High-availability Palo Alto interface alerting

Question

Hello Thwack forum.  I have a question regarding interface monitoring/alerting for the Palo Altos within NPM.  We have an HA pair of Palo Altos that uplink to our core.  With how the Palo Altos work in HA the Standby unit shows all interfaces as down.  This causes false positive alerts on the Standby or we have to disable interface monitoring for the Standby device.

I am trying to create an alert specific to the Palo Altos that utilizes the following trigger conditions:

If panSysHAState = active

AND

interface = down

I can't seem to find how to tie both of those together.  I sifted through the various trigger conditions but can't locate "Interface" alerts and the "panSysHAState".  Can anyone give me some direction so I can get this alert setup properly?

brian.hirschtick · Answer

So it looks like I was wrong from the start.  There is a parameter in PanOS 8.1.x+ that allows you to enable port-channels on the passive appliance within LACP.  So I ended up not even needing this.  Thanks for all the help/guidance though, Adam.

adam.beedell · Answer

Hi Brian,

I ran into that problem trying to implement my own suggestion to get the screenshot - I think the Interface alert CAN update custom properties, but the Custom Poller one cant, so the alert action to mess with the Mute variable will need to be on the interface one, and the Palo Alto status one will be what sends the alert emails.

Fairly sure that works, though it's not the most elegant design, you'll want to play around with it for a while and see what works for you

brian.hirschtick · Answer

Adam,

That is very informative, thanks!  However, when creating this alert I get the below error when trying to define the action of "Change of custom property".  See below.

Here is the configuration for the custom property of "Mute" and you can see I defined it within the Palo Alto Node custom properties.