Palo Alto Networks

Palo Alto Networks

Palo Alto Networks, Inc. is an American multinational cybersecurity company with headquarters in Santa Clara, California. Its core products are a platform that includes advanced firewalls and cloud-based offerings that extend those firewalls to cover other aspects of security.

Available solutions




This template is for Zabbix version: 7.2
Also available for: 7.0

Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/net/paloalto/paloalto_pa440?at=release/7.2

Palo Alto PA-440 by HTTP

Overview

This template is designed for the effortless deployment of Palo Alto PA-440 monitoring by Zabbix via XML API and doesn't require any external scripts.

For more details about PAN-OS API, refer to the official documentation.

Requirements

Zabbix version: 7.2 and higher.

Tested versions

This template has been tested on:

  • Palo Alto PA-440, PAN-OS 11.2.4-h1

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

Configure a user for monitoring. Note that in order to retrieve the device certificate information, superuser privileges are required. If you opt for a user with limited access (for security reasons), the device certificate expiration metrics will not be discovered.

Superuser privileges user (full access to all data):

  1. Add a new administrator user. Go to Device > Administrators and click Add.
  2. Enter the necessary details. Set the Administrator Type to Dynamic and select the built-in Superuser role. Commit the changes.

Limited privileges user (no access to device certificate data):

  1. Create a new Admin Role. Go to Device > Admin Role and click Add.
  2. Enter the necessary details. Adjust the list of permissions:
  • Restrict access to all sections in the Web UI tab
  • Allow access to the Configuration and Operational Requests sections in the XML API tab
  • Check that the access to CLI is set to None in the Command Line tab
  • Restrict access to all sections in the REST API tab
  1. Add a new administrator user. Go to Device > Administrators and click Add.
  2. Enter the necessary details. Set the Administrator Type to Role Based and select the profile that was created in the previous steps. Commit the changes.

Set the host macros:

  1. Set the firewall XML API endpoint URL in the {$PAN.PA440.API.URL} macro in the format <scheme>://<host>[:port]/api (port is optional).
  2. Set the name of the user that you created in the {$PAN.PA440.USER} macro.
  3. Set the password of the user that you created in the {$PAN.PA440.PASSWORD} macro.

Macros used

Name Description Default
{$PAN.PA440.API.URL}

The firewall XML API endpoint in the format <scheme>://<host>[:port]/api (port is optional).
{$PAN.PA440.HTTP_PROXY}

The HTTP proxy for HTTP agent items (set if needed). If the macro is empty, then no proxy is used.
{$PAN.PA440.TIMEOUT}

The timeout threshold for the HTTP items that retrieve data from the API.

 15s
{$PAN.PA440.USER}

The name of the user that is used for monitoring.

 zbx_monitor
{$PAN.PA440.PASSWORD}

The password of the user that is used for monitoring.
{$PAN.PA440.HA.CONFIG_SYNC.THRESH}

The threshold for the configuration synchronization trigger. Can be set to an evaluation period in seconds (time suffixes can be used) or an evaluation range of the latest collected values (if preceded by a hash mark).

 #1
{$PAN.PA440.HA.STATE.IGNORE_USER_SUSPENDED}

Controls whether the HA "suspended" state trigger should fire if the state is caused by the user request. "1" - ignored, "0" - not ignored.

 1
{$PAN.PA440.IF.HW.IFNAME.MATCHES}

The interface name regex filter to use in hardware interface discovery - for including.

 .+
{$PAN.PA440.IF.HW.IFNAME.NOT_MATCHES}

The interface name regex filter to use in hardware interface discovery - for excluding.

 ^(?:tunnel|vlan|loopback)$
{$PAN.PA440.IF.HW.CONTROL}

The link status triggers will fire only for hardware interfaces where the context macro equals "1".

 1
{$PAN.PA440.IF.HW.ERRORS.WARN}

The warning threshold of the packet error rate for hardware interfaces. Can be used with the hardware interface name as context.

 2
{$PAN.PA440.IF.HW.UTIL.MAX}

The threshold in the hardware interface utilization triggers.

 90
{$PAN.PA440.IF.SW.IFNAME.MATCHES}

The interface name regex filter to use in logical interface discovery - for including.

 .+
{$PAN.PA440.IF.SW.IFNAME.NOT_MATCHES}

The interface name regex filter to use in logical interface discovery - for excluding.

 ^(?:tunnel|vlan|loopback)$
{$PAN.PA440.IF.SW.IFZONE.MATCHES}

The interface zone name regex filter to use in logical interface discovery - for including.

 .+
{$PAN.PA440.IF.SW.IFZONE.NOT_MATCHES}

The interface zone name regex filter to use in logical interface discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.IF.SW.VSYS.MATCHES}

The interface virtual system name regex filter to use in logical interface discovery - for including.

