## Palo Alto IPSec VPN Monitoring Checkmk special agent and check plug-in for monitoring the operational state of IPSec VPN tunnels on Palo Alto Networks firewalls. The plug-in queries the PAN-OS XML API for the VPN flow status. Unlike interface-based SNMP monitoring, it retrieves the actual IPSec tunnel state reported by PAN-OS. ### Features - Automatic discovery of IPSec VPN tunnels - One Checkmk service per tunnel - Active tunnels reported as `OK` - Inactive tunnels reported as `CRIT` - Other tunnel states reported as `UNKNOWN` - Secure integration with the Checkmk password store - Configurable API timeout - Optional HTTPS certificate verification - Details for peer IP, local IP, interfaces, monitoring state and tunnel IDs ### Requirements - Checkmk 2.4 - HTTPS access from the Checkmk server to the firewall management interface - PAN-OS XML API key - PAN-OS administrator role with `XML API > Operational Requests` permission ### Tested with - Checkmk Enterprise Edition 2.4.0p22 - Palo Alto Networks PA-460 ### Installation Install the MKP using the Checkmk Extension Packages interface or command line: ```bash mkp add paloalto_ipsec-1.0.0.mkp mkp enable paloalto_ipsec cmk -R ``` After installation: 1. Store the PAN-OS API key under `Setup > General > Passwords`. 2. Configure `Palo Alto IPSec VPN monitoring` under the special-agent integrations. 3. Assign the rule to the firewall host. 4. Run service discovery. ### Security The API key is resolved through the Checkmk password store. The secret itself is not exposed in verbose Checkmk output or in the special-agent process arguments. ### Disclaimer This project is not affiliated with or endorsed by Checkmk GmbH or Palo Alto Networks.