Zabbix Template: PFSense by SNMP

Template for monitoring pfSense by SNMP Setup: 1. Enable SNMP daemon at Services in pfSense web interface https://docs.netgate.com/pfsense/en/latest/services/snmp.html 2. Setup firewall rule to get access from Zabbix proxy or Zabbix server by SNMP https://docs.netgate.com/pfsense/en/latest/firewall/index.html#managing-firewall-rules 3. Link template to the host

MIBs used: BEGEMOT-PF-MIB HOST-RESOURCES-MIB

Generated by official Zabbix template tool "Templator"

Items

Item: DHCP server status

MIB: HOST-RESOURCES-MIB The status of DHCP server process.

pfsense.dhcpd.status

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: DNS server status

MIB: HOST-RESOURCES-MIB The status of DNS server process.

pfsense.dns.status

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: State of nginx process

MIB: HOST-RESOURCES-MIB The status of nginx process.

pfsense.nginx.status

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: Packets with bad offset

MIB: BEGEMOT-PF-MIB True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

pfsense.packets.bad.offset

Settings:

Item Setting	Value
Type	SNMP_AGENT
Value type	FLOAT in pps
History	7d

Item: Fragmented packets

MIB: BEGEMOT-PF-MIB True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

pfsense.packets.fragment

Settings:

Item Setting	Value
Type	SNMP_AGENT
Value type	FLOAT in pps
History	7d

Item: Packets matched a filter rule

MIB: BEGEMOT-PF-MIB True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

pfsense.packets.match

Settings:

Item Setting	Value
Type	SNMP_AGENT
Value type	FLOAT in pps
History	7d

Item: Packets dropped due to memory limitation

MIB: BEGEMOT-PF-MIB True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

pfsense.packets.mem.drop

Settings:

Item Setting	Value
Type	SNMP_AGENT
Value type	FLOAT in pps
History	7d

Item: Normalized packets

MIB: BEGEMOT-PF-MIB True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

pfsense.packets.normalize

Settings:

Item Setting	Value
Type	SNMP_AGENT
Value type	FLOAT in pps
History	7d

Item: Short packets

MIB: BEGEMOT-PF-MIB True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

pfsense.packets.short

Settings:

Item Setting	Value
Type	SNMP_AGENT
Value type	FLOAT in pps
History	7d

Item: Packet filter running status

MIB: BEGEMOT-PF-MIB True if packet filter is currently enabled.

pfsense.pf.status

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: Firewall rules count

MIB: BEGEMOT-PF-MIB The number of labeled filter rules on this system.

pfsense.rules.count

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: Source tracking table current

MIB: BEGEMOT-PF-MIB Number of entries in the source tracking table.

pfsense.source.tracking.table.count

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: Source tracking table limit

MIB: BEGEMOT-PF-MIB Maximum number of 'sticky-address' or 'source-track' rules in the ruleset.

pfsense.source.tracking.table.limit

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: Source tracking table utilization in %

Utilization of source tracking table in %.

pfsense.source.tracking.table.pused

Settings:

Item Setting	Value
Type	CALCULATED
Value type	FLOAT in %
History	7d

Item: States table current

MIB: BEGEMOT-PF-MIB Number of entries in the state table.

pfsense.state.table.count

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: States table limit

MIB: BEGEMOT-PF-MIB Maximum number of 'keep state' rules in the ruleset.

pfsense.state.table.limit

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Item: States table utilization in %

Utilization of state table in %.

pfsense.state.table.pused

Settings:

Item Setting	Value
Type	CALCULATED
Value type	FLOAT in %
History	7d

Item: SNMP agent availability

Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list. Possible values: 0 - not available 1 - available 2 - unknown

zabbix[host,snmp,available]

Settings:

Item Setting	Value
Type	INTERNAL
History	7d

Triggers

Trigger: DHCP server is not running

Please check DHCP server settings https://docs.netgate.com/pfsense/en/latest/services/dhcp/index.html Settings:

Trigger Setting	Values
Priority	AVERAGE

last(/PFSense by SNMP/pfsense.dhcpd.status)=0

Trigger: DNS server is not running

Please check DNS server settings https://docs.netgate.com/pfsense/en/latest/services/dns/index.html Settings:

Trigger Setting	Values
Priority	AVERAGE

last(/PFSense by SNMP/pfsense.dns.status)=0

Trigger: Web server is not running

Please check nginx service status. Settings:

