ZenPacks : Juniper routers / firewalls / switches : Comments

RE: Juniper routers / firewalls / switches

community@zenoss.org — Fri, 22 Jul 2011 06:02:36 GMT

Hi Jane,

Just installed this to monitor our Juniper firewalls but alas we've got different hardware. Apparently our firewalls are models ISG2000, ISG1000 and SSG550.

I know you specifiy SRX100/210 firewalls, but I thought I'd be cheeky and ask if the OID list(s) could be expanded to include other models?...;-)

All I can offer in return is being a dutiful tester...

Cheers

James

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 27 Jul 2011 05:01:17 GMT

Also not sure if it was because I was using this pack against the incorrect Juniper devices, but it seemed to cause a rather nasty problem that stopped zenaction from functioning...

2011-07-27 14:17:46,172 ERROR zen.ZenActions: unexpected exception

Traceback (most recent call last):

File "/opt/zenoss/Products/ZenEvents/zenactions.py", line 636, in runCycle

self.mainbody()

File "/opt/zenoss/Products/ZenEvents/zenactions.py", line 624, in mainbody

self.eventCommands(zem)

File "/opt/zenoss/Products/ZenEvents/zenactions.py", line 613, in eventCommands

self.processEvent(zem, command, self.runEventCommand)

File "/opt/zenoss/Products/ZenEvents/zenactions.py", line 411, in processEvent

data['eventUrl'] = self.getEventUrl(evid, device)

File "/opt/zenoss/Products/ZenEvents/zenactions.py", line 226, in getEventUrl

return "%s/viewDetail?evid=%s" % (self.getBaseUrl(device), evid)

File "/opt/zenoss/Products/ZenEvents/zenactions.py", line 220, in getBaseUrl

return "%s%s" % (url, device.getPrimaryUrlPath())

AttributeError: 'JuniperDevice' object has no attribute 'getPrimaryUrlPath'

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 08 Aug 2011 10:08:32 GMT

Hi James - thanks for the input.

In theory anything can be expanded - by anyone . What OIDs do your boxes respond to?? Much of the basic stuff in this Juniper ZenPack is based on OIDs that start 1.3.6.1.4.1.2636.3.1. I am not familiar with your models - they may have been someone else's kit that Juniper bought?? If their enterprise-specific OIDs dont start with 1.3.6.1.4.1.2636 then they are way different boxes. If they do start with this then maybe we have a chance.

With regard to the zenaction failure, that's bad news. Are you saying that zenaction crashed or just had these error messages in the log? It certainly looks like it is a result of not modeling the device properly (because of the missing OIDs), but it still ought to fail nicely - I'll have a look.

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Fri, 02 Sep 2011 16:28:25 GMT

Love the pack. Any plans to add monitoring capabilitiesf or power supplies or fans?.

Get this error on 4200EX switches for the event class /Perf/SNMP for the CPU, Memory and Temp

Error reading value for "Cpu" on 10.133.109.110 (oid .1.3.6.1.4.1.2636.3.1.13.1.8 is bad). I'm using the JuniperBaseComp performance template

Thanks

RE: Juniper routers / firewalls / switches

community@zenoss.org — Thu, 22 Sep 2011 09:40:57 GMT

I don't see any cpu/temp graph for the MX / EX within the FPC/RE or PIC sub...?

I've activated all related subs in the Juniper.js and remodel the devices.. but it doesn't help.

Any Ideas?

Thanks Michael

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 03 Oct 2011 15:02:23 GMT

Hi,

You should already have power supply and fan components if the Juniper box supports them. Looks like your Juniper devices either use different OIDs for CPU and don't support it at all. Can you find out what OID they DO use for CPu, memory and temperature?

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 04 Oct 2011 12:48:03 GMT

Hello Jane,

thanks for reply...

The OID seems to be accurate, cause I see all relevant information under the details, but the graphs isn't showing anything.

Thanks

Michael

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 04 Oct 2011 13:09:43 GMT

Hello Jane,

the zenhub.log shows this entrys...

