DumbMonit
ИнтеграцииСеть и межсетевые экраны
Мониторинг Sophos Firewall в DumbMonit
A Sophos Firewall (SFOS) through its XML API: the link of every interface in a zone, and which IPsec connections are activated. Its live tunnel, HA and licence state are not in that API.
ДокументацияОфициальный сайт: Sophos Firewall
Описания на английском, как в самом продукте. Подписи на странице — на вашем языке.
Что проверяет DumbMonit
A Sophos Firewall (SFOS) through its XML API: the link of every interface bound to a zone, and which IPsec connections are activated. That is deliberately all. The XML API is a configuration API: besides the read-only connectivity status of each interface, it exposes no live state. <Get><IPSecConnection> returns whether an administrator activated a connection, not whether the tunnel is up; high availability, licences and subscriptions and the firmware version are not in it at all. DumbMonit publishes the activation as such and never presents it as a tunnel state.
Типичное применение. Firewall: interface links only (the XML API exposes no tunnel, HA or licence state)
Примеры
- Sophos XGS
- Sophos Firewall virtual appliance
- SFOS 19 to 21
Как подключается
Что понадобится
- User name and passwordThe dumbmonit user, whose device access profile is read-only everywhere.
Сетевые порты, которые нужно открыть
4444/TCPAdministration API (HTTPS, default)
Шаги настройки: Allow DumbMonit to read the Sophos Firewall XML API
Profiles → Device access: add a profile named DumbMonit read-only and set every permission to Read-only.
Authentication → Users: add a user named dumbmonit, of type Administrator, with that profile and a long random password.
dumbmonitBackup & firmware → API (Administration → API access from SFOS 22): turn on the API configuration and add the DumbMonit server's address to the allowed IP addresses.
In DumbMonit, enter the firewall address (sophos.lan) with that user name and password.
Обратите внимание. The API listens on the administration port (4444 by default) with a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.