# PFSense SNMP ## Overview For Zabbix version: 6.2 and higher Template for monitoring pfSense by SNMP This template was tested on: - pfSense, version 2.5.0, 2.5.1, 2.5.2 ## Setup > See [Zabbix template operation](https://www.zabbix.com/documentation/6.2/manual/config/templates_out_of_the_box/network_devices) for basic instructions. 1. Import template into Zabbix 2. Enable SNMP daemon at Services in pfSense web interface https://docs.netgate.com/pfsense/en/latest/services/snmp.html 3. Setup firewall rule to get access from Zabbix proxy or Zabbix server by SNMP https://docs.netgate.com/pfsense/en/latest/firewall/index.html#managing-firewall-rules 4. Link template to the host ## Zabbix configuration No specific Zabbix configuration is required. ### Macros used |Name|Description|Default| |----|-----------|-------| |{$IF.ERRORS.WARN} |

Threshold of error packets rate for warning trigger. Can be used with interface name as context.

|`2` | |{$IF.UTIL.MAX} |

Threshold of interface bandwidth utilization for warning trigger in %. Can be used with interface name as context.

|`90` | |{$IFCONTROL} |

Macro for operational state of the interface for link down trigger. Can be used with interface name as context.

|`1` | |{$NET.IF.IFADMINSTATUS.MATCHES} |

This macro is used in filters of network interfaces discovery rule.

|`^.*` | |{$NET.IF.IFADMINSTATUS.NOT_MATCHES} |

Ignore down(2) administrative status

|`^2$` | |{$NET.IF.IFALIAS.MATCHES} |

This macro is used in filters of network interfaces discovery rule.

|`.*` | |{$NET.IF.IFALIAS.NOT_MATCHES} |

This macro is used in filters of network interfaces discovery rule.

|`CHANGE_IF_NEEDED` | |{$NET.IF.IFDESCR.MATCHES} |

This macro used in filters of network interfaces discovery rule.

|`.*` | |{$NET.IF.IFDESCR.NOT_MATCHES} |

This macro used in filters of network interfaces discovery rule.

|`CHANGE_IF_NEEDED` | |{$NET.IF.IFNAME.MATCHES} |

This macro used in filters of network interfaces discovery rule.

|`^em[0-9]+$` | |{$NET.IF.IFNAME.NOT_MATCHES} |

This macro used in filters of network interfaces discovery rule.

|`^$` | |{$NET.IF.IFOPERSTATUS.MATCHES} |

This macro used in filters of network interfaces discovery rule.

|`^.*$` | |{$NET.IF.IFOPERSTATUS.NOT_MATCHES} |

Ignore notPresent(6)

|`^6$` | |{$NET.IF.IFTYPE.MATCHES} |

This macro used in filters of network interfaces discovery rule.

|`.*` | |{$NET.IF.IFTYPE.NOT_MATCHES} |

This macro used in filters of network interfaces discovery rule.

|`CHANGE_IF_NEEDED` | |{$SNMP.TIMEOUT} |

The time interval for SNMP availability trigger.

|`5m` | |{$SOURCE.TRACKING.TABLE.UTIL.MAX} |

Threshold of source tracking table utilization trigger in %.

|`90` | |{$STATE.TABLE.UTIL.MAX} |

Threshold of state table utilization trigger in %.

|`90` | ## Template links There are no template links in this template. ## Discovery rules |Name|Description|Type|Key and additional info| |----|-----------|----|----| |Network interfaces discovery |

Discovering interfaces from IF-MIB.

|SNMP |net.if.discovery

**Filter**:

AND

- {#IFADMINSTATUS} MATCHES_REGEX `{$NET.IF.IFADMINSTATUS.MATCHES}`

- {#IFADMINSTATUS} NOT_MATCHES_REGEX `{$NET.IF.IFADMINSTATUS.NOT_MATCHES}`

- {#IFOPERSTATUS} MATCHES_REGEX `{$NET.IF.IFOPERSTATUS.MATCHES}`

- {#IFOPERSTATUS} NOT_MATCHES_REGEX `{$NET.IF.IFOPERSTATUS.NOT_MATCHES}`

- {#IFNAME} MATCHES_REGEX `{$NET.IF.IFNAME.MATCHES}`

- {#IFNAME} NOT_MATCHES_REGEX `{$NET.IF.IFNAME.NOT_MATCHES}`

- {#IFDESCR} MATCHES_REGEX `{$NET.IF.IFDESCR.MATCHES}`

- {#IFDESCR} NOT_MATCHES_REGEX `{$NET.IF.IFDESCR.NOT_MATCHES}`

- {#IFALIAS} MATCHES_REGEX `{$NET.IF.IFALIAS.MATCHES}`

- {#IFALIAS} NOT_MATCHES_REGEX `{$NET.IF.IFALIAS.NOT_MATCHES}`

- {#IFTYPE} MATCHES_REGEX `{$NET.IF.IFTYPE.MATCHES}`

- {#IFTYPE} NOT_MATCHES_REGEX `{$NET.IF.IFTYPE.NOT_MATCHES}`

| ## Items collected |Group|Name|Description|Type|Key and additional info| |-----|----|-----------|----|---------------------| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound packets discarded |

MIB: IF-MIB

The number of inbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

|SNMP |net.if.in.discards[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND: ``

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound packets with errors |

MIB: IF-MIB

For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

|SNMP |net.if.in.errors[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND: ``

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Bits received |

MIB: IF-MIB

The total number of octets received on the interface, including framing characters. This object is a 64-bit version of ifInOctets. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

|SNMP |net.if.in[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND: ``

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound packets discarded |

MIB: IF-MIB

The number of outbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

|SNMP |net.if.out.discards[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND: ``

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound packets with errors |

MIB: IF-MIB

For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

|SNMP |net.if.out.errors[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND: ``

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Bits sent |

MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of ifOutOctets.Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

|SNMP |net.if.out[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND: ``

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Speed |

MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of `n' then the speed of the interface is somewhere in the range of `n-500,000' to`n+499,999'. For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero.

|SNMP |net.if.speed[{#SNMPINDEX}]

**Preprocessing**:

- MULTIPLIER: `1000000`

- DISCARD_UNCHANGED_HEARTBEAT: `1h`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Operational status |

MIB: IF-MIB

The current operational state of the interface.

- The testing(3) state indicates that no operational packet scan be passed

- If ifAdminStatus is down(2) then ifOperStatus should be down(2)

- If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic

- It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection)

- It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state

- It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

|SNMP |net.if.status[{#SNMPINDEX}]

**Preprocessing**:

- DISCARD_UNCHANGED_HEARTBEAT: `6h`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Interface type |

MIB: IF-MIB

The type of interface.

Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA),

through updating the syntax of the IANAifType textual convention.

|SNMP |net.if.type[{#SNMPINDEX}]

**Preprocessing**:

- DISCARD_UNCHANGED_HEARTBEAT: `6h`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Rules references count |

MIB: BEGEMOT-PF-MIB

The number of rules referencing this interface.

|SNMP |net.if.rules.refs[{#SNMPINDEX}] | |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 traffic passed |

MIB: BEGEMOT-PF-MIB

IPv4 bits per second passed coming in on this interface.

|SNMP |net.if.in.pass.v4.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 traffic blocked |

MIB: BEGEMOT-PF-MIB

IPv4 bits per second blocked coming in on this interface.

|SNMP |net.if.in.block.v4.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 traffic passed |

MIB: BEGEMOT-PF-MIB

IPv4 bits per second passed going out on this interface.

|SNMP |net.if.out.pass.v4.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 traffic blocked |

MIB: BEGEMOT-PF-MIB

IPv4 bits per second blocked going out on this interface.

