topic Re: Graphical traffic monitoring... in General Topics

Graphical traffic monitoring...

LCMember4427 — Tue, 09 Apr 2013 07:14:35 GMT

Hi,

We have a PA500 box running 4.1.11 software.

Formerly we used pfsense enjoying RRD graphing of traffic amount on the different interfaces. We display network information on a big monitor outside our office. Does anyone here use some thirdparty software to achieve this with PAN boxes? We don't need all the bells and whistles, and it should be easy to configure.

Thanks for help and comments on this..

regards Tor

Re: Graphical traffic monitoring...

UhMayYeah — Tue, 09 Apr 2013 10:35:43 GMT

Third Party Suggestion : Cacti :https://live.paloaltonetworks.com/thread/4367

Inbuilt Features:

1>ACC

2>Monitor Tab>App Scope

3>QOS enabled on interface https://live.paloaltonetworks.com/message/21764#21764

Re: Graphical traffic monitoring...

ericgearhart — Tue, 09 Apr 2013 13:54:15 GMT

I have Zabbix watching several pairs of PA firewalls as well, and graph trending on interfaces, CPU, memory, firewall sessions, etc all work.

Also alerting on specific events works too (for example: "if the session table goes over 80% utilization send an alert")

Re: Graphical traffic monitoring...

Jamiefitzgerald — Tue, 09 Apr 2013 21:27:43 GMT

Here is a cool tool that will help as wel

Re: Graphical traffic monitoring...

_slv_ — Mon, 27 May 2013 11:59:48 GMT

Hi Egearthart

Could you share to me your Zabbix template? I send you few days ago PM, but I didn't get any answer.

With regard

Slawek

Re: Graphical traffic monitoring...

ericgearhart — Tue, 28 May 2013 13:32:18 GMT

slv - honestly the low level discovery features built in to Zabbix 2.0 and 2.2 should make it really easy to walk the Palo Altos and automatically discover interfaces and build graphs, without needing to template out interfaces.

I can export what I have (which mostly provides graphs of the session table, management and data plane CPU usage, number of sessions broken down by TCP, UDP, etc) but for simple interface graphs use low level discovery! It really is the best way to go

https://www.zabbix.com/documentation/2.0/manual/discovery/low_level_discovery#discovery_of_snmp_oids

I would highly recommend you start off with Zabbix 2.2, there are a bunch of critical SNMP fixes in that version. Also Zabbix 2.2 implements AES/SHA support for SNMPv3, which Palo Alto requires for SNMPv3 (otherwise you're forced to use SNMPv2, which is completely clear text... not a good solution to start off with).

Zabbix 2.2 isn't released yet, but there's supposed to be a beta out by the middle of June.

Re: Graphical traffic monitoring...

_slv_ — Tue, 28 May 2013 19:26:13 GMT

I know that automatically discover is working and I have now graphs of traffic. I'm asking you because You have much more (CPU, memory, firewall sessions and >>alerting<<)

If you can export template and send it to me I will be very grateful.

I started playing with zabbix few days ago, I have to learn a lot to build my own template. Good example will be very appreciated.

Regards

SLawek