AT-FIREWALL-MIB

All MIBs › AT-FIREWALL-MIB

Organization: Allied Telesis, Inc

Last Updated: 2006-06-28

Category: VPN and Security, Vendor: Allied Telesis

Description: Manages stateful firewall policy rules, connection tracking tables, and packet filter statistics on Allied Telesis security gateways.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is AT-FIREWALL-MIB?

AT-FIREWALL-MIB manages stateful firewall policy, connection tracking, and packet filter statistics on Allied Telesis security gateway appliances. It exposes counters for total and per-node active sessions, along with firewall trap messages for notable events. Its monitoring emphasis is software/security service status: tracking overall and per-node session counts, which reveals abnormal load, connection-flood behavior, or a potential denial-of-service condition against the firewall engine. It is a self-contained Allied Telesis enterprise MIB with no apparent dependency on other standard MIBs. It is deployed on Allied Telesis security gateways or UTM appliances positioned at a network edge or between security zones. Engineers can download the AT-FIREWALL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in AT-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Allied Telesis security gateways/firewalls

Monitoring Examples

The module exposes totalNumberOfSessions and numberOfSessionsPerNodeTable/numberOfSessionsPerNodeEntry, indexed by nodeIpAddress, with numberOfSessionsPerNode as the counter. An administrator would watch totalNumberOfSessions for an abnormal upward trend suggesting a connection-flood attack, then drill into numberOfSessionsPerNodeTable by nodeIpAddress to identify which internal or external host is generating the excessive session volume.

What Can Be Monitored

total active firewall sessions
sessions per node
firewall trap/alert messages
session-count tracking status per node

Imported Objects

From AT-SMI-MIB

DisplayStringUnsized
modules	OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-SMI

Gauge32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TruthValue

How to Use in IPNetwork Monitor

Example using numberOfSessionsPerNode OID:

Select an Allied Telesis security gateway/firewall as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type numberOfSessionsPerNode into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of active sessions created by the corresponding node. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Gauge32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
firewall	1.3.6.1.4.1.207.8.4.4.4.77			This MIB file contains definitions of managed objects for the FIREWALL module.
firewallTraps	1.3.6.1.4.1.207.8.4.4.4.77.0
NTF firewallAttackTrap	1.3.6.1.4.1.207.8.4.4.4.77.0.1			A firewall trap is generated when the firewall detects an intrusion or attack and notifies the router manager. Firewall trap notifications are enabled with the command ENABLE FIREWALL NOTIFY=SNMP.
STR firewallTrapMessage	1.3.6.1.4.1.207.8.4.4.4.77.1	DisplayString	read-only	The last message sent in a firewall TRAP. This variable is really just a placeholder for the object sent in the firewall TRAP, but can be read independently if required. Note however that a new TRAP will cause this variable to be overwritten.
firewallSessionsStatistics	1.3.6.1.4.1.207.8.4.4.4.77.2
G32 totalNumberOfSessions	1.3.6.1.4.1.207.8.4.4.4.77.2.1	Gauge32	read-only	The total number of sessions going through the firewall. It will be the sum of the number of sessions on all individual nodes.
INT numberOfSessionsPerNodeCountingStatus	1.3.6.1.4.1.207.8.4.4.4.77.2.2	INTEGER	read-write	The status of counting the number of sessions per node, ie, when this particular ferture is on, the status will be enabled, other wise it will be disabled, which is the default status.
numberOfSessionsPerNodeTable	1.3.6.1.4.1.207.8.4.4.4.77.2.3		not-accessible	This is a table of nodes in the network with their corresponding ip address and number of sessions
numberOfSessionsPerNodeEntry	1.3.6.1.4.1.207.8.4.4.4.77.2.3.1		not-accessible	An entry includes the information about a node and numbers of sessions belongs to it.
IP nodeIpAddress	1.3.6.1.4.1.207.8.4.4.4.77.2.3.1.1	IpAddress	read-only	The ip address of each node that has firewall limit rules attached and needs to be monitored
G32 numberOfSessionsPerNodeEx	1.3.6.1.4.1.207.8.4.4.4.77.2.3.1.2	Gauge32	read-only	Number of active sessions created by the corresponding node

RFC description

Monitors firewall attack detection and intrusion events on Allied Telesis routers.

Start monitoring Allied Telesis security gateways/firewalls with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download AT-FIREWALL-MIB