Checkpoint Firewalls Changed Interface Description after R80.40 Upgrade #254
Comments
|
also see:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168601
Symptoms
-
SNMP poll of OID IF-MIB::ifDescr after upgrade to R80.40 Gaia OS shows only the driver details:
[Expert@GW:0]# snmpwalk -v 2c -c public localhost IF-MIB::ifDescr
IF-MIB::ifDescr.1 = STRING: lo
IF-MIB::ifDescr.2 = STRING: VMware VMXNET3 Ethernet Controller
IF-MIB::ifDescr.3 = STRING: VMware VMXNET3 Ethernet Controller
IF-MIB::ifDescr.4 = STRING: VMware VMXNET3 Ethernet Controller
-
SNMP poll of OID IF-MIB::ifDescr in a pre R80.40 Gaia OS shows the interface names:
[Expert@GW:0]# snmpwalk -v 2c -c public localhost IF-MIB::ifDescr
IF-MIB::ifDescr.1 = STRING: lo
IF-MIB::ifDescr.2 = STRING: eth0
IF-MIB::ifDescr.3 = STRING: eth1
IF-MIB::ifDescr.4 = STRING: eth2
IF-MIB::ifDescr.5 = STRING: eth3
IF-MIB::ifDescr.6 = STRING: vpnt1
Cause
The output on R80.40 and higher versions has changed and polling ifDesc provides descriptive information of the interface (Such as driver).
Solution
Use SNMP OID IF-MIB::ifName to get interface names for Gaia OS R80.40 and after
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
…On Wednesday d. 26. August 2020 kl. 10:24, Mario Rimann ***@***.***> wrote:
After upgrading a firewall from R80.30 to R80.40 we noticed that our traffic graphs don't show any data anmyore. To gather the interface's traffic, we run the plugin so it basically collects just all interfaces of the firewalls (unfiltered), Icinga2 pushes those performance data to InfluxDB and only in Grafana we then select certain data-streams (like eth1_traffic_in).
As far as we see, the interfaces are now presented different from the Checkpoint Firewalls - and it seems that check_nwc_health relies on the ifDescr and not the ifName. I'm not sure if that's by intention, a bug, or maybe even configurable to use ifName.
If I select/filter for "Intel Corporation I211 Gigabit Network Connection 2_traffic_in" I get the proper data out. But of course it would be nice if that would stay as "eth1" as it was before.
So far I did not find any way so influence the ifDescr value of those interfaces. The "comment" on the interface seems to have no influence and is properly shown in the output as Alias-Name (e.g. "WAN").
Verbose output of the interfaces:
***@***.***:/usr/lib/nagios/plugins/contrib/libexec# ./check_nwc_health --hostname x.x.x.x --mode list-interfaces-detail -vv
000001 lo ________ unknown unknown
000002 Intel Corporation I211 Gigabit Network Connection 2 WAN unknown unknown
000003 Intel Corporation I211 Gigabit Network Connection 3 REDACTED unknown unknown
000004 Intel Corporation I211 Gigabit Network Connection 4 REDACTED unknown unknown
000005 Intel Corporation I211 Gigabit Network Connection 5 ________ unknown unknown
000006 Intel Corporation I211 Gigabit Network Connection 6 ________ unknown unknown
000007 Intel Corporation I211 Gigabit Network Connection 7 REDACTED unknown unknown
000008 eth3.13 ________ unknown unknown
000009 eth3.12 ________ unknown unknown
000010 eth2.105 REDACTED unknown unknown
000011 eth2.202 REDACTED unknown unknown
000012 eth2.43 REDACTED unknown unknown
000013 eth3.11 ________ unknown unknown
000014 eth2.106 REDACTED unknown unknown
[INTERFACESUBSYSTEM]
bootTime: 1598378184.43
duplicates: HASH(0x558d7526e598)
ifCacheLastChange: 1598429622
ifTableLastChange: 1598378184.43
interface_cache: HASH(0x558d75277df0)
info: checking interfaces
[INTERFACE_14]
ifAlias: REDACTED
ifDescr: eth2.106
ifIndex: 14
ifName: eth2.106
[INTERFACE_1]
ifAlias: ________
ifDescr: lo
ifIndex: 1
ifName: lo
[INTERFACE_2]
ifAlias: WAN
ifDescr: Intel Corporation I211 Gigabit Network Connection 2
ifIndex: 2
ifName: eth1
[INTERFACE_8]
ifAlias: ________
ifDescr: eth3.13
ifIndex: 8
ifName: eth3.13
(...)
[INTERFACE_11]
ifAlias: REDACTED
ifDescr: eth2.202
ifIndex: 11
ifName: eth2.202
[INTERFACE_3]
ifAlias: REDACTED
ifDescr: Intel Corporation I211 Gigabit Network Connection 3
ifIndex: 3
ifName: eth2
[INTERFACE_10]
ifAlias: REDACTED
ifDescr: eth2.105
ifIndex: 10
ifName: eth2.105
OK - have fun
checking interfaces
Unfortunately I did not run the same command to compare the output with a R80.30.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, [view it on GitHub](#254), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AAXS5VGS4TNHSEWEBHM6XL3SCTBCPANCNFSM4QLROO7Q).
|
|
Just came across this behaviour as well, after Checkpoint appliances were upgraded from R80.30 to R81.10. The reason seems to be, as @henriknoerr mentioned, that the newer Gaia version uses another way to fill the "ifDescr" field. |
This comment was marked as outdated.
This comment was marked as outdated.
|
Hello, |
|
looks like I never pushed my changes to github, rather embarrasingly. And now there's some merge conflict and I really don't have the time to mess with git, sorry. |
…interfaces by SNMP ifName fixes lausser#254
|
Hello, |
|
@arnotron cool that you developped a fix for it. Always helpful to have someone else also looking at the code :-) In the example shown above (#254 (comment)) the "real" interface name can now be found under So here's a practical run on our CheckPoint VSX Firewall, currently running version R81.10. If I add the UPDATE: OH CRAP! I just realized I did a manual code merge on the check_nwc_health we used and basically implemented PR #111 to have this UPDATE2: Now I had to look it up for sure, what did I do back then. So this was in January 2022 when I manually merged PR #276 into the code. I guess this was the PR from @cmock but the PR has been deleted. So since then the plugin runs with this iflabel parameter (which was never merged in upstream, unfortunately). |
After upgrading a firewall from R80.30 to R80.40 we noticed that our traffic graphs don't show any data anmyore. To gather the interface's traffic, we run the plugin so it basically collects just all interfaces of the firewalls (unfiltered), Icinga2 pushes those performance data to InfluxDB and only in Grafana we then select certain data-streams (like eth1_traffic_in).
As far as we see, the interfaces are now presented different from the Checkpoint Firewalls - and it seems that check_nwc_health relies on the ifDescr and not the ifName. I'm not sure if that's by intention, a bug, or maybe even configurable to use ifName.
If I select/filter for "Intel Corporation I211 Gigabit Network Connection 2_traffic_in" I get the proper data out. But of course it would be nice if that would stay as "eth1" as it was before.
So far I did not find any way so influence the ifDescr value of those interfaces. The "comment" on the interface seems to have no influence and is properly shown in the output as Alias-Name (e.g. "WAN").
Verbose output of the interfaces:
Unfortunately I did not run the same command to compare the output with a R80.30.
The text was updated successfully, but these errors were encountered: