Palo alto Interface Monitoring

Reply
Highlighted
L2 Linker

Palo alto Interface Monitoring

Hi Team, 

 

Is there a way I can Monitor Palo Alto Interfaces directly using SLA. 

In case the Interface has no traffic, It will bring itself down. 

 

I have already searched two VR PBR stuff. I want to know if there is a way by which we can do tracking on interface. 

 

Regards, 


Accepted Solutions
Highlighted
L7 Applicator

Hi

 

first of: thanks for the kudos! much appreciated :)

 

secondly: ok I see what you're trying to do. we don't have a mechanism to bring an interface down like that, short of it going electrically down, but we do have a mechanism that removes routes when path monitor fails: PBR

 

if you set up your primary route via PBR with a monitor profile set to 'failover', the route will be removed once a remote IP ping fails and then aither the next PBR policy or routing table will be used

in your routing table you would not include a route to the primary link as this is accomplished by PBR, so as soon as the PBR monitor fails, there is no more route to the primary link until the monitor is reestablished. 

 

pbf monitor disable fail.png

 

hope this helps ?

reaper - PANgurus.com
Find my book at https://www.amazon.com/dp/1789956374

View solution in original post


All Replies
Highlighted
L7 Applicator

Hi

 

you can monitor interfaces using SNMP.

Interface state is controlled by configuration changes and requires a commit to forcibly turn off an interface.

 

could you provide a scenario of what you are trying to accomplish exactly? there may be different methods to accomplish what you want to set up

reaper - PANgurus.com
Find my book at https://www.amazon.com/dp/1789956374
Highlighted
Cyber Elite

If this is something that you really need you would need to make ample use of the API to actually get it to work. You could monitor the interfaced with SNMP and then have a script that would run if the interface didn't show any untilization. I really can't think of a scenario where you would really want to do something like this though? 

Highlighted
L2 Linker

Hi Reaper, 

 

First of all, I would like to give you credit of guru as I have learned a lot from your posts and articles!

 

Second, the secanrio is that my netscreen firewall can have an IP SLA in many flavors implemented on the interfaces. 

Example: I have interfaces which do something like link and path monitoring. hence, they will go down in case conditions are met (ping to internet etc). 

 

In Palo Alto only way I see them happening is using PBR and routing or using HA. There is no way I could find that Interfaces themselfs can monitor if cable is disconnected or Internet is not reachable and shut themselfs down and disable routes. 

 

Hence, to be sure that my search was correct. Can you confirm. 

L2 Linker

Actually, I come from a different background. :) We used this when Interfaces themself auto disable when conditions are met. By conditions I mean something like link and path monitoring in Palo alto. 

 

The Interfaces will disable themself and delete route entry. 

 

Not sure if that explains. 

Highlighted
L7 Applicator

Hi

 

first of: thanks for the kudos! much appreciated :)

 

secondly: ok I see what you're trying to do. we don't have a mechanism to bring an interface down like that, short of it going electrically down, but we do have a mechanism that removes routes when path monitor fails: PBR

 

if you set up your primary route via PBR with a monitor profile set to 'failover', the route will be removed once a remote IP ping fails and then aither the next PBR policy or routing table will be used

in your routing table you would not include a route to the primary link as this is accomplished by PBR, so as soon as the PBR monitor fails, there is no more route to the primary link until the monitor is reestablished. 

 

pbf monitor disable fail.png

 

hope this helps ?

reaper - PANgurus.com
Find my book at https://www.amazon.com/dp/1789956374

View solution in original post

Highlighted
L5 Sessionator

PA has monitor object which does something similar:

- disables tunnel interface when it's applied on IPSEC tunnel when some destination isn't reachable

- disables PBF route  when some destination isn't reachable

 

But unfortunatelly it can't be applied to a network interface.

 

 

Highlighted
L2 Linker

Thanks @reaper you are awesome.,

Tags (1)
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!