topic Re: How can I monitor BGP state using SNMP? in General Topics

How can I monitor BGP state using SNMP?

Alisson_Lima — Wed, 24 Apr 2019 22:26:50 GMT

Hi all,

Somebody know anyway how can I monitor BGP state using SNMP? I've several VPN site-to-site between my on-premisses gateway and AWS cloud.

Att,

Alisson Lima

Re: How can I monitor BGP state using SNMP?

PhoneBoy — Thu, 25 Apr 2019 23:19:33 GMT

You can monitor the routing tables via SNMP.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90860

Re: How can I monitor BGP state using SNMP?

Alisson_Lima — Fri, 26 Apr 2019 00:29:56 GMT

Hi PhoneBoy,

Thank you for your response, but I wouldn't to monitor only routing table. Is there any way to monitor only BGP state (Estabilished, Active, Connect or Idle)?

Thank you.

Alisson Lima

Re: How can I monitor BGP state using SNMP?

PhoneBoy — Fri, 26 Apr 2019 15:45:48 GMT

There's no predefined OID for that but you can create a script that gathers the data you're interested in and probe it via SNMP. See section IV-6 of the SK I previously linked to.

Re: How can I monitor BGP state using SNMP?

Northy — Thu, 27 Feb 2020 13:14:15 GMT

Whilst it has been a while since this post has received any update, using the link @PhoneBoy provided I was able to successfully set up monitoring for BGP state via a custom SNMP OID.

At a high level

Stopped the SNMP agent

Created a small shell script that basically ran a clish command and grep'd out my desired information, similar to below

then I added this as an SNMP extend line to "/etc/snmp/userDefinedSettings.conf", similar to below

extend BGP_Status /bin/sh /var/log/my_script/BGP_Status.sh

restarted the SNMP agent.

tested using the SNMP walk command (you need to have 127.0.0.1 under agent interfaces in order to use localhost)

snmpwalk -t 10 -v 2c -c netw0rks localhost NET-SNMP-AGENT-MIB::nsExtensions

from here i used the translate command

snmptranslate -On NET-SNMP-EXTEND-MIB::nsExtendOutLine.\"BGP_Status\"

The value you get back should allow you to monitor via SNMP

I hope it helps someone to get started at least, it is not the prettiest way to get the state and it wouldn't really work for multiple neighbours but for my scenario, it worked.

Re: How can I monitor BGP state using SNMP?

Hugo_Romero — Fri, 24 Sep 2021 13:39:14 GMT

Hi @PhoneBoy , Can you share the Number for SK?

Re: How can I monitor BGP state using SNMP?

_Val_ — Fri, 24 Sep 2021 13:55:15 GMT

@Hugo_Romero The link is above in one of the @PhoneBoy 's replies, but here is the SK number: sk90860

Re: How can I monitor BGP state using SNMP?

Dan_Moesch — Wed, 28 Aug 2024 19:10:33 GMT

It looks like Checkpoint now supports the BGP OID -

.1.3.6.1.2.1.15.3.1.3

I opened a TAC case and this is what they referred me too. Running 81.20, so its possible its part of the 81.20 GAIA update

Re: How can I monitor BGP state using SNMP?

Chris_Atkinson — Thu, 29 Aug 2024 05:42:00 GMT

I'm not sure that's going to do what you hope it might.

bgpPeerFsmEstablishedTime, OID - ".1.3.6.1.2.1.15.3.1.16" may be an alternative depending on your objective.

Re: How can I monitor BGP state using SNMP?

Dan_Moesch — Thu, 29 Aug 2024 12:28:08 GMT

Yes, that is nice for established time. The point of my post is CP doesn't have this documented anywhere and suggested creating a script etc, when its not needed anymore.

Re: How can I monitor BGP state using SNMP?

Chris_Atkinson — Thu, 29 Aug 2024 13:03:31 GMT

Have you confirmed this by testing, my understand of the OID you referenced differs

Re: How can I monitor BGP state using SNMP?

Dan_Moesch — Thu, 29 Aug 2024 13:16:49 GMT

It works very well, in addition I have a nice little to add our SNMP monitoring Dashboard showing peer state, established time etc. Makes it easier for support to look at this dashboard then remoting in to each firewall and running "show bgp peers"

In addition, I created a custom email alert should the BGP Peer state numerical values change from "established" so we get an email alert if a BGP peer session goes down. Since CP only peers with the active, I had to add another SNMP check for "haidentifier" OID so the alert only looks for the state on the active member.