Network Infra Firewalls

Telegen collector and unified modes can poll firewall telemetry via the top-level netinfra section.

Supported firewalls

paloalto: Palo Alto PAN-OS API (API key or username/password for key generation)
fortigate: FortiGate FortiOS REST API (Bearer token)

Both collectors export through the shared V3 pipeline metrics exporter, so firewall metrics follow the same OTLP/remote-write flow as other signals.

Example config

netinfra:
  enabled: true
  collect_interval: 30s

  paloalto:
    - name: "pan-dc1"
      base_url: "https://10.10.10.20"
      # Option A: pre-generated key
      api_key: "${PALOALTO_API_KEY}"
      # Option B: username/password (used to generate key when api_key is empty)
      # username: "${PALOALTO_USER}"
      # password: "${PALOALTO_PASSWORD}"
      verify_ssl: true
      timeout: 30s
      collect_interval: 30s
      collect: ["system", "interfaces"]
      labels:
        site: "dc1"
        team: "network"

  fortigate:
    - name: "fg-edge-1"
      base_url: "https://10.10.20.30"
      token: "${FORTIGATE_TOKEN}"
      verify_ssl: true
      timeout: 30s
      collect_interval: 30s
      collect: ["system", "interfaces"]
      labels:
        site: "edge"
        team: "security"

Runtime notes

Use --mode collector or --mode unified for mixed black-box + host/eBPF collection.
netinfra.enabled can remain false if you force mode via CLI and provide at least one target.
If shared OTLP metrics exporter is unavailable at startup, Telegen logs degraded status and continues with other enabled sources.