CISCO-UNIFIED-FIREWALL-MIB

All MIBs › CISCO-UNIFIED-FIREWALL-MIB

Organization: Cisco Systems

Last Updated: 2021-03-18

Category: Cisco Devices, VPN and Security

Description: Manages Cisco unified firewall providing session statistics, connection counts, and policy enforcement metrics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-UNIFIED-FIREWALL-MIB?

CISCO-UNIFIED-FIREWALL-MIB models status and performance statistics common to Cisco's stateful firewall implementations (such as those on ASA and IOS Zone-Based/Context-Based firewalls), covering stateful packet filtering and related connection-management features. It exposes global connection counters covering attempts, successful setups, aborted/declined setups (due to policy or resource limits), half-open and fully active connections, expirations, and connection-setup rate over rolling intervals. This makes it a strong performance/fault monitoring MIB for firewall software health: rising cufwConnGlobalNumHalfOpen or cufwConnGlobalNumEmbryonic counts can indicate a SYN-flood style attack, while cufwConnGlobalNumPolicyDeclined and cufwConnGlobalNumResDeclined reveal connections being rejected by policy or due to resource exhaustion, and setup-rate objects show real-time connection load trends. It is a self-contained Cisco enterprise MIB, explicitly scoped to exclude firewall configuration (only status/statistics), so it complements rather than depends on separate configuration-oriented MIBs. It is deployed on Cisco firewall/security appliances and IOS devices running firewall features, monitored by security operations teams for both capacity planning and attack detection. Engineers can download the CISCO-UNIFIED-FIREWALL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-UNIFIED-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco ASA firewalls
Cisco IOS devices with zone-based/context-based firewall features

Monitoring Examples

A security operator would poll cufwConnGlobalNumActive alongside cufwConnGlobalNumHalfOpen and cufwConnGlobalNumEmbryonic to gauge current connection load and detect a potential SYN-flood if half-open/embryonic counts spike disproportionately to active connections. cufwConnGlobalNumSetupsAborted and cufwConnGlobalNumPolicyDeclined would be checked to distinguish legitimate policy blocking from resource exhaustion (cufwConnGlobalNumResDeclined). cufwConnGlobalConnSetupRate1 and cufwConnGlobalConnSetupRate5 (1- and 5-minute setup rates) give a rolling view of connection churn useful for correlating a traffic spike with a firewall performance event, and ciscoUnifiedFirewallMIBNotifs would fire traps for related fault conditions.

What Can Be Monitored

total connection attempts and successful setups
aborted/policy-declined/resource-declined connections
half-open and embryonic connection counts
active and expired connection counts
1-minute and 5-minute connection setup rates

Imported Objects

From BRIDGE-MIB

dot1dTpFdbPort
dot1dTpFdbStatus

From CISCO-FIREWALL-MIB

Hardware
HardwareStatus

From CISCO-FIREWALL-TC

CFWApplicationProtocol
CFWNetworkProtocol
CFWPolicy
CFWPolicyTarget
CFWPolicyTargetType
CFWUrlServerStatus
CFWUrlfVendorId

