One metric I wanted to track was panTcpDropPacket - which tracks dropped packets. pushes each metric to a custom namespace in CloudWatch.Currently, the list of OIDs is stored inside the script - I will push this to SSM Parameter store so I don’t have to update the image when I want to add new metrics. for each endpoint, it loops through a list of MIBs and OIDS for each metric I wanted to track.I will look to have a task run in each region to improve fault tolerance. As of today, the task runs only in us-east-1 and communicates over the TGW/VPC private network to all the endpoints.There were 8 firewalls in 3 different AWS Regions connected via Transit Gateway, so I stored the list of management interface IPs in DynamoDB along with some other metadata. This is where the SNMP agent inside the networking device pushes metrics or alerts to your SNMP manager when your certain OIDs hit a certain threshold - e.g., a cord was unplugged.Ĭheck out this article by ManageEngine for more in depth information about SNMP.

This is where you can load your vendor-specific MIBs and tell it to query the OIDs you want from your network device for tracking. A polling flow is typically driven by a device (mostly network management systems but sometimes can be an organization’s SIEM or XDR) called a SNMP Manager.These metrics are processed by either polling or pushing. Policy Denies - this would monitor how many packets your firewall is blocking by policy.Active Sessions - to know when your firewall hits its licensed session limit.NAT Allocation failures - firewalls are often performing network address translation, so identifying NAT failures can be helpful when troubleshooting networking issues.Packet Drops - a spike in packet drops would indicate either a issue either in the firewall’s configuration or an upstream or downstream networking device.Temperature - for hardware, you don’t want your firewall heating up.Link state - for hardware firewalls, you would want to know if something got unplugged.

Next gen firewall