Trigger Setting	Values
Priority	AVERAGE

last(/PFSense by SNMP/pfsense.nginx.status)=0

Trigger: Packet filter is not running

Please check PF status. Settings:

Trigger Setting	Values
Priority	HIGH

last(/PFSense by SNMP/pfsense.pf.status)<>1

Trigger: Source tracking table usage is high

Please check the number of sticky connections https://docs.netgate.com/pfsense/en/latest/monitoring/status/firewall-states-sources.html Settings:

Trigger Setting	Values
Priority	WARNING

min(/PFSense by SNMP/pfsense.source.tracking.table.pused,#3)>{$SOURCE.TRACKING.TABLE.UTIL.MAX}

Trigger: State table usage is high

Please check the number of connections https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#config-advanced-firewall-maxstates Settings:

Trigger Setting	Values
Priority	WARNING

min(/PFSense by SNMP/pfsense.state.table.pused,#3)>{$STATE.TABLE.UTIL.MAX}

Trigger: No SNMP data collection

SNMP is not available for polling. Please check device connectivity and SNMP settings. Settings:

Trigger Setting	Values
Priority	WARNING

max(/PFSense by SNMP/zabbix[host,snmp,available],{$SNMP.TIMEOUT})=0

Discovery Rules

Discovery Rule: Network interfaces discovery

Discovering interfaces from IF-MIB.

pfsense.net.if.discovery

Settings:

Item Setting	Value
Type	SNMP_AGENT

Discovery Rule: Network interfaces discovery: Item Prototypes

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 traffic blocked

MIB: BEGEMOT-PF-MIB IPv4 bits per second blocked coming in on this interface.

net.if.in.block.v4.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 packets blocked

MIB: BEGEMOT-PF-MIB The number of IPv4 packets blocked coming in on this interface.

net.if.in.block.v4.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 traffic blocked

MIB: BEGEMOT-PF-MIB IPv6 bits per second blocked coming in on this interface.

net.if.in.block.v6.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 packets blocked

MIB: BEGEMOT-PF-MIB The number of IPv6 packets blocked coming in on this interface.

net.if.in.block.v6.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound packets discarded

MIB: IF-MIB The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

net.if.in.discards[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound packets with errors

MIB: IF-MIB For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

net.if.in.errors[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 traffic passed

MIB: BEGEMOT-PF-MIB IPv4 bits per second passed coming in on this interface.

net.if.in.pass.v4.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 packets passed

MIB: BEGEMOT-PF-MIB The number of IPv4 packets passed coming in on this interface.

net.if.in.pass.v4.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 traffic passed

MIB: BEGEMOT-PF-MIB IPv6 bits per second passed coming in on this interface.

net.if.in.pass.v6.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 packets passed

MIB: BEGEMOT-PF-MIB The number of IPv6 packets passed coming in on this interface.

net.if.in.pass.v6.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Bits received

MIB: IF-MIB The total number of octets received on the interface, including framing characters. This object is a 64-bit version of ifInOctets. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

net.if.in[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 traffic blocked

MIB: BEGEMOT-PF-MIB IPv4 bits per second blocked going out on this interface.

net.if.out.block.v4.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 packets blocked

MIB: BEGEMOT-PF-MIB The number of IPv4 packets blocked going out on this interface.

net.if.out.block.v4.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 traffic blocked

MIB: BEGEMOT-PF-MIB IPv6 bits per second blocked going out on this interface.

net.if.out.block.v6.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 packets blocked

MIB: BEGEMOT-PF-MIB The number of IPv6 packets blocked going out on this interface.

net.if.out.block.v6.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound packets discarded

MIB: IF-MIB The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

net.if.out.discards[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound packets with errors

MIB: IF-MIB For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

net.if.out.errors[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 traffic passed

MIB: BEGEMOT-PF-MIB IPv4 bits per second passed going out on this interface.

net.if.out.pass.v4.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 packets passed

MIB: BEGEMOT-PF-MIB The number of IPv4 packets passed going out on this interface.

net.if.out.pass.v4.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 traffic passed

MIB: BEGEMOT-PF-MIB IPv6 bits per second passed going out on this interface.

net.if.out.pass.v6.bps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 packets passed

MIB: BEGEMOT-PF-MIB The number of IPv6 packets passed going out on this interface.

net.if.out.pass.v6.pps[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Bits sent

MIB: IF-MIB The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of ifOutOctets.Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

net.if.out[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Rules references count