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DateAndTime
DisplayString
TEXTUAL-CONVENTION
TimeStamp
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoFwAaicHttpGroup	1.3.6.1.4.1.9.9.491.2.2.11			This group defines statistics pertaining to deep packet inspection of HTTP payloads. A firewall that implements this group must implement the group 'ciscoFwBasicAaicGroup'.
ciscoFwApplInspectionGroup	1.3.6.1.4.1.9.9.491.2.2.4			This group contains the MIB objects required to instrument the firewall Application Inspection function.
ciscoFwBasicAaicGroup	1.3.6.1.4.1.9.9.491.2.2.10			This group contains the MIB objects required to instrument the basic elements of Advanced Application Inspection and Control (AAIC).
ciscoFwConnectionGroup	1.3.6.1.4.1.9.9.491.2.2.1			This group contains the MIB objects required to instrument the firewall stateful connection activity.
ciscoFwConnResourceUsageGroup	1.3.6.1.4.1.9.9.491.2.2.2			This group contains the MIB objects required to instrument the resource usage of the stateful packet filtering feature of the managed firewall.
ciscoFwFailoverGroup	1.3.6.1.4.1.9.9.491.2.2.13			This group contains the MIB objects that allow the administrator to control the granularity of objects reported by the agent.
ciscoFwMibReportingControlGroup	1.3.6.1.4.1.9.9.491.2.2.12			This group contains the MIB objects that allow the administrator to control the granularity of objects reported by the agent.
ciscoFwNotificationsGroup	1.3.6.1.4.1.9.9.491.2.2.8			This group contains notifications defined in the Cisco Firewall MIB pertaining to basic firewall operations. Presently, the list include a notification pertaining to URL filtering alone.
ciscoFwPolicyConnectionGroup	1.3.6.1.4.1.9.9.491.2.2.3			This group contains the MIB objects required to instrument policy based summary of firewall connection activity.
ciscoFwTransparentFwGroup	1.3.6.1.4.1.9.9.491.2.2.7			This group contains the MIB objects required to instrument the transparent mode (or layer 2) operation of a firewall.
ciscoFwTransparentNotifGroup	1.3.6.1.4.1.9.9.491.2.2.9			This group contains the notifications that signal security critical events pertaining to the transparent mode operation of the firewall.
ciscoFwUrlFilterGroup	1.3.6.1.4.1.9.9.491.2.2.5			This group contains the MIB objects required to instrument the firewall URL filtering function.
ciscoFwUrlFilterResourceGroup	1.3.6.1.4.1.9.9.491.2.2.6			This group contains the MIB objects required to instrument the resource usage of the URL filtering feature of the managed firewall.
NTF ciscoUFwL2StaticMacAddressMoved	1.3.6.1.4.1.9.9.491.0.2			This notification is generated when the firewall detects the move of a static MAC address to a new port. Such a change could occur either as a result of physical move of the device with the MAC Address to the new port, due to management action of relocating the MAC address at the new location or due to MAC address spoofing. The varbinds identify the new location (port) of the MAC Address and its status at the new location. This notification is issued if and only if the object 'cufwCntlL2StaticMacAddressMoved' has been set to 'true'.
NTF ciscoUFwUrlfServerStateChange	1.3.6.1.4.1.9.9.491.0.1			This notification is generated when the firewall elects a new primary URL filtering server from the existing set of configured servers. Such a change could occur either as a result of the current primary server becoming unavailable or as a result of explicit management action in nominating a filtering server the primary server. The notification is issued just before the change occurs. Consequently, the varbinds identify the attributes corresponding to the old primary server. This notification is issued if and only if the object 'cufwCntlUrlfServerStatusChange' has been set to 'true'.
ciscoUnifiedFirewallMIB	1.3.6.1.4.1.9.9.491			Overview of Cisco Firewall MIB ============================== This MIB Module models status and performance statistics pertaining to the common features supported by Cisco firewall implementations. For each firewall feature, capability (if applicable) and statistics are defined. Supporting the configuration of firewall features is outside the scope of this MIB. Following are the major firewall features: 1) 'Stateful Packet Filtering' Creating and maintaining the state of authorized traffic flows dynamically to permit only flows authorized by the policy is a mandatory function of a firewall. This MIB instruments the activity and memory usage by this function. 2) 'Application Inspection' This refers to the function of inspecting the headers of layer 3 and layer 4 protocols and creating dynamic entries in the connection table for traffic flows spawned by an already established traffic flow. This MIB reflects the protocols that are being inspected. 3) 'URL Filtering' This refers to the function of facilitating or restricting URL access requests through the firewall by consulting either local policy or that configured on a dedicated URL filtering server. This MIB instruments the URL filtering activity, the status and activity of distinct URL filtering servers configured on the firewall and the impact of the performance of the URL filtering servers on the latency and throughput of the firewall. 4) 'Proxy Authentication' This refers to the function of authenticating and/or authorizing users on behalf of servers on the secure side of the firewall. This operation could affect the throughput of the firewall. The MIB objects pertaining to Proxy Authentication will be defined in a subsequent revision of this MIB. 5) 'Transparent Mode Operation' A firewall could operate as a bridge and yet filter traffic based on layer 3-layer 7 control and payload information. Operating in this mode makes it easy to implement a firewall without fragmenting existing subnets. Another advantage of this mode of operation is enhanced security. This MIB instruments the status, activity, and performance of the firewall in this mode. Please note that to fully manage a firewall operating in this mode, the firewall must also support the bridge MIB (BRIDGE-MIB). 6) 'Advanced Application Inspection and Control' This function is also termed 'Application Firewall' and pertains to inspecting payload and headers of application traffic to make sure the traffic flows conform to the configured security policy. Monitoring this function entails identifying the security alerts generated by this function and measuring the impact on firewall performance by this task. Application Firewall will be instrumented in a separate MIB dedicated for the function. 