Network Firewall (Appliance)

The Network Firewall (Appliance) check monitors a perimeter firewall — its reachability, firmware level, license / feature-key status, and security signals. It runs every 15 minutes on the octoja agent; the interval is not user-configurable. The agent platform (Windows, macOS, or Linux) is irrelevant — what matters is that the agent can reach the appliance or the vendor cloud.

octoja reaches the firewall through one of twelve vendor surfaces: Clavister NetWall (REST API), Check Point (SNMP), FortiGate (REST API), FortiGate (SNMP), OPNsense, pfSense (SNMP), Securepoint UTM (SNMP), Sophos XG / XGS (local), Sophos XG / XGS (SNMP), WatchGuard (REST), WatchGuard (SNMP), and SonicWall (SNMP). The fields visible in the UI depend on the selected vendor.

Which vendor surface?

The REST and local-API surfaces track firmware and license status; the SNMP surfaces read live measurements. What each surface delivers:

• Clavister NetWall (REST API) reads firmware, CPU, RAM, connection-table usage, license and subscription expiry, SECaaS status, and HA peer health through the local cOS Core REST API.
• FortiGate (REST API) reports the installed firmware version and FortiGuard license expiry. FortiGate (SNMP) reads live measurements: CPU, memory, disk, sessions, VPN tunnels, HA cluster members, and interfaces.
• WatchGuard (SNMP) delivers CPU, sessions, interfaces, and HA, plus feature-key expiry and firmware level.
• SonicWall (SNMP) delivers CPU, RAM, sessions, interfaces, and VPN tunnels.
• Sophos XG / XGS (SNMP) delivers RAM, disk, interfaces, and VPN tunnels.
• Securepoint UTM (SNMP) delivers CPU, RAM, sessions, interfaces, VPN tunnels (IPsec, OpenVPN, and WireGuard), HA sync state, firmware level, and license expiry.
• Check Point (SNMP) delivers CPU, RAM, disk, sessions, interfaces, VPN tunnels, HA, the gateway's overall status, and license expiry.
• pfSense (SNMP) delivers CPU, RAM, root file system, packet-filter state, sessions, and interfaces.

For a FortiGate, pick the surface that matches what you want to watch: FortiGate (REST API) for firmware and FortiGuard license status, or FortiGate (SNMP) for live measurements. You can configure both checks against the same appliance if you want each set of signals. Sophos XG / XGS offers the same choice: Sophos XG / XGS (local) for firmware and gateway status over the XML API, or Sophos XG / XGS (SNMP) for live memory, disk, VPN, and interface measurements.

Prerequisites

• A managed Clavister NetWall, OPNsense, pfSense, WatchGuard, Sophos XG / XGS, FortiGate, SonicWall, Securepoint UTM, or Check Point appliance
• The octoja agent installed on a device that can reach the appliance (every surface except WatchGuard REST) or the WatchGuard Cloud (WatchGuard REST)
• API credentials for the chosen vendor, or — for any SNMP surface — an SNMP community string or SNMPv3 user with read access (see the vendor sections below)
• Alternatively, the firewall registered in octoja as a network device — then octoja supplies its IP to the check automatically

Steps

1. Go to Devices and open the device where the octoja agent is installed — or open the firewall itself if it is registered as a network device.
2. Click the Checks tab → Add Check → Network Firewall (Appliance).
3. Pick a Vendor. The form rearranges to show the relevant fields.
4. Fill in the vendor-specific fields (see below).
5. Adjust License warning (days) if 30 days is not enough lead time for your renewal workflow (Clavister NetWall, WatchGuard, FortiGate, Securepoint UTM, and Check Point).
6. Leave Verify TLS certificate off unless your appliance presents a certificate signed by a trusted CA — most perimeter firewalls do not. The field appears on the OPNsense, Sophos XG / XGS (local), and FortiGate (REST API) surfaces. Clavister NetWall has Verify Clavister TLS certificate instead, which is on by default.
7. Click Add Check.

After the first check interval, the result appears in the device's Checks tab with online status, firmware level, license expiry (WatchGuard), open incidents (WatchGuard), and an issue list.

Adding the check on a network device. When the firewall itself is registered as a network device instead of running the octoja agent, the Host / IP field does not appear — octoja fills in the device's own IP each time the check runs, and the check runs from the agent picked as the device's Monitoring asset. The same applies to this check rolled out from a config package, so one package can cover every firewall in the group.

If you protect multiple appliances of the same vendor, configure one check per appliance. All the local-API and SNMP surfaces are appliance-local; only the WatchGuard (REST) surface is account-wide (one check covers every Firebox in the account).

Settings

Common fields apply across vendors; the rest are revealed when the matching vendor is selected.

Common

Clavister NetWall (REST API)

OPNsense

Where do I get an OPNsense API key/secret? octoja needs an API key and matching secret from an OPNsense user with read access to status and firmware information. Generate the key/secret pair in the OPNsense web UI and paste both into the fields above — see your firewall vendor's documentation for the exact steps.

WatchGuard (REST)

Sophos XG / XGS (local)

FortiGate (REST API)

FortiGate (SNMP)

Before you configure the check, enable SNMP on the appliance and create a v2c community string or an SNMPv3 user with read access — see your firewall vendor's documentation.

VPN tunnel status is aggregated by tunnel name: a tunnel counts as up when any of its selectors is up.

