Monitoring internet connectivity

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
Jsytsma
L0 Member

Monitoring internet connectivity

Is there an way to monitor if\when internet connectivity is lost on an interface on Palo 5220?  We are trying to determine if our internet connection is going down occasionally (for just minute or less), but not finding anything on the Palo to indicate an internet bounce other than IPsec tunnels renegotiating.  One thought was to set up probes from the Palo to Google DNS and alert when a certain number of pings are lost.  Is there a way to do this?


Accepted Solutions
SutareMayur
L6 Presenter

Hi @Jsytsma ,

 

As mentioned by @OtakarKlier  , the one of the option is to monitor the static route which is being used for the internet traffic i.e. default route. You can enable the path monitoring on the route and add any ICMP enabled internet IP under destination. So Palo Alto will monitor its ping response from the IP address of the interface where internet link is terminated.

 

And for active monitoring, you can set email alerts based on the system logs conditions as given below. With below conditions, firewall will track path-monitoring failures and its recovery and send mail alerts.

NOTE -  In this case, if path monitoring fails, palo alto will remove that particular route from its forwarding table until that path monitoring status gets restored.

 

SutareMayur_0-1615557256388.png

 

In addition to it, you can also enable monitoring interface status where internet is terminated and enable mail alerts for the status change.

 

Hope it helps!

 

Mayur S.

View solution in original post


All Replies
OtakarKlier
Cyber Elite

Hello,

The interface and path monitoring the PAN is really meant for HA failures and the static is meant for routing.

Here is the article for the routing https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/static-routes/configure-path-mo...

 

However I think your best method would be to use some monitoring service such as PRTG. This way you can monitor the interface statistics and path with netflow.

 

Regards,

SutareMayur
L6 Presenter

Hi @Jsytsma ,

 

As mentioned by @OtakarKlier  , the one of the option is to monitor the static route which is being used for the internet traffic i.e. default route. You can enable the path monitoring on the route and add any ICMP enabled internet IP under destination. So Palo Alto will monitor its ping response from the IP address of the interface where internet link is terminated.

 

And for active monitoring, you can set email alerts based on the system logs conditions as given below. With below conditions, firewall will track path-monitoring failures and its recovery and send mail alerts.

NOTE -  In this case, if path monitoring fails, palo alto will remove that particular route from its forwarding table until that path monitoring status gets restored.

 

SutareMayur_0-1615557256388.png

 

In addition to it, you can also enable monitoring interface status where internet is terminated and enable mail alerts for the status change.

 

Hope it helps!

 

Mayur S.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!