Palo Alto IPSec VPN Monitoring

Checkmk special agent and check plug-in for monitoring the operational state of IPSec VPN tunnels on Palo Alto Networks firewalls.

The plug-in queries the PAN-OS XML API for the VPN flow status. Unlike interface-based SNMP monitoring, it retrieves the actual IPSec tunnel state reported by PAN-OS.

Features

• Automatic discovery of IPSec VPN tunnels
• One Checkmk service per tunnel
• Active tunnels reported as OK
• Inactive tunnels reported as CRIT
• Other tunnel states reported as UNKNOWN
• Secure integration with the Checkmk password store
• Configurable API timeout
• Optional HTTPS certificate verification
• Details for peer IP, local IP, interfaces, monitoring state and tunnel IDs

Requirements

• Checkmk 2.4
• HTTPS access from the Checkmk server to the firewall management interface
• PAN-OS XML API key
• PAN-OS administrator role with XML API > Operational Requests permission

Tested with

• Checkmk Enterprise Edition 2.4.0p22
• Palo Alto Networks PA-460

Installation

Install the MKP using the Checkmk Extension Packages interface or command line:

mkp add paloalto_ipsec-1.0.0.mkp
mkp enable paloalto_ipsec
cmk -R

After installation:

1. Store the PAN-OS API key under Setup > General > Passwords.
2. Configure Palo Alto IPSec VPN monitoring under the special-agent integrations.
3. Assign the rule to the firewall host.
4. Run service discovery.

Security

The API key is resolved through the Checkmk password store. The secret itself is not exposed in verbose Checkmk output or in the special-agent process arguments.

Disclaimer

This project is not affiliated with or endorsed by Checkmk GmbH or Palo Alto Networks.