topic Re: SNMP notifications - some missing? in General Topics

SNMP notifications - some missing?

mcocat — Wed, 19 Nov 2014 14:39:18 GMT

I have enabled SNMP notifications on threats greater than or equal to severity "medium". Under monitor > threats I am seeing my alerts, but I only receive (via SNMP) some of the threats that shows up on the PA interface. Here is an example:

I am only receiving SNMP alarms on the "SCAN: Host Sweeps", but not the spyware or the virus.

Is this because of the rule being hit? How can I enable notifications on all of the rules?

Re: SNMP notifications - some missing?

ssharma — Wed, 19 Nov 2014 15:00:45 GMT

Hi @mcocat,

You can configure SNMP under Objects -> Log Forwarding.

Then use this log forwarding on all security policy that you want get alerts from. Under Policies - > Security -> Action -> Log Forwarding

Hope this helps. Thank you.

Re: SNMP notifications - some missing?

mcocat — Wed, 19 Nov 2014 15:08:54 GMT

So for my P_User Rule -Apps Allowed rule, I already have log forwarding enabled.

And here is my log forwarding settings:

Re: SNMP notifications - some missing?

ssharma — Wed, 19 Nov 2014 15:13:02 GMT

Yes, you are using P-Panorama log forwarding profile, which does not have SNMP enabled on them. You have Panorama rule, which has SNMP but that is not used in your P_User Rule -Apps Allowed rule.

So 2 options,

1. either use Panorama log forwarding instead of P-Panorama in P_User Rule -Apps Allowed rule

2. Or modify P-Panorama rule to include snmp on them

Hope this helps. Thank you.

Re: SNMP notifications - some missing?

mcocat — Wed, 19 Nov 2014 15:21:19 GMT

That makes sense, I have a commit running now. So the fact that I was receiving alerts for the entries that didn't match a rule would mean that my default isn't configured correctly to use P-Panorama. Where can I change the default? Thanks for your help!

Re: SNMP notifications - some missing?

ssharma — Wed, 19 Nov 2014 15:35:27 GMT

You have to change P-Panorama from the Panorama server, which is pushing these configuration. Hope this helps. Thank you.