SNAT translation has an indefinite timeout configured-f5-all

SNAT translation has an indefinite timeout configured-f5-all
0

SNAT translation has an indefinite timeout configured-f5-all

Vendor: f5

OS: all

Description:
A SNAT translation object with an indefinite idle timeout could result in stalled connections and resource exhaustion. It is good practice to set a timeout to the smallest possible finite value that your applications allows.

Remediation Steps:
Reconfigure your SNAT translation objects with the lowest finite value that your application allows.

How does this work?
This alert uses the iControl REST interface to extract the SNAT translation configurations.

Why is this important?
A SNAT translation object with an indefinite idle timeout could result in stalled connections and resource exhaustion. It is good practice to set a timeout to the smallest possible finite value that your application allows.

Without Indeni how would you find this?
An adminstrator could login to the device through SSH, execute the command “tmsh -c ‘cd /;list ltm snat-translation recursive’”. Then for each configured SNAT translation, verify that the idle timeout values is not set to “indefinite”.

f5-rest-mgmt-tm-ltm-snat-translation

name: f5-rest-mgmt-tm-ltm-snat-translation
description: Get SNAT translation idle timeout values
type: monitoring
monitoring_interval: 60 minutes
requires:
    vendor: f5
    product: load-balancer
    rest-api: 'true'
comments:
    lb-snat-translation-indefinite-idle-timeout:
        why: |
            A SNAT translation object with an indefinite idle timeout could result in stalled connections and resource exhaustion. It is good practice to set a timeout to the smallest possible finite value that your application allows.
        how: |
            This alert uses the iControl REST interface to extract the SNAT translation configurations.
        can-with-snmp: false
        can-with-syslog: false
steps:
-   run:
        type: HTTP
        command: /mgmt/tm/ltm/snat-translation?$select=fullPath,ipIdleTimeout,tcpIdleTimeout,udpIdleTimeout,enabled
    parse:
        type: JSON
        file: rest-mgmt-tm-ltm-snat-translation.parser.1.json.yaml

F5SNATTranslationIndefiniteTimeoutRule

// Deprecation warning : Scala template-based rules are deprecated. Please use YAML format rules instead.

package com.indeni.server.rules.library.templatebased.f5
import com.indeni.server.rules.library.templates.StateDownTemplateRule


case class F5SNATTranslationIndefiniteTimeoutRule() extends StateDownTemplateRule(
  ruleName = "F5SNATTranslationIndefiniteTimeoutRule",
  ruleFriendlyName = "F5 Devices: SNAT translation has an indefinite timeout configured",
  ruleDescription = "A SNAT translation object with an indefinite idle timeout could result in stalled connections and resource exhaustion. It is good practice to set a timeout to the smallest possible finite value that your applications allows.",
  metricName = "lb-snat-translation-indefinite-idle-timeout",
  applicableMetricTag = "name",
  alertItemsHeader = "Affected SNAT translation lists",
  alertDescription = "A SNAT translation object with an indefinite idle timeout could result in stalled connections and resource exhaustion. It is good practice to set a timeout to the smallest possible finite value that your applications allows.",
  baseRemediationText = "Reconfigure your SNAT translation objects with the lowest finite value that your application allows.",
  alertIfDown = false
)()