Zabbix template for Palo Alto Networks Next-Generation firewall

Overview

The template to monitor Palo Alto Networks NGFW PAN-OS by Zabbix v.7.0 using SNMP v2c or SNMPv3. For use with a different Zabbix version please choose corresponding branch.

This template is linked with official zabbix template: Network Generic Device by SNMP.

This template was tested on:

• PAN-OS, version 9.1
• PAN-OS, version 10.0
• PAN-OS, version 10.1
• PAN-OS, version 10.2
• PAN-OS, version 11.0

Setup

See Zabbix templates importing for basic instructions on how to import a template.

Create a NGFW host and link this template to it.

Zabbix configuration

• Set/change the SNMP settings to match your community string (SNMPv2c) or Security name, security level ... (SNMPv3). See CONFIGURING SNMP MONITORING
• Set SNMP settings on the NGFW and commit. See [Enable SNMP Monitoring] (https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/device/device-setup-operations/enable-snmp-monitoring.html)

Interface monitoring

Interfaces monitored by template Network Generic Device by SNMP

Discovery rules

Name	Description	Type	Key and additional info
DISK Discovery	Discovery for disk partitions	SNMP agent	vfs.storage.partitions Filter: based on SNMP walk storage table item, MATCHES_REGEX .1.3.6.1.2.1.25.2.1.4
FAN Discovery	Discovery for fans	SNMP agent	entPhysicalDescr[FAN] Filter: {#SNMPVALUE} MATCHES_REGEX {Fan}
POWER Discovery	Discovery for power supplies	SNMP agent	entPhysicalDescr[POWER] Filter: {#SNMPVALUE} MATCHES_REGEX {Power}
TEMPERATURE Discovery	Discovery of temperature sensors	SNMP agent	entPhysicalDescr[TEMPERATURE] Filter: {#SNMPVALUE} MATCHES_REGEX {Temperature}

Items collected

Name	Description
App-ID content date	Currently installed application definition release date. If no release date is found, unknown is returned.
App-ID Version	Currently installed application definition version. If no application definition is found, 0 is returned.
Chassis type	Chassis type for this Palo Alto device.
Global Protect Client Version	Currently installed global-protect client package version. If package is not installed, 0.0.0 is returned.
GP active tunnels	Number of active tunnels.
GP gateway utilization	GlobalProtect Gateway utilization percentage.
GP tunnels supported	Max tunnels allowed.
HA Mode	Current high-availability mode (disabled, active-passive, or active-active).
HA Peer State	Current peer high-availability state.
HA State	Current high-availability state.
HW Version	Hardware version of the unit.
Memory utilization	calculated item
PAN-OS Version	Full software version. The first two components of the full version are the major and minor versions. The third component indicates the maintenance release number.
Processor 1 Load (mgmt)	The average, over the last minute, of the percentage of time that this processor was not idle. Implementations may approximate this one minute smoothing period if necessary.
Processor 2 Load (data)	The average, over the last minute, of the percentage of time that this processor was not idle. Implementations may approximate this one minute smoothing period if necessary.
Serial Number	The serial number of the unit. If not available, an empty string is returned.
Session table utilization	Session table utilization percentage. Values should be between 0 and 100.
SNMP walk storage table	SNMP extract of HOST-RESOURCES-MIB::hrStorageTable, used for disk discovery
Threat Version	Currently installed threat definition version. If no threat definition is found, 0 is returned.
Total active ICMP sessions	Total number of active ICMP sessions.
Total active sessions	Total number of active sessions.
Total active TCP sessions	Total number of active TCP sessions.
Total active UDP sessions	Total number of active UDP sessions.
Total Memory	Memory installed in system.
Total supported sessions	Total number of sessions supported.
URL Filtering Version	Currently installed URL filtering version. If no URL filtering is installed, 0 is returned.
Used Memory	Memory actually used by system.

Triggers

Appropriate triggers are associated with the items

Feedback

Please report any issues with the template here in the "Issues" tab.