Monitor Panorama and Log Collector Statistics Using SNMP
You can configure an SNMP manager to request information from a Panorama management server and configure Panorama to respond. For example, the SNMP manager can request the high availability (HA) mode, Panorama state, and Panorama version. If the Panorama management server has a local Log Collector, then Panorama can also provide logging statistics: average logs per second, storage duration, retention periods, log disk usage, log forwarding status from individual firewalls to Panorama and external servers, and the status of firewall-to-Log Collector connections. Panorama doesn’t synchronize SNMP configurations between HA peers; you must enable SNMP requests and responses on each peer.
You can also configure a Dedicated Log Collector to respond to requests for the same logging statistics as the Panorama management server. This information is useful when evaluating whether you need to expand log storage capacity.
You can’t configure an SNMP manager to control Panorama or Log Collectors (using SET messages); an SNMP manager can only collect statistics (using GET messages).
For details on how Panorama implements SNMP, see SNMP Support.
- Configure the SNMP Manager to get statistics from
Panorama and the Log Collectors.The following steps are an overview of the tasks you perform on the SNMP manager. For the specific steps, refer to the documentation of your SNMP manager.
- To enable the SNMP manager to interpret statistics, load the Supported MIBs and, if necessary, compile them.
- For each Panorama appliance that the SNMP manager
will monitor, define its connection settings (IP address and port)
and authentication settings (SNMPv2c community string or SNMPv3
username and password). All Panorama appliances use port 161.The SNMP manager can use the same or different connection and authentication settings for multiple Panorama management servers and Log Collectors. The settings must match those you define when you configure SNMP on Panorama (see Step Configure the Panorama management server to respond to statistics requests from an SNMP manager. and Step Configure the Dedicated Log Collectors (if any) to respond to SNMP requests.). For example, if you use SNMPv2c, the community string you define when configuring Panorama must match the community string you define in the SNMP manager for Panorama.
- Determine the object identifiers (OIDs) of the statistics you will monitor. For example, to monitor the logging rate, a MIB browser shows that this statistic corresponds to OID 126.96.36.199.4.1.254188.8.131.52.1.1 in PAN-PRODUCT-MIB.my. For details, see Use an SNMP Manager to Explore MIBs and Objects.
- Configure the SNMP manager to monitor the desired OIDs.
- Enable SNMP traffic on the management (MGT) interface
of the Panorama management server.
- Select PanoramaSetupManagement and edit the Management Interface Settings.
- In the Services section, select the SNMP check box and click OK.
- Enable SNMP traffic on the management (MGT) interface
of any M-Series appliances in Log Collector mode:
- Select PanoramaManaged Collectors and select the Log Collector.
- Select the Management tab, select the SNMP check box, and click OK.
the Panorama management server to respond to statistics requests
from an SNMP manager.
- Select PanoramaSetupOperations and, in the Miscellaneous section, click SNMP Setup.
- Select the SNMP Version and
configure the authentication values as follows. For version details,
see SNMP Support.
- V2c—Enter the SNMP Community String, which identifies a community of SNMP managers and monitored devices (Panorama, in this case), and serves as a password to authenticate the community members to each other.Don’t use the default community string public; it is well known and therefore not secure.
- V3—Create at least one SNMP view group and one user. User accounts and views provide authentication, privacy, and access control when SNMP managers get statistics.Views—Each view is a paired OID and bitwise mask: the OID specifies a MIB, and the mask (in hexadecimal format) specifies which objects are accessible inside (include matching) or outside (exclude matching) that MIB. Click Add in the first list and enter a Name for the group of views. For each view in the group, click Add and configure the view Name, OID, matching Option (include or exclude), and Mask.Users—Click Add in the second list, enter a username in the Users column, select the View group from the drop-down, enter the authentication password (Auth Password) used to authenticate to the SNMP manager, and enter the privacy password (Priv Password) used to encrypt SNMP messages to the SNMP manager.
- Click OK to save the settings.
the Dedicated Log Collectors (if any) to respond to SNMP requests.For each Collector Group:
- Select PanoramaCollector Groups and select the Collector Group.
- Select the Monitoring tab, configure the same settings as in Step 4, and click OK.
- Commit the changes to Panorama and push the changes to
- Select CommitCommit and Push and Edit Selections in the Push Scope.
- Select Collector Groups you, select the Collector Groups you edited, and click OK.
- Commit and Push your changes.
- Monitor the Panorama and Log Collector statistics in
an SNMP manager.Refer to the documentation of your SNMP manager.
Monitor Statistics Using SNMP
Monitor Statistics Using SNMP The statistics that a Simple Network Management Protocol (SNMP) manager collects from Palo Alto Networks firewalls can help you gauge the ...
SNMP Support You can use an SNMP manager to monitor event-driven alerts and operational statistics for the firewall, Panorama, or WF-500 appliance and for the ...
Enable SNMP Monitoring
Enable SNMP Monitoring Device > Setup > Operations Simple Network Management Protocol (SNMP) is a standard protocol for monitoring the devices on your network. Select ...
Device > Server Profiles > SNMP Trap
Device > Server Profiles > SNMP Trap Simple Network Management Protocol (SNMP) is a standard protocol for monitoring the devices on your network. To alert ...
Forward Traps to an SNMP Manager
Forward Traps to an SNMP Manager Simple Network Management Protocol (SNMP) traps can alert you to system events (failures or changes in hardware or software ...
Collector Group Configuration
Collector Group Configuration To configure a Collector Group , click Add and complete the following fields. Collector Group Settings Configured In Description Name Panorama Collector ...
Monitor Panorama To monitor Panorama and its managed collectors, you can periodically view their System and Config logs ( filter logs by type), configure an ...
Configure Log Forwarding from Panorama to External Destinations
Configure Log Forwarding from Panorama to External Destinations Panorama enables you to forward logs to external services, including syslog, email, SNMP trap, and HTTP-based services. ...
Use an SNMP Manager to Explore MIBs and Objects
Use an SNMP Manager to Explore MIBs and Objects To use SNMP for monitoring Palo Alto Networks firewalls, Panorama, or WF-500 appliances, you must first ...