Problems
A single list of everything currently wrong, by severity and age. Operators can acknowledge or close problems with a reason. All problems are also kept in the event log.
Product · PA Monitor
API-based monitoring for Palo Alto Networks firewalls
PA Monitor monitors Palo Alto Networks firewalls through the PAN-OS XML API. It covers the whole firewall, with particular depth in routing: protocol state, route tables, path monitoring and MPLS paths between sites, alongside IPsec tunnels, GlobalProtect users, system health, licenses, certificates and software.
MPLS sites · example fleetpoll interval 5 min
On this page
Overview
Capabilities at a glance
- RoutingBGP, OSPF, RIP, IS-IS, static, path monitoring and BFD on both routing engines.
- MPLS path analysisSite discovery, prefix reachability and one confirmed problem per site.
- Health and inventoryCPU, sessions, throughput, interfaces, HA, licenses, certificates and software.
- AlertingProblems, threshold rules and scoped maintenance windows.
- GlobalProtectUser sessions, history, investigation search and anomaly alerts.
- Dashboards and reportsNOC dashboards, scheduled reports, Teams, Slack, email and webhooks.
- Read-only and auditedRead-only API access, encrypted keys, roles and an audit log.
- On-premisesOne offline Windows installer, with HTTPS and nightly backups built in.
Routing
Routing monitoring
Routing is the core of PA Monitor. Each poll reads the routing state of every firewall, on both legacy virtual routers and the Advanced Routing Engine. The engine is detected automatically when a firewall is added.
A BGP session that is Established is treated as up. A peer that is established but receives no routes, or is missing a site's prefixes, is flagged separately rather than reported as down.
Flaps are detected from session uptime between polls. Repeated flaps are grouped into a single flap-storm problem instead of one alert per event.
Capabilities
- BGP, OSPF, RIP, IS-IS and static routes
- Received and advertised prefixes per BGP peer
- Static route path monitoring and BFD sessions
- Flap detection and flap-storm handling
- Route-table change log: added, removed, next-hop changed
- Fleet-wide route and prefix search
- FIB lookup tool
- Fleet-wide BGP, OSPF, RIP and IS-IS views
MPLS and WAN
MPLS path analysis
After each poll cycle, PA Monitor identifies the sites, classifies the MPLS links (BGP peers on MPLS interfaces) and checks that every prefix a site advertises to its MPLS peers arrives at the other sites.
A site is evaluated only after all of its links have been checked. Some links down is a partial outage (warning); all links down is an outage (critical). Paths to and from an affected site do not alert separately, and a new MPLS problem must be seen on three checks, 30 seconds apart, before it is raised.
Interfaces are classified as MPLS/WAN or DIA (internet) from zone names, using editable keyword rules with common defaults. A manual tag on an interface always takes precedence.
Capabilities
- Automatic site and MPLS link discovery
- Prefix reachability between all sites
- Per-site outage and partial-outage problems
- Three-check confirmation before alerting
- Suppression of dependent path alerts
- Topology view, path availability (SLA %), uplinks and failover history
- Internet (DIA) circuits tracked separately from MPLS
Coverage
Sensors
Each firewall is assigned a monitoring profile that selects the sensors to run and how often (minimum 60 seconds; default 5 minutes). Slow-changing data such as licenses and certificates is collected on its own hourly or daily schedule.
| Sensor | Collects | Problems raised |
|---|---|---|
| Routing | Routes, BGP, OSPF, RIP, IS-IS and interfaces; flaps and route-table changes | Peer or neighbor down, no active static route, flap storm |
| Path monitoring | State of path-monitored static routes | Path monitor down |
| BFD | BFD session state | BFD session down |
| System health | Management plane, dataplane, sessions, throughput, interface traffic, disk and environmentals as time-series metrics | Threshold alert rules |
| System info and HA | Model, versions, uptime and high-availability state | Reboot, upgrade and HA change events |
| IPsec tunnels | Tunnel state, tunnel monitor and SA lifetime | Tunnel down |
| GlobalProtect | Connected users and session history | Same user on two public IPs at once; login from a new network |
| Licenses | Installed licenses and expiry dates | 60, 30 and 7 days before expiry |
| Certificates | Configuration certificates (full details) and the certificate store | 30 and 7 days before expiry |
| Software and content | Newer PAN-OS and content versions available to each firewall | Content more than 14 days behind |
| Panorama | Managed firewalls, connection, policy and template sync status, commit and push jobs | Disconnected from Panorama, out of sync |
An unreachable firewall is reported as down once, and its remaining sensors are skipped rather than failing individually.