 .+
{$PAN.PA440.IF.SW.VSYS.NOT_MATCHES}

The interface virtual system name regex filter to use in logical interface discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.IF.SW.ERRORS.WARN}

The warning threshold of the packet error rate for logical interfaces. Can be used with the logical interface name as context.

 2
{$PAN.PA440.BGP.PEER.NAME.MATCHES}

The BGP peer name regex filter to use in BGP peer discovery - for including.

 .+
{$PAN.PA440.BGP.PEER.NAME.NOT_MATCHES}

The BGP peer name regex filter to use in BGP peer discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.BGP.PEER.GROUP.MATCHES}

The BGP peer group regex filter to use in BGP peer discovery - for including.

 .+
{$PAN.PA440.BGP.PEER.GROUP.NOT_MATCHES}

The BGP peer group regex filter to use in BGP peer discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.BGP.CONTROL}

The BGP session triggers will fire only for peers where the context macro equals "1".

 1
{$PAN.PA440.OSPF.NEIGHBOR.ADDR.MATCHES}

The OSPF neighbor address regex filter to use in OSPF neighbor discovery - for including.

 .+
{$PAN.PA440.OSPF.NEIGHBOR.ADDR.NOT_MATCHES}

The OSPF neighbor address regex filter to use in OSPF neighbor discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.OSPF.NEIGHBOR.AREA.MATCHES}

The OSPF neighbor area regex filter to use in OSPF neighbor discovery - for including.

 .+
{$PAN.PA440.OSPF.NEIGHBOR.AREA.NOT_MATCHES}

The OSPF neighbor area regex filter to use in OSPF neighbor discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.OSPF.CONTROL}

The OSPF neighbor triggers will fire only for neighbors where the context macro equals "1".

 1
{$PAN.PA440.OSPFV3.NEIGHBOR.ADDR.MATCHES}

The OSPFv3 neighbor address regex filter to use in OSPFv3 neighbor discovery - for including.

 .+
{$PAN.PA440.OSPFV3.NEIGHBOR.ADDR.NOT_MATCHES}

The OSPFv3 neighbor address regex filter to use in OSPFv3 neighbor discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.OSPFV3.NEIGHBOR.AREA.MATCHES}

The OSPFv3 neighbor area regex filter to use in OSPFv3 neighbor discovery - for including.

 .+
{$PAN.PA440.OSPFV3.NEIGHBOR.AREA.NOT_MATCHES}

The OSPFv3 neighbor area regex filter to use in OSPFv3 neighbor discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.OSPFV3.CONTROL}

The OSPFv3 neighbor triggers will fire only for neighbors where the context macro equals "1".

 1
{$PAN.PA440.LICENSE.FEATURE.MATCHES}

The license feature name regex filter to use in license discovery - for including.

 .+
{$PAN.PA440.LICENSE.FEATURE.NOT_MATCHES}

The license feature name regex filter to use in license discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.LICENSE.DESC.MATCHES}

The license feature description regex filter to use in license discovery - for including.

 .+
{$PAN.PA440.LICENSE.DESC.NOT_MATCHES}

The license feature description regex filter to use in license discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.LICENSE.EXPIRY.WARN}

The time threshold until the license expires; used in the license expiry trigger. Can be set to an evaluation period in seconds (time suffixes can be used). Can be used with the license feature name as context.

 7d
{$PAN.PA440.CERT.DEVICE.EXPIRY.WARN}

The time threshold until the device certificate expires; used in the device certificate expiry trigger. Can be set to an evaluation period in seconds (time suffixes can be used).

 7d
{$PAN.PA440.CERT.NAME.MATCHES}

The certificate name regex filter to use in certificate discovery - for including.

 .+
{$PAN.PA440.CERT.NAME.NOT_MATCHES}

The certificate name regex filter to use in certificate discovery - for excluding.

 CHANGE_IF_NEEDED
{$PAN.PA440.CERT.EXPIRY.WARN}

The time threshold until the certificate expires; used in the certificate expiry trigger. Can be set to an evaluation period in seconds (time suffixes can be used). Can be used with the certificate name as context.

 7d

Items

Name Description Type Key and additional info
Get system info

Get the general system information.

 HTTP agent pan.pa440.system_info.get

Preprocessing

  • XML to JSON
Get session info

Get the information about sessions.

 HTTP agent pan.pa440.session_info.get

Preprocessing

  • XML to JSON
Get system state

Get the system state information. Used with a filter to retrieve CPU utilization metrics.

 HTTP agent pan.pa440.system_state.get

Preprocessing

  • XML to JSON
Get system environmentals

Get the system environment state information.

 HTTP agent pan.pa440.environmentals.get

Preprocessing

  • XML to JSON
Get HA info

Get the high availability information.

 HTTP agent pan.pa440.ha.get

Preprocessing

  • XML to JSON
Get OSPF neighbors

Get the OSPF neighbor information.

