topic Monitoring Data Center objects in Firewall and Security Management

Monitoring Data Center objects

Tiago_Cerqueira — Tue, 04 Jan 2022 11:18:22 GMT

Hi,

I'm looking into monitoring the data center objects update status; if they are able to update, when was the last update and status of the last update, etc.

Is this feasible? Can I check this via command line?

Re: Monitoring Data Center objects

Tal_Paz-Fridman — Tue, 04 Jan 2022 12:54:51 GMT

Not sure if this is what you mean but there are Management API commands that might help:

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-data-center-objects~v1.8%20

Re: Monitoring Data Center objects

Tiago_Cerqueira — Tue, 04 Jan 2022 18:16:10 GMT

It's definitely a good start. Querying the API and checking for each object when it was the last update of said object is a good start (more than 10m without update, for example, and it would trigger an alert)

Would it also be possible to use PDP and PEP to achieve this on the gateway itself? If so, it might also be possible to do something with SNMP.

Re: Monitoring Data Center objects

Pauli — Wed, 05 Jan 2022 11:02:44 GMT

You can monitor the state of the connected DCs via SNMP on the primary SMS (sk124532):

1.3.6.1.4.1.2620.1.52.101.0 Disconnected Datacenters

1.3.6.1.4.1.2620.1.52.3.0 Connected Datacenters

Also you can check other states of the Cloudguard Controller via snmp - Imported objects, Controller updates, ....

Re: Monitoring Data Center objects

Tiago_Cerqueira — Wed, 05 Jan 2022 14:52:35 GMT

Just something I found along the way, it's also possible to check the status of these objects and the connected gateways using cpstat vsec on the proper CMA. It will provide the following ouput:

# cpstat vsec

vSEC Controller Status: on
Number of disconnected Data Centers: 0
Number of Data Centers: 1
Number of imported Data Center objects: 1
Number of gateways enforcing Data Center objects: 1

Gateways Enforcing Data Center Objects
---------------------------------------------------
|Name |IP |Version|Update status|
---------------------------------------------------
|A_GATEWAY|10.x.x.x|R80.40 |Succeeded |
---------------------------------------------------