topic Re: monitoring identity awareness in Firewall and Security Management

monitoring identity awareness

Marco_Valenti — Wed, 29 Aug 2018 15:43:55 GMT

Hey checkmates

I would like to know if someone of you is using some sort of script or one liner to monitor the state of identity awareness through command like adlog a dc as an example if the count of events from a dc is equal to zero or something similar.

Thanks in advance

Re: monitoring identity awareness

Claudio_Bolcato — Wed, 29 Aug 2018 19:32:48 GMT

pep show user all
pep show pdp all
dpd conn pep

You can use pdp and pep command for monitoring and troubleshooting identity awareness.
There are many helpful sub commands. Run those commands in expert mode on the gateway.

Re: monitoring identity awareness

Marco_Valenti — Thu, 30 Aug 2018 07:14:39 GMT

probably I was not clear enough , I would like to know if someone of you put something like that into a script that can be monitored via snmp that show a result like if in adlog a dc the count is equal to zero , in large env showing all user won't be enough

Re: monitoring identity awareness

Kaspars_Zibarts — Thu, 30 Aug 2018 13:45:40 GMT

I have it displayed in a small dashboard as we have 3 IDCs in different parts of the world connected to multiple firewalls, so two most critical gateways are in the dashboard reporting two things - that connectivity to IDC is alive (new events are arriving) and total number of users. INT represents 41k chassis with 4 SGM blades each (green tick agaist IDC means that connection to IDC is handled by that specific SGM). EXT is a regular non-chassis gateway. Error seen below unfortunately is part of R76 code on chassis - occasionally it fails to respond to pep s p a command, so my script then reports Error. Code itself is a simple bash script that calls pdp conn adqa or pdp conn idc (depending on GW version) and then pep s p a. Nothing overly complicated

I'm actually planning to "upgrade" this to have all gateways included that run IA. But haven't got time to do it yet..

Re: monitoring identity awareness

Marco_Valenti — Fri, 31 Aug 2018 07:05:20 GMT

Thanks this give me something that I can work on with extend snmp or similar at least trying to clean some output for retrieving the filed Users

Re: monitoring identity awareness

Kaspars_Zibarts — Fri, 31 Aug 2018 09:18:10 GMT

Yep, IA monitoring can be challenging (as it is not 100% stable, especially on R76 chassis). And having multiple VSXes and MDS.. I'm trying to pull this to one place so I can have a quick view of what's happening with IA across all GWs, all CMAs and all IDCs. Food for thought Royi Priov‌?

Re: monitoring identity awareness

Marco_Valenti — Fri, 31 Aug 2018 10:04:21 GMT

indeed , about vsx can you extend snmp per vs too? not so experienced on vsx side.

Your dashboard seems pretty solid instead of this oneliner but seems to do the job at the moment at least

pep s p a | awk -F " " '{print $5}' | grep -v time | sed '/^$/d'

Re: monitoring identity awareness

Kaspars_Zibarts — Fri, 31 Aug 2018 10:19:00 GMT

That's exactly what i do and then check if you have received new events in last two minutes comparing current time vs last event. That's how green tick is updated

Re: monitoring identity awareness

Dan_Roddy — Tue, 26 Mar 2019 15:40:56 GMT

Greetings Kaspars, I switched my Identity source from ADquery to Collector. After installing the first Collector yesterday, it had an issue so I installed Collector on a dedicated 2016 server and it is working very well. However, when I run pdp conn idc I still see the old Collector with Invalid Shared Secret and 5 events in the last hour with last event showing 'no event'. I think this is causing the Alert on my gateway. There should be no alerts. So I went to the bogus Collector and uninstalled it. The old Collector is not listed in Authorized Clients in the Cluster Identity Sources so why does it show in pdp conn idc listing? How do I remove it?

Thank you for your help!

Dan

Re: monitoring identity awareness

Tiago_Cerqueira — Sat, 31 Jul 2021 01:09:55 GMT

Hi Kaspars,

Sorry to resurrect this old thread, but it still seems there is no good way to monitor IDC events.

I'm currently trying to achieve the same as the OP and yourself have done, a way to monitor the reception of IDC events on the gateway itself.

I can write a quick script that will fetch these values via SSH, but I'd prefer to perform this via SNMP. I've looked through the identityServer MIB(1.3.6.1.4.1.2620.1.38), but from here I'm only able to monitor the number of events being received on the collector machine itself.

So far, I'd like to avoid using SSH, but I keep coming back to it as it is the easiest approach. Is there no way around using SSH? I've considered several, such as using extended SNMP and a custom OID or by executing a script in the gateway itself (using cpd_sched_config) and sending the result back to the snmp manager), but I wonder if I should just bite the bullet and use SSH

To be clear, I would like to query the GW (or the IDC itself), for the same information showed, in the Gateways tab, under columns "Events in last hour" and "Last event send time

Let me know your inputs. Thanks!

Re: monitoring identity awareness

Tiago_Cerqueira — Tue, 03 Aug 2021 00:24:47 GMT

I found a way to do this without SNMP or SSH, by using the gaia_api run-script. You can run any expert command there, that includes pdp conn idc. Then I just need to handle it on the client side

I plan to release a nagios plugin that will monitor the events received on the firewall per IDC and alert if they drop or if one (or all) stop receiving events inside a threshold.

Re: monitoring identity awareness

KostasGR — Tue, 03 Aug 2021 06:02:32 GMT

Hello all,

Does anyone knows the oid in order to monitor the value of pep users (100) from the below table?

pep show pdp all
Command: root->show->pdp->all
---------------------------------------------------------------------------
| Direction | IP | ID | Status | Users | Connect time |
---------------------------------------------------------------------------
| Incoming | w.z.y.x | 0 | Connected | 39 |-------------------- |
---------------------------------------------------------------------------
| Incoming | x.y.z.w | 0 | Connected | 100 | ------------------- |
---------------------------------------------------------------------------
| Outgoing | x.y.z.w | 0 | Connected | N/A | -----------------|
---------------------------------------------------------------------------

BR,

Kostas

Re: monitoring identity awareness

David_Evans — Mon, 24 Jan 2022 12:16:07 GMT

Did you get anywhere with this? I was headed down the same path and didn't want to recreate the wheel.

Re: monitoring identity awareness

Tiago_Cerqueira — Tue, 25 Jan 2022 11:46:23 GMT

Hi,

I do have some code that runs the pdp idc conn command via API, but I didn't get to the processing part (not much time available to work on this). I'd be willing to share that if you'd like.