AVENTAIL-SECURITY-HISTORY-MIB

All MIBs › AVENTAIL-SECURITY-HISTORY-MIB

Organization: Aventail

Last Updated: 2004-09-07

Category: VPN and Security, Vendor: Aventail

Description: Provides security event history and audit log retrieval for Aventail SSL VPN access policy violations.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is AVENTAIL-SECURITY-HISTORY-MIB?

AVENTAIL-SECURITY-HISTORY-MIB is an Aventail (SSL VPN appliance vendor, later SonicWALL) proprietary MIB reporting recent login/access-denial security events. Its objects cover login-denial and access-denial counts, and the last denied login's user/time and last denied access's user/resource/time. As a security/status MIB it lets an administrator quickly identify the most recent failed authentication or authorization attempt on an Aventail SSL VPN appliance. It is deployed on Aventail (SonicWALL) SSL VPN appliances. Engineers can download the AVENTAIL-SECURITY-HISTORY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in AVENTAIL-SECURITY-HISTORY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Aventail (SonicWALL) SSL VPN appliances

Monitoring Examples

An administrator checks lastLoginDeniedUser and lastAccessDeniedResource to identify the most recent failed authentication/authorization attempt on an Aventail SSL VPN appliance.

What Can Be Monitored

recent login/access denial events

Imported Objects

From AVENTAIL-MIB

aventail

MODULE-IDENTITY

From HOST-RESOURCES-MIB

InternationalDisplayString

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using numOfLoginDenials OID:

Select an Aventail (SonicWALL) SSL VPN appliance (legacy) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type numOfLoginDenials into the Find box to locate it in the OID tree, then select it and click OK. The number of login denials since the last reset \ interval; where reset interval is 24 hours. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if the count changes from its expected baseline, since that would indicate the underlying set of items changed unexpectedly. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
aventailSecurityHistory	1.3.6.1.4.1.4331.4			This Aventail MIB provides Security History Info
I32 numOfLoginDenialsEx	1.3.6.1.4.1.4331.4.1	Integer32	read-only	The number of login denials since the last reset \ interval; where reset interval is 24 hours
lastLoginDenial	1.3.6.1.4.1.4331.4.2
NUM lastLoginDeniedUser	1.3.6.1.4.1.4331.4.2.1	InternationalDisplayString	read-only	The user@realm who last was denied authentication
NUM lastLoginDeniedTime	1.3.6.1.4.1.4331.4.2.2	InternationalDisplayString	read-only	The time the last user was denied authentication in a \ string of the form Wed Jun 30 21:49:08 1993.
I32 numOfAccessDenials	1.3.6.1.4.1.4331.4.3	Integer32	read-only	The number of access denials since the last reset \ interval; where reset interval is 24 hours.
lastAccessDenial	1.3.6.1.4.1.4331.4.4
NUM lastAccessDeniedUser	1.3.6.1.4.1.4331.4.4.1	InternationalDisplayString	read-only	The last user who was denied access in the form \ user@realm.
NUM lastAccessDeniedResource	1.3.6.1.4.1.4331.4.4.2	InternationalDisplayString	read-only	The URI resource that was denied access to
NUM lastAccessDeniedTime	1.3.6.1.4.1.4331.4.4.3	InternationalDisplayString	read-only	The time the last user was denied access in a string \ of the form Wed Jun 30 21:49:08 1993

RFC description

Tracks Aventail security appliance login and access denial events with timestamps and user information.

Start monitoring Aventail (SonicWALL) SSL VPN appliances (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download AVENTAIL-SECURITY-HISTORY-MIB