DumbMonit
RU
GitHub Живое демо

Мониторы

Межсетевые экраны

OPNsense, pfSense, FortiGate и Sophos: шлюзы, туннели, интерфейсы, высокая доступность и лицензии.

Описания мониторов и тексты правил оповещений на английском, как в самом продукте. Подписи на странице соответствуют вашему языку.

OPNsense

opnsense

Gateway latency and loss, VPN tunnels, DHCP leases, services and pending updates.

Примеры

  • OPNsense firewall
  • Home router
  • Multi-WAN edge

Что понадобится

  • API key and secretThe two lines of the file OPNsense downloads when the key is created.

Порт по умолчанию: 443

Встроенные правила оповещений 12

  • ТревогаInternet gateway downdpinger no longer gets an answer from a gateway. On a multi-WAN firewall the traffic has already moved to another link, quietly. loss and delay are warnings, not failures, and do not fire this rule.
  • ПредупреждениеGateway losing packetsA gateway is losing more than a fifth of the packets sent to it: the link answers, badly. Clears below 10 %.
  • ИнфоGateway slowA gateway's round-trip time has stayed above 300 ms. Three hundred milliseconds leaves a mobile backup link alone.
  • ПредупреждениеFirewall state table filling uppf is tracking more than 80 % of the connections it is allowed. Past the limit the firewall drops new connections with no other symptom.
  • ПредупреждениеFirewall network buffers exhaustedMore than 90 % of the FreeBSD network buffers are in use. A firewall that runs out stops forwarding with the CPU still idle.
  • ПредупреждениеVPN tunnel downA configured VPN tunnel has had no session for ten minutes. A plugin that is not installed, or a connection that is disabled, has no series and cannot fire.
Показать ещё 6
  • ПредупреждениеFirewall resolver stoppedUnbound has stopped answering. The firewall still routes; the machines behind it no longer resolve. Turn this rule off if your firewall resolves with something else.
  • ТревогаFirewall core service stoppeddpinger, which watches the gateways, or configd, which runs everything else, is stopped. Only those two, because a service switched off on purpose is not a failure.
  • ПредупреждениеFirewall too hotA sensor reads above 85 °C: the fanless box in the cupboard is about to start throttling. Clears at 78 °C.
  • ИнфоFirewall left in CARP maintenance modeCARP has been left in persistent maintenance mode: this firewall handed its virtual addresses to its partner and will not take them back on its own.
  • ИнфоFirewall reboot pendingAn update is installed but needs a reboot to take effect.
  • ИнфоFirewall updates pendingThe firewall has packages waiting to be updated. It is the most exposed machine on the network.
Шаги настройки: Create a read-only API key in OPNsense

  1. System → Access → Groups → Add: name the group as follows.

    dumbmonit

  2. In that group, under Assigned Privileges, add the privileges listed below.

  3. System → Access → Users → Add: name the user as follows, generate a password, and make it a member of that group.

    dumbmonit

  4. Edit the user, click + under API keys, and save the downloaded file: it holds the key and the secret, shown only once.

  5. In DumbMonit, enter the firewall address (192.168.1.1 or fw.lan:8443), the key as API key and the secret as API secret.

Обратите внимание. An API key is a password that never expires: restrict the group's source networks to the DumbMonit host and never grant All pages. OPNsense ships a self-signed certificate: tick "Accept an unverifiable certificate" if the connection is refused.

Документация

pfSense

pfsense

A pfSense firewall through its REST API package: gateways down or losing packets, interfaces without link, stopped services, CPU, memory and disk.

Примеры

  • pfSense CE
  • pfSense Plus
  • Netgate appliance

Что понадобится

  • REST API keyThe key created for the dumbmonit user: it carries only that user's read privileges.

