topic Re: GlobalProtect monitoring in General Topics

GlobalProtect monitoring

jeanvancaloen — Wed, 30 Oct 2013 10:43:37 GMT

I need to graph GlobalProtect current users + traffic via SNMP. I cannot find anything in SNMPwalk or in the available MIBs.

I looked through some older discussions but it seems there is no immediate answer. Any update?

Thanks

Re: GlobalProtect monitoring

Retired Member — Thu, 31 Oct 2013 17:30:36 GMT

Currently there is no OID for tracking GP users via SNMP. However, I would advise to contact your PANW Sales Rep to inquire about roadmap for such a feature.

-Richard

Re: GlobalProtect monitoring

jeanvancaloen — Fri, 25 Jul 2014 07:39:13 GMT

Seems PANOS 6 has required SNMP monitoring capabilities but we're waiting on confirmed stability before upgrading production clusters. Anyone inhere that has used it to graph current GP connections and traffic? Not sure if it's possible to monitor status and traffic of individual ipsec tunnels.

Re: GlobalProtect monitoring

jeanvancaloen — Wed, 07 Jan 2015 15:01:48 GMT

I finally managed to start monitoring with the API, very simple CLI commands and rrdtool on a linux box.

Simply put:

Polling every 5 mins through cronjob

- wget to poll the API which is fed to grep -c to count the active connections

- output of the above is used to update the RRD

Graphs generated every 5 mins through cronjob representing both our gateways and the total and display of the maximum amount of connections.

Graph looks like this now, will make it sexier as I get the chance

If anyone is interested I'd be glad to share the scripts and commands. RRDtool is not user-friendly for first-timers... at all! 😐

Re: GlobalProtect monitoring

Roland_Sonder — Wed, 28 Aug 2019 05:53:08 GMT

I do have the same requirement. I shall validate the max concurrent connected GlobalProtect users in order to plan for additional mobile licenses. I do have a about 50 gateways spread worldwide. It would be of great help for me if you could provide more details about your approach and solution.

Roland

Re: GlobalProtect monitoring

Arijit2 — Wed, 18 Mar 2020 05:00:43 GMT

Hi there,

can you please share the commands to get the GP user stats using API.

Re: GlobalProtect monitoring

ITgroupEAA — Wed, 01 Apr 2020 22:20:24 GMT

This is great if possible can you please share your scripts.

Thank You

Re: GlobalProtect monitoring

mhernandezeaa — Wed, 01 Apr 2020 22:23:46 GMT

This is exactly what I am needing. If possible can you please share your scripts.

Thank You

Re: GlobalProtect monitoring

Converged — Tue, 09 Jun 2020 16:20:35 GMT

I believe there are now SNMP OIDs for GlobalProtect, as our librenms (linux based) is able to graph the number of GlobalProtect sessions

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-gateways/globalprotect-gateway-concepts/globalprotect-mib-support.html

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaSCAS

says:

Item Name OID Source MIB Description

System uptime	hrSystemUptime.0	1.3.6.1.2.1.25.1.1.0	RFC1514-MIB
GlobalProtect gateway utilization	panGPGatewayUtilization	1.3.6.1.4.1.25461.2.1.2.5.1	PAN-COMMON-MIB
GlobalProtect gateway % utilization	panGPGWUtilizationPct.0	1.3.6.1.4.1.25461.2.1.2.5.1.1	PAN-COMMON-MIB
GlobalProtect gateway max tunnels	panGPGWUtilizationMaxTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.2	PAN-COMMON-MIB
GlobalProtect gateway active tunnels	panGPGWUtilizationActiveTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.3	PAN-COMMON-MIB

Re: GlobalProtect monitoring

ferencd — Mon, 06 Dec 2021 08:25:55 GMT

Could you please share your script. We have the same problem. We have several gateways and would like to count users logged into a specific gateway.