7) 'Failover' or 'Redundancy' Redundancy configuration is essential for business critical firewalls. Instrumenting this function entails reflecting the configuration of redundancy and identifying failover events. The MIB objects pertaining to Proxy Authentication will be defined in a subsequent revision of this MIB. The management information for each firewall feature is defined in a distinct module compliance unit. The compliance units corresponding to basic features of firewalls are defined as mandatory. Acronyms ======== Following are definitions of some terms used in this module. Please refer to the module conformance for a glossary of feature-specific terms. `Firewall' A firewall is a set of related programs, implemented on a host or a network device, that protects the resources of a private network from users from other networks. Common firewalling functions include stateful packet filtering, proxy authentication of users on behalf of applications on the secure side of the firewall, URL access control, inspection of payload of traffic streams to determine security threats. `Layer2 Firewall' or 'Transparent Firewall' A firewall device that operates as a bridge while performing firewalling function. `Connection' The record in the firewall of a traffic strean that has been authorized to flow through the firewall. `Half Open Connection' For a connection oriented protocol: a connection that has not reached the established on both the sides of the connection. For a connection-less protocol: the connection corresponding to a traffic stream where traffic flow has occurred (since the establishment of the connection entry) only on one direction. `Embryonic Connection' The connection entry corresponding to an application layer protocol in which the signaling channel has been established while the setup of the data channel is underway. `Policy' An element of firewall configuration that identifies the access rights to a resource by a traffic source. An example of a policy is an Access Control Rule. `Policy Target' An entity to which a policy is applied so that the action corresponding to the policy is taken only on traffic streams associated with the entity. An example of a policy target is an interface. `URL Filtering Server' A server which is employed by the firewall to enforce URL access policies. `Protocol Data Unit' or PDU An instance of the unit of information using which a protocol operates is called the Protocol Data Unit or the PDU of the protocol. `Deep Packet Inspection' The task of examining the contents of the payloads of one or more layer 7 application protocols with a view to enforcing the local security policies termed 'Deep Packet Inspection'. `Advanced Application Inspection and Control' An entity that performs deep packet inspection of layer 7 application protocol data units is termed an 'Application Firewall'.
ciscoUnifiedFirewallMIBConform	1.3.6.1.4.1.9.9.491.2
ciscoUnifiedFirewallMIBNotifs	1.3.6.1.4.1.9.9.491.0
ciscoUnifiedFirewallMIBObjects	1.3.6.1.4.1.9.9.491.1
ciscoUniFirewallMIBCompliance	1.3.6.1.4.1.9.9.491.2.1.1			The compliance statement for SNMP entities the Cisco Firewall MIB.
ciscoUniFirewallMIBCompliances	1.3.6.1.4.1.9.9.491.2.1
ciscoUniFirewallMIBGroups	1.3.6.1.4.1.9.9.491.2.2
NUM cuCluIfcIndex	1.3.6.1.4.1.9.9.491.1.8.2.3.1.1	InterfaceIndex	read-only	The ifIndex from the IF-MIB for an interface in a cluster unit.
C64 cufwAaicBlacklistedFlowsCount	1.3.6.1.4.1.9.9.491.1.5.3.1.7	Counter64	read-only	The number of flows from policy configuration that were black-listed by Snort after inspection.
C64 cufwAaicBlockedSnortCount	1.3.6.1.4.1.9.9.491.1.5.3.1.2	Counter64	read-only	The number of packets blocked in Snort.
C64 cufwAaicBypassSnortBusyCount	1.3.6.1.4.1.9.9.491.1.5.3.1.5	Counter64	read-only	The number of packets that bypassed inspection when Snort was too busy to handle the packets.
C64 cufwAaicBypassSnortDownCount	1.3.6.1.4.1.9.9.491.1.5.3.1.4	Counter64	read-only	The number of packets that bypassed inspection when Snort was Down.
C64 cufwAaicDeniedFlowEvCount	1.3.6.1.4.1.9.9.491.1.5.3.1.10	Counter64	read-only	The Lina process sends denied flow events to Snort when it decides to drop a flow before sending it to Snort.
C64 cufwAaicEndofFlowEvCount	1.3.6.1.4.1.9.9.491.1.5.3.1.9	Counter64	read-only	The Lina process sends end-of-flow events to Snort when a fast path flow ends.
cufwAaicEngineStats	1.3.6.1.4.1.9.9.491.1.5.3
C64 cufwAaicFastfwdFlowsCount	1.3.6.1.4.1.9.9.491.1.5.3.1.6	Counter64	read-only	The number of flows that were fast forwarded both by policy, and as result of initial inspection due to say Whitelisting.
C64 cufwAaicFwdbeforeDropCount	1.3.6.1.4.1.9.9.491.1.5.3.1.11	Counter64	read-only	Valid for NGIPS interfaces only. This is the number of to-be-dropped packets forwarded to Snort. When the Lina process decides to drop the frame for some reason such as (Invalid TCP header length, Invalid UDP length or Invalid IP length), the frames are also sent to Snort for visibility.
C64 cufwAaicGlobalNumBadPDUSize	1.3.6.1.4.1.9.9.491.1.5.1.2	Counter64	read-only	This MIB object records the number of application protocol data units (PDU) that had either an invalid header size or an invalid payload size, as determined by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of application traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicGlobalNumBadPortRange	1.3.6.1.4.1.9.9.491.1.5.1.3	Counter64	read-only	Number of application protocol units that attempted to advertise illegal port ranges for secondary connections. An example of such an occurrence would be a passive FTP connection, where the server advertises a disallowed port range for data connection. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of application traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicGlobalNumBadProtocolOps	1.3.6.1.4.1.9.9.491.1.5.1.1	Counter64	read-only	'Protocol Operation' is the application protocol specific operation that the PDU is intended to perform. An example of 'protocol operation' is the HELO command of SMTP protocol. This MIB object records the number of application protocol data units that contained a protocol operation which was disallowed by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of application traffic payloads. This value is accumulated from the last reboot of the firewall.
