CISCO-FIREWALL-MIB

All MIBs › CISCO-FIREWALL-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2005-12-06

Category: Cisco Devices, VPN and Security

Description: Monitors Cisco firewall devices, providing connection statistics and security event information for firewall activity tracking.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring CISCO-FIREWALL-MIB with a free 30-day trial of IPNetwork Monitor.

What Is CISCO-FIREWALL-MIB?

CISCO-FIREWALL-MIB is a Cisco enterprise MIB for monitoring firewall-capable Cisco devices such as PIX, ASA, and IOS Firewall-enabled routers. It centers on an events table capturing security, content-inspection, connection, access, authentication, and generic firewall event types, each carrying a timestamp, index, and description. Rather than physical hardware sensors, it focuses on software-level security and connection status, letting administrators track attack attempts, authentication failures, and connection anomalies in near real time. It follows standard SNMP notification conventions and is commonly paired with other Cisco security MIBs (e.g. syslog or IPSec MIBs) for a fuller picture on the same platform. It is deployed on Cisco perimeter and internal firewalls in enterprise and service-provider networks needing centralized SNMP-based event correlation. Security teams building centralized firewall event correlation frequently search for the cisco-firewall-mib specification when integrating Cisco ASA/PIX alerts into their SNMP monitoring pipeline.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco PIX/ASA firewalls
Cisco IOS Firewall-enabled routers

Monitoring Examples

An NMS can poll cfwBasicEventsTable, indexed by cfwBasicEventIndex, to retrieve entries with cfwBasicEventTime, cfwBasicSecurityEventType or cfwBasicConnectionEventType, and cfwBasicEventDescription. A sudden spike in cfwBasicAccessEventType or cfwBasicAuthenticationEventType entries would reveal a brute-force login attempt or access policy violation. cfwBasicEventsTableLastRow lets a poller fetch only new events efficiently since the previous check.

What Can Be Monitored

firewall security events
connection events
access control violations
authentication failures
content inspection events

