-
Monitoring firewall Internet Connectivity
I have set up firewalls in the Pandora FMS. I need to monitor the internet connectivity status of these firewalls. I am thinking something like, whether I can create ping checks to an external server such as 8.8.8.8 withing these agents’ wan links. Is this possible or are there any other ways to do this?
-
3 Replies
-
Good morning,
For the monitoring of such firewalls, you can configure and use remote monitoring and use snmp queries to monitor both the interfaces and the consumption of the same, availability, status, etc.. I provide access to the documentation:
pandorafms.com/manual/!current/en/documentation/03_monitoring/03_remote_monitoring
Best regards
-
I have already setup both remote network monitoring using ICMP and SNMP. I already have the consumptions of each interface. What I need is to create an timely ping check to an external server such as 8.8.8.8 from the firewall’s network, so that I can monitor the internet connectivity status of these firewalls. Because sometimes the WAN interface might be in the Operating status (ifOperStatus) but you unable to access the internet.
-
I understand the reported behavior when verifying the information provided by the SNMP monitoring against the firewall/router. Usually, if you want to verify this connectivity in case of a possible suspicion of the reported situation, the usual way is to connect to the router and do it directly from the router, since you cannot make the tool interact directly with it, as if it were a user. There are other possibilities that I will explain, as well as some clarification.
There is the possibility to perform Host Alive checks from a module in a Console Agent, but if you set a host alive module in the console agent corresponding to the router monitoring. This will perform the check directly against the external server but from the PandoraFMS server itself, if the server is not inside the router/firewall network, the test will not be effective.
The easiest way is to establish a software agent in a device that supports it (Rasberry, computer…) that is inside the corresponding network and create a module that performs this check at system level. This can be done by means of a module that executes a script.
-
