Palo Alto Site to Site VPN tunnel Encryption domain monitoring

takkigergo

Hello Thwackers,

We were recently able to upgrade our SolarWinds Orion services and all of the modules connect to it to a verson which supports Palo Alto S2S VPN API pulling. While starting to implementing it I've noticed that the OoB alert for S2S VPN monitoring picks up every Encryption domain, which is great. The problem what I'm facing is that not all Encryption domain, needs to be always up. Just to give an example: I have 12 domains, but the end users currently only communicating over 9, while they have the option to communicate with more network subnets if needed.

I would like to somehow still monitor the complete tunnel if the tunnel itself is up (meaning at least 1 Encryption domain is up). Does anyone had similar problem, or need as I'm not sure how to do it in the alert settings.

Thank you,

Greg

gmotx

Hello,

I have a similar issue and this was the reply from support:
In my case the encryption domain/Proxy-id is activated only when interesting traffic is seen. If not, the "tunnel" goes inactive although the VPN/gateway stays up. In the end I just disabled the Palo Alto polling. Removing the VPN interface from the node resources does not "fix" it.
Pretty sure we were not getting these alerts in the past, but also not sure when or what upgrade they came into play.

As per the investigation of our Application Engineer. This will fall as a Feature Request .
One way to overcome it is to use SQL Advanced Alert. But even from SQL scripting, it will take a lot of work to achieve.
The Alert is using the Id of DB\Ctx_C_Orion_NetMan_Firewalls_SiteToSiteTunnel.csv. Each Id represents a Tunnel with each "Name" column in the same table.
There is a need to script a custom query to check if the name, e.g. P2-IPSec-1 is within the "Name" column of Ctx_C_Orion_NetMan_Firewalls_SiteToSiteTunnel,
then it should not trigger again. But this requires SQL or SWQL, and we do not support creating a custom query as per our support limitations.