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
RowPointer
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
NTF cfwAccessNotification	1.3.6.1.4.1.9.9.147.2.0.5			This notification is used to notify the NMS of access events. The included objects provide more detailed information about the event.
NTF cfwAuthNotification	1.3.6.1.4.1.9.9.147.2.0.6			This notification is used to notify the NMS of authentication events. The included objects provide more detailed information about the event.
ACC cfwBasicAccessEventType	1.3.6.1.4.1.9.9.147.1.1.1.2.1.6	AccessEvent	read-only	The type of access-related event that this row contains. If the event is not access-related this object will not be instantiated.
AUT cfwBasicAuthenticationEventType	1.3.6.1.4.1.9.9.147.1.1.1.2.1.7	AuthenticationEvent	read-only	The type of authentication-related event that this row contains. If the event is not authentication-related this object will not be instantiated.
CON cfwBasicConnectionEventType	1.3.6.1.4.1.9.9.147.1.1.1.2.1.5	ConnectionEvent	read-only	The type of connection-related event that this row contains. If the event is not connection-related this object will not be instantiated.
CON cfwBasicContentInspEventType	1.3.6.1.4.1.9.9.147.1.1.1.2.1.4	ContentInspectionEvent	read-only	The type of content inspection-related event that this row contains. If the event is not content inspection-related this object will not be instantiated.
STR cfwBasicEventDescription	1.3.6.1.4.1.9.9.147.1.1.1.2.1.9	SnmpAdminString	read-only	A description of the event. The value of the object may be a zero-length string.
NUM cfwBasicEventDetailsTableRow	1.3.6.1.4.1.9.9.147.1.1.1.2.1.10	RowPointer	read-only	A pointer to a row in the table containing details about this event. Generally, the table will be the cfwNetEventsTable but a Cisco-defined table may also appear here. If there there is no more detailed information for this event the value of this object will have the value {0 0}.
U32 cfwBasicEventIndex	1.3.6.1.4.1.9.9.147.1.1.1.2.1.1	Unsigned32	not-accessible	An index that uniquely identifies an entry in the log table. These indices are assigned beginning with 1 and increase by one with each new event logged.
cfwBasicEvents	1.3.6.1.4.1.9.9.147.1.1.1
cfwBasicEventsEntry	1.3.6.1.4.1.9.9.147.1.1.1.2.1		not-accessible	An entry in the table, containing general information about an event. This table will always be sparse, i.e., each row will instanciate only a subet of the columnar objects.
cfwBasicEventsTable	1.3.6.1.4.1.9.9.147.1.1.1.2		not-accessible	Table of basic data for firewall events. The agent may choose to delete the instances of cfwBasicEventsEntry as required because of lack of memory. The oldest Events will be selected first for deletion.
U32 cfwBasicEventsTableLastRow	1.3.6.1.4.1.9.9.147.1.1.1.1	Unsigned32	read-only	The index value of the most recently created row in the cfwBasicEventsTable. This number starts at 1 and increase by one with each new log entry. When this number wraps, all events are deleted.
DAT cfwBasicEventTime	1.3.6.1.4.1.9.9.147.1.1.1.2.1.2	DateAndTime	read-only	The time that the event occurred.
GEN cfwBasicGenericEventType	1.3.6.1.4.1.9.9.147.1.1.1.2.1.8	GenericEvent	read-only	The type of generic event that this row contains. If the event does not fall into one of the other categories this object will be populated. Otherwise, this object will not be instantiated.
SEC cfwBasicSecurityEventType	1.3.6.1.4.1.9.9.147.1.1.1.2.1.3	SecurityEvent	read-only	The type of security-related event that this row contains. If the event is not security-related this object will not be instantiated.
STR cfwBufferStatInformation	1.3.6.1.4.1.9.9.147.1.2.2.1.1.3	SnmpAdminString	read-only	A detailed textual description of the statistic identified by cfwBufferStatType.
cfwBufferStatsEntry	1.3.6.1.4.1.9.9.147.1.2.2.1.1		not-accessible	An entry in the table, containing status information about a particular statistic for the set of buffers of a particular size.
U32 cfwBufferStatSize	1.3.6.1.4.1.9.9.147.1.2.2.1.1.1	Unsigned32	not-accessible	This object contains the size of the set of buffers for which this row contains the statistics given by cfwBufferStatType.
cfwBufferStatsTable	1.3.6.1.4.1.9.9.147.1.2.2.1		not-accessible	A table conatining status information about a firewall's buffers.
RES cfwBufferStatType	1.3.6.1.4.1.9.9.147.1.2.2.1.1.2	ResourceStatistics	not-accessible	This object identifies the type of statistic given by this row for the particular set of buffers identified by cfwBufferStatSize.
G32 cfwBufferStatValue	1.3.6.1.4.1.9.9.147.1.2.2.1.1.4	Gauge32	read-only	The value of the buffer statistic.
C32 cfwConnectionStatCount	1.3.6.1.4.1.9.9.147.1.2.2.2.1.4	Counter32	read-only	This is an integer that contains the value of the resource statistic. If a type of 'gauge' is more appropriate this object will be omitted resulting in a sparse table.
