There are two CPUs on a Firewall. There is a management plane cpu and a data plane cpu.
The OIDs are below.
Active sessions: .1.3.6.1.4.1.25461.2.1.2.3.3
MGMT Utilization: .1.3.6.1.2.1.25.3.3.1.2.1
Data Plane Utilization: .1.3.6.1.2.1.25.3.3.1.2.2
The first step is to enable snmp on the Firewall.
Under
Device/Setup/Operations/Miscellaneous/SNMP Setup
enter your community string and pick the version.
Now I'm using unsecured snmp v2 because I didn't know how to use snmpv3 on the Splunk Application that I'm going to use to generate charts.
on an ubuntu vm I tested it.
admin@ubuntu-poc-vm:~$ snmpget 10.48.64.112 -v 2c -c public .1.3.6.1.2.1.25.3.2.1.3.2
iso.3.6.1.2.1.25.3.2.1.3.2 = STRING: "Slot-1 Data Processor"
admin@ubuntu-poc-vm:~$ snmpget 10.48.64.112 -v 2c -c public .1.3.6.1.2.1.25.3.2.1.3.1
iso.3.6.1.2.1.25.3.2.1.3.1 = STRING: "Management Processor"
admin@ubuntu-poc-vm:~$ snmpget 10.48.64.112 -v 2c -c public .1.3.6.1.2.1.25.3.3.1.2.1
iso.3.6.1.2.1.25.3.3.1.2.1 = INTEGER: 23
admin@ubuntu-poc-vm:~$ snmpwalk 10.48.64.112 -v 2c -c public .1.3.6.1.2.1.25.3.3.1.2.2
iso.3.6.1.2.1.25.3.3.1.2.2 = INTEGER: 5
Next I setup Splunk on a Windows 7 VM. It was pretty easy as you go to their website and download the app for your particular flavor of OS.
Once installed you hop onto the webui and change your credentials.
Next you need to install the SNMP Modular Input app. It's free.
Then you need to go Settings > Data Inputs > SNMP > Add New
Here I created a new input for each SNMP OID that I wanted to query.
There's a reason for this. I could have added a list of OIDs using comma delimited but I had a hard time trying parsing the data I wanted to graph. If someone has a better method let me know.
Last I used set source type to Manual and the actual source type to "snmp_ta" which is the SNMP Modular app.
Next I went to Manage App and looked for snmp_ta app and edited the permissions. I made the app visible.
A new icon appears in the dashboard and now I can double click it to examine the data being polled.
I first click on data summary and select the source tab and choose your source.
I should now see all the data that SNMP Modular Input queried from the firewall.
Now it's time to manipulate the data and create some nice graphs. First I have to manipulate the search fields.
I add a pipe and enter fields value.
This will specifically give me the value what is return from the SNMP OID.
Next I choose the Visualization tab and click on Pivot. I will only have 1 field to use which is the value field.
Then on the Y Axis I make sure the field says #value and I can label this as Data Plane CPU.
Then on the X Axis side I choose _time which will graph the data collected over time.
Make sure the Null Values say connected to give me a nice line graph instead of a bunch of dots.
Last I save this panel and give it a name so I can put it on my Dashboard.
Now you may say, Big deal, all this work to do that. I can just spin up Solar Winds and it's really easy. No need to create search queries and add pipes and then do all this to create one graph. Well the reason for using Splunk is that Palo Alto Networks has a nice plug-in (it's free) that works directly with Splunk. So with one tab I can check on all the traffic, threats and wildfire data collected and on the other tab I can look at the CPU Utilization and Session counts. This gives me one single pane of glass instead of having to jump onto different management tools to give me the same information.
