Monitoring Palo PA-3400

Our organization is migrating from Checkpoing to Palo and we're trying to get the first couple of deployed firewalls into Orion.

So far in working with the firewall engineer, we haven't been able to get a configuration that allows for Orion to discovery the firewall. He's been digging through Palo support articles but hasn't found the right settings yet.

Anybody here have insight as to how to setup the SNMPv3 settings and views on Palo to allow Orion to discover the devices correctly?

Find more posts tagged with

palo

palo alto

Accepted answers

stuartd

I can confirm that we have (about 10 mostly PA-3xxx series) Palo Alto Firewalls that we monitor via one of our SW instances, and all use SNMP v3.

We did create our own device template for NCM, but from a SW side of things that was pretty much it.

I am not able to talk about the PA side as that isn't my area of expertise, but a config extract shows this:

 }
          snmp-setting {
            access-setting {
              version {
                v3 {
                  views {
                    Name-V3 {
                      view {
                        Name-V3 {
                          oid .1;
                          option include;
                          mask 0x80;
                        }
                      }
                    }
                  }
                  users {
                    xxxxxx-YYY {
                      authpwd -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;
                      privpwd -yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy;
                      view Name-V3;
                    }
                  }
                }
              }
            }

From the GUI it looks like this:

And options selected on SW side are SHA1 and AES128.

I hope that helps in some small manner?

All comments

stuartd

 }
          snmp-setting {
            access-setting {
              version {
                v3 {
                  views {
                    Name-V3 {
                      view {
                        Name-V3 {
                          oid .1;
                          option include;
                          mask 0x80;
                        }
                      }
                    }
                  }
                  users {
                    xxxxxx-YYY {
                      authpwd -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;
                      privpwd -yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy;
                      view Name-V3;
                    }
                  }
                }
              }
            }

From the GUI it looks like this:

And options selected on SW side are SHA1 and AES128.

I hope that helps in some small manner?

superfly

We too use SHA1 and AES128 to monitor PA's via SNMP 3.

I use these setting in the GUI

I'm monitoring PA-850's and PA-1410's

bourlis

We have 22 Palo Alto's in our environment, all managed via SNMPv3. I would highly suggest following Superfly's example, but don't forget to enable SNMP management on the management interface.

Navigate to Device > Setup > Management.
Click the Management Interface Settings button.
Select the SNMP box.

Also use "oid 1.3.6.1.6" & "mask 0xf0" this grants you access to all management info.

If you haven't done so I would also download the Palo Alto Pollers here on Thwack. I use the one created by emay, it fixes the machine type from the lackluster default machine type.

routermonkey

We did get everything running a while ago and I never got a chance to come back and reply. We just started a migration to Palo and this was one of the first nodes in production.

But thanks for the suggestion of the custom pollers.