WatchGuard (SNMP)

Enable SNMP on the Firebox and create a v2c community string or an SNMPv3 user with read access first — see your firewall vendor's documentation. RAM, disk, and VPN measurements are not collected on this surface.

SonicWall (SNMP)

Enable SNMP on the appliance and create a v2c community string or an SNMPv3 user with read access first — see your firewall vendor's documentation. Disk and HA measurements are not collected on this surface.

Sophos XG / XGS (SNMP)

Enable SNMP on the appliance and create a v2c community string or an SNMPv3 user with read access first — see your firewall vendor's documentation. The SOPHOS-XG-MIB exposes no CPU object, so CPU and HA measurements are not collected on this surface.

pfSense (SNMP)

The pfSense surface uses SNMP v2c only — the SNMP version and SNMPv3 fields are not shown. First enable the SNMP service on the pfSense with the MIB II, Host Resources, and PF modules.

Securepoint UTM (SNMP)

Enable SNMP on the appliance and create a v2c community string or an SNMPv3 user with read access first — see your firewall vendor's documentation. Disk measurements are not collected on this surface. The appliance reports its firmware level and remaining license days itself, so no target version is configured.

Check Point (SNMP)

Enable SNMP on the gateway and create a v2c community string or an SNMPv3 user with read access first — see your firewall vendor's documentation.

Field behaviour

• The Interfaces that must be up and VPN tunnels that must be up pickers populate from what the previous SNMP run discovered. Run the check once, then come back to select the names you want to require.
• SNMP and Clavister thresholds are normalised so that the warning value is never higher than the critical value — if entered the wrong way round, octoja swaps them.
• Version comparison ignores letter case and matches on whole version components: the running version counts as up to date when it equals the target or extends it at a component boundary. 12.7.1 meets a target of 12.7, and 21.0.0 GA meets 21.0.0, while 20.0.2 does not meet a target of 2. Set Target firmware version to a shorter prefix to let patch revisions through.
• The SNMP interface collection skips software loopback interfaces. A required interface that is admin-up but operationally down is reported as down.

Results

Issue codes

The check reports a list of issue rows; the worst severity becomes the overall result. When all dimensions are clean, the result is OK.

*Clavister, Sophos, WatchGuard, SonicWall (SNMP) and Check Point (SNMP) outdated only fires when the matching target version is configured. OPNsense and Securepoint UTM (SNMP) need no target version — the appliance itself reports the available upgrade. FortiGate (REST API) reports the installed firmware version only, so the up-to-date dimension does not apply to that surface, nor to pfSense (SNMP).

OPNsense and Sophos feature-key / license expiry is currently not surfaced. The license dimension applies to Clavister, WatchGuard, FortiGate (REST API), Securepoint UTM (SNMP) and Check Point (SNMP).

Error codes

When the check itself cannot run (incomplete configuration, authentication failure, unreachable API), it reports a Failure result with one of the following error codes instead of issue rows. The check detail view shows the matching message.

Metrics collected

• vendor — the vendor string echoed back for the renderer
• online — appliance is reachable / at least one Firebox is connected
• firmwareCurrent — currently installed firmware version (best-effort across vendor JSON shapes)
• firmwareLatest — latest version reported by OPNsense or Securepoint UTM, or the configured target string for Clavister, Sophos, WatchGuard, SonicWall and Check Point
• upToDate — true / false / null (null when the up-to-date dimension was not evaluated)
• licenseExpiresAt — soonest feature-key / subscription expiry (Clavister, WatchGuard, FortiGate (REST API), Securepoint UTM and Check Point), ISO-8601
• openAlerts — ThreatSync open-incident count when available (WatchGuard only)
• issues — list of {severity, code, detail} entries that contributed to the result

The SNMP surfaces and Clavister additionally return the live measurements below; which of them are populated depends on what the vendor MIB or API exposes.

• sysName / model / osVersion / uptimeDays — appliance identity and uptime
• cpuPercent / memPercent / diskPercent — CPU, memory, and disk usage in percent
• memTotalMB / diskTotalMB — total memory and disk capacity
• sessionCount — active session count
• sessionLimit / sessionPercent — connection-table size and usage (Clavister only)
• vpnTunnels plus vpnTunnelsTotal / vpnTunnelsUp / vpnTunnelsDown — per-tunnel status and totals
• haMode / haGroup / haNodes / haNodeCount — HA mode, group, and per-node CPU / memory
• interfaces plus ifTotal / ifUp / ifDown and ifInErrors / ifOutErrors — interface status and aggregate error counters

Notes

• HTTP timeout per API call is 30 seconds.
• Use a dedicated read-only API user where the vendor allows it. The OPNsense and Sophos APIs accept credentials with browse-only permissions for status and firmware queries.
• The OPNsense flow triggers a fresh firmware-check before reading status, then waits 4 seconds — the OPNsense API serves a cached status until a check is explicitly triggered.
• For WatchGuard, the ThreatSync incident check is best-effort — accounts without a ThreatSync subscription return a non-success code and octoja silently skips that dimension.
• The WatchGuard parser is tolerant of field-name variations across tenants: connectionStatus / status, fireboxVersion / osVersion, featureKeyExpiration / expirationDate, and so on.
• The Sophos XML API requires the credentials in the request body, not headers — octoja escapes user input via the XML serializer before posting.