|SNMP |net.if.out.block.v4.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 packets passed |

MIB: BEGEMOT-PF-MIB

The number of IPv4 packets passed coming in on this interface.

|SNMP |net.if.in.pass.v4.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv4 packets blocked |

MIB: BEGEMOT-PF-MIB

The number of IPv4 packets blocked coming in on this interface.

|SNMP |net.if.in.block.v4.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 packets passed |

MIB: BEGEMOT-PF-MIB

The number of IPv4 packets passed going out on this interface.

|SNMP |net.if.out.pass.v4.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv4 packets blocked |

MIB: BEGEMOT-PF-MIB

The number of IPv4 packets blocked going out on this interface.

|SNMP |net.if.out.block.v4.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 traffic passed |

MIB: BEGEMOT-PF-MIB

IPv6 bits per second passed coming in on this interface.

|SNMP |net.if.in.pass.v6.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 traffic blocked |

MIB: BEGEMOT-PF-MIB

IPv6 bits per second blocked coming in on this interface.

|SNMP |net.if.in.block.v6.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 traffic passed |

MIB: BEGEMOT-PF-MIB

IPv6 bits per second passed going out on this interface.

|SNMP |net.if.out.pass.v6.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 traffic blocked |

MIB: BEGEMOT-PF-MIB

IPv6 bits per second blocked going out on this interface.

|SNMP |net.if.out.block.v6.bps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

- MULTIPLIER: `8`

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 packets passed |

MIB: BEGEMOT-PF-MIB

The number of IPv6 packets passed coming in on this interface.

|SNMP |net.if.in.pass.v6.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Inbound IPv6 packets blocked |

MIB: BEGEMOT-PF-MIB

The number of IPv6 packets blocked coming in on this interface.

|SNMP |net.if.in.block.v6.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 packets passed |

MIB: BEGEMOT-PF-MIB

The number of IPv6 packets passed going out on this interface.

|SNMP |net.if.out.pass.v6.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |Network interfaces |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Outbound IPv6 packets blocked |

MIB: BEGEMOT-PF-MIB

The number of IPv6 packets blocked going out on this interface.

|SNMP |net.if.out.block.v6.pps[{#SNMPINDEX}]

**Preprocessing**:

- CHANGE_PER_SECOND

| |pfSense |PFSense: Packet filter running status |

MIB: BEGEMOT-PF-MIB

True if packet filter is currently enabled.

|SNMP |pfsense.pf.status | |pfSense |PFSense: States table current |

MIB: BEGEMOT-PF-MIB

Number of entries in the state table.

|SNMP |pfsense.state.table.count | |pfSense |PFSense: States table limit |

MIB: BEGEMOT-PF-MIB

Maximum number of 'keep state' rules in the ruleset.

|SNMP |pfsense.state.table.limit | |pfSense |PFSense: States table utilization in % |

Utilization of state table in %.

|CALCULATED |pfsense.state.table.pused

**Expression**:

`last(//pfsense.state.table.count) * 100 / last(//pfsense.state.table.limit)` | |pfSense |PFSense: Source tracking table current |

MIB: BEGEMOT-PF-MIB

Number of entries in the source tracking table.

|SNMP |pfsense.source.tracking.table.count | |pfSense |PFSense: Source tracking table limit |

MIB: BEGEMOT-PF-MIB

Maximum number of 'sticky-address' or 'source-track' rules in the ruleset.

|SNMP |pfsense.source.tracking.table.limit | |pfSense |PFSense: Source tracking table utilization in % |

Utilization of source tracking table in %.

|CALCULATED |pfsense.source.tracking.table.pused

**Expression**:

`last(//pfsense.source.tracking.table.count) * 100 / last(//pfsense.source.tracking.table.limit)` | |pfSense |PFSense: DHCP server status |

MIB: HOST-RESOURCES-MIB

The status of DHCP server process.

