DumbMonit
FR
GitHub Démo en ligne

Surveillances

Pare-feux

OPNsense, pfSense, FortiGate et Sophos : passerelles, tunnels, interfaces, haute disponibilité et licences.

Les descriptions des surveillances et les textes des règles d'alerte sont en anglais, comme dans le produit. Les libellés de la page suivent votre langue.

OPNsense

opnsense

Gateway latency and loss, VPN tunnels, DHCP leases, services and pending updates.

Exemples

  • OPNsense firewall
  • Home router
  • Multi-WAN edge

Ce qu'il faut

  • API key and secretThe two lines of the file OPNsense downloads when the key is created.

Port par défaut: 443

Règles d'alerte livrées 12

  • AlerteInternet gateway downdpinger no longer gets an answer from a gateway. On a multi-WAN firewall the traffic has already moved to another link, quietly. loss and delay are warnings, not failures, and do not fire this rule.
  • AvisGateway losing packetsA gateway is losing more than a fifth of the packets sent to it: the link answers, badly. Clears below 10 %.
  • InfoGateway slowA gateway's round-trip time has stayed above 300 ms. Three hundred milliseconds leaves a mobile backup link alone.
  • AvisFirewall state table filling uppf is tracking more than 80 % of the connections it is allowed. Past the limit the firewall drops new connections with no other symptom.
  • AvisFirewall network buffers exhaustedMore than 90 % of the FreeBSD network buffers are in use. A firewall that runs out stops forwarding with the CPU still idle.
  • AvisVPN tunnel downA configured VPN tunnel has had no session for ten minutes. A plugin that is not installed, or a connection that is disabled, has no series and cannot fire.
Afficher 6 de plus
  • AvisFirewall resolver stoppedUnbound has stopped answering. The firewall still routes; the machines behind it no longer resolve. Turn this rule off if your firewall resolves with something else.
  • AlerteFirewall core service stoppeddpinger, which watches the gateways, or configd, which runs everything else, is stopped. Only those two, because a service switched off on purpose is not a failure.
  • AvisFirewall too hotA sensor reads above 85 °C: the fanless box in the cupboard is about to start throttling. Clears at 78 °C.
  • InfoFirewall left in CARP maintenance modeCARP has been left in persistent maintenance mode: this firewall handed its virtual addresses to its partner and will not take them back on its own.
  • InfoFirewall reboot pendingAn update is installed but needs a reboot to take effect.
  • InfoFirewall updates pendingThe firewall has packages waiting to be updated. It is the most exposed machine on the network.
Étapes de mise en place: Create a read-only API key in OPNsense

  1. System → Access → Groups → Add: name the group as follows.

    dumbmonit

  2. In that group, under Assigned Privileges, add the privileges listed below.

  3. System → Access → Users → Add: name the user as follows, generate a password, and make it a member of that group.

    dumbmonit

  4. Edit the user, click + under API keys, and save the downloaded file: it holds the key and the secret, shown only once.

  5. In DumbMonit, enter the firewall address (192.168.1.1 or fw.lan:8443), the key as API key and the secret as API secret.

À savoir. An API key is a password that never expires: restrict the group's source networks to the DumbMonit host and never grant All pages. OPNsense ships a self-signed certificate: tick "Accept an unverifiable certificate" if the connection is refused.

Documentation

pfSense

pfsense

A pfSense firewall through its REST API package: gateways down or losing packets, interfaces without link, stopped services, CPU, memory and disk.

Exemples

  • pfSense CE
  • pfSense Plus
  • Netgate appliance

Ce qu'il faut

  • REST API keyThe key created for the dumbmonit user: it carries only that user's read privileges.

Port par défaut: 443

Règles d'alerte livrées 7

  • AlertepfSense gateway downA pfSense gateway is down: its monitor address no longer answers, and the traffic it carries stops or fails over.
  • AvispfSense gateway losing packetsA pfSense gateway loses more than 10 % of the probes to its monitor address: the line is degraded (dumbmonit_pfsense_gateway_loss_percent unless on (target, gateway) dumbmonit_pfsense_gateway_up == 0).
  • AvispfSense gateway slowThe round trip to a pfSense gateway's monitor address has stayed above 500 ms for fifteen minutes.
  • AvispfSense interface without linkAn enabled pfSense interface has no link: cable, switch port or network card.
  • AvispfSense service stoppedA pfSense service that is enabled is not running: DNS resolver, VPN, NTP….
  • AvispfSense disk nearly fullThe pfSense disk is more than 90 % full: logs, reports and package updates stop being written.
Afficher 1 de plus
  • AlerteMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Étapes de mise en place: Create a read-only REST API key for DumbMonit

  1. Install the pfSense-pkg-RESTAPI package (version 2) from Diagnostics → Command Prompt, with the file matching your pfSense version (2.7.2 below).

    pkg-static add https://github.com/pfrest/pfSense-pkg-RESTAPI/releases/latest/download/pfSense-2.7.2-pkg-RESTAPI.pkg

  2. System → REST API → Settings: tick both BasicAuth and Key among the authentication methods.

  3. System → User Manager → Users → Add: create the user dumbmonit with a long random password.

  4. Edit the user and, under Assigned Privileges, add the privileges listed below.

  5. Create the key as dumbmonit, copy the key value of the answer, then remove the POST privilege again.

    curl -k -u dumbmonit -X POST -H 'Content-Type: application/json' -d '{"descr":"DumbMonit"}' https://pfsense.lan/api/v2/auth/key

  6. In DumbMonit, enter the pfSense address (pfsense.lan) and paste the key as API key.

À savoir. The REST API package is a community project, not part of pfSense: reinstall it after each pfSense upgrade. pfSense ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you replaced it.

Documentation

FortiGate

fortigate

A Fortinet firewall through the FortiOS REST API: IPsec tunnels down, interfaces without link, HA out of sync, memory near conserve mode, FortiGuard licences expiring.

Exemples

  • FortiGate 40F / 60F / 100F
  • FortiGate VM
  • FortiOS 7.x

Ce qu'il faut

  • API tokenThe token of the dumbmonit REST API user, sent as a bearer token.

Port par défaut: 443

Règles d'alerte livrées 9

  • AlerteFortiGate IPsec tunnel downNo phase 2 of a FortiGate site-to-site IPsec tunnel is up: the site behind it is cut off.
  • AvisFortiGate interface without linkAn enabled FortiGate interface with an address has no link: cable, transceiver or the device in front.
  • AvisFortiGate HA out of syncThe members of a FortiGate HA cluster no longer have the same configuration checksum: a failover would run another configuration.
  • AlerteFortiGate HA member lostA FortiGate HA cluster has fewer members than in the last 24 hours: there is no standby any more (max_over_time(dumbmonit_fortigate_ha_members[1d]) - dumbmonit_fortigate_ha_members).
  • AvisFortiGate memory near conserve modeFortiGate memory has stayed above 85 % for ten minutes: at 88 % (by default) it enters conserve mode and stops inspecting new sessions.
  • AvisFortiGate CPU highFortiGate CPU has stayed above 90 % for fifteen minutes.
Afficher 3 de plus
  • AvisFortiGate licence expiringA FortiGuard or FortiCare licence of the FortiGate expires in less than 30 days, or has expired.
  • InfoFortiGate firmware updateFortiGuard offers a newer patch release of the FortiOS branch the FortiGate runs.
  • AlerteMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Étapes de mise en place: Create a read-only REST API user for DumbMonit

  1. System → Admin Profiles → Create New: name the profile as follows and set the access permissions listed below, everything else None.

    dumbmonit-ro

  2. System → Administrators → Create New → REST API Admin: name it as follows and pick that profile.

    dumbmonit

  3. Under Trusted Hosts, enter the DumbMonit server's address with a /32 mask: FortiGate refuses 0.0.0.0/0.

  4. Click OK: FortiGate shows the API token once. Copy it.

  5. In DumbMonit, enter the FortiGate address (fw.lan) and paste the token as API token.

À savoir. FortiGate ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentation

Sophos Firewall

sophos

A Sophos Firewall (SFOS) through its XML API: the link of every interface in a zone, and which IPsec connections are activated. Its live tunnel, HA and licence state are not in that API.

Exemples

  • Sophos XGS
  • Sophos Firewall virtual appliance
  • SFOS 19 to 21

Ce qu'il faut

  • User name and passwordThe dumbmonit user, whose device access profile is read-only everywhere.