2011-09-26 21:00:24,008 WARNING zen.SnmpPerfConfig: mib lookup for .1.3.6.1.4.1.2636.3.1.13.1.7 failed
2011-09-26 21:00:24,010 WARNING zen.SnmpPerfConfig: mib lookup for .1.3.6.1.4.1.2636.3.1.13.1.8 failed
2011-09-26 21:00:24,010 WARNING zen.SnmpPerfConfig: mib lookup for .1.3.6.1.4.1.2636.3.1.13.1.15 failed

Thanks Michael

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 17 Oct 2011 22:55:22 GMT

I meant to send this a long time ago but FYI, the ISG and SSG model firewalls that we are using were actually created by Netscreen, who were subsequently acquired by Juniper.

Jane guessed correctly - these have enterprise OIDs that start with .1.3.6.1.4.1.3224 and thus this Zenpack won't work with them.

Figured I'd post in case other people with the older Netscreen models were considering trying this Zenpack.

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 18 Oct 2011 00:49:49 GMT

FYI for anyone else with the older Netscreen firewalls, use this Zenpack: http://community.zenoss.org/docs/DOC-3449

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 18 Oct 2011 07:58:26 GMT

Hello James and Jane,

my problem is solved.

It was a bug inline with Ticket #7859... (Leading Dot in front of a MIB value)

Michael

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 18 Oct 2011 12:31:20 GMT

Hi,

seems that the zenpack has some Browser dependencies?

Based on test with Zenoss 3.2 and activated columns within Juniper.js

IE 8.0: only Events, ObjectName, Monitored and Status columns are displayed.

FireFox 3.6 all activated columns are displayed

Michael

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 18 Oct 2011 14:41:37 GMT

@James - The ISG series are basically the evolution of NetScreen, it's pretty clear this pack is based on JUNOS, a totally different architecture. It would probably be easier to make a separate ZenPack for ScreenOS based devices.

Woops nevermind, I see you later comments now.

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 18 Oct 2011 14:54:41 GMT

Tested fine against SRX650, EX2200, EX3200, and J-Series J2320

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 18 Oct 2011 20:06:37 GMT

Interesting. Thanks for the feedback Michael. I have only tested with Firefox as I don't use Windows . Has anyone else tried with other versions of IE or Chrome??

Glad to see that the OID problem turned out to be the "leading dot" bug - I should have asked whther you were using 3.2!

twm1010 - thanks for the update about other Junos-type devices that the ZenbPack does work for.

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 13 Feb 2012 18:57:04 GMT

In 1.2 the scripts in ZenPacks/ZenSystems/Juniper/lib seemed to not have their execute bit set. I had to +x them to stop the alerts. Also I am monitoring SRX 650's and 3400's. What modeling templates do you recommend I bind? I am currently binding all of them but Interfaces are not graphing anything.

Thanks,

Brad

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 28 Feb 2012 06:20:54 GMT

Really nice pack.

and maybe we can make it better.

It works good on my SRX240

but on my EX4200 I recieve the following errors.

"Error reading value for "Cpu" on CORE1 (oid .1.3.6.1.4.1.2636.3.1.13.1.8 is bad)"

"Error reading value for "Temp" on CORE1 (oid .1.3.6.1.4.1.2636.3.1.13.1.7 is bad)"

"Error reading value for "Memory" on CORE1 (oid .1.3.6.1.4.1.2636.3.1.13.1.15 is bad)"

I belive the OID's ar wrong.

Maybe this info will help.

"http://kb.juniper.net/InfoCenter/index?page=content&id=KB17526&cat=EX4200_1&actp=LIST"

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 13 Mar 2012 09:35:52 GMT

Interesting - thanks for your feedback. I have just re-downloaded the 1.2 egg file and that DOES seem to have the execute bits set on the files in the lib directory. Could it be something on your local setup that has changed this?

With regard to binding templates, I think you should find that appropriate device-level templates are already associated with the relevant Juniper device classes. Many of the templates are COMPONENT templates and deo remember that component templates bind automatically (and should NOT be manually bound by a user).