cufwAaicGlobals	1.3.6.1.4.1.9.9.491.1.5.1
cuFwAaicGrp	1.3.6.1.4.1.9.9.491.1.5
C64 cufwAaicHttpNumBadContent	1.3.6.1.4.1.9.9.491.1.5.2.1.5	Counter64	read-only	The number of PDUs corresponding to HTTP protocol which were detected to be containing content whose type disallowed by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicHttpNumBadPDUSize	1.3.6.1.4.1.9.9.491.1.5.2.1.2	Counter64	read-only	The number of PDUs corresponding to HTTP protocol that had either an invalid header size or an invalid payload size, as determined by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicHttpNumBadProtocolOps	1.3.6.1.4.1.9.9.491.1.5.2.1.1	Counter64	read-only	The number of PDUs corresponding to HTTP protocol which were detected to be containing HTTP protocol methods which are disallowed by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicHttpNumDoubleEncodedPkts	1.3.6.1.4.1.9.9.491.1.5.2.1.7	Counter64	read-only	The number of PDUs corresponding to HTTP protocol which were detected to be containing double encoding. Double encoding is a mechanism to obfuscate content in which a encoded data is re-encoded so as to evade deep packet inspections. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicHttpNumLargeURIs	1.3.6.1.4.1.9.9.491.1.5.2.1.4	Counter64	read-only	The number of PDUs corresponding to HTTP protocol which were detected to be containing a URI of size not permitted by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicHttpNumMismatchContent	1.3.6.1.4.1.9.9.491.1.5.2.1.6	Counter64	read-only	The number of PDUs corresponding to HTTP protocol which were detected to be containing content whose type was different from the content type specified in the header of the PDU. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall.
C64 cufwAaicHttpNumTunneledConns	1.3.6.1.4.1.9.9.491.1.5.2.1.3	Counter64	read-only	The number of connections corresponding to HTTP protocol which were detected to be tunneling other application traffic streams. An instance of this would be InstantMessenger traffic running on HTTP. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall.
cufwAaicHttpProtocolStats	1.3.6.1.4.1.9.9.491.1.5.2.1
C64 cufwAaicInjbySnortCount	1.3.6.1.4.1.9.9.491.1.5.3.1.3	Counter64	read-only	The number of packets Snort created and added to the traffic stream.
C64 cufwAaicInjDropCount	1.3.6.1.4.1.9.9.491.1.5.3.1.12	Counter64	read-only	The number of packets that Snort added to the traffic stream that were dropped.
G32 cufwAaicIntrusionEvtRate	1.3.6.1.4.1.9.9.491.1.5.3.2.1	Gauge32	read-only	The rate at which intrusion events were recorded by Snort on this firewall averaged over the last 300 seconds.
cufwAaicLinaSnortStats	1.3.6.1.4.1.9.9.491.1.5.3.1
C64 cufwAaicPassedSnortCount	1.3.6.1.4.1.9.9.491.1.5.3.1.1	Counter64	read-only	The number of packets sent to Snort from Lina. These are packets with pass verdict.
cufwAaicProtocolStats	1.3.6.1.4.1.9.9.491.1.5.2
cufwAaicSnortEvRates	1.3.6.1.4.1.9.9.491.1.5.3.2
C64 cufwAaicStartofFlowEvCount	1.3.6.1.4.1.9.9.491.1.5.3.1.8	Counter64	read-only	The Lina process sends start-of-flow events to Snort when it fast paths a flow without sending it to Snort. These events help Snort keep track of the connections and report the connection events.
T/F cufwAIAlertEnabled	1.3.6.1.4.1.9.9.491.1.2.2	TruthValue	read-write	The value identifies if application inspection alerts have been globally enabled or disabled.
T/F cufwAIAuditTrailEnabled	1.3.6.1.4.1.9.9.491.1.2.1	TruthValue	read-write	The value identifies if audit trail in application inspection has been globally enabled or disabled.
C64 cufwAppConnNumAborted	1.3.6.1.4.1.9.9.491.1.1.4.2.1.8	Counter64	read-only	The number of connections that were terminated by the firewall successful establishment, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
G32 cufwAppConnNumActive	1.3.6.1.4.1.9.9.491.1.1.4.2.1.7	Gauge32	read-only	The number of connections that are currently active, corresponding to the protocol denoted by 'cufwAppConnProtocol'.
C64 cufwAppConnNumAttempted	1.3.6.1.4.1.9.9.491.1.1.4.2.1.2	Counter64	read-only	The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
G32 cufwAppConnNumHalfOpen	1.3.6.1.4.1.9.9.491.1.1.4.2.1.6	Gauge32	read-only	The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwAppConnProtocol'.
C64 cufwAppConnNumPolicyDeclined	1.3.6.1.4.1.9.9.491.1.1.4.2.1.4	Counter64	read-only	The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
C64 cufwAppConnNumResDeclined	1.3.6.1.4.1.9.9.491.1.1.4.2.1.5	Counter64	read-only	The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
C64 cufwAppConnNumSetupsAborted	1.3.6.1.4.1.9.9.491.1.1.4.2.1.3	Counter64	read-only	The number of connection setup attempts, corresponding to the protocol denoted by 'cufwAppConnProtocol', that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwAppConnNumPolicyDeclined' and 'cufwAppConnNumResDeclined'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
CFW cufwAppConnProtocol	1.3.6.1.4.1.9.9.491.1.1.4.2.1.1	CFWApplicationProtocol	not-accessible	The layer7 protocol for which this conceptual row summarizes the connection activity for this firewall.
G32 cufwAppConnSetupRate1	1.3.6.1.4.1.9.9.491.1.1.4.2.1.9	Gauge32	read-only	The connection setup rate averaged over the last 60 seconds corresponding to the protocol denoted by 'cufwAppConnProtocol'.
G32 cufwAppConnSetupRate5	1.3.6.1.4.1.9.9.491.1.1.4.2.1.10	Gauge32	read-only	The connection setup rate averaged over the last 300 seconds corresponding to the protocol denoted by 'cufwAppConnProtocol'.
cufwAppConnSummaryEntry	1.3.6.1.4.1.9.9.491.1.1.4.2.1		not-accessible	Each entry contains the summary of connection activity for a distinct layer 7 protocol identified by the index element 'cufwAppConnProtocol'.
cufwAppConnSummaryTable	1.3.6.1.4.1.9.9.491.1.1.4.2		not-accessible	This table lists the summary of firewall connections pertaining to Layer 7 protocols, catalogued by distinct application protocols. Each entry in the table lists the connection summary corresponding to a distinct application protocol. For instance, to obtain the connection summary for SMTP on the firewall since the last reboot of the device, use the conceptual row corresponding to cufwAppConnProtocol = fwApSmtp
cuFwApplInspectionGrp	1.3.6.1.4.1.9.9.491.1.2
