topic Re: Monitoring internet connectivity in General Topics

Monitoring internet connectivity

Jsytsma — Wed, 10 Mar 2021 20:45:40 GMT

Is there an way to monitor if\when internet connectivity is lost on an interface on Palo 5220? We are trying to determine if our internet connection is going down occasionally (for just minute or less), but not finding anything on the Palo to indicate an internet bounce other than IPsec tunnels renegotiating. One thought was to set up probes from the Palo to Google DNS and alert when a certain number of pings are lost. Is there a way to do this?

Re: Monitoring internet connectivity

OtakarKlier — Wed, 10 Mar 2021 22:31:27 GMT

Hello,

The interface and path monitoring the PAN is really meant for HA failures and the static is meant for routing.

Here is the article for the routing https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/static-routes/configure-path-monitoring-for-a-static-route

However I think your best method would be to use some monitoring service such as PRTG. This way you can monitor the interface statistics and path with netflow.

Regards,

Re: Monitoring internet connectivity

SutareMayur — Fri, 12 Mar 2021 14:03:58 GMT

Hi @Jsytsma ,

As mentioned by @OtakarKlier , the one of the option is to monitor the static route which is being used for the internet traffic i.e. default route. You can enable the path monitoring on the route and add any ICMP enabled internet IP under destination. So Palo Alto will monitor its ping response from the IP address of the interface where internet link is terminated.

And for active monitoring, you can set email alerts based on the system logs conditions as given below. With below conditions, firewall will track path-monitoring failures and its recovery and send mail alerts.

NOTE - In this case, if path monitoring fails, palo alto will remove that particular route from its forwarding table until that path monitoring status gets restored.

In addition to it, you can also enable monitoring interface status where internet is terminated and enable mail alerts for the status change.

Hope it helps!