You say that you are not seeing any graphs for interfaces?? You should get this regardless of the zenpack as the interface component templates (ethernetCsmacd and ethernetCsmacd_64) are part of standard Zenoss Core.

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 16 Apr 2012 22:01:54 GMT

Hi!

I am a complete newbie on Zenoss, but we have a running 3.2.1 with this ZenPack, since we have lots of SRXs. We are almost exclusively runnning SRX 240H, with 10.4R[4-9]

The most strange thing right now is that all stuff, most importantly the Routing Engines, are discovered on my clusters, but are missing on my single systems. This is a pity, since I need to keep an eye on CPU usage.

Any ideas or troubleshooting tips? Remember that I am a newbie, but I have this Zenoss 3 book: http://www.packtpub.com/zenoss-core-3-x-network-and-system-monitoring/book

/Per

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 18 Apr 2012 16:57:42 GMT

Hi Per,

Not sure I understand your comment about your "single systems" (I don't have Juniper boxes myself).

Can you do some snmpwalk tests from your Zenoss server to one of the offending boxes? You will need the snmp parameters for the target device. For example, if you are talking to a device called switch.example.org, using SNMP version 1 with a community name of public, could you run the following and email (jane.curry@skills-1st.co.uk) me the ouput (cos I think it might be BIG):

snmpwalk -v 1 -c public switch.example.org .1.3.6.1.4.1.2636.3.1.8.1

also

snmpwalk -v 1 -c public switch.example.org .1.3.6.1.4.1.2636.3.1.13.1

If you use SNMP version 2, remember you need

snmpwalk -v 2c -c public switch.example.org .1.3.6.1.4.1.2636.3.1.13.1

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Fri, 20 Apr 2012 07:29:51 GMT

Hi Jane!

Just wanted to make a public reply thanking you for your kind effort in helping me with this problem.

It turned out to be a known problem when you have modeled a node as something else, and then change the device class and remodel the node.

The final fix turned out to be to delete the node (keep data) and then recreate it with the same name/IP. In most cases the existing data was picked up.

All nodes are now properly modeled.

Once again, thanks!

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 22 May 2012 21:52:55 GMT

Thanks for making this ZenPack, I have found it very useful. I have one question though. I have several Juniper J4350 routers with BGP on them. It reads the peers perfectly. Is there an easy way to get it to send a critical alert when a peer changes status?

Thanks,

Joe

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 03 Sep 2012 22:23:55 GMT

Hi...as a relatively new user of Zenoss, recently upgraded from ver 3 to ver 4 and was just wondering if there will be a upgrade to allow this zenpack to work in ver 4.x?

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 04 Sep 2012 10:35:00 GMT

For all interested parties.......

I am today working on making this ZenPack with Zenoss Core 4.2. There have been a number of requests and comments since it was released. If you have requests (with detailed input please!), then today would be a really good day to contribute.

I know that one of the scripts does not work with SNMP v3 and have that in hand. I know other folk have different models of Juniper device that don't give data for the OIDs that I have used. If you can point me at other OIDs for specific Juniper (Junos) devices (not NetScreen devices - see previous comment) then please do so and I will try and incorporate.

Thanks,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 04 Sep 2012 19:03:55 GMT

OK. For anyone whu has a Core 4.2 test environment, I have put up a 4.2 version of this ZenPack on github - https://github.com/jcurry/ZenPacks.ZenSystems.Juniper/tree/4.x . There is a link to the Zenoss 4 compatible egg file under the downloads section towards the bottom of the README.rst.

PLEASE provide feedback.

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Fri, 14 Sep 2012 06:50:43 GMT

Have had it installed and running since you updated it to 4.2. One thing I notice is that the VLAN information doesn't seem to come through like it did under 3.x. We run EX2200, EX3300, EX4200 & EX3200 series switches that are all monitored.

RE: Juniper routers / firewalls / switches

community@zenoss.org — Fri, 14 Sep 2012 08:57:26 GMT

Hmm - the only test device I currently have access to is a EX4200 but

the VLAN stuff looks just the same for me on 3.1 and 4.2. Do you get

error messages from the modeler? Is anything else different?

