MIB Viewer

Palo Alto

Unlike Cisco, Juniper, and Fortinet, Palo Alto's SNMP setup is primarily a GUI-driven workflow rather than a well-documented sequence of CLI commands - this guide reflects that rather than inventing CLI syntax Palo Alto itself doesn't document for this purpose.

Enabling SNMP (SNMPv2c or SNMPv3)

  1. Navigate to Device > Setup > Operations, then click SNMP Setup in the lower right.
  2. Enter the physical location and a contact (these populate the standard sysLocation/sysContact objects).
  3. Choose the SNMP version: V2c or V3.
    • For V2c, enter the community string directly on this page.
    • For V3, the page changes to show view and user configuration instead - you need at least one view and one user assigned to it.
  4. Click OK, then commit the configuration.

SNMP also needs to be explicitly enabled on whichever interface will answer queries - typically Device > Setup > Management, then check the SNMP box under Management Interface Settings.

Sending traps: a separate configuration path

This is the biggest structural difference from other vendors on this list: Palo Alto separates being polled (the SNMP Setup page above) from sending traps, which is configured as a Server Profile tied to log forwarding, not inside the SNMP Setup page itself.

  1. Go to Device > Server Profiles > SNMP Trap and add a new profile - name it, specify the SNMP version, the manager's IP address, and (for v2c) the community string to use when sending traps.
  2. Under Device > Log Settings, pick which log types/severities should actually generate a trap, and select the SNMP server profile you just created as the destination.

In other words: a firewall can be pollable over SNMP without sending a single trap, and can send traps without allowing any inbound SNMP queries at all - the two are independently configured and neither implies the other.

Verifying from the CLI

While configuration is GUI-first, the resulting settings can be inspected from the CLI:

show deviceconfig system snmp-setting

Model/platform differences

This workflow applies the same way across PA-Series firewalls. Panorama (Palo Alto's centralized management platform) has its own separate SNMP configuration, under its own Device tab in the Panorama web interface - configuring SNMP on Panorama does not configure it on the firewalls it manages, or vice versa; each is set up independently.