Complex condition alerts

I've two Palo Alto firewalls in HA and connected to two switches as it show on the diagram.

Interfaces Te1/1/6 and Te1/1/5 on Switch-1 and Te1/1/7 and Te1/1/8 on Switch-2 are down until the firewall-1 goes down and firewall-2 take the active role.
I can't figure out how to set this alert with this conditions:

Alert interfaces Te1/1/5 and Te1/1/6 on switch-1 and Te1/1/7 and Te1/1/8 on switch-2 when they are down only when Firewall-1 is down. And not alert the default interface down for this interfaces.

Can anyone point me to right direction on how can I set this alarms?

Find more posts tagged with

alerts_trigger

Alerts

Accepted answers

All comments

Blazter

As an option, you can use a third-party software or service to receive notifications when the equipment does not work as it should.

ecmel

You can configure "Dependency" in SolarWinds platform between your firewall devices and related switch interfaces.

For example, Firewall-1 node can be selected as the parent object and interface Te1/1/5 of Switch-1 can be defined as your child object for your first dependency configuration. Then you can configure dependency relationship for each device-interface pair.

By this way, if parent object goes down, dependent child objects will be displayed as UNREACHABLE instead of DOWN status and you won't receive alerts from these child objects.

You can access add your custom dependency definitions using Settings -> All Settings page. If you click on "Manage Dependencies" link under "Node & Group Management", you will see "Add New Dependency" button on this page.

dcastro

Hi ecmel,

That's correct and it's part of what I'm configuring, but I'm wondering how I can avoid DOWN status alerts from interfaces on Switch2 because that's the normal status of them as long as FW1 is UP. Another thing that I didn't mention is that FW2 status is UP, just Switch-2 interfaces are down.

I'm thinking about configuring dependencies as you adviced and modify the interfaces alerts with the condition that not sending the alert for those particular interfaces on switch-2 and set a brand new alert for them.

ecmel

Hi dcastro,

I agree, as you mentioned, you need to exclude these interfaces that are normally in down state from your default interface down alert scope and then you need to configure a new alert with a complex alert definition to trigger alert on a Switch-2 interface when FW-2 is in down state.

I would define the alert condition as shown in the screenshot below. You may consider to add more interfaces to the "primary section" scope using "OR" condition to test multiple Switch-2 interfaces.