Dependencies Questions

[ahahum]

Greetings!

I'm looking for some help on dependencies when monitoring firewalls at remote locations. We have a lot of locations that use an IPSec tunnel to connect back to the rest of our network. These IPSec tunnels are initiated with a Cisco Pix firewall.

The way I am currently monitoring them is I configure 2 hosts for each firewall - 1 for the public IP and 1 for the private IP which is only accessible if the IPSec tunnel is up.

I would like to set dependencies for the private IP triggers based on the availability of the public side.

I know I can go through and do this individually for each host trigger to it's respective dependent, but I was wondering if there was an easier, more creative way to accomplish this.

Is anyone else doing something similar?

Thank you for reading...I look forward to hearing some ideas here.

Adam

[simon123]

Templated host dependency

Greetings!

I'm looking for some help on dependencies when monitoring firewalls at remote locations. We have a lot of locations that use an IPSec tunnel to connect back to the rest of our network. These IPSec tunnels are initiated with a Cisco Pix firewall.

The way I am currently monitoring them is I configure 2 hosts for each firewall - 1 for the public IP and 1 for the private IP which is only accessible if the IPSec tunnel is up.

I would like to set dependencies for the private IP triggers based on the availability of the public side.

I know I can go through and do this individually for each host trigger to it's respective dependent, but I was wondering if there was an easier, more creative way to accomplish this.

Is anyone else doing something similar?

Thank you for reading...I look forward to hearing some ideas here.

Adam

This used to be very simple: You just set up a template for some subnet (behind firewalls, routers, etc) and then in the template add triggers (ping) who are dependant on the (ping) triggers from the firewall, ... -hosts. After that you just stick the template to any host that's in that subnet, and voila...

This action has however been disabled for some reason in the latest version. There's already a request to re-add this functionality (as it is a very important functionality if you ask me), you can follow this at
https://support.zabbix.com/browse/ZBXNEXT-835.

As for now, i don't see how you can add a host dependency to a template unless you downgrade to a pre 1.8.3 version. anyone else?

EDIT:

You could also use the API and script the whole thing, if you have some kind of list with the addresses and names of these firewalls...

[ahahum]

This used to be very simple: You just set up a template for some subnet (behind firewalls, routers, etc) and then in the template add triggers (ping) who are dependant on the (ping) triggers from the firewall, ... -hosts. After that you just stick the template to any host that's in that subnet, and voila...

This action has however been disabled for some reason in the latest version. There's already a request to re-add this functionality (as it is a very important functionality if you ask me), you can follow this at
https://support.zabbix.com/browse/ZBXNEXT-835.

As for now, i don't see how you can add a host dependency to a template unless you downgrade to a pre 1.8.3 version. anyone else?

EDIT:


You could also use the API and script the whole thing, if you have some kind of list with the addresses and names of these firewalls...

I'm not sure this applies to my situation. I will try to provide an example. If I have misunderstood you, I apologize.

Remote FW1
Public IP: 4.2.2.2
Private IP: 10.23.1.1

I setup Ping checks for both. If Public is down, then Private is also down - but I only need alert on Public, not both.

Currently, I just use 1 template for my remote firewalls. They have ping checks, bandwidth, and uptime. I alert on icmpping returning 0 for the previous 3 polls.

I am not understanding how to tie these in using your method. It seems like you're saying to tie these triggers back into a dependency of my main firewall connection at the site Zabbix lives. This is not what I'm trying to do at this point.

I should point out I create a host for both 4.2.2.2 and 10.23.1.1 in this scenario. Both have the same template applied.

[MarkusL]

Hi!

My point of view is, that you have no chance to do it in a more simple way. Problem is, that zabbix can´t find out which external IP belongs to which internal. So you have to depend your triggers by hand: "this internal (host) IP belongs to this external (host) IP, thats why int depends on that ext".

Another way would be to test it with a script on a "master-machine"; maybe your zabbix-server.

Example of a windows-batch:

ping -n 1 4.2.2.2>2nul
if %errorlevel%==0 (goto next) else (zabbix_sender [options] "external down")
:next
ping -n 1 10.23.1.1>2nul
if %errorlevel%==0 (zabbix_sender [options] "VPN up") else (zabbix_sender [options] "VPN down")


With a little work, you can generate one script and a txt-file or something with all your IPs. With a for-command each IP is tested.
Your dependency-model is now in the batch, not in zabbix = no more host2host-dependencies.

We do a lot of outside-scripting to get important infos to have a kind of "basis-monitoring" = communication of all relevant parts ok; now let´s monitor the relevant stuff :-)




Kind regards,

Markus.

[ahahum]

Hi!

My point of view is, that you have no chance to do it in a more simple way. Problem is, that zabbix can´t find out which external IP belongs to which internal. So you have to depend your triggers by hand: "this internal (host) IP belongs to this external (host) IP, thats why int depends on that ext".

Another way would be to test it with a script on a "master-machine"; maybe your zabbix-server.

Example of a windows-batch:

ping -n 1 4.2.2.2>2nul
if %errorlevel%==0 (goto next) else (zabbix_sender [options] "external down")
:next
ping -n 1 10.23.1.1>2nul
if %errorlevel%==0 (zabbix_sender [options] "VPN up") else (zabbix_sender [options] "VPN down")


With a little work, you can generate one script and a txt-file or something with all your IPs. With a for-command each IP is tested.
Your dependency-model is now in the batch, not in zabbix = no more host2host-dependencies.

We do a lot of outside-scripting to get important infos to have a kind of "basis-monitoring" = communication of all relevant parts ok; now let´s monitor the relevant stuff :-)




Kind regards,

Markus.

That's what I figured, but I thought I would check with the community of gurus before I started pounding through that. I hadn't done it previously because changes to the template would overwrite dependencies. Luckily, that was fixed in 1.8.5.

I'll dig into those scripting ideas...that looks very promising.