Alerts and Queryables for Firewall Monitoring
Alerts and Queryable for Firewall Monitoring
This use case establishes monitoring and alerting capabilities for the High Availability (HA) status for critical Checkpoint and Palo Alto Firewalls deployed in various physical environments such as data centers or headquarters.
Scale of this Example: Checkpoint (11), and Palo Alto (150) devices are covered.
Configured Example
Alerts, including alarm codes, are configured and BigPanda is successfully receiving all configured alerts.
Alerting Condition
The alert triggers when there is a violation on Palo Alto or Checkpoint firewall HA status. The specifics are shown as shown in the following table.
| Alert Name | Priority | Queryable | Notes |
|---|---|---|---|
| Checkpoint Firewall Connections Utilization - High | P2 | fw_connections_concurrent_utilization where device_priority=HIGH, fw_connections_concurrent_utilization>80, device_ip!=None | Alert triggered for high-priority Checkpoint firewall devices if concurrent connection utilization exceeds 80%. Devices with a “None” IP address are excluded from this alerting rule. |
| Checkpoint Firewall Connections Utilization | P4 | fw_connections_concurrent_utilization where device_priority=None, fw_connections_concurrent_utilization>85, device_ip!=None | Alert triggered if the concurrent connection utilization for Checkpoint firewall devices, which currently have no specific type mentioned (“None”), exceeds 85%. |
| Checkpoint Firewall Connections Utilization - Critical | P1 | fw_connections_concurrent_utilization where device_priority=CRITICAL, fw_connections_concurrent_utilization>75, device_ip!=None | P1 alert triggered when concurrent connections on critical Checkpoint firewall devices exceed the 75% threshold. Note: Devices lacking an assigned IP address are excluded from this specific alerting rule. |
| Checkpoint Firewall Connections Utilization - LOW | P3 | fw_connections_concurrent_utilization where device_priority=LOW, fw_connections_concurrent_utilization>95, device_ip!=None | Alert triggered if the concurrent connection utilization for low priority Checkpoint firewall devices exceeds 95%. Devices lacking an associated IP address(None) are excluded from this alerting rule. |
| Paloalto Firewall CPU Utilization - Low | P1 | fw_pan_cpu where device_priority=LOW, fw_pan_cpu>75 | Alert triggered when CPU for Low priority PAN firewall devices exceeds 75%. |
| Paloalto Firewall CPU Utilization - Low | P1 | fw_pan_cpu where device_priority=LOW, fw_pan_cpu>75 | Alert triggered when CPU for Low priority PAN firewall devices exceeds 75%. |
| VirtualFirewallSNMPPollFailure | P1 | fw_last_poll_timedelta_secs where fw_type=“virtual”, identifier!~“vsys1|*VLAN*”, fw_last_poll_timedelta_secs_color >= 3.5 | Alert triggered when Virtual firewall SNMP polling is stale—last-poll age meets or exceeds threshold (3.5), excluding vsys1/VLAN-style identifiers; indicates possible poll failure or unreachable device. |
| FanStatus | P1 | device_fan_state where device_fan_state_violation>0,device_vendor=Arista|PaloAltoNetworks|CheckPoint|F5|Cloudgenix|Cisco|HP|Arista|PaloAltoNetworks|CheckPoint|F5|Cloudgenix|Cisco|HP|Infoblox group-by vendor | Alert triggered when Hardware health when power supply/module reports a violation (non-OK state) on Arista, Palo Alto, Check Point, or F5 gear; grouped by vendor |
| PowerStatus | P1 | device_power_state where device_vendor=Arista|PaloAltoNetworks|CheckPoint|F5, device_power_state_violation>0 group-by device_vendor | Alert triggered when Hardware health when power supply/module reports a violation (non-OK state) on Arista, Palo Alto, Check Point, or F5 gear; grouped by vendor. |
| TemperatureStatus | P1 | device_temperature_f where device_temperature_f_violation>0, device_vendor=Arista|PaloAltoNetworks|CheckPoint|F5|Infoblox|Cloudgenix|Cisco|HP|Infoblox group-by vendor | Alert triggered when Hardware health: temperature violates policy on Arista, Palo Alto, Check Point, or F5 devices. |
| Paloalto Firewall Connections Utilization | P3 | fw_session_count_headroom_percentage as honeycomb where fw_session_count_headroom_percentage_violation>0, ipaddress != None , model!=“PA-VM” | Alert triggered when session headroom percentage violates policy. |
| AWS Paloalto Firewall CPU Utilization | P3 | pan_cpu as honeycomb where pan_cpu_violation>0 , device_model=“PA-VM” | CPU violates priority-based thresholds |
| Paloalto Firewall Memory Utilization | P3 | pan_memory_util as honeycomb where pan_memory_util_violation>0 , device_model!=“PA-VM” | memory utilization violates policy |
| AWS Paloalto Firewall Memory Utilization | P3 | pan_memory_util as honeycomb where pan_memory_util_violation>0 , device_model=“PA-VM” | memory utilization violates policy |
| LoadBalancerHAClusterDown | P2 | s2_lb_ha_cluster_harddown as threshold-violation-matrix where s2_lb_ha_cluster_harddown_violation>0 | Alert triggered when HA cluster hard-down—entire cluster reported unavailable (all members down) per threshold-violation matrix. |
| ModuleStatusDown | P3 | module_admin_oper_status as honeycomb where module_admin_oper_status_violation>0 group-by device, entity_model_name | Alert triggered when Line card/module administrative/operational status violates policy |
| haStatus | P2 | ha_status as line-plot where ha_status_violation>0 group-by device | Alert triggered when there is violation on Palo alto/Checkpoint firewall devices. |