|SNMP |pfsense.dhcpd.status

**Preprocessing**:

- CHECK_NOT_SUPPORTED: ``

⛔️ON_FAIL: `CUSTOM_VALUE -> 0`

| |pfSense |PFSense: DNS server status |

MIB: HOST-RESOURCES-MIB

The status of DNS server process.

|SNMP |pfsense.dns.status

**Preprocessing**:

- CHECK_NOT_SUPPORTED: ``

⛔️ON_FAIL: `CUSTOM_VALUE -> 0`

| |pfSense |PFSense: State of nginx process |

MIB: HOST-RESOURCES-MIB

The status of nginx process.

|SNMP |pfsense.nginx.status

**Preprocessing**:

- CHECK_NOT_SUPPORTED: ``

⛔️ON_FAIL: `CUSTOM_VALUE -> 0`

| |pfSense |PFSense: Packets matched a filter rule |

MIB: BEGEMOT-PF-MIB

True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

|SNMP |pfsense.packets.match

**Preprocessing**:

- CHANGE_PER_SECOND

| |pfSense |PFSense: Packets with bad offset |

MIB: BEGEMOT-PF-MIB

True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

|SNMP |pfsense.packets.bad.offset

**Preprocessing**:

- CHANGE_PER_SECOND

| |pfSense |PFSense: Fragmented packets |

MIB: BEGEMOT-PF-MIB

True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

|SNMP |pfsense.packets.fragment

**Preprocessing**:

- CHANGE_PER_SECOND

| |pfSense |PFSense: Short packets |

MIB: BEGEMOT-PF-MIB

True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

|SNMP |pfsense.packets.short

**Preprocessing**:

- CHANGE_PER_SECOND

| |pfSense |PFSense: Normalized packets |

MIB: BEGEMOT-PF-MIB

True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

|SNMP |pfsense.packets.normalize

**Preprocessing**:

- CHANGE_PER_SECOND

| |pfSense |PFSense: Packets dropped due to memory limitation |

MIB: BEGEMOT-PF-MIB

True if the packet was logged with the specified packet filter reason code. The known codes are: match, bad-offset, fragment, short, normalize, and memory.

|SNMP |pfsense.packets.mem.drop

**Preprocessing**:

- CHANGE_PER_SECOND

| |pfSense |PFSense: Firewall rules count |

MIB: BEGEMOT-PF-MIB

The number of labeled filter rules on this system.

|SNMP |pfsense.rules.count | |Status |PFSense: SNMP agent availability |

Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list.

Possible value:

0 - not available

1 - available

2 - unknown

|INTERNAL |zabbix[host,snmp,available] | ## Triggers |Name|Description|Expression|Severity|Dependencies and additional info| |----|-----------|----|----|----| |PFSense: Interface [{#IFNAME}({#IFALIAS})]: High input error rate |

Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

|`min(/PFSense SNMP/net.if.in.errors[{#SNMPINDEX}],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}`

Recovery expression:

`max(/PFSense SNMP/net.if.in.errors[{#SNMPINDEX}],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8` |WARNING |

**Depends on**:

- PFSense: Interface [{#IFNAME}({#IFALIAS})]: Link down

| |PFSense: Interface [{#IFNAME}({#IFALIAS})]: High inbound bandwidth usage |

The network interface utilization is close to its estimated maximum bandwidth.

|`(avg(/PFSense SNMP/net.if.in[{#SNMPINDEX}],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])) and last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])>0 `

Recovery expression:

`avg(/PFSense SNMP/net.if.in[{#SNMPINDEX}],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])` |WARNING |

**Depends on**:

- PFSense: Interface [{#IFNAME}({#IFALIAS})]: Link down

| |PFSense: Interface [{#IFNAME}({#IFALIAS})]: High output error rate |

Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

|`min(/PFSense SNMP/net.if.out.errors[{#SNMPINDEX}],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}`

Recovery expression:

`max(/PFSense SNMP/net.if.out.errors[{#SNMPINDEX}],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8` |WARNING |

**Depends on**:

- PFSense: Interface [{#IFNAME}({#IFALIAS})]: Link down

| |PFSense: Interface [{#IFNAME}({#IFALIAS})]: High outbound bandwidth usage |

The network interface utilization is close to its estimated maximum bandwidth.

|`(avg(/PFSense SNMP/net.if.out[{#SNMPINDEX}],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])) and last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])>0 `

Recovery expression:

`avg(/PFSense SNMP/net.if.out[{#SNMPINDEX}],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])` |WARNING |

**Depends on**:

- PFSense: Interface [{#IFNAME}({#IFALIAS})]: Link down

| |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Ethernet has changed to lower speed than it was before |

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.

|`change(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])<0 and last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])>0 and ( last(/PFSense SNMP/net.if.type[{#SNMPINDEX}])=6 or last(/PFSense SNMP/net.if.type[{#SNMPINDEX}])=7 or last(/PFSense SNMP/net.if.type[{#SNMPINDEX}])=11 or last(/PFSense SNMP/net.if.type[{#SNMPINDEX}])=62 or last(/PFSense SNMP/net.if.type[{#SNMPINDEX}])=69 or last(/PFSense SNMP/net.if.type[{#SNMPINDEX}])=117 ) and (last(/PFSense SNMP/net.if.status[{#SNMPINDEX}])<>2) `

Recovery expression:

`(change(/PFSense SNMP/net.if.speed[{#SNMPINDEX}])>0 and last(/PFSense SNMP/net.if.speed[{#SNMPINDEX}],#2)>0) or (last(/PFSense SNMP/net.if.status[{#SNMPINDEX}])=2) ` |INFO |

**Depends on**:

- PFSense: Interface [{#IFNAME}({#IFALIAS})]: Link down

| |PFSense: Interface [{#IFNAME}({#IFALIAS})]: Link down |

This trigger expression works as follows:

1. Can be triggered if operations status is down.

2. {$IFCONTROL:"{#IFNAME}"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.

|`{$IFCONTROL:"{#IFNAME}"}=1 and (last(/PFSense SNMP/net.if.status[{#SNMPINDEX}])=2)` |AVERAGE | | |PFSense: Packet filter is not running |

Please check PF status.

|`last(/PFSense SNMP/pfsense.pf.status)<>1` |HIGH | | |PFSense: State table usage is high |

Please check the number of connections https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#config-advanced-firewall-maxstates

|`min(/PFSense SNMP/pfsense.state.table.pused,#3)>{$STATE.TABLE.UTIL.MAX}` |WARNING | | |PFSense: Source tracking table usage is high |

Please check the number of sticky connections https://docs.netgate.com/pfsense/en/latest/monitoring/status/firewall-states-sources.html

|`min(/PFSense SNMP/pfsense.source.tracking.table.pused,#3)>{$SOURCE.TRACKING.TABLE.UTIL.MAX}` |WARNING | | |PFSense: DHCP server is not running |

Please check DHCP server settings https://docs.netgate.com/pfsense/en/latest/services/dhcp/index.html

|`last(/PFSense SNMP/pfsense.dhcpd.status)=0` |AVERAGE | | |PFSense: DNS server is not running |

Please check DNS server settings https://docs.netgate.com/pfsense/en/latest/services/dns/index.html

|`last(/PFSense SNMP/pfsense.dns.status)=0` |AVERAGE | | |PFSense: Web server is not running |

Please check nginx service status.

|`last(/PFSense SNMP/pfsense.nginx.status)=0` |AVERAGE | | |PFSense: No SNMP data collection |

SNMP is not available for polling. Please check device connectivity and SNMP settings.

|`max(/PFSense SNMP/zabbix[host,snmp,available],{$SNMP.TIMEOUT})=0` |WARNING | | ## Feedback Please report any issues with the template at https://support.zabbix.com