Palo Alto Prisma SD-WAN Monitoring
LogicMonitor’s suite for Palo Alto SD-WAN (formerly CloudGenix SD-WAN) monitors the following:
- Sites and traffic generated by the sites
- CloudGenix SD-WAN elements or devices and the status of these devices
This suite uses the Palo Alto Prisma SD-WAN API to retrieve site data.
Setup Requirements
- To configure the Palo Alto Prisma SD-WAN API, you need the Access Token from Palo Alto for the Cloudgenix portal.
Create CloudGenix Device Group
From the Resources page, create a Palo Alto SD-Wan device group and assign it the following properties:
Property | Value |
paloalto.sdwan.api.token.pass | API key |
Add Resources into Monitoring
Add sites and elements for monitoring, either manually or using NetScan. NetScan is the recommended method for adding sites, while Palo Alto SD-WAN elements should be added manually.
Adding Resources Manually
For adding Palo Alto SD-WAN elements manually, see Adding Devices.
Adding Resources using NetScan
You can create and run an advanced NetScan to automatically add sites. For more information, see Creating NetScans.
To configure the NetScan:
- In Settings | NetScans | Add | Advanced NetScan, select “Upload a script or csv to discover devices” from the Method field’s dropdown.
- From the scripting options, select “Embed Groovy Script”.
- Copy and paste the following Groovy Script into the field, replacing “Enter API token here” with your Access Token (make sure the API token is enclosed in quotes):
import com.logicmonitor.common.sse.utils.GroovyScriptHelper as GSH
import com.logicmonitor.mod.Snippets
def token = "Enter API token here"
def modLoader = GSH.getInstance()._getScript("Snippets", Snippets.getLoader()).withBinding(getBinding())
def collectorCache = this.class.classLoader.loadClass("com.santaba.agent.util.script.ScriptCache").getCache()
def sdwan = modLoader.load("paloalto.sdwan", "0")
def endpoint = "https://api.cloudgenix.com:443"
Map headers = [:]
headers.put("x-auth-token", token)
headers.put("Content-Type", "application/json")
def url = endpoint + "/v2.0/api/profile"
profileData = sdwan.httpGet(url, headers, 5)
String tenant = profileData.data.tenant_id
String region = profileData.data.region
endpoint = "https://api.${region}.cloudgenix.com:443" // add the region to the endpoint
Map sites = sdwan.sites(endpoint, tenant, headers, collectorCache)
sites.each{ k,v ->
println "${k}.site.invalid##${v}##auto.paloalto.sdwan.tenant=${tenant}##auto.paloalto.sdwan.siteid=${k}"
}
return 0
Manually Configure Sites
Although the NetScan method is recommended, you can also manually configure sites.
- Sites need to be set up with the property of the SiteID used in the hostname and in the format
siteid.site.invalid
, such as in the example:15342169863630098.site.invalid
. - We recommend that the display name match the site names in the SD-WAN configuration, such as Toledo or Main Office.
The following two properties need to be obtained from Palo Alto and set on each site:
Property | Value |
paloalto.sdwan.siteid | The SD-WAN internal ID for this site |
paloalto.sdwan.tenant | The tenant ID for this site |
The addCategory_PaloAlto_SDWAN
PropertySource will complete the configuration.
Import LogicModules
From the LogicMonitor public repository, import all PaloAlto SD-WAN LogicModules, which are listed in the LogicModules in Package section of this support article. If these LogicModules are already present, ensure you have the most recent versions. Once the LogicModules are imported (assuming all previous setup requirements have been met), data collection will automatically commence.
LogicModules in Package
Display Name | Type | Description |
addCategory_PaloAlto_SDWAN | PropertySource | Identifies SD-Wan sites and elements and adds system auto properties to the resources and adds the category paloalto.sdwan.sites to sites and paloalto.sdwan.elements to elements. |
PaloAlto_SDWAN_SiteEvents | EventSource | Pulls in alerts from the Palo Alto SDWan API. See this link for additional information. |
Palo Alto SDWAN Site Performance | DataSource | Traffic usage and other performance reported for a site from the API. |
Palo Alto SDWAN Link Quality | DataSource | Reports bandwidth utilization by WAN interface. |
Palo Alto SDWAN Watchdog | DataSource | Creates a background thread to retrieve data from the API. This data source must be installed for PaloAlto_SDWAN_Site_Performance to work. |
Note: Alerts are generated by Palo Alto Prisma SD-WAN API and imported into LogicMonitor.
Palo Alto SD-WAN Event Monitoring
Palo Alto SD-WAN event monitoring can be noisy for large installations. The following are optional properties you can set to override the existing Palo Alto SD-WAN alert levels if there are errors that need to be ignored or elevated. For more information, see Palo Alto’s alert codes documentation.
Property | Description |
paloalto.sdwan.event.ignore | Comma separated list of events to ignore. |
paloalto.sdwan.event.critical | Comma separated list of events to set at a Logicmonitor critical level. |
paloalto.sdwan.event.error | Comma separated list of events/alerts to set at a Logicmonitor error level. |
paloalto.sdwan.event.warning | Comma separated list of events to set at a Logicmonitor warning level. |