Cheers,

jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Sun, 16 Sep 2012 23:31:49 GMT

Yes we have built a new server using Centos as Ubuntu which we ran our ver 3.x on was no longer supported properly. It could be that some of the packages on Ubuntu we haven’t installed on Centos as we selected to install just a basic server.

I haven’t checked the modeller for messages as it could be a missing package at OS level.

Thanks,

John

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 17 Sep 2012 12:07:05 GMT

I have a ex3200 (11.4R3.7), monitored by zenoss-3.2.1.

I added it under /Network/Switch/Juniper but the routing engine modeler doesn't work as I would expect. The class is Products.ZenModel.Device.Device instead of ZenPacks.ZenSystems.Juniper.JuniperDevice

>>> dmd.Devices.Network.Switch.Juniper.moveDevices('/Network/Switch/Juniper','10.44.25.145')

2012-09-17 13:59:47 ERROR Zope.ZCatalog uncatalogObject unsuccessfully attempted to uncatalog an object with a uid of /zport/dmd/Devices/Network/Switch/Juniper/devices/10.44.25.145/os.

RE: Juniper routers / firewalls / switches

community@zenoss.org — Fri, 21 Sep 2012 11:29:27 GMT

Hi Thomas,

It certainly should have a python class of ZenPacks.ZenSystems.Juniper.JuniperDevice. Can I suggest you delete the device and re-add it?

The message about "unsuccessfully attempted to uncatalog an object"... I believe is a benign message that you often see when a device has been deleted.

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Fri, 21 Sep 2012 11:35:24 GMT

Hi John,

I doubt that stuff is missing at an OS level. Are you modelling exactly the same device? Check the modeller output. You could run the Vlan modeler in debug mode for a device with:

zenmodeler run -v 10 -d <your device name> --collect JuniperVlanMap

You should see SNMP data being fetched.

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 26 Sep 2012 02:44:41 GMT

Hi Jane,

I tried that command but I think something is amiss with my Zenoss install as it came back with:

./zenmodeler: line 12: /bin/zenfunctions: No such file or directory

./zenmodeler: line 19: generic: command not found

I’ll see if I can find something about why zenfunctions seems to be missing.

Thanks for your assistance,

John

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 26 Sep 2012 05:32:06 GMT

I’ve since determined the previous issue was that the command needed to be run as zenoss user and not root user. I captured the output but am not sure where it is having a problem as it looks as though it is working still not sure what may be different from when we had 3.2 working.

2012-09-26 15:00:36,718 DEBUG zen.SnmpClient: running <ZenPacks.ZenSystems.Juniper.modeler.plugins.JuniperVlanMap.JuniperVlanMap object at 0x73bd650>

2012-09-26 15:00:36,718 DEBUG zen.SnmpClient: sending queries for plugin JuniperVlanMap

2012-09-26 15:00:36,719 DEBUG zen.twistedsnmp: reactor settings: Juniper routers / firewalls / switches, None

2012-09-26 15:00:36,719 DEBUG zen.twistedsnmp: reactor settings: Juniper routers / firewalls / switches, 0.999976

….

2012-09-26 15:00:40,289 DEBUG zen.ZenModeler: Processing plugin JuniperVlanMap on device juniper3300-vc ...

2012-09-26 15:00:40,289 DEBUG zen.ZenModeler: Plugin JuniperVlanMap results = ({}, {<Products.DataCollector.plugins.CollectorPlugin.GetTableMap object at 0x739e9d0>: {'.1.3.6.1.4.1.2636.3.40.1.5.1.6.1.2': {'.1.3.6.1.4.1.2636.3.40.1.5.1.6.1.2.4': '\xac\x12$R'}},

…

<Products.DataCollector.plugins.CollectorPlugin.GetTableMap object at 0x739e910>: {'.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3': {'.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.8': 2, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.9': 2, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.6': 1, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.7': 1, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.4': 1, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.5': 1, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.2': 1, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.3': 1, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.10': 2, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3.11': 2}, '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.2': {'.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.2.3': 'default', '.1.3.6.1.4.1.2636.3.40.1.5.1.5.1.2.2': 'clients',

