CISCO-SSLVPN-MIB

All MIBs › CISCO-SSLVPN-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2015-11-17

Category: Cisco Devices, VPN and Security

Description: Manages Cisco SSL VPN (clientless and AnyConnect) gateway sessions, user authentication, and tunnel statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-SSLVPN-MIB?

CISCO-SSLVPN-MIB manages and monitors Cisco's SSL VPN gateway functionality, covering both clientless browser-based VPN and AnyConnect client-based remote-access sessions on Cisco security gateways. It exposes session-capacity configuration (maximum sessions allowed) alongside real-time counters for active and peak sessions, control/data packet throughput, and failure statistics such as authentication failures, connect and reconnect failures, and Dead Peer Detection (DPD) timeouts. This is squarely a software service-health MIB: it lets administrators watch whether the VPN gateway is approaching its licensed session capacity, spot spikes in authentication or connection failures that could indicate an outage or credential-stuffing attempt, and detect DPD timeouts signaling unreachable remote clients. As an SSL/TLS-based VPN technology it implicitly relies on underlying TCP/IP and certificate infrastructure, though it doesn't appear to formally import other MIBs. It is typically deployed on Cisco ASA firewalls or IOS-XE/ISR routers acting as remote-access SSL VPN concentrators for a distributed workforce. Network engineers evaluating or troubleshooting this functionality can download the CISCO-SSLVPN-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-SSLVPN-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco ASA firewalls
Cisco IOS-XE/ISR routers acting as SSL VPN gateways

Monitoring Examples

An admin would poll csslvpnActiveSessions and csslvpnPeakSessions against csslvpnMaxSessionAllowed to see how close the gateway is to its licensed session ceiling, and track csslvpnInDataPackets/csslvpnOutDataPackets to confirm VPN traffic is actually flowing. A rising csslvpnAuthFailures or csslvpnConnectFailures counter alongside steady csslvpnAuthRequests would flag a wave of failed logins, while a jump in csslvpnDpdTimeouts suggests many remote clients have gone silent or lost connectivity. Comparing csslvpnActiveSessions trends over time helps size gateway capacity for peak remote-work hours.

What Can Be Monitored

active VPN sessions
peak VPN sessions vs. max allowed
authentication failures
connect/reconnect failures
DPD timeouts
VPN data/control packet throughput

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime

How to Use in IPNetwork Monitor

Example using csslvpnInControlPackets OID:

