitor and you have a long term graphical representation of what the firewall is doing, how much traffic it is seeing, how many sessions it is supporting, etc.

Hope these help,

Kameron

Re: Cacti - Templates

jvalentine — Mon, 19 Mar 2012 23:43:55 GMT

These are great. Thanks for sharing!

Re: Cacti - Templates

saint-paul — Tue, 20 Mar 2012 10:32:46 GMT

Thanks.

And for those having trouble importing template, how to fix version checking in cacti with xml version hash error

http://docs.cacti.net/howto:determine_cacti_template_version

Re: Cacti - Templates

mikand — Tue, 20 Mar 2012 17:52:32 GMT

Nice work! Thanks for sharing! 🙂

Re: Cacti - Templates

atseng — Mon, 26 Mar 2012 15:51:21 GMT

nick work! thanks for sharing!

Re: Cacti - Templates

ericgearhart — Sun, 29 Apr 2012 15:32:01 GMT

I've built the equivalent of these graphs in Zabbix as well... Zabbix allows you to do some interesting things as well, such as "if the last retrieved uptime raw value is less than 600 seconds, send an alert" (i.e. if the firewall has rebooted in the last ten minutes, throw an alert), or "if the SNMP queried temperature is over X, send an alert"

Unfortunately Zabbix doesn't support SHA/AES for SNMPv3, and the Palo Altos we have don't seem to support MD5/3DES, so I ended up having to use SNMPv2

If anyone's interested I can post them here, or open a new thread

Re: Cacti - Templates

Quinton — Tue, 09 Oct 2012 18:55:42 GMT

I'm interested in those Zabbix templates thanks. Would you mind posting them?

Re: Cacti - Templates

jthompson159 — Wed, 24 Oct 2012 16:41:37 GMT

Thanks for the templates.

Have you graphed traffic utilization on sub interfaces? some reason I'm struggling with this <maybe cause i'm new to cacti> I'm running cacti 0.8.8a

Re: Cacti - Templates

kklein — Wed, 24 Oct 2012 19:27:31 GMT

Jerrold,

Currently, there isn't any SNMP support for Sub-interfaces. There are feature requests for this, so you may want to speak with your local PANW SE and have them add you and your company to the FR.

Thanks,

Kameron

Re: Cacti - Templates

ericgearhart — Fri, 08 Feb 2013 19:13:06 GMT

quinton - sorry for the late reply.

I will try to export the Zabbix hosts I've built... we're monitoring our 4020 and a pair of 5020s with Zabbix and it's working great. I'll start a new thread and post them there.

Re: Cacti - Templates

sboelter — Mon, 18 Feb 2013 09:12:55 GMT

...works great with our PA-500 but i can't see the traffic graphs on Cacti. Do i have to add them manually?

Re: Cacti - Templates

Colt — Wed, 27 Feb 2013 17:46:57 GMT

Hi,

i'm using cacti 0.8.7g and this template was exported using cacti 0.8.7h.

Then it doesn't works for me

To be able to import this template, i had to change all the hash version occurrences inside the .xml file for the correct ones.

I used sed (in a gnu/linux system) to do the trick:

sed -i -r 's/(hash_[0-9]{2})0022/\10021/g' cacti_host_template_palo_alto_firewalls_-_pa-50xx.xml

The above command, change the cacti_host_template_palo_alto_firewalls_-_pa-50xx.xml template file from cacti 0.8.7h to cacti 0.8.7g version

Hope this helps someone too

Best regards.

Re: Cacti - Templates

Colt — Tue, 05 Mar 2013 11:25:56 GMT

Hello,

i have updated your host template to be able to monitor in the correct way palo alto firewalls running pan-0s 4.1

Best regards,

Re: Cacti - Templates

darren_g — Tue, 19 Mar 2013 00:56:28 GMT

Thumbs up from me - just found this, and it worked a treat - thanks!

Re: Cacti - Templates

tobannon — Mon, 27 May 2013 13:56:27 GMT

Hi,

Thanks for the templates. However, I'm not getting any data returned. I'm using the 20XX host template for my 3020. I'm using Nagios as well and it is pulling data correctly. I've checked all of the oids and they are correct. Any ideas?

Thanks,

Todd

Re: Cacti - Templates

alexander_conn — Fri, 14 Jun 2013 06:20:14 GMT

Hi, I'm fairly new to Cacti and SNMP. How do I get the interface traffic graphs up and running? I can see the graph templates in Cacti, but my assumption is I need to configure the data source some how...

Re: Cacti - Templates

kklein — Fri, 14 Jun 2013 14:21:06 GMT

I am not sure if you are just using the templates, or if you are using the VM I built. Either way, read this document and it should get you pointed in the right direction: https://dl.dropboxusercontent.com/u/68056332/Cacti%20Virtual%20Appliance%20Documentation%20-%20Version%201.2.pdf

Hope this helps,

Kameron

Re: Cacti - Templates

kklein — Fri, 14 Jun 2013 14:22:01 GMT

Follow the directions in this document and you should be in good shape: https://dl.dropboxusercontent.com/u/68056332/Cacti%20Virtual%20Appliance%20Documentation%20-%20Version%201.2.pdf

Re: Cacti - Templates

darren_g — Sun, 16 Jun 2013 23:27:55 GMT

Kameron.

Is this VM appliance available for download somewhere?

I've built my own, but I'm still having issues with some parts of the PA information, so I'd like to look at yours.

Thanks

Re: Cacti - Templates

alexander_conn — Mon, 17 Jun 2013 01:00:08 GMT

Me too