Problems and maintenance
Problems, alert rules and maintenance windows
Alert rules
Raise a problem when a metric stays past a threshold for a set duration, for one firewall, a device group, a profile or the whole fleet. Defaults cover dataplane CPU, session table, packet buffer, management memory, temperature and disk.
Don't monitor
Items that should never alert, such as a lab BGP peer, stay visible but raise no problems, and are never counted as MPLS links.
Maintenance window scopes
Alerts during a window are still recorded but excluded from problem counts, the map and notifications. A window ends at its scheduled time or by hand, never because the condition cleared, so a flapping circuit cannot end it early.
| Scope | Covers |
|---|---|
| Whole firewall | Every alert of the firewall |
| MPLS only | The site's MPLS link alert, MPLS paths to and from the site, and BGP sessions on its MPLS links |
| DIA only | BGP sessions, path-monitored routes and IPsec tunnels on internet interfaces |
| Single item | One BGP peer, IPsec tunnel or path-monitored route |
Remote access
GlobalProtect visibility
PA Monitor collects connected GlobalProtect users and session history from every gateway, and supports investigation searches across the whole fleet.
Because this is personal data, access requires a separate GlobalProtect permission, and every search, timeline view and export is written to the audit log.
Capabilities
- Active users and session history per gateway
- Search by user, public IP or virtual IP
- "Who held this IP at time T" lookups
- CSV export of search results
- Alerts for one user on two public IPs at once
- Alerts for logins from a new network
Operations
Interface and reporting
Dashboards
Drag-and-drop dashboards with availability map, problems, top-N and graph widgets. Kiosk mode with rotation for NOC displays.
Device pages
Per-firewall overview, graphs, routing, interfaces, sensors, GlobalProtect and events, with availability history and outage list.
Search and history
Global search across devices, users, IP addresses, prefixes and interfaces. Event log of status changes, flaps, HA failovers, reboots and upgrades.
Notifications
Microsoft Teams, Slack, generic JSON webhooks and email. Each channel filters by severity and device group, optionally includes recoveries and operational events, and delivers new problems within 30 seconds.
Reports
Availability and SLA, top problems, inventory, and license and certificate expiry, as tables, CSV or PDF. Scheduled daily, weekly or monthly delivery by email, plus a daily summary.
Integrations
Prometheus exporter for metrics, reachability, open problems, tunnels and expiry. REST API with built-in documentation and scoped, expiring API tokens. Panorama integration.
Architecture
How PA Monitor works
A single Windows server polls each firewall directly over HTTPS using the PAN-OS XML API, stores the results, evaluates problems and serves the web interface. No agent is installed on the firewalls, and no data leaves your network unless you configure a notification channel.
Monitored
- Palo Alto Networks firewalls
- Both members of HA pairs
- Panorama (optional)
PA Monitor server
- Pollers on per-profile schedules
- Problem evaluation and MPLS analysis
- Database with metrics and history
- Web interface and REST API over HTTPS
- Nightly backups
Delivered to
- Operators in the browser and on NOC screens
- Teams, Slack, email and webhooks
- Prometheus and scripts via the API
- Scheduled email reports
Security
Security and access control
Read-only on the firewalls
PA Monitor uses a read-only admin role over the XML API and never changes configuration. The full command list is documented, so access can be limited to exactly those commands.
Credential handling
The account password is used once to generate an API key and then discarded. API keys are stored encrypted with AES-256-GCM. Certificate private keys are never read.
Roles and audit
Read-only, operator and admin roles, plus a separate GlobalProtect permission. Logins are rate-limited, and logins, changes and GlobalProtect searches are audited.
