topic Re: monitoring Maestro in Hyperscale Firewall (Maestro)

monitoring Maestro

Wolfgang — Mon, 04 Jan 2021 06:59:40 GMT

Hello CheckMates,

I'm looking for a solution to monitor the state of the individual gateways (not the MHOs).
Last week one of the gateways crashed and was not was available. If you login to a MHO or the SG no statement shown about the failing appliance. Only if you did a mouse over in the orchestrator-view you could see a small hint for lost connectivity with these appliance.
Best way would be to monitor the state via SNMP from external monitoring system, but how can I achieve this ?

How do you monitor your Maestro environments?

Wolfgang

Re: monitoring Maestro

HristoGrigorov — Fri, 29 May 2020 07:32:59 GMT

Install Zabbix and import one of the many available CPFW templates and go from there.

Re: monitoring Maestro

Chris_Atkinson — Fri, 29 May 2020 14:42:01 GMT

1.) asg monitor

2.) asg alert

Re: monitoring Maestro

Wolfgang — Mon, 01 Jun 2020 09:22:52 GMT

@Chris_Atkinson

thanks for your answer.

"asg monitor" needs ssh into the environment to look what happens.

"asg alert", will be fine but is it possible to monitor these states, those for they are alert sending will be configured ?

Maybee with SNMP-Monitoring Tools like CheckMK, PRTG, Nagios, Zabbix etc.

Wolfgang

Re: monitoring Maestro

Peter_Lyndley — Mon, 01 Jun 2020 10:02:57 GMT

Hi Wolfgang,

I personally use Indeni, which makes ssh connection to all managed devices and runs various commands to ascertain the state and health of the firewall. I would recommend it over snmp based tools, simply for its flexibility and as it uses ssh, you can make use of any Check Point or linux os command, rather than trying to work out which OID is useful..... I have no affiliation to Indeni, i am just a user of the product

Re: monitoring Maestro

oliver_gao36 — Mon, 04 Jan 2021 06:50:55 GMT

Hi Wolfgang,

In our test environment, i deployed a PRTG and a Zabbix, they are both working well.

i am going to deploy a Prometheus with Grafana for evaluation, but looks it is a bit complicated.

Re: monitoring Maestro

Chris_Atkinson — Mon, 04 Jan 2021 10:06:17 GMT

For awareness R80.20SP JHF T309 provides some monitoring enhancements.

See sk155832 for details.

Re: monitoring Maestro

Sven_Glock — Tue, 26 Jan 2021 20:31:21 GMT

Hi Wolfgang,

same problem here.

Monitoring the SMO is ok, when all traffic is active on SMO side. (I don't want to say it is good as sometimes there are diffent states on single sgms)
I want to run VSX in VSLS mode on maestro with both sites active.

Implementing monitoring in the existing snmp monitoring would be the easiest.

So I am looking forward the outcome of this threat 😉

Regards

Sven

Re: monitoring Maestro

Chris_Atkinson — Wed, 27 Jan 2021 03:15:43 GMT

In case the below is helpful to some, appreciate that it may not be detailed enough for everyone's taste however.

# snmpwalk -v 2c <snip> .1.3.6.1.4.1.2620.1.48.28.5.1
…
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.2.1.0 = STRING: "1_01"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.2.2.0 = STRING: "1_02"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.2.3.0 = STRING: "1_03"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.2.4.0 = STRING: "1_04"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.2.5.0 = STRING: "1_05"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.2.6.0 = STRING: "1_06"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.2.7.0 = STRING: "1_07"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.3.1.0 = STRING: "ACTIVE"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.3.2.0 = STRING: "ACTIVE"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.3.3.0 = STRING: "DOWN"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.3.4.0 = STRING: "ACTIVE"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.3.5.0 = STRING: "DOWN"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.3.6.0 = STRING: "ACTIVE"
SNMPv2-SMI::enterprises.2620.1.48.28.5.1.3.7.0 = STRING: "ACTIVE"

Source: sk168878