In-Reply-To: <20050519162122.14982.qmail@www.securityfocus.com>
Cool!, but... this is supposed to be added in the pandora_agent.conf file, but,
all these commands are included in the IPSO?? Are that commands valid for any
IPSO? We want to use that to monitor more FW, but we want to be sure of the
availability...
And continuing asking, there's anything more that the included in the default
file that can be done for FW security? Something like count the fw objects or
rules, or see if IP forwarding is enable...
And also, how to configure an alert if the FW is dropping a large amount of
packages (sympthom of an attack..)?
I know there are a lot of questions, sorry :-D
Hello!
We have 2 Nokia IPSO 3.5 in HA with CheckPoint NG FP4, and we are trying to
monitor these with Pandora agent for IPSO (the last version 1.1). I'm using
the standard monitors like CPU packet fragmentation and so on and all it's
OK, I can see the graphics and statistics, but... can we obtain any way to
have the state of High Availability, not with iclid?
Easy, I think that is not included in the default agent for Nokia FW-1 IPSO,
but implementation would be some as:
module_begin
module_name run_ha_ckp
module_type generic_proc
module_exec cpstat -f all ha | tr -s " " " " | awk '/Status short: OK|HA
started: yes|HA state: active/{x+=1} END { if (x == 3) print "1"; else print
"0"}'
module_end
module_begin
module_name ha_fw_ckp
module_type generic_proc
module_exec cpstat -f sync fw | tr -s " " " " | awk '/sync - configured:
Yes|sync - out state: On|sync - in state: On/{x+=1} END { if (x == 3) print
"1"; else print "0"}'
module_end
Please before check commands outside Pandora (running in prompt and verifing
syntax). In http://pandoramon.sourceforge.net/index.php?sec=docs/index
(Pandora Documentation section), will be published a "contrib" modules
section, please check in a few days.