STR cfwConnectionStatDescription	1.3.6.1.4.1.9.9.147.1.2.2.2.1.3	SnmpAdminString	read-only	A detailed textual description of this statistic.
cfwConnectionStatEntry	1.3.6.1.4.1.9.9.147.1.2.2.2.1		not-accessible	An entry in the table, containing information about a firewall statistic.
SER cfwConnectionStatService	1.3.6.1.4.1.9.9.147.1.2.2.2.1.1	Services	not-accessible	The identification of the type of connection providing statistics.
cfwConnectionStatTable	1.3.6.1.4.1.9.9.147.1.2.2.2		not-accessible	Table of firewall statistic instances.
CON cfwConnectionStatType	1.3.6.1.4.1.9.9.147.1.2.2.2.1.2	ConnectionStat	not-accessible	The state of the connections that this row contains statistics for.
G32 cfwConnectionStatValue	1.3.6.1.4.1.9.9.147.1.2.2.2.1.5	Gauge32	read-only	This is an integer that contains the value of the resource statistic. If a type of 'counter' is more appropriate this object will be omitted resulting in a sparse table.
NTF cfwConnNotification	1.3.6.1.4.1.9.9.147.2.0.4			This notification is used to notify the NMS of connection-oriented events. The included objects provide more detailed information about the event.
NTF cfwContentInspectNotification	1.3.6.1.4.1.9.9.147.2.0.3			This notification is used to notify the NMS of content inspection events. The included objects provide more detailed information about the event.
cfwEvents	1.3.6.1.4.1.9.9.147.1.1
NTF cfwGenericNotification	1.3.6.1.4.1.9.9.147.2.0.7			This notification is used to notify the NMS of events that do not fall into the other categories. The included objects provide more detailed information about the event.
STR cfwHardwareInformation	1.3.6.1.4.1.9.9.147.1.2.1.1.1.2	SnmpAdminString	read-only	A detailed textual description of the resource identified by cfwHardwareType.
STR cfwHardwareStatusDetail	1.3.6.1.4.1.9.9.147.1.2.1.1.1.4	SnmpAdminString	read-only	A detailed textual description of the current status of the resource which may provide a more specific description than cfwHardwareStatusValue.
cfwHardwareStatusEntry	1.3.6.1.4.1.9.9.147.1.2.1.1.1		not-accessible	An entry in the table, containing status information about a resource.
cfwHardwareStatusTable	1.3.6.1.4.1.9.9.147.1.2.1.1		not-accessible	Table of firewall cfwHardwareStatusEntry entries.
HAR cfwHardwareStatusValue	1.3.6.1.4.1.9.9.147.1.2.1.1.1.3	HardwareStatus	read-only	This object contains the current status of the resource.
HAR cfwHardwareType	1.3.6.1.4.1.9.9.147.1.2.1.1.1.1	Hardware	not-accessible	The hardware type for which this row provides status information.
STR cfwNetEventDescription	1.3.6.1.4.1.9.9.147.1.1.2.2.1.14	SnmpAdminString	read-only	A detailed description of the event.
IP cfwNetEventDstIpAddress	1.3.6.1.4.1.9.9.147.1.1.2.2.1.5	IpAddress	read-only	Destination IP address in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different destination addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
INT cfwNetEventDstIpPort	1.3.6.1.4.1.9.9.147.1.1.2.2.1.9	INTEGER	read-only	Destination UDP/TCP port in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different destination ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
STR cfwNetEventIdentity	1.3.6.1.4.1.9.9.147.1.1.2.2.1.13	SnmpAdminString	read-only	This object will contain a description of the entity that caused the event. The entity could be a userid, username, processid or other identifier for the entity using the service. If there is no such information then this object will contain a zero-length string.
U32 cfwNetEventIndex	1.3.6.1.4.1.9.9.147.1.1.2.2.1.1	Unsigned32	not-accessible	An index that uniquely identifies an entry in the log table. These indices are assigned beginning with one and increase by one with each new log entry. When this number wraps, all events are deleted in order to allow the NMS to differentiate between old and new events.
IP cfwNetEventInsideDstIpAddress	1.3.6.1.4.1.9.9.147.1.1.2.2.1.6	IpAddress	read-only	Destination IP address after Network Address Translation has been applied. If NAT has not been applied to the destination address in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different destination addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
INT cfwNetEventInsideDstIpPort	1.3.6.1.4.1.9.9.147.1.1.2.2.1.10	INTEGER	read-only	Destination UDP/TCP port after Port Address Translation has been applied. If PAT has not been applied to the Destination port in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different destination ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
IP cfwNetEventInsideSrcIpAddress	1.3.6.1.4.1.9.9.147.1.1.2.2.1.4	IpAddress	read-only	Source IP address after Network Address Translation has been applied. If NAT has not been applied to the source address in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different source addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