 HTTP agent pan.pa440.ospf.neighbors.get

Preprocessing

  • XML to JSON

  • JavaScript: The text is too long. Please see the template.
Get OSPFv3 neighbors

Get the OSPFv3 neighbor information.

 HTTP agent pan.pa440.ospfv3.neighbors.get

Preprocessing

  • XML to JSON

  • JavaScript: The text is too long. Please see the template.
Get licenses

Get the information about installed licenses.

 HTTP agent pan.pa440.licenses.get

Preprocessing

  • XML to JSON

  • JavaScript: The text is too long. Please see the template.
Get device certificate

Get the information about the device certificate. Note that superuser privileges are required to obtain the device certificate data.

 HTTP agent pan.pa440.certificate.device.get

Preprocessing

  • XML to JSON
Get certificates

Get the information about the certificates on the device.

 HTTP agent pan.pa440.certificate.get

Preprocessing

  • XML to JSON

  • JavaScript: The text is too long. Please see the template.
Get system info check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.system_info.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get session info check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.session_info.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get system state check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.system_state.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get system environmental check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.environmentals.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get HA info check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.ha.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get OSPF neighbor check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.ospf.neighbors.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get OSPFv3 neighbor check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.ospfv3.neighbors.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get license check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.licenses.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get device certificate check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.certificate.device.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
Get certificate check

Data collection check. Check the latest values for details.

 Dependent item pan.pa440.certificate.get.check

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h
App-ID version

Currently installed application definition version. If no application definition is found, 0 is returned.

 Dependent item pan.pa440.app_id.version

Preprocessing

  • JSON Path: $.response.result.system['app-version']

  • Discard unchanged with heartbeat: 12h
App-ID release date

Currently installed application definition release date. If no release date is found, the value is discarded.

 Dependent item pan.pa440.app_id.release_date

Preprocessing

  • JSON Path: $.response.result.system['app-release-date']

    ⛔️Custom on fail: Discard value

  • Discard unchanged with heartbeat: 12h
GlobalProtect client package version

Currently installed GlobalProtect client package version. If package is not installed, "0.0.0" is returned.

 Dependent item pan.pa440.gp.client.version

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 12h
Threat version

Currently installed threat definition version. If no threat definition is found, "0" is returned.

 Dependent item pan.pa440.threat.version

Preprocessing

  • JSON Path: $.response.result.system['threat-version']

  • Discard unchanged with heartbeat: 12h
URL filtering version

Currently installed URL filtering version. If no URL filtering is installed, "0" is returned.

 Dependent item pan.pa440.url_filtering.version

Preprocessing

  • JSON Path: $.response.result.system['url-filtering-version']

  • Discard unchanged with heartbeat: 12h
PAN-OS version

Full software version. The first two components of the full version are the major and minor versions. The third component indicates the maintenance release number.

 Dependent item pan.pa440.os.version

Preprocessing

  • JSON Path: $.response.result.system['sw-version']

  • Discard unchanged with heartbeat: 12h
Serial number

The serial number of the unit. If not available, an empty string is returned.

 Dependent item pan.pa440.serial_number

Preprocessing

  • JSON Path: $.response.result.system.serial

  • Discard unchanged with heartbeat: 12h
Host name

The host name of the system.

 Dependent item pan.pa440.hostname

Preprocessing

  • JSON Path: $.response.result.system.hostname

  • Discard unchanged with heartbeat: 12h
Uptime

The system uptime.

 Dependent item pan.pa440.uptime

Preprocessing

  • JSON Path: $.response.result.system.uptime

  • JavaScript: The text is too long. Please see the template.
Sessions: Supported, total

Total number of supported sessions.

 Dependent item pan.pa440.sessions.supported.total

Preprocessing

  • JSON Path: $.response.result['num-max']

  • Discard unchanged with heartbeat: 12h
Sessions: Active, total

Total number of active sessions.

 Dependent item pan.pa440.sessions.active.total

Preprocessing

  • JSON Path: $.response.result['num-active']
Sessions: Session table utilization, in %

Session table utilization in percent.

 Dependent item pan.pa440.sessions.table_util

Preprocessing

  • JavaScript: The text is too long. Please see the template.
Sessions: TCP, active

Total number of active TCP sessions.

 Dependent item pan.pa440.sessions.tcp.active

Preprocessing

  • JSON Path: $.response.result['num-tcp']
Sessions: UDP, active

Total number of active UDP sessions.

 Dependent item pan.pa440.sessions.udp.active

Preprocessing

  • JSON Path: $.response.result['num-udp']
Sessions: ICMP, active

Total number of active ICMP sessions.

 Dependent item pan.pa440.sessions.icmp.active

Preprocessing

  • JSON Path: $.response.result['num-icmp']
Data Plane: CPU utilization, in %

The average percentage of time over the last minute that this processor was not idle. Implementations may approximate this one-minute smoothing period if necessary.