STR cufwAspFlowDropDescription	1.3.6.1.4.1.9.9.491.1.5.3.4.1.3	SnmpAdminString	read-only	Description of the flow drop counter.
I32 cufwAspFlowDropIndex	1.3.6.1.4.1.9.9.491.1.5.3.4.1.1	Integer32	read-only	Index within the data-plane flow drop list of supported counters.
STR cufwAspFlowDropName	1.3.6.1.4.1.9.9.491.1.5.3.4.1.2	SnmpAdminString	read-only	Name of the flow drop counter.
cufwAspFlowDropsEntry	1.3.6.1.4.1.9.9.491.1.5.3.4.1		not-accessible	Each entry in the table pertains to an ASP flow drop.
cufwAspFlowDropsTable	1.3.6.1.4.1.9.9.491.1.5.3.4		not-accessible	This table lists all the ASP flow drops on this firewall device.
C32 cufwAspFlowDropValue	1.3.6.1.4.1.9.9.491.1.5.3.4.1.4	Counter32	read-only	Flow drop counter value.
STR cufwAspFrameDropDescription	1.3.6.1.4.1.9.9.491.1.5.3.3.1.3	SnmpAdminString	read-only	Description of the frame drop counter.
I32 cufwAspFrameDropIndex	1.3.6.1.4.1.9.9.491.1.5.3.3.1.1	Integer32	read-only	Index within the data-plane frame drop list of supported counters.
STR cufwAspFrameDropName	1.3.6.1.4.1.9.9.491.1.5.3.3.1.2	SnmpAdminString	read-only	Name of the frame drop counter.
cufwAspFrameDropsEntry	1.3.6.1.4.1.9.9.491.1.5.3.3.1		not-accessible	Each entry in the table pertains to an ASP frame drop.
cufwAspFrameDropsTable	1.3.6.1.4.1.9.9.491.1.5.3.3		not-accessible	This table lists all the ASP frame drops on this firewall device.
C32 cufwAspFrameDropValue	1.3.6.1.4.1.9.9.491.1.5.3.3.1.4	Counter32	read-only	Frame drop counter value.
NUM cufwCCLink	1.3.6.1.4.1.9.9.491.1.8.1.4	InterfaceIndex	read-only	The ifIndex of the interface used for cluster communication between the units.
IP cufwCCLipAddr	1.3.6.1.4.1.9.9.491.1.8.1.11	InetAddress	read-only	The ip address used on the interface for CCL communication.
PHY cufwCCLmacAddr	1.3.6.1.4.1.9.9.491.1.8.1.12	PhysAddress	read-only	The MAC address on the CCL link.
T/F cufwCluConsoleReplicate	1.3.6.1.4.1.9.9.491.1.8.1.7	TruthValue	read-only	The console replication feature is enabled on this slave. Slave units send the console messages to the master unit so that you only need to monitor one console port for the cluster.
T/F cufwCluEnabled	1.3.6.1.4.1.9.9.491.1.8.1.1	TruthValue	read-only	This value depicts if clustering is enabled or not on the device.
CUF cufwCluFromState	1.3.6.1.4.1.9.9.491.1.8.3.2.1.2	CUfwCluState	read-only	The log entry points to the cluster state that this event transitioned from.
STR cufwCluGroupName	1.3.6.1.4.1.9.9.491.1.8.1.5	SnmpAdminString	read-only	The group name uniquely identifying this cluster.
NUM cufwCluHealthCheck	1.3.6.1.4.1.9.9.491.1.8.2.3.1.3	CUfwInterfaceMonitor	read-only	The monitoring state of the interface being addressed in a cluster unit.
CUF cufwCluHealthStatus	1.3.6.1.4.1.9.9.491.1.8.2.3.1.2	CUfwCluHealth	read-only	The health-check outcome of the interface being addressed in a cluster unit.
cufwCluHistEvEntry	1.3.6.1.4.1.9.9.491.1.8.3.2.1		not-accessible	Each entry in the table lists details of a cluster state transition.
cufwCluHistEvTable	1.3.6.1.4.1.9.9.491.1.8.3.2		not-accessible	This table summarises the cluster state transitions' history in a unit.
INT cufwCluHistIndex	1.3.6.1.4.1.9.9.491.1.8.3.2.1.1	INTEGER	read-only	A distinct index that points to an entry in the cluster history table for this unit.
cufwCluInterfaceEntry	1.3.6.1.4.1.9.9.491.1.8.2.3.1		not-accessible	Each entry in the table depicts the health of a clustering interface.
INT cufwCluInterfaceMode	1.3.6.1.4.1.9.9.491.1.8.1.2	INTEGER	read-only	Mode of interface in clustering. Value Type 0 none 1 Spanned ether-channel 2 Individual 3 invalid
cufwCluInterfaceTable	1.3.6.1.4.1.9.9.491.1.8.2.3		not-accessible	This table summarises the health of each interface in a cluster unit.
STR cufwCluLastJoinAt	1.3.6.1.4.1.9.9.491.1.8.1.15	DisplayString	read-only	The date&time at which this unit last joined the cluster.
STR cufwCluLastLeaveAt	1.3.6.1.4.1.9.9.491.1.8.1.16	DisplayString	read-only	The date&time at which this unit last left the cluster.
INT cuFwCluMaxStateEvents	1.3.6.1.4.1.9.9.491.1.8.3.1	INTEGER	read-only	The max count of history logs for cluster state transitions that can be saved on the device.
STR cufwCluOverallHealth	1.3.6.1.4.1.9.9.491.1.8.2.2	DisplayString	read-only	The string would show either healthy or un-healthy.
INT cufwCluPriority	1.3.6.1.4.1.9.9.491.1.8.1.9	INTEGER	read-only	The priority of this unit for master unit elections (1 being highest).
STR cufwCluSerialNum	1.3.6.1.4.1.9.9.491.1.8.1.10	SnmpAdminString	read-only	The vendor-specific serial number string for the current unit in cluster.
INT cufwCluSiteID	1.3.6.1.4.1.9.9.491.1.8.1.8	INTEGER	read-only	The site ID for this unit used in inter-site clustering.
cuFwClusterGlobals	1.3.6.1.4.1.9.9.491.1.8.1
cuFwClusterGrp	1.3.6.1.4.1.9.9.491.1.8
cuFwClusterHistory	1.3.6.1.4.1.9.9.491.1.8.3
NTF cufwClusterStateChanged	1.3.6.1.4.1.9.9.491.0.4			This notification is generated when the firewall detects a new master has been elected. This notification is issued if and only if the object 'cufwCntlCluStateChange' has been set to 'true'.
cuFwClusterStatus	1.3.6.1.4.1.9.9.491.1.8.2
STR cufwCluSwVersion	1.3.6.1.4.1.9.9.491.1.8.1.13	SnmpAdminString	read-only	The vendor-specific software revision string for the current unit in cluster.
CUF cufwCluToState	1.3.6.1.4.1.9.9.491.1.8.3.2.1.3	CUfwCluState	read-only	The log entry points to the cluster state that this event transitioned to.
DAT cufwCluTransitionAt	1.3.6.1.4.1.9.9.491.1.8.3.2.1.4	DateAndTime	read-only	The date&time at which this transition happened for the cluster unit.
STR cufwCluTransitionReason	1.3.6.1.4.1.9.9.491.1.8.3.2.1.5	DisplayString	read-only	The reason for this transition for the cluster unit.
STR cuFwCluUnitHealth	1.3.6.1.4.1.9.9.491.1.8.2.1	DisplayString	read-only	The string would show either healthy or un-healthy.
INT cufwCluUnitHoldtime	1.3.6.1.4.1.9.9.491.1.8.1.14	INTEGER	read-only	To determine unit health, the ASA cluster units send keepalive messages on the cluster control link to other units. The hold time that each unit will wait before declaring a peer unit as dead.
STR cufwCluUnitName	1.3.6.1.4.1.9.9.491.1.8.1.6	SnmpAdminString	read-only	The name uniquely identifying this cluster member.
CUF cufwCluUnitState	1.3.6.1.4.1.9.9.491.1.8.1.3	CUfwCluState	read-only	The current state of the unit in cluster.
