Эта страница ещё не переведена: показана английская версия.
Palo Alto PAN-OS¶
A Palo Alto Networks firewall (physical or VM-Series) through the PAN-OS XML API: interfaces bound to a zone that lost their link, an HA pair that lost its peer or is out of sync, a session table filling up, management CPU and memory, licences and subscriptions expiring, and a failed configuration commit.
Beta
This integration was built from Palo Alto Networks' XML API documentation,
not against a running firewall. Every call is a read, but the shape of some
answers (HA state, show system resources, show interface all) is the
least documented: tell us what breaks.
DumbMonit uses a role-based account whose role only allows XML API
operational requests. The API key goes in the X-PAN-KEY header, never in the
URL (the older ?key= form would leave it in access logs). Requests are sent
as POST forms. With a user name and password, DumbMonit asks the firewall for a
key (type=keygen, credentials in the request body), keeps it for an hour and
asks again when it is refused; with an API key you generated yourself, it is
used as is.
Every minute DumbMonit runs one required operational command, show system
info, and six optional ones that a narrower role, or a firewall without a
cluster, may refuse without failing the rest: show system resources, show
session info, show high-availability state, request license info, show
interface all and show jobs all.
Network ports to open¶
From the DumbMonit server (or its relay agent) to the device:
| Port | Protocol | Purpose |
|---|---|---|
| 443 | TCP | Management interface (HTTPS, default) |
What it watches¶
All metrics are prefixed dumbmonit_paloalto_.
| Metric | Labels | Meaning |
|---|---|---|
version_info |
version, model, hostname |
Value 1. |
uptime_seconds |
Time since boot. | |
cpu_usage_percent, memory_used_percent |
Management plane, read from the text output of show system resources (CPU: 100 minus idle; memory: without buffers and cache). Left out when the output cannot be read. |
|
sessions, sessions_max, session_usage_percent |
Active sessions, capacity of the session table, and the share used. | |
session_setup_rate, packets_per_second, throughput_kbps |
Rates from show session info. |
|
ha_enabled |
1 when HA is configured. | |
ha_state_info |
state, peer_state |
Value 1, with the local and peer HA states. |
ha_local_functional |
0 when the local state is suspended or non-functional. |
|
ha_peer_up |
1 when the peer is active or passive and the HA link to it is up. | |
ha_in_sync |
1 when the running configuration is synchronized. | |
interface_link_up |
interface, zone |
Physical link of ethernet and ae interfaces. |
interface_down |
interface, zone |
1 when the interface is bound to a zone and has no link. Ports without a zone are left alone. |
interface_speed_mbps |
interface, zone |
While the link is up. |
interface_address_info |
interface, description, address, vlan |
Value 1, the IPv4 network of the interface (used by the topology map). |
interfaces_down |
Count. | |
license_status_info |
license, status |
Value 1, for every licence listed. |
license_expired |
license |
1 when expired. |
license_expiry_seconds |
license |
Until expiry; negative once expired. Licences that never expire have none. |
last_commit_ok |
1 when the latest finished commit succeeded (a commit with warnings counts as succeeded). |
The built-in rules that apply:
- Palo Alto interface without link: for five minutes (Advisory).
- Palo Alto HA peer lost: for two minutes (Warning).
- Palo Alto HA out of sync: for fifteen minutes (Advisory).
- Palo Alto HA member not functional: for five minutes (Warning).
- Palo Alto session table filling up: above 90 % for ten minutes (Advisory).
- Palo Alto management CPU high and memory high: above 90 % for fifteen minutes (Advisory).
- Palo Alto licence expiring: less than 30 days left, or expired (Advisory, reminded daily).
- Palo Alto commit failed: the latest commit failed (Info, reminded daily).
The monitor page¶
The Firewall panel says what is wrong in a sentence, shows CPU, memory, sessions and the HA state, then lists the interfaces without link and the licences expiring within 60 days or expired.
Create a read-only XML API account for DumbMonit¶
-
Device → Admin Roles → Add: name the role as follows. On the XML API tab enable Operational Requests only; leave every other privilege, and the Web UI and Command Line tabs, disabled.
dumbmonit-ro -
Device → Administrators → Add: name the account as follows, set Authentication to a password, the type to Role Based and the role to the one above.
dumbmonit -
Click Commit: the role and the account exist only once committed.
-
In DumbMonit, enter the firewall address (pa.lan) with that user name and password, or with an API key you generated for that account.
Required permissions¶
- XML API → Operational Requests: enabled — show system info, resources, sessions, interfaces, HA state, jobs and licence info
- Every other XML API privilege: disabled — Configuration, Commit, Export, Import, Report, Log and User-ID Agent are not needed
- Web UI and Command Line: disabled — The account never signs in interactively
Warning
The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.
Vendor documentation: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api
Notes¶
-
To generate the key yourself instead of letting DumbMonit do it:
curl -k -X POST "https://pa.lan/api/?type=keygen" -d "user=dumbmonit" --data-urlencode "password=..."
Paste the <key> of the answer as API key. A key generated for a role-based
account carries that role's limits.
- The management interface must allow HTTPS; it does by default. Behind a
data-plane interface, allow HTTPS in its management profile.
- Only the management plane is measured for CPU and memory. Data-plane load
is not read.
- Global Protect, IPsec tunnel and URL-filtering figures are not read: they are
not covered by the commands above.
Credentials¶
| Credential | Fields |
|---|---|
| User name and password | The account created above; DumbMonit asks the firewall for an API key with it. |
| API key | A key already generated for that account, sent as X-PAN-KEY. |
Address: the host name or IP of the firewall, host:port, or a URL. Options:
- Port (443): the HTTPS port of the management interface.
- Accept an unverifiable certificate: the firewall's own certificate is self-signed.
- Timeout per request (15 s).
Troubleshooting¶
"PAN-OS refused the credentials (403)": wrong or revoked key, wrong password, or the role does not allow Operational Requests. Commit the role and the account, then try again.
"PAN-OS refused the request (16: Unauthorized request)": the role lacks the Operational Requests privilege.
No HA, licence, session or interface figure: the role cannot run that command, or the firewall has no cluster; the rest is still read.