Select a Cisco SSL VPN gateway as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type csslvpnInControlPackets into the Find box to locate it in the OID tree, then select it and click OK. This object indicates the total number of control packets received by the Secure Gateway. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in packets), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoSslvpnMIB	1.3.6.1.4.1.9.9.829			This MIB module defines management objects for configuration and monitoring of the Cisco secure gateway that implements SSLVPN. Glossary: AnyConnect - Cisco AnyConnect a unified agent that delivers multiple security services to help enable and protect the enterprise. SSL - Secure Sockets Layer URL - Uniform Resource Locator VPN - Virtual Private Network
ciscoSslvpnMIBNotifs	1.3.6.1.4.1.9.9.829.0
NTF csslvpnSessionLimitNotif	1.3.6.1.4.1.9.9.829.0.1			This notification would be sent when the attempt of creating a new active sessions may exceed the maximum number of sessions supported by the device.
NTF csslvpnTunnelUpNotif	1.3.6.1.4.1.9.9.829.0.2			This notification would be sent when SSLVPN tunnel gets created.
NTF csslvpnTunnelDownNotif	1.3.6.1.4.1.9.9.829.0.3			This notification would be sent when SSLVPN tunnel tears down.
ciscoSslvpnMIBObjects	1.3.6.1.4.1.9.9.829.1
csslvpnGlobalStatistics	1.3.6.1.4.1.9.9.829.1.1
U32 csslvpnMaxSessionAllowed	1.3.6.1.4.1.9.9.829.1.1.1	Unsigned32	read-only	This object indicates the maximum number of active SSLVPN sessions that are supported by the device.
U32 csslvpnActiveSessions	1.3.6.1.4.1.9.9.829.1.1.2	Unsigned32	read-only	This object indicates the total number of active SSLVPN sessions.
U32 csslvpnPeakSessions	1.3.6.1.4.1.9.9.829.1.1.3	Unsigned32	read-only	This object indicates the total number of sessions during peak time.
C64 csslvpnInControlPacketsEx	1.3.6.1.4.1.9.9.829.1.1.4	Counter64	read-only	This object indicates the total number of control packets received by the Secure Gateway.
C64 csslvpnInDataPackets	1.3.6.1.4.1.9.9.829.1.1.5	Counter64	read-only	This object indicates the total number of data packets received by the Secure Gateway.
C64 csslvpnOutControlPackets	1.3.6.1.4.1.9.9.829.1.1.6	Counter64	read-only	This object indicates the total number of control packets sent by the Secure Gateway.
C64 csslvpnOutDataPackets	1.3.6.1.4.1.9.9.829.1.1.7	Counter64	read-only	This object indicates the total number of data packets sent by the Secure Gateway.
U32 csslvpnAuthFailures	1.3.6.1.4.1.9.9.829.1.1.8	Unsigned32	read-only	This object indicates the total number of authentication failures.
U32 csslvpnConnectFailures	1.3.6.1.4.1.9.9.829.1.1.9	Unsigned32	read-only	This object indicates the total number of connect failures.
U32 csslvpnReconnectFailures	1.3.6.1.4.1.9.9.829.1.1.10	Unsigned32	read-only	This object indicates the total number of reconnect failures.
C64 csslvpnDpdTimeouts	1.3.6.1.4.1.9.9.829.1.1.11	Counter64	read-only	This object indicates the total number of Dead Peer Detection timeouts.
C64 csslvpnAuthRequests	1.3.6.1.4.1.9.9.829.1.1.12	Counter64	read-only	This object indicates the total number of authentication requests.
C64 csslvpnAuthResponses	1.3.6.1.4.1.9.9.829.1.1.13	Counter64	read-only	This object indicates the total number of authentication responses.
C64 csslvpnInDpdRequests	1.3.6.1.4.1.9.9.829.1.1.14	Counter64	read-only	This object indicates the total number of Dead Peer Detection requests received by Secure Gateway.
C64 csslvpnOutDpdRequests	1.3.6.1.4.1.9.9.829.1.1.15	Counter64	read-only	This object indicates the total number of Dead Peer Detection requests sent by Secure Gateway.
C64 csslvpnInDpdResponses	1.3.6.1.4.1.9.9.829.1.1.16	Counter64	read-only	This object indicates the total number of Dead Peer Detection responses received by Secure Gateway.
C64 csslvpnOutDpdResponses	1.3.6.1.4.1.9.9.829.1.1.17	Counter64	read-only	This object indicates the total number of Dead Peer Detection responses sent by Secure Gateway.
csslvpnSession	1.3.6.1.4.1.9.9.829.1.2
csslvpnSessionTable	1.3.6.1.4.1.9.9.829.1.2.1		not-accessible	A list of SSLVPN sessions which has been successfully created by the secure gateway.
csslvpnSessionEntry	1.3.6.1.4.1.9.9.829.1.2.1.1		not-accessible	An entry providing the management information of a SSLVPN session. An entry will be created when the SSLVPN session has been successfully provisioned by the secure gateway. An entry will be removed when the SSLVPN session has been removed by the secure gateway.
U32 csslvpnSessionID	1.3.6.1.4.1.9.9.829.1.2.1.1.1	Unsigned32	not-accessible	This object indicates the index of a SSLVPN session. The value of csslvpnSessionID is assigned uniquely during session creation.
STR csslvpnSessionUser	1.3.6.1.4.1.9.9.829.1.2.1.1.2	SnmpAdminString	read-only	This object indicates the username with which session is authenticated.