T/F cufwCntlCluStateChange	1.3.6.1.4.1.9.9.491.1.7.4	TruthValue	read-write	This object defines the administrative state of sending the SNMP notification to signal the election of a new master in a cluster unit.
T/F cufwCntlFOstateChange	1.3.6.1.4.1.9.9.491.1.7.3	TruthValue	read-write	This object defines the administrative state of sending the SNMP notification to signal the election of a new active or standby in an HA pair.
T/F cufwCntlL2StaticMacAddressMoved	1.3.6.1.4.1.9.9.491.1.7.2	TruthValue	read-write	This object defines the administrative state of sending the SNMP notification to signal the move of a statically configured MAC address to a new port. Such a change could occur either as a result of physical move of the device with the MAC Address to the new port or due to MAC address spoofing.
T/F cufwCntlUrlfServerStatusChange	1.3.6.1.4.1.9.9.491.1.7.1	TruthValue	read-write	This object defines the administrative state of sending the SNMP notification to signal the election of a new primary URL filtering server by this firewall. Such a change could occur either as a result of the current primary server becoming unavailable or as a result of explicit management action in nominating a filtering server the primary server.
cuFwConnectionGlobals	1.3.6.1.4.1.9.9.491.1.1.1
cuFwConnectionGrp	1.3.6.1.4.1.9.9.491.1.1
cuFwConnectionReportSettings	1.3.6.1.4.1.9.9.491.1.1.3
cuFwConnectionResources	1.3.6.1.4.1.9.9.491.1.1.2
cuFwConnectionSummaryTables	1.3.6.1.4.1.9.9.491.1.1.4
G32 cufwConnGlobalConnSetupRate1	1.3.6.1.4.1.9.9.491.1.1.1.10	Gauge32	read-only	The averaged number of connections which the firewall establishing per second, averaged over the last 60 seconds.
G32 cufwConnGlobalConnSetupRate5	1.3.6.1.4.1.9.9.491.1.1.1.11	Gauge32	read-only	The averaged number of connections which the firewall establishing per second, averaged over the last 300 seconds.
C64 cufwConnGlobalNumAborted	1.3.6.1.4.1.9.9.491.1.1.1.8	Counter64	read-only	The number of connections which were active but which were aborted by the firewall due to reasons of policy or resource rationing. This value is accumulated from the last reboot of the firewall.
G32 cufwConnGlobalNumActive	1.3.6.1.4.1.9.9.491.1.1.1.6	Gauge32	read-only	The number of connections which are currently active.
C64 cufwConnGlobalNumAttempted	1.3.6.1.4.1.9.9.491.1.1.1.1	Counter64	read-only	Connection Statistics Aggregation Connection 1 +-----------+ ------------->\| \|-------> Global Connection Summary Connection 2 \| \| ------------->\| \| Connection 3 \| \| ------------->\| First \|------------> ConnSummary \| Level \| (i.e, L-3/4 Protocol Connection 4 \|Aggregation\| Connection Summary) ------------->\| \| . \| \| . \| \|---------------> PolicyConnSummary Connection N \| \| (i.e, L-3/4 Policy Target based ------------->\| \| Protocol Connection Summary) +-----------+ +-----------+ L-3/4 Protocol \| \| Connection Summary \| \| ------------------>\| \|---------> AppConnSummary \| \| (i.e, L-7 Protocol \| Second \| Connection Summary) \|---Level---\| L-3/4 Policy Target \|Aggregation\| based Protocol \| \| Connection Summary \| \| ------------------>\| \|---------------> PolicyAppConnSummary \| \| (i.e, L-7 Policy Target based \| \| Protocol Connection Summary) +-----------+ Specifically, the object 'cufwConnGlobalNumAttempted' models the number of connections which are attempted to be set up through the firewall. This value is accumulated from the last reboot of the firewall.
G32 cufwConnGlobalNumEmbryonic	1.3.6.1.4.1.9.9.491.1.1.1.9	Gauge32	read-only	The number of embryonic application layer connections (that is, connections in which the signaling channel has been established while the data channel is awaiting setup). This value is accumulated from the last reboot of the firewall.
C64 cufwConnGlobalNumExpired	1.3.6.1.4.1.9.9.491.1.1.1.7	Counter64	read-only	The number of connections which were active but which were since normally terminated. This value is accumulated from the last reboot of the firewall.
G32 cufwConnGlobalNumHalfOpen	1.3.6.1.4.1.9.9.491.1.1.1.5	Gauge32	read-only	The number of connections which are in the process of being setup but which have not yet reached the established state in the connection table.
C64 cufwConnGlobalNumPolicyDeclined	1.3.6.1.4.1.9.9.491.1.1.1.3	Counter64	read-only	The number of connections which were attempted to be setup but which were declined due to reasons of security policy. This includes the connections that failed authentication. This value is accumulated from the last reboot of the firewall.
G32 cufwConnGlobalNumRemoteAccess	1.3.6.1.4.1.9.9.491.1.1.1.12	Gauge32	read-only	The number of active connections which correspond to remote access applications. Specifically, the protocol for which the connection is established must be one of PPP, PPTP, L2TP or remote access IPsec (IPsec connections employing extended authentication). This value is accumulated from the last reboot of the firewall.
C64 cufwConnGlobalNumResDeclined	1.3.6.1.4.1.9.9.491.1.1.1.4	Counter64	read-only	The number of connections which were attempted to be setup but which were declined due to non-availability of required resources. This value is accumulated from the last reboot of the firewall.
C64 cufwConnGlobalNumSetupsAborted	1.3.6.1.4.1.9.9.491.1.1.1.2	Counter64	read-only	The number of connection setup attempts that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwConnGlobalNumPolicyDeclined' and 'cufwConnGlobalNumResDeclined'. This value is accumulated from the last reboot of the firewall.
C64 cufwConnNumAborted	1.3.6.1.4.1.9.9.491.1.1.4.1.1.8	Counter64	read-only	The number of connections that were abnormally terminated after successful establishment, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall.
G32 cufwConnNumActive	1.3.6.1.4.1.9.9.491.1.1.4.1.1.7	Gauge32	read-only	The number of connections that are currently active, corresponding to the protocol denoted by 'cufwConnProtocol'.
C64 cufwConnNumAttempted	1.3.6.1.4.1.9.9.491.1.1.4.1.1.2	Counter64	read-only	The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall.
G32 cufwConnNumHalfOpen	1.3.6.1.4.1.9.9.491.1.1.4.1.1.6	Gauge32	read-only	The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwConnProtocol'.
C64 cufwConnNumPolicyDeclined	1.3.6.1.4.1.9.9.491.1.1.4.1.1.4	Counter64	read-only	The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall.
C64 cufwConnNumResDeclined	1.3.6.1.4.1.9.9.491.1.1.4.1.1.5	Counter64	read-only	The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall.
