infrasonar/paloalto-probe

InfraSonar PaloAlto Probe

InfraSonar PaloAlto Probe

Documentation: https://docs.infrasonar.com/collectors/probes/paloalto/

Environment variable

Variable	Default	Description
AGENTCORE_HOST	127.0.0.1	Hostname or Ip address of the AgentCore.
AGENTCORE_PORT	8750	AgentCore port to connect to.
INFRASONAR_CONF	/data/config/infrasonar.yaml	File with probe and asset configuration like credentials.
MAX_PACKAGE_SIZE	500	Maximum package size in kilobytes (1..2000).
MAX_CHECK_TIMEOUT	300	Check time-out is 80% of the interval time with MAX_CHECK_TIMEOUT in seconds as absolute maximum.
DRY_RUN	none	Do not run demonized, just return checks and assets specified in the given yaml (see the Dry run section below).
LOG_LEVEL	warning	Log level (debug, info, warning, error or critical).
LOG_COLORIZED	0	Log using colors (0=disabled, 1=enabled).
LOG_FTM	%y%m%d %H:%M:%S	Log format prefix.

API key

This probe requires an API key which must be placed in the INFRASONAR_CONF configuration file. For example:

paloalto:
  config:
    secret: 'gJlQWE56987nBxIqyfa62sZeRtYuIo2BgzEA9UOnlZBhU=='

Docker build

docker build -t paloalto-probe . --no-cache

Dry run

Available checks:

• interface
• route
• session
• system

Create a yaml file, for example (test.yaml):

asset:
  name: "foo.local"
  check: "system"
  config:
    address: "192.168.1.2"

Run the probe with the DRY_RUN environment variable set the the yaml file above.

DRY_RUN=test.yaml python main.py

paloalto-probe's Issues

Throughput of Interfaces

We would like to monitoring the throughput of interfaces as described here

Note this might require configuring QoS statistics on the firewalls.

Check Status and Monitor an IPSEC VPN Tunnels

We would like to check the status of IPSEC VPN Tunnels

[Palo Alto reference artikel

From this article we extracted these two commands:

Check ike phase1 status

show vpn ike-sa

Check Encryption and Decryption (encap/decap) across tunnel

show vpn flow