End-of-Life (EoL)

Forward Traps to an SNMP Manager

Simple Network Management Protocol (SNMP) traps can alert you to system events (failures or changes in hardware or software of Palo Alto Networks firewalls) or to threats (traffic that matches a firewall security rule) that require immediate attention.
To see the list of traps that Palo Alto Networks firewalls support, use your SNMP Manager to access the panCommonEventEventsV2 MIB. For details, see Use an SNMP Manager to Explore MIBs and Objects.
For details on how for Palo Alto Networks firewalls implement SNMP, see SNMP Support.
  1. Enable the SNMP manager to interpret the traps it receives.
    Load the Supported MIBs for Palo Alto Networks firewalls and, if necessary, compile them. For the specific steps, refer to the documentation of your SNMP manager.
  2. Configure an SNMP Trap server profile.
    The profile defines how the firewall accesses the SNMP managers (trap servers). You can define up to four SNMP managers for each profile.
    Optionally, configure separate SNMP Trap server profiles for different log types, severity levels, and WildFire verdicts.
    1. Log in to the firewall web interface.
    2. Select
      Server Profiles
      SNMP Trap
    3. Click
      and enter a
      for the profile.
    4. If the firewall has more than one virtual system (vsys), select the
      (vsys or
      ) where this profile is available.
    5. Select the SNMP
      and configure the authentication values as follows. For version details, see SNMP Support.
      • V2c
        —For each server, click
        and enter the server
        , IP address (
        SNMP Manager
        ), and
        Community String
        . The community string identifies a community of SNMP managers and monitored devices, and serves as a password to authenticate the community members to each other.
      As a best practice, don’t use the default community string
      ; it’s well known and therefore not secure.
      • V3
        —For each server, click
        and enter the server
        , IP address (
        SNMP Manager
        ), SNMP
        account (this must match a username defined in the SNMP manager),
        used to uniquely identify the firewall (you can leave the field blank to use the firewall serial number), authentication password (
        Auth Password
        ) used to authenticate to the server, and privacy password (
        Priv Password
        ) used to encrypt SNMP messages to the server.
    6. Click
      to save the server profile.
  3. Configure log forwarding.
    1. Configure the destinations of Traffic, Threat, and WildFire traps:
      1. 2 For each log type and each severity level or WildFire verdict, select the
        SNMP Trap
        server profile.
      2. 3 The rules will trigger trap generation and forwarding.
    2. 4 For each log (trap) type and severity level, select the
      SNMP Trap
      server profile.
    3. Click
  4. Monitor the traps in an SNMP manager.
    Refer to the documentation of your SNMP manager.
    When monitoring traps related to firewall interfaces, you must match the interface indexes in the SNMP manager with interface names in the firewall web interface. For details, see Firewall Interface Identifiers in SNMP Managers and NetFlow Collectors.

Recommended For You