Palo alto Interface Monitoring

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo alto Interface Monitoring

L2 Linker

Hi Team, 

 

Is there a way I can Monitor Palo Alto Interfaces directly using SLA. 

In case the Interface has no traffic, It will bring itself down. 

 

I have already searched two VR PBR stuff. I want to know if there is a way by which we can do tracking on interface. 

 

Regards, 

1 accepted solution

Accepted Solutions

Hi

 

first of: thanks for the kudos! much appreciated 🙂

 

secondly: ok I see what you're trying to do. we don't have a mechanism to bring an interface down like that, short of it going electrically down, but we do have a mechanism that removes routes when path monitor fails: PBR

 

if you set up your primary route via PBR with a monitor profile set to 'failover', the route will be removed once a remote IP ping fails and then aither the next PBR policy or routing table will be used

in your routing table you would not include a route to the primary link as this is accomplished by PBR, so as soon as the PBR monitor fails, there is no more route to the primary link until the monitor is reestablished. 

 

pbf monitor disable fail.png

 

hope this helps ?

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

7 REPLIES 7

Cyber Elite
Cyber Elite

Hi

 

you can monitor interfaces using SNMP.

Interface state is controlled by configuration changes and requires a commit to forcibly turn off an interface.

 

could you provide a scenario of what you are trying to accomplish exactly? there may be different methods to accomplish what you want to set up

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

If this is something that you really need you would need to make ample use of the API to actually get it to work. You could monitor the interfaced with SNMP and then have a script that would run if the interface didn't show any untilization. I really can't think of a scenario where you would really want to do something like this though? 

Hi Reaper, 

 

First of all, I would like to give you credit of guru as I have learned a lot from your posts and articles!

 

Second, the secanrio is that my netscreen firewall can have an IP SLA in many flavors implemented on the interfaces. 

Example: I have interfaces which do something like link and path monitoring. hence, they will go down in case conditions are met (ping to internet etc). 

 

In Palo Alto only way I see them happening is using PBR and routing or using HA. There is no way I could find that Interfaces themselfs can monitor if cable is disconnected or Internet is not reachable and shut themselfs down and disable routes. 

 

Hence, to be sure that my search was correct. Can you confirm. 

Actually, I come from a different background. 🙂 We used this when Interfaces themself auto disable when conditions are met. By conditions I mean something like link and path monitoring in Palo alto. 

 

The Interfaces will disable themself and delete route entry. 

 

Not sure if that explains. 

Hi

 

first of: thanks for the kudos! much appreciated 🙂

 

secondly: ok I see what you're trying to do. we don't have a mechanism to bring an interface down like that, short of it going electrically down, but we do have a mechanism that removes routes when path monitor fails: PBR

 

if you set up your primary route via PBR with a monitor profile set to 'failover', the route will be removed once a remote IP ping fails and then aither the next PBR policy or routing table will be used

in your routing table you would not include a route to the primary link as this is accomplished by PBR, so as soon as the PBR monitor fails, there is no more route to the primary link until the monitor is reestablished. 

 

pbf monitor disable fail.png

 

hope this helps ?

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

PA has monitor object which does something similar:

- disables tunnel interface when it's applied on IPSEC tunnel when some destination isn't reachable

- disables PBF route  when some destination isn't reachable

 

But unfortunatelly it can't be applied to a network interface.

 

 

Thanks @reaper you are awesome.,

  • 1 accepted solution
  • 7390 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!