 Dependent item pan.pa440.data_plane.cpu.util

Preprocessing

  • JSON Path: $.response.result

  • Regular expression: (?m)^sys\.monitor\.s1\.dp0\.exports:.*1minavg'?:\s*(\d+) \1
Management Plane: CPU utilization, in %

The average percentage of time over the last minute that this processor was not idle. Implementations may approximate this one-minute smoothing period if necessary.

 Dependent item pan.pa440.management_plane.cpu.util

Preprocessing

  • JSON Path: $.response.result

  • Regular expression: (?m)^sys\.monitor\.s1\.mp\.exports:.*1minavg'?:\s*(\d+) \1
CPU temperature

The CPU temperature in degrees Celsius.

 Dependent item pan.pa440.cpu.temp

Preprocessing

  • JSON Path: $.response.result.thermal.Slot1.entry.DegreesC

Triggers

Name Description Expression Severity Dependencies and additional info
PA-440: Failed to get system info data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.system_info.get.check))>0 High
PA-440: Failed to get session info data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.session_info.get.check))>0 High
PA-440: Failed to get system state data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.system_state.get.check))>0 High
PA-440: Failed to get environmental data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.environmentals.get.check))>0 High
PA-440: Failed to get HA data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.get.check))>0 High
PA-440: Failed to get OSPF neighbor data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.ospf.neighbors.get.check))>0 High
PA-440: Failed to get OSPFv3 neighbor data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.ospfv3.neighbors.get.check))>0 High
PA-440: Failed to get license data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.licenses.get.check))>0 High
PA-440: Failed to get device certificate data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.certificate.device.get.check))>0 High
PA-440: Failed to get certificate data from the API

Failed to get data from the API. Check the latest values for details.

 length(last(/Palo Alto PA-440 by HTTP/pan.pa440.certificate.get.check))>0 High

LLD rule HA metric discovery

Name Description Type Key and additional info
HA metric discovery

Discovers high availability metrics.

 Dependent item pan.pa440.ha.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 12h

Item prototypes for HA metric discovery

Name Description Type Key and additional info
HA state

The current state of high availability.

Information about high availability states:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states

 Dependent item pan.pa440.ha.local[state{#SINGLETON}]

Preprocessing

  • JSON Path: $.response.result.group['local-info'].state

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h
HA state reason

The reason for the current state of high availability. May be absent in the master item data in some cases; set to an empty string if not found.

Information about high availability states:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states

 Dependent item pan.pa440.ha.local[state_reason{#SINGLETON}]

Preprocessing

  • JSON Path: $.response.result.group['local-info']['state-reason']

    ⛔️Custom on fail: Set value to:

  • Discard unchanged with heartbeat: 1h
HA peer state

The current peer state of high availability.

Information about high availability states:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states

 Dependent item pan.pa440.ha.peer[state{#SINGLETON}]

Preprocessing

  • JSON Path: $.response.result.group['peer-info'].state

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h
HA configuration synchronization status

The current state of the running configuration synchronization.

 Dependent item pan.pa440.ha[config_sync_status{#SINGLETON}]

Preprocessing

  • JSON Path: $.response.result.group['running-sync']
HA mode

The current mode of high availability. Possible values:

0 - Active-Passive

1 - Active-Active

2 - Unknown

 Dependent item pan.pa440.ha[mode{#SINGLETON}]

Preprocessing

  • JSON Path: $.response.result.group.mode

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1d

Trigger prototypes for HA metric discovery

Name Description Expression Severity Dependencies and additional info
PA-440: HA state has been changed

The high availability state has changed. The following state transitions are checked:

1. Active-Passive HA mode:
- "passive" > "active"
- "active" > "passive"

2. Active-Active HA mode:
- "active-secondary" > "active-primary"
- "active-primary" > "active-secondary"

Information about high availability states:
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states

 (last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}])=1 and last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}],#2)=2) or (last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}])=2 and last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}],#2)=1) or (last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}])=3 and last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}],#2)=4) or (last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}])=4 and last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}],#2)=3) High
PA-440: HA is in "non-functional" state

Error state due to a dataplane failure or a configuration mismatch such as: only one firewall configured for packet forwarding, VR sync, or QoS sync.

In active/passive mode, all of the causes listed for the tentative state cause the non-functional state:
- Failure of a firewall.
- Failure of a monitored object (a link or path).
- The firewall leaves the suspended or non-functional state.

Information about high availability states:
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states

 last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}])=6 and length(last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state_reason{#SINGLETON}]))>0 High
PA-440: HA is in "tentative" state

State of a firewall (in an active/active configuration) caused by one of the following:
- Failure of a firewall.
- Failure of a monitored object (a link or path).
- The firewall leaves the suspended or non-functional state.