…

'.1.3.6.1.2.1.2.2.1.6.672': 'd\x87\x88\xb8\xb6\x99', '.1.3.6.1.2.1.2.2.1.6.673': 'd\x87\x88\xb8\xb6\x9a'}}})

2012-09-26 15:00:40,302 INFO zen.ZenModeler: processing JuniperVlanMap for device juniper3300-vc

2012-09-26 15:00:40,331 DEBUG zen.Classifier: No classifier defined

2012-09-26 15:00:40,380 INFO zen.ZenModeler: No change in configuration detected

2012-09-26 15:00:40,381 DEBUG zen.ZenModeler: Client juniper3300-vc finished

2012-09-26 15:00:40,381 DEBUG zen.ZenModeler: Running 0 clients

2012-09-26 15:00:40,381 INFO zen.ZenModeler: Scan time: 4.26 seconds

This is just a small portion of the output I’ve included, there was many lines of numbers and it did have all my vlans detected which I have only included a couple, yet within the GUI under Components they simply do not appear.

John

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 26 Sep 2012 06:00:51 GMT

I have occasionally seen this before. Incidentally, ALWAYS, ALWAYS, ALWAYS do zenoss stuff as the zenoss user; other wise you can end up with stuff not owned by zenoss and that causes havoc.

Thins to try:

1) Use Shift-Refresh on your broswer

2) Clear the browser cache

3) I assume you have stopped and restarted Zenoss entirely since installing the ZenPack?

4) Delete the device and rediscover it, making sure it goes into the correct Juniper class

5) Use the ZMI (Zope Management Interface) to work out whether the OBJECTs are there:

a) Point browser at <your zenoss>:8080//zport/dmd/manage

b) In the left hand window, navigate to the correct device class and then in the main window go down devices

c) Navigate down the instance for your device

d) You should see the realtionships for the different components - there should be a JuniperVl

e) Are there any instances under the Vl??????

f) If yes, then the modeler is fine and it is just an issue with the GUI

6) What browser are you using? I always use Firefox (currently 15)

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 26 Sep 2012 06:38:52 GMT

I am trying the ZMI but not sure whether something is missing or not from it as there is no JuniperVI anywhere I looked, here is a screenshot:

cid:image001.png@01CD9C05.5007A420

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 26 Sep 2012 20:12:12 GMT

Here is a screenshot of mine (device name is balcked out).

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 26 Sep 2012 22:02:43 GMT

Could it be that I have not installed any Juniper MIBs on my Zenoss server? My Zope screen is definitely missing and although I don’t believe we installed any Juniper MIBs on our old 3.2 Zen server that could be our issue.

RE: Juniper routers / firewalls / switches

community@zenoss.org — Wed, 26 Sep 2012 22:33:28 GMT

Nope. Zenoss only uses MIBs for interpreting TRAPs. If you are not seeing the Zope screen at all then something else is defintely wrong.

Cheers,

Jane

RE: Juniper routers / firewalls / switches

community@zenoss.org — Thu, 01 Nov 2012 13:37:16 GMT

Hi Jane

I just wanted to let you know that I've implemented your 4.2 Zenpack to monitor our pair of Juniper SRX210H firewalls. It works perfectly first time, thank you!

Cheers

Rob

RE: Juniper routers / firewalls / switches

community@zenoss.org — Tue, 16 Jul 2013 08:18:55 GMT

I am running version 2 of your zenpack on Zenoss 4.2.3/4.2.4. There is a problem with the zenpack install in that it is setting the shell scripts in /lib to 664 which they can't execute. chmod +x *.sh fixes them and removes the warning messages.

Brad

RE: Juniper routers / firewalls / switches

community@zenoss.org — Mon, 02 Dec 2013 09:52:08 GMT

Hi,

fyi, the jnxYellowAlarmState has not been added to the JuniperRoutingEngine template threshold.