STR csslvpnSessionProfile	1.3.6.1.4.1.9.9.829.1.2.1.1.3	SnmpAdminString	read-only	This object indicates the SSL profile to which session is connected. The SSL profile defines authentication and accounting lists. Profile selection will be based on policy and URL values. Profile may also optionally associate with default authorization policy
STR csslvpnSessionPolicy	1.3.6.1.4.1.9.9.829.1.2.1.1.4	SnmpAdminString	read-only	This object indicates the SSL policy to which session is connected. SSL policy defines the cipher suites to be supported and the trust point to be used during SSL negotiation. SSL policy is a container of all the parameters used in the SSL negotiation. The policy selection would be done by matching the session parameters against the parameters configured under the policy
IPt csslvpnSessionClientIpAddrType	1.3.6.1.4.1.9.9.829.1.2.1.1.5	InetAddressType	read-only	This object indicates the type of public IP Address of the client that initiated the session.
IP csslvpnSessionClientIpAddr	1.3.6.1.4.1.9.9.829.1.2.1.1.6	InetAddress	read-only	This object indicates the public IP Address of the client that initiated the session. The type of this address is determined by the value of csslvpnSessionClientIpAddrType object.
IPt csslvpnSessionTunnelIpAddrType	1.3.6.1.4.1.9.9.829.1.2.1.1.7	InetAddressType	read-only	This object indicates the type of IP address assigned to AnyConnect client during tunnel bring up.
IP csslvpnSessionTunnelIpAddr	1.3.6.1.4.1.9.9.829.1.2.1.1.8	InetAddress	read-only	This object indicates the IP address assigned to AnyConnect client during tunnel bring up. The type of this address is determined by the value of csslvpnSessionTunnelIpAddrType object.
ADR csslvpnSessionTunnelNetmask	1.3.6.1.4.1.9.9.829.1.2.1.1.9	InetAddressPrefixLength	read-only	This object indicates the netmask assigned to the client during the session bring up. This object is always interpreted with the value of csslvpnSessionTunnelIpAddrType object.
U32 csslvpnSessionNumConnections	1.3.6.1.4.1.9.9.829.1.2.1.1.10	Unsigned32	read-only	This object indicates the total number of connections associated with a particular session.
C64 csslvpnSessionRxPackets	1.3.6.1.4.1.9.9.829.1.2.1.1.11	Counter64	read-only	This object indicates the total number of packets received during the session.
C64 csslvpnSessionTxPackets	1.3.6.1.4.1.9.9.829.1.2.1.1.12	Counter64	read-only	This object indicates the total number of packets transmitted during the session.
C64 csslvpnSessionRxBytes	1.3.6.1.4.1.9.9.829.1.2.1.1.13	Counter64	read-only	This object indicates the total number of bytes received during the session.
C64 csslvpnSessionTxBytes	1.3.6.1.4.1.9.9.829.1.2.1.1.14	Counter64	read-only	This object indicates the total number of bytes transmitted during the session.
DAT csslvpnSessionLastUsed	1.3.6.1.4.1.9.9.829.1.2.1.1.15	DateAndTime	read-only	This object indicates the time, when the session was last used.
DAT csslvpnSessionCreated	1.3.6.1.4.1.9.9.829.1.2.1.1.16	DateAndTime	read-only	This object indicates the time, when the session was created.
csslvpnNotificationControl	1.3.6.1.4.1.9.9.829.1.3
BIT csslvpnNotificationEnable	1.3.6.1.4.1.9.9.829.1.3.1	Bits	read-write	This object specifies whether a specified notification is enabled or not. If a bit corresponding to a notification is set to 1, then the specified notification can be generated. sessionLimit -- the csslvpnSessionLimitNotif notification. tunnelUp -- the csslvpnTunnelUpNotif notification. tunnelDown -- the csslvpnTunnelDownNotif notification.
ciscoSslvpnMIBConform	1.3.6.1.4.1.9.9.829.2
ciscoSslvpnMIBCompliances	1.3.6.1.4.1.9.9.829.2.1
ciscoSslvpnMIBCompliance	1.3.6.1.4.1.9.9.829.2.1.1			The compliance statement for entities which implement CISCO-SSLVPN-MIB.
ciscoSslvpnMIBGroups	1.3.6.1.4.1.9.9.829.2.2
csslvpnGlobalSessionGroup	1.3.6.1.4.1.9.9.829.2.2.1			A collection of objects providing management information for global SSLVPN session statistics.
csslvpnStatisticsGroup	1.3.6.1.4.1.9.9.829.2.2.2			A collection of objects providing management information for global SSLVPN statistics.
csslvpnSessionGroup	1.3.6.1.4.1.9.9.829.2.2.3			A collection of objects providing management information for SSLVPN sessions.
csslvpnNotificationGroup	1.3.6.1.4.1.9.9.829.2.2.4			A collection of SSLVPN notifications.
csslvpnNotificationControlGroup	1.3.6.1.4.1.9.9.829.2.2.5			A collection of objects providing control on the generation of SSLVPN notifications.

RFC description

Cisco SSL VPN MIB providing management objects for monitoring SSL VPN sessions, connections, and statistics on Cisco ASA and VPN concentrator devices.

Start monitoring Cisco SSL VPN gateways with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-SSLVPN-MIB