Extend the Network Firewall Check to Include Clavister (cOS Core / NetWall)

The Check network-firewall now covers OPNsense, Sophos XG, WatchGuard, FortiGate, SonicWall, Securepoint UTM, and Check Point. Clavister is missing—and with it, the vendor on which my entire perimeter infrastructure runs: 15 Clavister NetWall devices (cOS Core 15.00.x), centrally managed via Clavister InControl 4.01. Right now, I can only run a ping and a generic SNMP check on sysUpTime, while for every other firewall on the dashboard, I get metrics for CPU, sessions, VPN, and license expiration.

Clavister is a Swedish manufacturer with a strong foothold in the German SME sector and the public sector; through its distribution channels, it is widespread enough among MSP customers that the effort is worthwhile—not just for me.

What cOS Core offers in terms of interfaces

Both are included in the product without an additional license and can be enabled in the configuration (RemoteMgmtREST and RemoteMgmtSNMP, respectively).

Object path in cOS Core Provides REST API (JSON over HTTPS) RemoteManagement RemoteMgmtREST /api/about Version and model, /api/oper/license Registration key, subscriptions, and their expiration dates, /api/oper/neighbor_devices, /api/oper/blacklist SNMP v1/v2c/v3 RemoteManagement RemoteMgmtSNMP Clavister Enterprise MIB and IF MIB: CPU load, memory, open connections approaching the limit, interface status and throughput, IPsec tunnel status, HA role

The REST API accepts Basic Authentication with a dedicated read-only account and can be restricted to a source IP and interface—perfect for monitoring access.

Metrics I’d like to see

In the order in which I miss them in my day-to-day work:

• License and subscription expiration. When the subscription expires, signature updates for IDP and antivirus stop silently. Today, this is purely a matter of calendar maintenance in Hudu.

• Firmware version and up-to-date status. Knowing which cOS Core version is running is the foundation of any security assessment.

• HA status. Active/passive, sync status, mismatched configurations. A broken HA pair that goes unnoticed is a classic issue.

• Connections approaching the session limit and CPU load—both serve as early warnings of a throughput drop.

• IPsec and SSL VPN tunnels: how many expected, how many established.

• Interface status, including link changes on the WAN ports.

Additional: InControl as a central data source

As with UniFi and Securepoint, Clavister also has a central management instance: InControl (Windows Server, SOAP/SDK on port 8080) tracks every managed firewall, including its reachability, firmware, configuration revision status, and active alerts. An integration similar to `unifi-device` —connect once, evaluate all firewalls on the server side without polling each device—would be the much quicker solution for a deployment like mine (15 devices at 14 locations) than setting up 15 individual SNMP connections.

If I had to choose: I’d go with the SNMP/REST option in the existing network-firewall-Check first, because it doesn’t require any additional infrastructure. The InControl integration can follow later.

What I can contribute

I have the Clavister environment up and running and can provide OID walks, REST responses, and test access for development—including an HA pair and active IPsec tunnels.