Hi Everyone,
We started using the new Palo Alto plugin with excitement. It successfully retrieves the ARP table from the Palo Alto firewall as XML every 20 minutes.
However, for some reason, while reading the ARP table from Palo Alto, the records are constantly expiring and being added again. This does not occur for the ARP records received via SNMP. Has anyone observed this situation?
In the example below, the IP address 192.168.0.250 belongs to a server. There is no disconnection, but for some reason, the MAC tracker records show that a re-connection is happening every 20 minutes. (BTW - our nav version is the latest (5.10.2).)
Best Regards Mehmet E. ŞAHİN
On Wed 05 Jun 2024 at 13:53, Mehmet E. Şahin (BAŞKANLIK-BİDB) mehmet.sahin@tubitak.gov.tr wrote:
We started using the new Palo Alto plugin with excitement. It successfully retrieves the ARP table from the Palo Alto firewall as XML every 20 minutes.
However, for some reason, while reading the ARP table from Palo Alto, the records are constantly expiring and being added again. This does not occur for the ARP records received via SNMP. Has anyone observed this situation?
I have not, but I don't have access to a Palo Alto firewall myself.
However, I suspect there may be some unintended entanglement with the regular SNMMP ARP plugin that (by default config) runs immediately before the Palo Alto ARP plugin. It does mark records as missing if it doesn't find them using SNMP. The actual database updates do not happen until the entire job (including the PaloAlto plugin) is finished, so the Palo Alto plugin would have the opportunity to rectify any incorrect markings.
Unfortunately, I don't think mr. Heimonen, who contributed the Palo Alto plugin, is a member of this list, so I'm Cc:ing him. This functionality was provided courtesy of the University of Tromsø, who needed it, but I don't know what their experience with this in production is thus far.
I'm looking into it
Sent from Outlook for Androidhttps://aka.ms/AAb9ysg ________________________________ From: Morten Brekkevold morten.brekkevold@sikt.no Sent: Thursday, June 6, 2024 9:58:42 AM To: mehmet.sahin@tubitak.gov.tr mehmet.sahin@tubitak.gov.tr Cc: nav-users@lister.sikt.no nav-users@lister.sikt.no; Joar Heimonen joarheimonen@live.no Subject: Re: [Nav-users] NAV - Palo Alto Plugin: MAC Records Keep Expiring
On Wed 05 Jun 2024 at 13:53, Mehmet E. Şahin (BAŞKANLIK-BİDB) mehmet.sahin@tubitak.gov.tr wrote:
We started using the new Palo Alto plugin with excitement. It successfully retrieves the ARP table from the Palo Alto firewall as XML every 20 minutes.
However, for some reason, while reading the ARP table from Palo Alto, the records are constantly expiring and being added again. This does not occur for the ARP records received via SNMP. Has anyone observed this situation?
I have not, but I don't have access to a Palo Alto firewall myself.
However, I suspect there may be some unintended entanglement with the regular SNMMP ARP plugin that (by default config) runs immediately before the Palo Alto ARP plugin. It does mark records as missing if it doesn't find them using SNMP. The actual database updates do not happen until the entire job (including the PaloAlto plugin) is finished, so the Palo Alto plugin would have the opportunity to rectify any incorrect markings.
Unfortunately, I don't think mr. Heimonen, who contributed the Palo Alto plugin, is a member of this list, so I'm Cc:ing him. This functionality was provided courtesy of the University of Tromsø, who needed it, but I don't know what their experience with this in production is thus far.
-- Sincerely, Morten Brekkevold
Sikt – Norwegian Agency for Shared Services in Education and Research
-
joar heimonen -
Mehmet E. Şahin (BAŞKANLIK-BİDB) -
Morten Brekkevold