A firewall in the tentative state synchronizes sessions and configurations from the peer.

Information about high availability states:
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states

 last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}])=5 and length(last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state_reason{#SINGLETON}]))>0 Average
PA-440: HA is in "suspended" state

The device is disabled and won't pass data traffic; although HA communications still occur, the device doesn't participate in the HA election process. It can't move to a HA functional state without user intervention.

The following case is excluded from the trigger's logic by default (can be changed by setting the {$PAN.PA440.HA.STATE.IGNORE_USER_SUSPENDED} macro value to "0"): the user suspends the device for HA manually.

Information about high availability states:
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-firewall-states

 last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state{#SINGLETON}])=7 and not (find(/Palo Alto PA-440 by HTTP/pan.pa440.ha.local[state_reason{#SINGLETON}],,"iregexp","^User requested$")=1 and {$PAN.PA440.HA.STATE.IGNORE_USER_SUSPENDED}=1) Average
PA-440: Configuration is not synchronized with HA peer

This trigger indicates that the configuration cannot be synchronized with the HA peer. Please debug this manually by checking the logs (Monitor > Logs > System).

 count(/Palo Alto PA-440 by HTTP/pan.pa440.ha[config_sync_status{#SINGLETON}],{$PAN.PA440.HA.CONFIG_SYNC.THRESH},"iregexp","^(?:synchronized|synchronization in progress)$")=0 High

LLD rule HA link discovery

Name Description Type Key and additional info
HA link discovery

Discovers high availability link metrics.

Information about high availability links:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-concepts/ha-links-and-backup-links

 Dependent item pan.pa440.ha.links.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for HA link discovery

Name Description Type Key and additional info
HA link [{#HALINK}]: Status

The current state of the high availability link.

Information about high availability links:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/ha-concepts/ha-links-and-backup-links

 Dependent item pan.pa440.ha.peer.link.state[{#HALINK}]

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h

Trigger prototypes for HA link discovery

Name Description Expression Severity Dependencies and additional info
PA-440: HA link [{#HALINK}]: Link down

The status of the high availability link is "down".

 last(/Palo Alto PA-440 by HTTP/pan.pa440.ha.peer.link.state[{#HALINK}])="down" High

LLD rule Hardware network interface discovery

Name Description Type Key and additional info
Hardware network interface discovery

Discovers hardware network interfaces.

 HTTP agent pan.pa440.if.hw.discovery

Preprocessing

  • XML to JSON

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for Hardware network interface discovery

Name Description Type Key and additional info
Interface [{#IFNAME}]: Get data

Get the interface statistics.

 HTTP agent pan.pa440.if.hw.get[{#IFNAME}]

Preprocessing

  • XML to JSON
Interface [{#IFNAME}]: Status

The current state of the interface.

 Dependent item pan.pa440.if.hw.status[{#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.hw.state

  • Discard unchanged with heartbeat: 1h
Interface [{#IFNAME}]: Speed

The current bandwidth of the interface. The item is created only for interfaces that report the actual speed in units of 1,000,000 bits.

 Dependent item pan.pa440.if.hw.speed[{#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.hw.speed

  • Custom multiplier: 1000000

  • Discard unchanged with heartbeat: 1h
Interface [{#IFNAME}]: Bits received, per second

The number of bits received per second by the interface.

 Dependent item pan.pa440.if.hw.bits.in.rate[{#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.hw.entry.port['rx-bytes']

  • Change per second

  • Custom multiplier: 8
Interface [{#IFNAME}]: Bits sent, per second

The number of bits sent per second by the interface.

 Dependent item pan.pa440.if.hw.bits.out.rate[{#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.hw.entry.port['tx-bytes']

  • Change per second

  • Custom multiplier: 8
Interface [{#IFNAME}]: Inbound packets discarded, per second

The number of inbound packets per second which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

 Dependent item pan.pa440.if.hw.packets.in.discards.rate[{#IFNAME}]

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Change per second
Interface [{#IFNAME}]: Inbound packets with errors, per second

The number of inbound packets per second that contained errors preventing them from being deliverable to a higher-layer protocol.

 Dependent item pan.pa440.if.hw.packets.in.errors.rate[{#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.hw.entry.port['rx-error']

  • Change per second
Interface [{#IFNAME}]: Outbound packets with errors, per second

The number of outbound packets per second that contained errors preventing them from being deliverable to a higher-layer protocol.

 Dependent item pan.pa440.if.hw.packets.out.errors.rate[{#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.hw.entry.port['tx-error']

  • Change per second

Trigger prototypes for Hardware network interface discovery

Name Description Expression Severity Dependencies and additional info
PA-440: Interface [{#IFNAME}]: Link down

This trigger expression works as follows:
1. It can be triggered if the operational status is "down".
2. {$PAN.PA440.IF.HW.CONTROL:"{#IFNAME}"}=1 - a user can redefine the context macro to "0", marking this interface as not important. No new trigger will be fired if this interface is down.
3. last(/TEMPLATE_NAME/METRIC)<>last(/TEMPLATE_NAME/METRIC,#2) - the trigger fires only if the operational status has changed to "down" from some other state (it does not fire for "eternal off" interfaces).