C64 cufwConnNumSetupsAborted	1.3.6.1.4.1.9.9.491.1.1.4.1.1.3	Counter64	read-only	The number of connection setup attempts, corresponding to the protocol denoted by 'cufwConnProtocol', that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwConnNumPolicyDeclined' and 'cufwConnNumResDeclined'. This value is accumulated from the last reboot of the firewall.
CFW cufwConnProtocol	1.3.6.1.4.1.9.9.491.1.1.4.1.1.1	CFWNetworkProtocol	not-accessible	The (L3-L4) protocol for which this conceptual row summarizes the connection activity on the managed entity.
T/F cufwConnReptAppStats	1.3.6.1.4.1.9.9.491.1.1.3.1	TruthValue	read-write	Setting this object to 'true' enables the MIB to report connection activity statistics pertaining to application protocols. If this object is set to 'false', the agent should stop updating the objects defined in this module pertaining to application protocols. Application monitoring could be a resource intensive operation. It is expected that the administrators would use this control to disable application monitoring when the performance of the firewall is degrading.
TIM cufwConnReptAppStatsLastChanged	1.3.6.1.4.1.9.9.491.1.1.3.2	TimeStamp	read-only	The time at which the value of cufwConnReptAppStats was last changed.
G32 cufwConnResActiveConnMemoryUsage	1.3.6.1.4.1.9.9.491.1.1.2.2	Gauge32	read-only	The amount of memory occupied by all structures required to maintain the state of all active connections.
G32 cufwConnResEmbrConnMemoryUsage	1.3.6.1.4.1.9.9.491.1.1.2.4	Gauge32	read-only	The amount of memory occupied by all structures required to maintain the state of all embryonic connections.
G32 cufwConnResHOConnMemoryUsage	1.3.6.1.4.1.9.9.491.1.1.2.3	Gauge32	read-only	The amount of memory occupied by all structures required to maintain the state of all half open connections.
G32 cufwConnResMemoryUsage	1.3.6.1.4.1.9.9.491.1.1.2.1	Gauge32	read-only	The amount of memory occupied by all structures required to maintain the state of all connections which are either being established or are active.
G32 cufwConnSetupRate1	1.3.6.1.4.1.9.9.491.1.1.4.1.1.9	Gauge32	read-only	The connection setup rate averaged over the last 60 seconds corresponding to the protocol denoted by 'cufwConnProtocol'.
G32 cufwConnSetupRate5	1.3.6.1.4.1.9.9.491.1.1.4.1.1.10	Gauge32	read-only	The connection setup rate averaged over the last 300 seconds corresponding to the protocol denoted by 'cufwConnProtocol'.
cufwConnSummaryEntry	1.3.6.1.4.1.9.9.491.1.1.4.1.1		not-accessible	Each entry contains the summary of connection activity for a layer3-layer4 network protocol.
cufwConnSummaryTable	1.3.6.1.4.1.9.9.491.1.1.4.1		not-accessible	This table summarizes the connection activity on the firewall per layer3-layer 4 protocol instance. Each entry in the table lists the connection summary of a distinct network protocol. For instance, the conceptual row corresponding to the index cufwConnProtocol = fwpTcp yields the summary of TCP connection activity on the firewall since its reboot.
I32 cufwContextId	1.3.6.1.4.1.9.9.491.1.4.2.2.1.2	Integer32	read-only	The virtual context-id of the ASA context for which this conceptual row summarizes an interface's health within a logical HA group.
NUM cufwContextifIndex	1.3.6.1.4.1.9.9.491.1.4.2.2.1.3	InterfaceIndex	read-only	The ifIndex from the IF-MIB for an interface in a context.
cuFwFailoverGlobals	1.3.6.1.4.1.9.9.491.1.4.1
cuFwFailoverGrp	1.3.6.1.4.1.9.9.491.1.4
cuFwFailoverHistory	1.3.6.1.4.1.9.9.491.1.4.4
NTF cufwFailoverStateChanged	1.3.6.1.4.1.9.9.491.0.3			This notification is generated when the firewall detects a state change in either units of an HA pair. This notification is issued if and only if the object 'cufwCntlFOstateChange' has been set to 'true'.
cuFwFailoverStatistics	1.3.6.1.4.1.9.9.491.1.4.3
cuFwFailoverStatus	1.3.6.1.4.1.9.9.491.1.4.2
I32 cufwFOCLientId	1.3.6.1.4.1.9.9.491.1.4.3.2.1.2	Integer32	read-only	A distinct HA client identifier for which this conceptual row summarizes the sync statistics.
STR cufwFOCLientName	1.3.6.1.4.1.9.9.491.1.4.3.2.1.3	DisplayString	read-only	The HA client's name for which this conceptual row summarizes the sync statistics.
T/F cufwFOEnabled	1.3.6.1.4.1.9.9.491.1.4.1.1	TruthValue	read-only	This value depicts if failover is enabled or not on the device.
I32 cufwFOEncryption	1.3.6.1.4.1.9.9.491.1.4.1.6	Integer32	read-only	The type of encryption enabled on the failover links between the units to encrypt all failover communications. Value Type 0 none 1 IPSec LAN-to-LAN tunnels 2 Key Passphrase
CUF cufwFOGroupIdx	1.3.6.1.4.1.9.9.491.1.4.3.2.1.1	CUfwFOGroupId	read-only	A distinct HA group identifier for which this conceptual row summarizes the sync statistics.
CUF cufwFOGroupIndex	1.3.6.1.4.1.9.9.491.1.4.2.1.1.1	CUfwFOGroupId	read-only	A distinct HA group identifier for which this conceptual row summarizes critical failover data.
G32 cufwFOGrpContextCount	1.3.6.1.4.1.9.9.491.1.4.2.1.1.5	Gauge32	read-only	The number of virtual contexts part of the group on the unit being polled.
CUF cufwFOGrpHAFromState	1.3.6.1.4.1.9.9.491.1.4.4.3.1.3	CUfwFOState	read-only	The log entry points to the HA state that this event transitioned from.
HAR cufwFOGrpHAstate	1.3.6.1.4.1.9.9.491.1.4.2.1.1.3	HardwareStatus	read-only	The current HA role of a group on the unit being polled. Allowed values are active or standby or unknown.
CUF cufwFOGrpHAToState	1.3.6.1.4.1.9.9.491.1.4.4.3.1.4	CUfwFOState	read-only	The log entry points to the HA state that this event transitioned to.
CUF cufwFOGrpId	1.3.6.1.4.1.9.9.491.1.4.2.2.1.1	CUfwFOGroupId	read-only	A distinct HA group identifier for which this conceptual row summarizes the interface health.
CUF cufwFOGrpIndex	1.3.6.1.4.1.9.9.491.1.4.4.3.1.1	CUfwFOGroupId	read-only	A distinct HA group identifier for which this conceptual row summarizes time-tale history of failover events.
STR cufwFOGrpLastFailoverAt	1.3.6.1.4.1.9.9.491.1.4.2.1.1.2	DisplayString	read-only	The date&time at which the last switchover was triggered for an HA group.
cufwFOGrpStatusEntry	1.3.6.1.4.1.9.9.491.1.4.2.1.1		not-accessible	Each entry in the table lists necessary HA status of a group.
cufwFOGrpStatusTable	1.3.6.1.4.1.9.9.491.1.4.2.1		not-accessible	This table summarizes the failover state of a logical group of ASA contexts. The HA switchover happens at the group level.
