I am having trouble with the custom Nagios plugin check_paloalto, specifically with the "certificates" check.
The rest of the checks are working fine.
Basically, the "certificates" check leverages the API calls and parse the XML running configuration file to find the certificates. The issue is that my firewalls (which are managed by Panorama, which in turn pushes the certificates from a template) do not present the certificate part in the XML configuration file. I verified it by calling the same API in the browser.
My goal is having a Nagios check that is triggered when a certificate is near the expiration date, since we are using them for SSL Inspection and other reasons.
Panorama and firewalls are running PAN-OS 10.1.10, and Nagios is running version 5.9.3.
Is there any reason why this happens?
Hi @GGarolla ,
What you are experiance is by design. Configuration pushed by Panorama is not stored in firewall local configuration, but it is stored separately as "panorama pushed" config.
I don't have access to FW right now, but there are CLI operation commands that allow you to list/view the panorama pushed config, I am sure there should be XML API call for those as well.
However in the link you shared is mentioned that Nagios is using the Rest API (note that PAN FWs supprot XML and REST, but they are different). REST was introduced fairly recently and it has its limitations, some commands/actions are available only under XML API.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!