INT cfwNetEventInsideSrcIpPort	1.3.6.1.4.1.9.9.147.1.1.2.2.1.8	INTEGER	read-only	Source UDP/TCP port after Port Address Translation has been applied. If PAT has not been applied to the source port in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different source ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
NUM cfwNetEventInterface	1.3.6.1.4.1.9.9.147.1.1.2.2.1.2	InterfaceIndexOrZero	read-only	The interface most closely associated with this event. For example, for an event that relates to the receipt of a packet, this object identifies the interface on which the packet was received. If there are multiple interfaces associated with an event, the interface most closely associated with the cause of the event will be used. For example, for an event for the setup of a TCP connection, the interface on the initiator's side of the connection would be preferred. If there is no associated interface, then this object has the value zero.
cfwNetEvents	1.3.6.1.4.1.9.9.147.1.1.2
cfwNetEventsEntry	1.3.6.1.4.1.9.9.147.1.1.2.2.1		not-accessible	An entry in the table, containing detailed information about an event. Note that this table may be sparse. If Network Address Translation is not enabled cfwNetEventInsideSrcIpAddress and cfwNetEventInsideDstIpAddress will not be instantiated in the row. If Port Address Translation is not enabled cfwNetEventInsideSrcIpPort and cfwNetEventInsideDstIpPort will not be instantiated in the row. Entries are added to this table at the same time that events are added to the cfwBasicEventsTable. These two tables may be configured to be different sizes so there may not be a one-to-one correspondence between rows in the two tables.
SER cfwNetEventService	1.3.6.1.4.1.9.9.147.1.1.2.2.1.11	Services	read-only	The identification of the type of service involved with this event.
STR cfwNetEventServiceInformation	1.3.6.1.4.1.9.9.147.1.1.2.2.1.12	SnmpAdminString	read-only	Specific service information. This can be used to describe the particular service indentified by cfwNetEventService and can reflect whether the service is a local service or a gateway service. For example, if the value for cfwNetEventService is loginTelnet then the string provided might be 'local telnet'.
IP cfwNetEventSrcIpAddress	1.3.6.1.4.1.9.9.147.1.1.2.2.1.3	IpAddress	read-only	Source IP address in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different source addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
INT cfwNetEventSrcIpPort	1.3.6.1.4.1.9.9.147.1.1.2.2.1.7	INTEGER	read-only	Source UDP/TCP port in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different source ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
cfwNetEventsTable	1.3.6.1.4.1.9.9.147.1.1.2.2		not-accessible	Table of detailed data for network events. The agent may choose to delete the instances of cfwBasicEventsEntry as required because of lack of memory. It is an implementation-specific matter as to when this deletion may occur. It is recommended that the oldest log instances are deleted first.
U32 cfwNetEventsTableLastRow	1.3.6.1.4.1.9.9.147.1.1.2.1	Unsigned32	read-only	The index value of the last row in the cfwNetEventsTable. This number starts at 1 and increase by one with each new log entry. When this number wraps, all events are deleted.
NTF cfwSecurityNotification	1.3.6.1.4.1.9.9.147.2.0.2			This notification is used for events involving security events. The included objects provide more detailed information about the event.
cfwStatistics	1.3.6.1.4.1.9.9.147.1.2.2
cfwStatus	1.3.6.1.4.1.9.9.147.1.2.1
cfwSystem	1.3.6.1.4.1.9.9.147.1.2
ciscoFirewallMIB	1.3.6.1.4.1.9.9.147			MIB module for monitoring Cisco Firewalls.
ciscoFirewallMIBCompliance	1.3.6.1.4.1.9.9.147.3.1.1			The compliance statement for entities which implement the Cisco FirewallMIB.
ciscoFirewallMIBComplianceRev1	1.3.6.1.4.1.9.9.147.3.1.2			The compliance statement for entities which implement the Cisco FirewallMIB.
ciscoFirewallMIBCompliances	1.3.6.1.4.1.9.9.147.3.1
ciscoFirewallMIBConformance	1.3.6.1.4.1.9.9.147.3
ciscoFirewallMIBEventsGroup	1.3.6.1.4.1.9.9.147.3.2.1			Firewall events
ciscoFirewallMIBGroups	1.3.6.1.4.1.9.9.147.3.2
ciscoFirewallMIBNotificationGroup	1.3.6.1.4.1.9.9.147.3.2.3			Firewall Notifications
ciscoFirewallMIBNotificationGroupRev1	1.3.6.1.4.1.9.9.147.3.2.4			Firewall Notifications
ciscoFirewallMIBNotificationPrefix	1.3.6.1.4.1.9.9.147.2
ciscoFirewallMIBNotifications	1.3.6.1.4.1.9.9.147.2.0
ciscoFirewallMIBObjects	1.3.6.1.4.1.9.9.147.1
ciscoFirewallMIBStatisticsGroup	1.3.6.1.4.1.9.9.147.3.2.2			Firewall statistics

RFC description

Monitors Cisco Firewalls (PIX and IOS devices) providing status, statistics, and events for firewall system management.

Start monitoring Cisco PIX/ASA firewalls and IOS Firewall-enabled routers (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-FIREWALL-MIB

What Is CISCO-FIREWALL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description