WARNING: if closed manually - it will not fire again on the next poll because of last(/TEMPLATE_NAME/METRIC)<>last(/TEMPLATE_NAME/METRIC,#2).

 {$PAN.PA440.IF.HW.CONTROL:"{#IFNAME}"}=1 and last(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.status[{#IFNAME}])="down" and (last(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.status[{#IFNAME}])<>last(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.status[{#IFNAME}],#2)) Average Manual close: Yes
PA-440: Interface [{#IFNAME}]: High bandwidth usage

The utilization of the network interface is close to its estimated maximum bandwidth.

 (avg(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.bits.in.rate[{#IFNAME}],15m)>({$PAN.PA440.IF.HW.UTIL.MAX:"{#IFNAME}"}/100)*last(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.speed[{#IFNAME}]) or avg(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.bits.out.rate[{#IFNAME}],15m)>({$PAN.PA440.IF.HW.UTIL.MAX:"{#IFNAME}"}/100)*last(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.speed[{#IFNAME}])) and last(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.speed[{#IFNAME}])>0 Warning Manual close: Yes
Depends on:
  • PA-440: Interface [{#IFNAME}]: Link down
PA-440: Interface [{#IFNAME}]: High error rate

It recovers when it is below 80% of the {$PAN.PA440.IF.HW.ERRORS.WARN:"{#IFNAME}"} threshold.

 min(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.packets.in.errors.rate[{#IFNAME}],5m)>{$PAN.PA440.IF.HW.ERRORS.WARN:"{#IFNAME}"} or min(/Palo Alto PA-440 by HTTP/pan.pa440.if.hw.packets.out.errors.rate[{#IFNAME}],5m)>{$PAN.PA440.IF.HW.ERRORS.WARN:"{#IFNAME}"} Warning Manual close: Yes
Depends on:
  • PA-440: Interface [{#IFNAME}]: Link down

LLD rule Logical network interface discovery

Name Description Type Key and additional info
Logical network interface discovery

Discovers logical network interfaces.

 HTTP agent pan.pa440.if.sw.discovery

Preprocessing

  • XML to JSON

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for Logical network interface discovery

Name Description Type Key and additional info
VSYS [{#VSYS}]: Interface [{#IFNAME}]: Get data

Get the interface statistics.

 HTTP agent pan.pa440.if.sw.get[{#VSYS}, {#IFNAME}]

Preprocessing

  • XML to JSON
VSYS [{#VSYS}]: Interface [{#IFNAME}]: Bits received, per second

The number of bits received per second by the interface.

 Dependent item pan.pa440.if.sw.bits.in.rate[{#VSYS}, {#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.ifnet.entry.ibytes

  • Change per second

  • Custom multiplier: 8
VSYS [{#VSYS}]: Interface [{#IFNAME}]: Bits sent, per second

The number of bits sent by the interface.

 Dependent item pan.pa440.if.sw.bits.out.rate[{#VSYS}, {#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.ifnet.entry.obytes

  • Change per second

  • Custom multiplier: 8
VSYS [{#VSYS}]: Interface [{#IFNAME}]: Inbound packets dropped, per second

The number of inbound packets per second which were chosen to be dropped even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

 Dependent item pan.pa440.if.sw.packets.in.drops.rate[{#VSYS}, {#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.ifnet.entry.idrops

  • Change per second
VSYS [{#VSYS}]: Interface [{#IFNAME}]: Inbound packets with errors, per second

The number of inbound packets per second that contained errors preventing them from being deliverable to a higher-layer protocol.

 Dependent item pan.pa440.if.sw.packets.in.errors.rate[{#VSYS}, {#IFNAME}]

Preprocessing

  • JSON Path: $.response.result.ifnet.counters.ifnet.entry.ierrors

  • Change per second

Trigger prototypes for Logical network interface discovery

Name Description Expression Severity Dependencies and additional info
PA-440: VSYS [{#VSYS}]: Interface [{#IFNAME}]: High error rate

It recovers when it is below 80% of the {$PAN.PA440.IF.SW.ERRORS.WARN:"{#IFNAME}"} threshold.

 min(/Palo Alto PA-440 by HTTP/pan.pa440.if.sw.packets.in.errors.rate[{#VSYS}, {#IFNAME}],5m)>{$PAN.PA440.IF.SW.ERRORS.WARN:"{#IFNAME}"} Warning Manual close: Yes

LLD rule BGP peer discovery

Name Description Type Key and additional info
BGP peer discovery

Discovers BGP peers.