Minimal exposure
Only the HTTPS web interface is exposed. The database, message broker and API listen on the local host only.
Sessions
Short-lived access tokens with a secure, httpOnly, SameSite=Strict refresh cookie.
Protected data
Configuration, database and backups are restricted to SYSTEM, administrators and the service accounts.
# sample of read-only XML API requests show system info show high-availability state show routing protocol bgp peer show advanced-routing bgp peer status show advanced-routing static-route-path-monitor show vpn ipsec-sa show global-protect-gateway current-user show sslmgr-store config-certificate-info request license info request content upgrade info # lists available versions; installs nothing
Deployment
Installation and system requirements
PA Monitor is delivered as a single offline Windows setup package that installs every component it needs. Setup configures HTTPS, then verifies the API, database, worker, web interface and HTTPS end to end. Silent installation is supported. Upgrades keep configuration, data and certificates, and run database migrations automatically. An administrator guide covering installation, configuration, troubleshooting and the full PAN-OS command list is included.
| Requirement | Detail |
|---|---|
| Operating system | Windows Server 2016 or later (2019 or later recommended) |
| Sizing | 4 CPU and 8 GB RAM for about 50 firewalls; 50 GB disk for one year of history |
| Network | HTTPS (TCP 443) from the server to each firewall's management interface |
| Firewall account | Read-only admin role with XML API access, on each firewall or via Panorama templates |
| Internet access | Not required |
Backups and restore
Nightly database backups with a copy of the configuration, kept for 14 days by default. Backup on demand, a scripted single-transaction restore, and a problem raised if a backup fails.
Data retention
Configurable. Defaults: full-resolution metrics 30 days, hourly summaries 1 year, routing snapshots 90 days, events and route changes 1 year, GlobalProtect history 1 year, audit log 2 years.
FAQ
Frequently asked questions
Does PA Monitor change anything on the firewalls?
No. It connects with a read-only admin role and only sends operational show requests and configuration reads. The complete command list is in the administrator guide, so access can be limited to exactly those commands.
Which PAN-OS routing engines are supported?
Both legacy virtual routers and the Advanced Routing Engine. The engine is detected automatically when a firewall is added, and the same views, problems and alerts apply to both.
Does the server need internet access?
No. The setup package is fully offline and includes every component. Outbound access is needed only for notification channels you choose to use, such as Microsoft Teams or Slack.
How many firewalls can one server monitor?
A server with 4 CPU cores and 8 GB of RAM handles about 50 firewalls, with 50 GB of disk for one year of history. Polling frequency is set per monitoring profile, so smaller sites can be polled less often.
How are HA pairs handled?
HA state, including the peer's state, is read from each monitored member. Adding both members of a pair, each with its own account, keeps full coverage after a failover.
Does it work with Panorama?
Yes. Firewalls are polled directly, and the read-only account can be deployed through Panorama templates. PA Monitor can also connect to Panorama to show managed firewalls, sync status and recent jobs, and raises problems for disconnected or out-of-sync firewalls.
Can it feed our existing tools?
Yes. A Prometheus exporter publishes metrics, reachability, open problems, tunnel state and expiry data. A documented REST API with scoped, expiring tokens and JSON webhooks for every event are also available.
How is GlobalProtect user data protected?
Access to GlobalProtect history requires a separate permission, and every search, timeline view and export is recorded in the audit log. Retention is configurable, with a default of one year.
How is PA Monitor licensed?
Licensing and pricing are provided on request. Email sales@geniests.com with the number of firewalls you want to monitor.
Evaluation
Evaluate PA Monitor on your own network
- Install PA Monitor on a Windows Server VM.
- Create a read-only admin account on one firewall and add it.
- Review the problems list after the first polling cycle.
Contact us for the installation package and a technical walkthrough.
PA Monitor is a product of Genie Security and Technology Solutions (GSTS). Palo Alto Networks, PAN-OS, GlobalProtect and Panorama are trademarks of Palo Alto Networks, Inc. PA Monitor is an independent product and is not affiliated with or endorsed by Palo Alto Networks. Site names on this page are examples.