Порт по умолчанию: 443

Встроенные правила оповещений 7

  • ТревогаpfSense gateway downA pfSense gateway is down: its monitor address no longer answers, and the traffic it carries stops or fails over.
  • ПредупреждениеpfSense gateway losing packetsA pfSense gateway loses more than 10 % of the probes to its monitor address: the line is degraded (dumbmonit_pfsense_gateway_loss_percent unless on (target, gateway) dumbmonit_pfsense_gateway_up == 0).
  • ПредупреждениеpfSense gateway slowThe round trip to a pfSense gateway's monitor address has stayed above 500 ms for fifteen minutes.
  • ПредупреждениеpfSense interface without linkAn enabled pfSense interface has no link: cable, switch port or network card.
  • ПредупреждениеpfSense service stoppedA pfSense service that is enabled is not running: DNS resolver, VPN, NTP….
  • ПредупреждениеpfSense disk nearly fullThe pfSense disk is more than 90 % full: logs, reports and package updates stop being written.
Показать ещё 1
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Create a read-only REST API key for DumbMonit

  1. Install the pfSense-pkg-RESTAPI package (version 2) from Diagnostics → Command Prompt, with the file matching your pfSense version (2.7.2 below).

    pkg-static add https://github.com/pfrest/pfSense-pkg-RESTAPI/releases/latest/download/pfSense-2.7.2-pkg-RESTAPI.pkg

  2. System → REST API → Settings: tick both BasicAuth and Key among the authentication methods.

  3. System → User Manager → Users → Add: create the user dumbmonit with a long random password.

  4. Edit the user and, under Assigned Privileges, add the privileges listed below.

  5. Create the key as dumbmonit, copy the key value of the answer, then remove the POST privilege again.

    curl -k -u dumbmonit -X POST -H 'Content-Type: application/json' -d '{"descr":"DumbMonit"}' https://pfsense.lan/api/v2/auth/key

  6. In DumbMonit, enter the pfSense address (pfsense.lan) and paste the key as API key.

Обратите внимание. The REST API package is a community project, not part of pfSense: reinstall it after each pfSense upgrade. pfSense ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you replaced it.

Документация

FortiGate

fortigate

A Fortinet firewall through the FortiOS REST API: IPsec tunnels down, interfaces without link, HA out of sync, memory near conserve mode, FortiGuard licences expiring.

Примеры

  • FortiGate 40F / 60F / 100F
  • FortiGate VM
  • FortiOS 7.x

Что понадобится

  • API tokenThe token of the dumbmonit REST API user, sent as a bearer token.

Порт по умолчанию: 443

Встроенные правила оповещений 9

  • ТревогаFortiGate IPsec tunnel downNo phase 2 of a FortiGate site-to-site IPsec tunnel is up: the site behind it is cut off.
  • ПредупреждениеFortiGate interface without linkAn enabled FortiGate interface with an address has no link: cable, transceiver or the device in front.
  • ПредупреждениеFortiGate HA out of syncThe members of a FortiGate HA cluster no longer have the same configuration checksum: a failover would run another configuration.
  • ТревогаFortiGate HA member lostA FortiGate HA cluster has fewer members than in the last 24 hours: there is no standby any more (max_over_time(dumbmonit_fortigate_ha_members[1d]) - dumbmonit_fortigate_ha_members).
  • ПредупреждениеFortiGate memory near conserve modeFortiGate memory has stayed above 85 % for ten minutes: at 88 % (by default) it enters conserve mode and stops inspecting new sessions.
  • ПредупреждениеFortiGate CPU highFortiGate CPU has stayed above 90 % for fifteen minutes.
Показать ещё 3
  • ПредупреждениеFortiGate licence expiringA FortiGuard or FortiCare licence of the FortiGate expires in less than 30 days, or has expired.
  • ИнфоFortiGate firmware updateFortiGuard offers a newer patch release of the FortiOS branch the FortiGate runs.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Create a read-only REST API user for DumbMonit

  1. System → Admin Profiles → Create New: name the profile as follows and set the access permissions listed below, everything else None.

    dumbmonit-ro

  2. System → Administrators → Create New → REST API Admin: name it as follows and pick that profile.

    dumbmonit

  3. Under Trusted Hosts, enter the DumbMonit server's address with a /32 mask: FortiGate refuses 0.0.0.0/0.

  4. Click OK: FortiGate shows the API token once. Copy it.

  5. In DumbMonit, enter the FortiGate address (fw.lan) and paste the token as API token.

Обратите внимание. FortiGate ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Документация

Sophos Firewall

sophos

A Sophos Firewall (SFOS) through its XML API: the link of every interface in a zone, and which IPsec connections are activated. Its live tunnel, HA and licence state are not in that API.

Примеры

  • Sophos XGS
  • Sophos Firewall virtual appliance
  • SFOS 19 to 21

Что понадобится

  • User name and passwordThe dumbmonit user, whose device access profile is read-only everywhere.