MIB: BEGEMOT-PF-MIB The number of rules referencing this interface.

net.if.rules.refs[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Speed

MIB: IF-MIB An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n' then the speed of the interface is somewhere in the range ofn-500,000' to`n+499,999'. For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero.

net.if.speed[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Operational status

MIB: IF-MIB The current operational state of the interface. - The testing(3) state indicates that no operational packet scan be passed - If ifAdminStatus is down(2) then ifOperStatus should be down(2) - If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic - It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection) - It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state - It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

net.if.status[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Item Prototype: Interface [{#IFNAME}({#IFALIAS})]: Interface type

MIB: IF-MIB The type of interface. Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA), through updating the syntax of the IANAifType textual convention.

net.if.type[{#SNMPINDEX}]

Settings:

Item Setting	Value
Type	SNMP_AGENT
History	7d

Discovery Rule: Network interfaces discovery: Discovery Triggers

Discovery Rule: Network interfaces discovery: Trigger Prototype: Interface [{#IFNAME}({#IFALIAS})]: High input error rate

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold. Settings:

Trigger Setting	Values
Priority	WARNING

min(/PFSense by SNMP/net.if.in.errors[{#SNMPINDEX}],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}

Discovery Rule: Network interfaces discovery: Trigger Prototype: Interface [{#IFNAME}({#IFALIAS})]: High output error rate

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold. Settings:

Trigger Setting	Values
Priority	WARNING

min(/PFSense by SNMP/net.if.out.errors[{#SNMPINDEX}],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}

Discovery Rule: Network interfaces discovery: Trigger Prototype: Interface [{#IFNAME}({#IFALIAS})]: Link down

This trigger expression works as follows: 1. It can be triggered if the operations status is down. 2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.

Settings:

Trigger Setting	Values
Priority	AVERAGE

{$IFCONTROL:"{#IFNAME}"}=1 and (last(/PFSense by SNMP/net.if.status[{#SNMPINDEX}])=2)

Discovery Rule: Network interfaces discovery: Graph Prototypes

The following graph prototypes are defined by this Template

• Interface [{#IFNAME}({#IFALIAS})]: Inbound packet filter traffic
• Interface [{#IFNAME}({#IFALIAS})]: Network traffic
• Interface [{#IFNAME}({#IFALIAS})]: Outbound packet filter traffic

Macros

The following Zabbix macros are configured via this template.

Macro: {$IF.ERRORS.WARN}

Threshold of error packets rate for warning trigger. Can be used with interface name as context.

Default:

2

Macro: {$IF.UTIL.MAX}

Threshold of interface bandwidth utilization for warning trigger in %. Can be used with interface name as context.

Default:

90

Macro: {$IFCONTROL}

Macro for operational state of the interface for link down trigger. Can be used with interface name as context.

Default:

1

Macro: {$NET.IF.IFADMINSTATUS.MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

^.*

Macro: {$NET.IF.IFADMINSTATUS.NOT_MATCHES}

Ignore down(2) administrative status.

Default:

^2$

Macro: {$NET.IF.IFALIAS.MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

.*

Macro: {$NET.IF.IFALIAS.NOT_MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

CHANGE_IF_NEEDED

Macro: {$NET.IF.IFDESCR.MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

.*

Macro: {$NET.IF.IFDESCR.NOT_MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

CHANGE_IF_NEEDED

Macro: {$NET.IF.IFNAME.NOT_MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

(^pflog[0-9.]*$|^pfsync[0-9.]*$)

Macro: {$NET.IF.IFOPERSTATUS.MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

^.*$

Macro: {$NET.IF.IFOPERSTATUS.NOT_MATCHES}

Ignore notPresent(6).

Default:

^6$

Macro: {$NET.IF.IFTYPE.MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

.*

Macro: {$NET.IF.IFTYPE.NOT_MATCHES}

This macro is used in filters of network interfaces discovery rule.

Default:

CHANGE_IF_NEEDED

Macro: {$SNMP.TIMEOUT}

The time interval for SNMP availability trigger.

Default:

5m

Macro: {$SOURCE.TRACKING.TABLE.UTIL.MAX}

Threshold of source tracking table utilization trigger in %.

Default:

90

Macro: {$STATE.TABLE.UTIL.MAX}

Threshold of state table utilization trigger in %.

Default:

90

Dashboards

The following Zabbix dashboards are included in this template.

• PFSense: Overview