Port par défaut: 4444

Règles d'alerte livrées 2

  • AvisSophos interface without linkA Sophos Firewall interface that is switched on and bound to a zone has no link.
  • AlerteMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Étapes de mise en place: Allow DumbMonit to read the Sophos Firewall XML API

  1. Profiles → Device access: add a profile named DumbMonit read-only and set every permission to Read-only.

  2. Authentication → Users: add a user named dumbmonit, of type Administrator, with that profile and a long random password.

    dumbmonit

  3. Backup & firmware → API (Administration → API access from SFOS 22): turn on the API configuration and add the DumbMonit server's address to the allowed IP addresses.

  4. In DumbMonit, enter the firewall address (sophos.lan) with that user name and password.

À savoir. The API listens on the administration port (4444 by default) with a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentation

Palo Alto PAN-OS

Bêtapaloalto

A Palo Alto Networks firewall through the PAN-OS XML API: interfaces without link, HA peer lost or out of sync, session table filling up, management CPU and memory, licences expiring, failed commits.

Exemples

  • PA-400 / PA-1400 series
  • VM-Series
  • PAN-OS 10.x and 11.x

Ce qu'il faut

  • User name and passwordThe dumbmonit account: DumbMonit asks the firewall for an API key with it and keeps the key, the password only travels in a request body.
  • API keyA key already generated for the dumbmonit account, sent in the X-PAN-KEY header.

Port par défaut: 443

Règles d'alerte livrées 9

  • AvisPalo Alto interface without linkA Palo Alto firewall interface bound to a zone has no link: cable, transceiver or the device in front.
  • AlertePalo Alto HA peer lostThe peer of a Palo Alto HA pair is no longer active or passive, or the HA link to it is down: there is no standby any more.
  • AvisPalo Alto HA out of syncThe running configuration of a Palo Alto HA pair is not synchronized: a failover would run another configuration.
  • AlertePalo Alto HA member not functionalThis Palo Alto firewall reports its HA state as suspended or non-functional.
  • AvisPalo Alto session table filling upThe session table of a Palo Alto firewall has stayed above 90 % of its capacity for ten minutes: new sessions will be refused when it is full.
  • AvisPalo Alto management CPU highThe management plane CPU of a Palo Alto firewall has stayed above 90 % for fifteen minutes.
Afficher 3 de plus
  • AvisPalo Alto licence expiringA licence or subscription of a Palo Alto firewall expires in less than 30 days, or has expired.
  • InfoPalo Alto commit failedThe last configuration commit of a Palo Alto firewall failed: the running configuration is not the one that was saved.
  • AlerteMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Étapes de mise en place: Create a read-only XML API account for DumbMonit

  1. Device → Admin Roles → Add: name the role as follows. On the XML API tab enable Operational Requests only; leave every other privilege, and the Web UI and Command Line tabs, disabled.

    dumbmonit-ro

  2. Device → Administrators → Add: name the account as follows, set Authentication to a password, the type to Role Based and the role to the one above.

    dumbmonit

  3. Click Commit: the role and the account exist only once committed.

  4. In DumbMonit, enter the firewall address (pa.lan) with that user name and password, or with an API key you generated for that account.

À savoir. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentation

SonicWall SonicOS

Bêtasonicwall

A SonicWall firewall through the SonicOS 7 API: the link of every interface bound to a zone. Kept minimal on purpose: only the API paths SonicWall publishes are read.

Exemples

  • SonicWall TZ / NSa / NSsp
  • SonicWall NSv
  • SonicOS 7.x

Ce qu'il faut

  • User name and passwordThe dumbmonit user, in a read-only group, sent as HTTP Basic.

Port par défaut: 443

Règles d'alerte livrées 2

  • AvisSonicWall interface without linkA SonicWall interface bound to a zone has no link.
  • AlerteMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Étapes de mise en place: Create a read-only user for the SonicOS API

  1. Device → Settings → Administration → Audit/SonicOS API: make sure HTTP Basic Access (RFC-2617) is on, then click Accept.

  2. Device → Users → Local Users & Groups → Add User: name it as follows, give it a long random password and add it to the group SonicWall Read-Only Admins.

    dumbmonit

  3. Allow HTTPS management on the interface DumbMonit reaches the firewall through (Device → Network → Interfaces → Configure → Management).

  4. In DumbMonit, enter the firewall address (sonicwall.lan) with that user name and password.

À savoir. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentation

Autres familles