Purnadi K

Watching Over Tunnels

Recommended Posts

--- "To him who is able to keep you from stumbling" ----

Monitoring a tunnel to be notified if it is stumbling is what this topic is all about.

Last year there was a request by one of our financial customer, a private investment bank, that uses Palo Alto Networks firewall to monitor the VPN tunnels on PAN device and although there are wide range of monitoring set with our current LogicModules, this specific feature is yet to be developed, so here comes a customized monitoring, leveraging on existing datasources. I will, again, refrain mentioning customer's name as I have no permission to use, but initial would suffice ("MB").

I had a privilege to deploy PAN device (PA-5000 series) long before layer-7 firewall becomes popular, when PAN stole the head-start in the industry. It is dubbed to be one of the sophisticated firewalls in the market even until now with its heartbreaking price (in my opinion) but it delivers its promise though. They even have virtual appliance which is quite efficient and a real software-driven firewall although selling the box is definitely a more money-making business just short years ago while nowadays hardware business with high-cost brand or trademark may start losing grounds and thanks to software-driven 'everything' (network,storage,data centre,etc).

Nothing fancy about it but it was meticulously established based on a research of Palo Alto Networks API. It is not official datasource in LogicMonitor repository yet but it is in LMExchange community grade datasource  (you can download with LogicModule Locator: 2KLFET).

Here is a working sample applied on a PA-800 series device with 3 tunnels connected to remote PAN devices:

pan_tunnel_status.thumb.png.b62baed8cbc04bfa58838a417012a223.png

 

Following is the Active Discovery script to discover the active tunnels on the device :

import com.santaba.agent.groovyapi.http.*;
apikey = hostProps.get("paloalto.apikey.pass")
host = hostProps.get("system.hostname")
command = java.net.URLEncoder.encode("<show><running><tunnel><flow><all></all></flow></tunnel></running></show>");
url = "https://${host}/api/?type=op&key=${apikey}&cmd=${command}";
response_xml = HTTP.body(url);
response_obj = new XmlSlurper().parseText(response_xml);
response_obj.result.IPSec.entry.each()
{
  name = it.name.text()
  tunnelid = it.id.text();
  innerIf = it."inner-if".text();
  localip = it."localip".text();
  peerip = it."peerip".text();
    println "${tunnelid}##${name}##local:${localip} - peer:${peerip}";
    
}
  return 0;

and afterward Collection script to get the data needed:

import com.santaba.agent.groovyapi.http.*;
apikey = hostProps.get("paloalto.apikey.pass")
host = hostProps.get("system.hostname")
wildvalue = '##WILDVALUE##';
command = java.net.URLEncoder.encode("<show><running><tunnel><flow><tunnel-id>" + wildvalue + "</tunnel-id></flow></tunnel></running></show>")
url = "https://${host}/api/?type=op&key=${apikey}&cmd=${command}"
response_xml = HTTP.body(url);
response_obj = new XmlSlurper().parseText(response_xml);
response_obj.result.IPSec.entry.each()
{
    entry ->
   entry.children().each()
    {
        node ->
        println node.name() + ": " + node.text(); 
        node.children().each()
        {
            list ->        
            println list.name() + ": " + list.text();             
            list.children().each()
            {
                instance ->             
                    println instance.name() + ":" + instance.text();               
            }
        }         
    }
}
return 0;

The original request was only to get the tunnel status (datapoint: tun_status) hence the graph is only one, but I expanded for other metrics available from the API.

 

One can always add graphs for other datapoints as they deem fit.

graph.thumb.png.5432d7ee42c29ccba765ebd990adfd2e.png

 

 

Quote

DISCLAIMER: All content in this article is solely a personal opinion of the author as a contribution to LogicMonitor community and is for personal use of the readers and provided as is, without assitance from LogicMonitor Support. There is no support or marketing-driven influence by any vendors or principals of any products mentioned in the article.

1

 

Edited by Purnadi K

Share this post


Link to post
Share on other sites

I tried to download LogicModule Locator: 2KLFET from the exchange but it does not appear that it is published anymore. Is there a way you can send it to me or publish it again?

Share this post


Link to post
Share on other sites
Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.