VMware Cloud Community
ASIS_Intl
Contributor
Contributor

Monitoring, at OS level, a PanOS vm-series Firewall from vROPs 6.5?

Hello VMware communities!

I am working on migrating most of our monitoring and data collection over from Solarwinds and into vROPS, Log Insight, and (soon to be) Network Insight. In doing this, I've been trying to get a better grasp on how to use vRealize to map out the network topology of our two data centers based on the devices it is able to see.

Let's take datacenterA. DatacenterA has a PanOS vm-series firewall at the edge of the virtual stack (full NSX stack). vROPs is aware of the nexus switches connecting the hosts as well as the core router directly upstream (L2 trunked connection with nexus switches). It is also aware of the VDS, vPGs, etc. However, it doesn't seem to be aware of the L3 hops going from core router (or edge) -> vm-series firewall -> ESG and down.

If I go to the Network Device Connectivity and pick a VM whose gateway is on the core router as one device and a VM underneath the DLR as the second device, it fails miserably at trying to create a graphical representation of the 'physical path'. Is the physical path considered a L2 path in this scenario? If so, what would the L3 equivalent look like in vROPs?

I have a lot to figure out, and as I write this my question has already changed 3-4 times - so let's stick with this:

It appears that the Network Devices Adapter for the Network Devices Management Pack auto applies to the gateway that the collector chosen lives on. I say this as when I tried using different SNMP credentials on a second adapter, it gave me a message saying that SNMP failed when trying on the gateway of the collector. In this case, the gateway lives on a core router. Is there no way to choose different SNMP credentials to use in different situations without adding a dozen different collectors on different devices? I'd like to add in my vm-series firewall through snmp monitoring on the management interface, however between it being on a different device/subnet and using different snmp credentials it doesn't seem all that feasible.

Alternatively, could LLDP be configured in a way on the PanOS device to enable the collector to gather data from it?

I guess I just don't get why the only things a single collector picked up are both pairs of Nexus switches, both core routers, but no other (meta-)physical routing devices at either datacenter.

Sorry for the sloppy question...vROPs auto-picked up enough things that I was ecstatic with it at first. But it appears that was just the low hanging fruit...hmmm.

Follow-up: If it exists, I'd greatly appreciate a link to a best practices guide so that I can get a better understanding of what I'm getting myself into and how to design/configure it better!

Thanks in advance Smiley Wink

1 Reply
mhampto
VMware Employee
VMware Employee

If you are able to, please open a Support Request for this as it environment specific and would be easier to answer in that format.