 HTTP agent pan.pa440.bgp.peer.discovery

Preprocessing

  • XML to JSON

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for BGP peer discovery

Name Description Type Key and additional info
BGP peer [{#PEER}]: Get data

Get the information about the peer.

 HTTP agent pan.pa440.bgp.peer.get[{#PEERGROUP}, {#PEERADDR}, {#PEER}]

Preprocessing

  • XML to JSON
BGP peer [{#PEER}]: Status

The current state of the BGP peer.

 Dependent item pan.pa440.bgp.peer.status[{#PEERGROUP}, {#PEERADDR}, {#PEER}]

Preprocessing

  • JSON Path: $.response.result.entry.status

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 1h
BGP peer [{#PEER}]: Status duration

The duration of the current state of the BGP peer.

 Dependent item pan.pa440.bgp.peer.status.duration[{#PEERGROUP}, {#PEERADDR}, {#PEER}]

Preprocessing

  • JSON Path: $.response.result.entry['status-duration']

Trigger prototypes for BGP peer discovery

Name Description Expression Severity Dependencies and additional info
PA-440: BGP peer [{#PEER}]: Session is not Established or Idle

The session with the peer is not "Established" or "Idle".

 {$PAN.PA440.BGP.CONTROL:"{#PEER}"}=1 and last(/Palo Alto PA-440 by HTTP/pan.pa440.bgp.peer.status[{#PEERGROUP}, {#PEERADDR}, {#PEER}])<>5 and last(/Palo Alto PA-440 by HTTP/pan.pa440.bgp.peer.status[{#PEERGROUP}, {#PEERADDR}, {#PEER}])<>0 High
PA-440: BGP peer [{#PEER}]: Session status duration has been reset

The duration of the session status with the peer has been reset.

 {$PAN.PA440.BGP.CONTROL:"{#PEER}"}=1 and last(/Palo Alto PA-440 by HTTP/pan.pa440.bgp.peer.status.duration[{#PEERGROUP}, {#PEERADDR}, {#PEER}])<10m Average

LLD rule OSPF neighbor discovery

Name Description Type Key and additional info
OSPF neighbor discovery

Discovers OSPF neighbors.

 Dependent item pan.pa440.ospf.neighbor.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for OSPF neighbor discovery

Name Description Type Key and additional info
OSPF neighbor [{#NEIGHBORADDR}]: Status

The current state of the OSPF neighbor.

 Dependent item pan.pa440.ospf.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}]

Preprocessing

  • JSON Path: The text is too long. Please see the template.

Trigger prototypes for OSPF neighbor discovery

Name Description Expression Severity Dependencies and additional info
PA-440: OSPF neighbor [{#NEIGHBORADDR}]: Neighbor is not found anymore

The neighbor is not found anymore and the neighborship is gone. Please investigate if this is planned.

 {$PAN.PA440.OSPF.CONTROL:"{#NEIGHBORADDR}"}=1 and nodata(/Palo Alto PA-440 by HTTP/pan.pa440.ospf.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}],5m)=1 High
PA-440: OSPF neighbor [{#NEIGHBORADDR}]: Status is not full or 2way

The status of the neighbor is not "full" or "2way". This may indicate issues with the OSPF session.

 {$PAN.PA440.OSPF.CONTROL:"{#NEIGHBORADDR}"}=1 and last(/Palo Alto PA-440 by HTTP/pan.pa440.ospf.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}])<>"full" and last(/Palo Alto PA-440 by HTTP/pan.pa440.ospf.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}])<>"2way" High

LLD rule OSPFv3 neighbor discovery

Name Description Type Key and additional info
OSPFv3 neighbor discovery

Discovers OSPFv3 neighbors.

 Dependent item pan.pa440.ospfv3.neighbor.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for OSPFv3 neighbor discovery

Name Description Type Key and additional info
OSPFv3 neighbor [{#NEIGHBORADDR}]: Status

The current status of the OSPFv3 neighbor.

 Dependent item pan.pa440.ospfv3.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}]

Preprocessing

  • JSON Path: The text is too long. Please see the template.

Trigger prototypes for OSPFv3 neighbor discovery

Name Description Expression Severity Dependencies and additional info
PA-440: OSPFv3 neighbor [{#NEIGHBORADDR}]: Neighbor is not found anymore

The neighbor is not found anymore and the neighborship is gone. Please investigate if this is planned.

 {$PAN.PA440.OSPFV3.CONTROL:"{#NEIGHBORADDR}"}=1 and nodata(/Palo Alto PA-440 by HTTP/pan.pa440.ospfv3.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}],5m)=1 High
PA-440: OSPFv3 neighbor [{#NEIGHBORADDR}]: Status is not full or 2way

The status of the neighbor is not "full" or "2way". This may indicate issues with the OSPF session.

 {$PAN.PA440.OSPFV3.CONTROL:"{#NEIGHBORADDR}"}=1 and last(/Palo Alto PA-440 by HTTP/pan.pa440.ospfv3.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}])<>"full" and last(/Palo Alto PA-440 by HTTP/pan.pa440.ospfv3.neighbor.status[{#NEIGHBORAREA}, {#NEIGHBORADDR}])<>"2way" High

LLD rule License discovery

Name Description Type Key and additional info
License discovery

Discovers licenses installed on the device. Only the licenses with an expiration date are discovered.

 Dependent item pan.pa440.licenses.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for License discovery

Name Description Type Key and additional info
License [{#FEATURE}]: Expires on

The expiration date for the license {#DESCRIPTION}.

 Dependent item pan.pa440.license.expires[{#FEATURE}]

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 12h
License [{#FEATURE}]: Expired

Indicates whether the license {#DESCRIPTION} has expired.

 Dependent item pan.pa440.license.expired[{#FEATURE}]

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Boolean to decimal

  • Discard unchanged with heartbeat: 12h

Trigger prototypes for License discovery

Name Description Expression Severity Dependencies and additional info
PA-440: License [{#FEATURE}]: Expires soon

The license will expire in less than {$PAN.PA440.LICENSE.EXPIRY.WARN:"{#FEATURE}"}.

 (last(/Palo Alto PA-440 by HTTP/pan.pa440.license.expires[{#FEATURE}]) - now())<{$PAN.PA440.LICENSE.EXPIRY.WARN:"{#FEATURE}"} Warning
PA-440: License [{#FEATURE}]: Has expired

The license {#DESCRIPTION} has expired.

 last(/Palo Alto PA-440 by HTTP/pan.pa440.license.expired[{#FEATURE}])=1 High Manual close: Yes

LLD rule Device certificate discovery

Name Description Type Key and additional info
Device certificate discovery

Discovers device certificate metrics. Note that superuser privileges are required to obtain the device certificate data.

 Dependent item pan.pa440.certificate.device.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for Device certificate discovery

Name Description Type Key and additional info
Device certificate: Expires in

The time in seconds until the device certificate expiration.

 Dependent item pan.pa440.certificate.device.expires_in[{#SINGLETON}]

Preprocessing

  • JSON Path: $.response.result['device-certificate']['seconds-to-expire']
Device certificate: Expires on

The expiration date of the device certificate.

 Dependent item pan.pa440.certificate.device.expires[{#SINGLETON}]

Preprocessing

  • JSON Path: $.response.result['device-certificate']['not_valid_after']

  • Discard unchanged with heartbeat: 12h

Trigger prototypes for Device certificate discovery

Name Description Expression Severity Dependencies and additional info
PA-440: Device certificate: Expires soon

The device certificate will expire in less than {$PAN.PA440.CERT.DEVICE.EXPIRY.WARN}.

 last(/Palo Alto PA-440 by HTTP/pan.pa440.certificate.device.expires_in[{#SINGLETON}])<{$PAN.PA440.CERT.DEVICE.EXPIRY.WARN} Warning

LLD rule Certificate discovery

Name Description Type Key and additional info
Certificate discovery

Discovers certificates on the device. Only the certificates with an expiration date are discovered.

 Dependent item pan.pa440.certificates.discovery

Preprocessing

  • JavaScript: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 3h

Item prototypes for Certificate discovery

Name Description Type Key and additional info
Certificate [{#CERTNAME}]: Expires on

The expiration date for the certificate.

 Dependent item pan.pa440.certificate.expires[{#CERTNAME}]

Preprocessing

  • JSON Path: The text is too long. Please see the template.

  • Discard unchanged with heartbeat: 12h

Trigger prototypes for Certificate discovery

Name Description Expression Severity Dependencies and additional info
PA-440: Certificate [{#CERTNAME}]: Expires soon

The certificate will expire in less than {$PAN.PA440.CERT.EXPIRY.WARN:"{#CERTNAME}"}.

 (last(/Palo Alto PA-440 by HTTP/pan.pa440.certificate.expires[{#CERTNAME}]) - now())<{$PAN.PA440.CERT.EXPIRY.WARN:"{#CERTNAME}"} Warning Depends on:
  • PA-440: Certificate [{#CERTNAME}]: Has expired
PA-440: Certificate [{#CERTNAME}]: Has expired

The certificate has expired.

 (last(/Palo Alto PA-440 by HTTP/pan.pa440.certificate.expires[{#CERTNAME}]) - now())<0 High

Feedback

Please report any issues with the template at https://support.zabbix.com

You can also provide feedback, discuss the template, or ask for help at ZABBIX forums

Articles and documentation

+ Propose new article

Didn't find integration you need?

Request custom integration

Zabbix integration team will develop custom integration based on your requirements and Zabbix best practices.

Request

Propose your integration

Have you already developed high quality integration and want to submit to Zabbix integration repository?

Propose