Порт по умолчанию: 4444

Встроенные правила оповещений 2

  • ПредупреждениеSophos interface without linkA Sophos Firewall interface that is switched on and bound to a zone has no link.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Allow DumbMonit to read the Sophos Firewall XML API

  1. Profiles → Device access: add a profile named DumbMonit read-only and set every permission to Read-only.

  2. Authentication → Users: add a user named dumbmonit, of type Administrator, with that profile and a long random password.

    dumbmonit

  3. Backup & firmware → API (Administration → API access from SFOS 22): turn on the API configuration and add the DumbMonit server's address to the allowed IP addresses.

  4. In DumbMonit, enter the firewall address (sophos.lan) with that user name and password.

Обратите внимание. The API listens on the administration port (4444 by default) with a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Документация

Palo Alto PAN-OS

Бетаpaloalto

A Palo Alto Networks firewall through the PAN-OS XML API: interfaces without link, HA peer lost or out of sync, session table filling up, management CPU and memory, licences expiring, failed commits.

Примеры

  • PA-400 / PA-1400 series
  • VM-Series
  • PAN-OS 10.x and 11.x

Что понадобится

  • User name and passwordThe dumbmonit account: DumbMonit asks the firewall for an API key with it and keeps the key, the password only travels in a request body.
  • API keyA key already generated for the dumbmonit account, sent in the X-PAN-KEY header.

Порт по умолчанию: 443

Встроенные правила оповещений 9

  • ПредупреждениеPalo Alto interface without linkA Palo Alto firewall interface bound to a zone has no link: cable, transceiver or the device in front.
  • ТревогаPalo Alto HA peer lostThe peer of a Palo Alto HA pair is no longer active or passive, or the HA link to it is down: there is no standby any more.
  • ПредупреждениеPalo Alto HA out of syncThe running configuration of a Palo Alto HA pair is not synchronized: a failover would run another configuration.
  • ТревогаPalo Alto HA member not functionalThis Palo Alto firewall reports its HA state as suspended or non-functional.
  • ПредупреждениеPalo Alto session table filling upThe session table of a Palo Alto firewall has stayed above 90 % of its capacity for ten minutes: new sessions will be refused when it is full.
  • ПредупреждениеPalo Alto management CPU highThe management plane CPU of a Palo Alto firewall has stayed above 90 % for fifteen minutes.
Показать ещё 3
  • ПредупреждениеPalo Alto licence expiringA licence or subscription of a Palo Alto firewall expires in less than 30 days, or has expired.
  • ИнфоPalo Alto commit failedThe last configuration commit of a Palo Alto firewall failed: the running configuration is not the one that was saved.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Create a read-only XML API account for DumbMonit

  1. Device → Admin Roles → Add: name the role as follows. On the XML API tab enable Operational Requests only; leave every other privilege, and the Web UI and Command Line tabs, disabled.

    dumbmonit-ro

  2. Device → Administrators → Add: name the account as follows, set Authentication to a password, the type to Role Based and the role to the one above.

    dumbmonit

  3. Click Commit: the role and the account exist only once committed.

  4. In DumbMonit, enter the firewall address (pa.lan) with that user name and password, or with an API key you generated for that account.

Обратите внимание. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Документация

SonicWall SonicOS

Бетаsonicwall

A SonicWall firewall through the SonicOS 7 API: the link of every interface bound to a zone. Kept minimal on purpose: only the API paths SonicWall publishes are read.

Примеры

  • SonicWall TZ / NSa / NSsp
  • SonicWall NSv
  • SonicOS 7.x

Что понадобится

  • User name and passwordThe dumbmonit user, in a read-only group, sent as HTTP Basic.

Порт по умолчанию: 443

Встроенные правила оповещений 2

  • ПредупреждениеSonicWall interface without linkA SonicWall interface bound to a zone has no link.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Create a read-only user for the SonicOS API

  1. Device → Settings → Administration → Audit/SonicOS API: make sure HTTP Basic Access (RFC-2617) is on, then click Accept.

  2. Device → Users → Local Users & Groups → Add User: name it as follows, give it a long random password and add it to the group SonicWall Read-Only Admins.

    dumbmonit

  3. Allow HTTPS management on the interface DumbMonit reaches the firewall through (Device → Network → Interfaces → Configure → Management).

  4. In DumbMonit, enter the firewall address (sonicwall.lan) with that user name and password.

Обратите внимание. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Документация

Другие семейства