Static routing table does not match across cluster members-paloaltonetworks-panos

Static routing table does not match across cluster members-paloaltonetworks-panos
5.0 1

Static routing table does not match across cluster members-paloaltonetworks-panos

Vendor: paloaltonetworks

OS: panos

Description:
Indeni will identify when two devices are part of a cluster and alert if their static routing tables are different.

Remediation Steps:
Ensure the static routing table matches across devices in a cluster.

How does this work?
This script uses the Palo Alto Networks API to retrieve the current routing table (the equivalent of running “show routing route” in CLI).

Why is this important?
Capture the route entries that are statically set on the device.

Without Indeni how would you find this?
An administrator would be able to poll this data through SNMP but additional external logic would be required to correlate the static routes table across cluster members.

panos-show-routing-route

name: panos-show-routing-route
description: fetch the current routing table
type: monitoring
monitoring_interval: 10 minutes
requires:
    vendor: paloaltonetworks
    os.name: panos
    product: firewall
comments:
    static-routing-table:
        why: |
            Capture the route entries that are statically set on the device.
        how: |
            This script uses the Palo Alto Networks API to retrieve the current routing table (the equivalent of running "show routing route" in CLI).
        without-indeni: |
            An administrator would be able to poll this data through SNMP but additional external logic would be required to correlate the static routes table across cluster members.
        can-with-snmp: false
        can-with-syslog: false
    connected-networks-table:
        why: |
            Capture the route entries that are directly connected to the device.
        how: |
            This script uses the Palo Alto Networks API to retrieve the current routing table (the equivalent of running "show routing route" in CLI).
        without-indeni: |
            An administrator would be able to poll this data through SNMP but additional external logic would be required to correlate the connected routes table across cluster members.
        can-with-snmp: false
        can-with-syslog: false
    routes-usage:
        skip-documentation: true
steps:
-   run:
        type: HTTP
        command: /api?type=op&cmd=<show><routing><route><%2Froute><%2Frouting><%2Fshow>&key=${api-key}
    parse:
        type: XML
        file: show-routing-route.parser.1.xml.yaml

static_routing_table_comparison_non_vsx

// Deprecation warning : Scala template-based rules are deprecated. Please use YAML format rules instead.

package com.indeni.server.rules.library.templatebased.crossvendor

import com.indeni.server.common.data.conditions.{Equals => DataEquals}
import com.indeni.server.rules.RuleContext
import com.indeni.server.rules.library.templates.SnapshotComparisonTemplateRule
import com.indeni.server.rules.RemediationStepCondition

/**
  *
  */
case class static_routing_table_comparison_non_vsx() extends SnapshotComparisonTemplateRule(
  ruleName = "static_routing_table_comparison_non_vsx",
  ruleFriendlyName = "Clustered Devices (Non-VS): Static routing table does not match across cluster members",
  ruleDescription = "Indeni will identify when two devices are part of a cluster and alert if their static routing tables are different.",
  metricName = "static-routing-table",
  isArray = true,
  metaCondition = !DataEquals("vsx", "true"),
  baseRemediationText = "Ensure the static routing table matches across devices in a cluster.",
  alertDescription = "Devices that are part of a cluster must have the same static routing tables. Review the differences below.\n\nThis alert was added per the request of <a target=\"_blank\" href=\"http://il.linkedin.com/pub/itzik-assaraf/2/870/1b5\">Itzik Assaraf</a> (Leumi Card)."
  )(
  RemediationStepCondition.VENDOR_CP -> "Use the \"show configuration\" command in clish to compare the calls to \"set static-route\".",
  RemediationStepCondition.VENDOR_CISCO ->
    """|
      |1. Execute the "show ip route static" command to display the current contents of the  static routes installed to the routing table.
      |2. Compare the static route config between the peer switches with the show run | i "ip route" command
      |NOTE: The static routes configured between the peer switches may be different in case of orphan devices without need of redundancy between the vPC peer switches
      |3. For more information please review the next Cisco configuration guide:
      |https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/unicast/configuration/guide/l3_cli_nxos/l3_route.html
    """.stripMargin
)
{override def deviceCondition(context: RuleContext) = generateDevicePassiveAndPassiveLinkStateCondition(context.tsDao)}

Very important in an Active/Active HA configuration.

When in Active/Passive mode, this rule will not trigger. (see last line of the rule)

There may be certain network design scenarios where these would not match such as in a DR site. They would only be identical with some type of DataCenter Interconnect to extend the IP subnets across sites like Cisco OTV or other failover equipment.