Palo alto Interface Monitoring

[yadsingh]

Hi Team, 

Is there a way I can Monitor Palo Alto Interfaces directly using SLA. 

In case the Interface has no traffic, It will bring itself down. 

I have already searched two VR PBR stuff. I want to know if there is a way by which we can do tracking on interface. 

Regards, 

[reaper]

Hi

you can monitor interfaces using SNMP.

Interface state is controlled by configuration changes and requires a commit to forcibly turn off an interface.

could you provide a scenario of what you are trying to accomplish exactly? there may be different methods to accomplish what you want to set up

[BPry]

If this is something that you really need you would need to make ample use of the API to actually get it to work. You could monitor the interfaced with SNMP and then have a script that would run if the interface didn't show any untilization. I really can't think of a scenario where you would really want to do something like this though? 

[yadsingh]

Hi Reaper, 

First of all, I would like to give you credit of guru as I have learned a lot from your posts and articles!

Second, the secanrio is that my netscreen firewall can have an IP SLA in many flavors implemented on the interfaces. 

Example: I have interfaces which do something like link and path monitoring. hence, they will go down in case conditions are met (ping to internet etc). 

In Palo Alto only way I see them happening is using PBR and routing or using HA. There is no way I could find that Interfaces themselfs can monitor if cable is disconnected or Internet is not reachable and shut themselfs down and disable routes. 

Hence, to be sure that my search was correct. Can you confirm. 

[yadsingh]

Actually, I come from a different background. 🙂 We used this when Interfaces themself auto disable when conditions are met. By conditions I mean something like link and path monitoring in Palo alto. 

The Interfaces will disable themself and delete route entry. 

Not sure if that explains. 

[reaper · Accepted solution]

Hi

first of: thanks for the kudos! much appreciated 🙂

secondly: ok I see what you're trying to do. we don't have a mechanism to bring an interface down like that, short of it going electrically down, but we do have a mechanism that removes routes when path monitor fails: PBR

if you set up your primary route via PBR with a monitor profile set to 'failover', the route will be removed once a remote IP ping fails and then aither the next PBR policy or routing table will be used

in your routing table you would not include a route to the primary link as this is accomplished by PBR, so as soon as the PBR monitor fails, there is no more route to the primary link until the monitor is reestablished. 

hope this helps ?

[santonic]

PA has monitor object which does something similar:

- disables tunnel interface when it's applied on IPSEC tunnel when some destination isn't reachable

- disables PBF route  when some destination isn't reachable

But unfortunatelly it can't be applied to a network interface.

[yadsingh]

Thanks @reaper you are awesome.,