STR cufwFOGrpTransitionAt	1.3.6.1.4.1.9.9.491.1.4.4.3.1.5	DisplayString	read-only	The date&time at which this transition happened for an HA group.
STR cufwFOGrpTransitionReason	1.3.6.1.4.1.9.9.491.1.4.4.3.1.6	DisplayString	read-only	The reason for this transition event for an HA group.
G32 cufwFOGrpUpTime	1.3.6.1.4.1.9.9.491.1.4.2.1.1.4	Gauge32	read-only	The Uptime of a group in the current HA role on the unit being polled.
cufwFOHistoryEvEntry	1.3.6.1.4.1.9.9.491.1.4.4.3.1		not-accessible	Each entry in the table.
cufwFOHistoryEvTable	1.3.6.1.4.1.9.9.491.1.4.4.3		not-accessible	This table summarizes the failover state of a logical group of ASA contexts.
I32 cufwFOHistoryIndex	1.3.6.1.4.1.9.9.491.1.4.4.3.1.2	Integer32	read-only	A distinct index that points to an entry in the table for an HA group.
cufwFOInterfaceEntry	1.3.6.1.4.1.9.9.491.1.4.2.2.1		not-accessible	Each entry in the table pertains to an interface in a context.
I32 cufwFOInterfaceHoldtime	1.3.6.1.4.1.9.9.491.1.4.1.18	Integer32	read-only	The hold time that each unit will wait before declaring the peer unit as dead due to interface check failure.
NUM cufwFOInterfaceMonitoring	1.3.6.1.4.1.9.9.491.1.4.2.2.1.4	CUfwInterfaceMonitor	read-only	The monitoring state of the interface being addressed in a context.
I32 cufwFOInterfacePolicy	1.3.6.1.4.1.9.9.491.1.4.1.15	Integer32	read-only	The count of interface failures set as threshold to trigger switchover when interfaces are declared as health-check failed.
I32 cufwFOInterfacePolltime	1.3.6.1.4.1.9.9.491.1.4.1.17	Integer32	read-only	The polling frequency of the Hello packets on each interface between the units in HA pair.
NUM cufwFOInterfaceStatus	1.3.6.1.4.1.9.9.491.1.4.2.2.1.5	CUfwInterfaceHealth	read-only	The health-check outcome of the interface being addressed in a context.
cufwFOInterfaceTable	1.3.6.1.4.1.9.9.491.1.4.2.2		not-accessible	This table summarizes the interface health check status of each interface in a group per context.
NUM cufwFOLink	1.3.6.1.4.1.9.9.491.1.4.1.3	InterfaceIndex	read-only	The ifIndex of the interface used for failover communication between the two units.
I32 cufwFOLinkStatePolltime	1.3.6.1.4.1.9.9.491.1.4.1.14	Integer32	read-only	The frequency at which the link-state of a unit's interfaces are polled to detect link failures.
cufwFOLogicalUpdateEntry	1.3.6.1.4.1.9.9.491.1.4.3.2.1		not-accessible	Each entry in the table lists the transmit and receive stats summary of a distinct HA client in the system.
cufwFOLogicalUpdatesTable	1.3.6.1.4.1.9.9.491.1.4.3.2		not-accessible	This table summarizes the statistics of every HA client's logical updates to and from its peer.
C32 cufwFOLUReceiveCount	1.3.6.1.4.1.9.9.491.1.4.3.2.1.6	Counter32	read-only	The count of received updates from peer for the HA client.
C32 cufwFOLUReceiveErrors	1.3.6.1.4.1.9.9.491.1.4.3.2.1.7	Counter32	read-only	The count of receive errors for updates from peer for the HA client.
C32 cufwFOLUTransmitCount	1.3.6.1.4.1.9.9.491.1.4.3.2.1.4	Counter32	read-only	The count of transmitted updates sent to peer for the HA client.
C32 cufwFOLUTransmitErrors	1.3.6.1.4.1.9.9.491.1.4.3.2.1.5	Counter32	read-only	The count of transmit errors for updates sent to peer for the HA client.
I32 cuFwFOMaxStateEvents	1.3.6.1.4.1.9.9.491.1.4.4.1	Integer32	read-only	The max count of history logs for FO state transitions that can be saved on the device.
G32 cufwFOMonitoredInterfaces	1.3.6.1.4.1.9.9.491.1.4.1.16	Gauge32	read-only	The count of interfaces monitored on the HA units for interface health.
T/F cufwFOReplicationHttp	1.3.6.1.4.1.9.9.491.1.4.1.19	TruthValue	read-only	This object depicts if the stateful replication of HTTP sessions is enabled in a Stateful Failover environment.
G32 cufwFOReplicationRate	1.3.6.1.4.1.9.9.491.1.4.1.20	Gauge32	read-only	The bulk-sync connection replication rate between the HA units.
STR cufwFOSerialNumMate	1.3.6.1.4.1.9.9.491.1.4.1.8	SnmpAdminString	read-only	The vendor-specific serial number string for the peer unit in pair.
STR cufwFOSerialNumOurs	1.3.6.1.4.1.9.9.491.1.4.1.7	SnmpAdminString	read-only	The vendor-specific serial number string for the current unit in pair.
T/F cufwFOStatefulUpdateEnabled	1.3.6.1.4.1.9.9.491.1.4.3.1	TruthValue	read-only	This value depicts if failover has enabled stateful updates for all HA clients on the device.
NUM cufwFOStateLink	1.3.6.1.4.1.9.9.491.1.4.1.4	InterfaceIndex	read-only	The ifIndex of the interface used for failover communication to pass connection state information.
T/F cufwFOStdbyConfigLocked	1.3.6.1.4.1.9.9.491.1.4.1.5	TruthValue	read-only	This object depicts if the the ability to make any configuration changes directly on the standby unit or context is enabled.
STR cufwFOSwVersionMate	1.3.6.1.4.1.9.9.491.1.4.1.10	SnmpAdminString	read-only	The vendor-specific software revision string for the peer unit in pair.
STR cufwFOSwVersionOurs	1.3.6.1.4.1.9.9.491.1.4.1.9	SnmpAdminString	read-only	The vendor-specific software revision string for the current unit in pair.
T/F cufwFOUnitBfdEnabled	1.3.6.1.4.1.9.9.491.1.4.1.13	TruthValue	read-only	This object depicts if BFD protocol is enabled between the units for health monitoring.
HAR cufwFOUnitDesignation	1.3.6.1.4.1.9.9.491.1.4.1.2	Hardware	read-only	The hardware type that points to designation as primary or secondary unit.
I32 cufwFOUnitHoldtime	1.3.6.1.4.1.9.9.491.1.4.1.12	Integer32	read-only	The hold time that each unit will wait before declaring the peer unit as dead. If the failed unit is the active unit, the standby unit takes over as the active unit.
I32 cufwFOUnitPolltime	1.3.6.1.4.1.9.9.491.1.4.1.11	Integer32	read-only	The polling frequency of the Hello packets between the units in HA pair.
cufwInspectionEntry	1.3.6.1.4.1.9.9.491.1.2.3.1		not-accessible	Each entry contains the configuration of a specific application inspection element.
CFW cufwInspectionPolicyName	1.3.6.1.4.1.9.9.491.1.2.3.1.1	CFWPolicy	not-accessible	The name of the policy that configures the device inspect the protocol specified by 'cufwInspectionProtocol'.
CFW cufwInspectionProtocol	1.3.6.1.4.1.9.9.491.1.2.3.1.2	CFWApplicationProtocol	not-accessible	The application protocol that is configured for inspection.
T/F cufwInspectionStatus	1.3.6.1.4.1.9.9.491.1.2.3.1.3	TruthValue	read-only	This MIB object identifies if the directive to inspect the protocol specified by 'cufwInspectionProtocol' by the policy corresponding to this conceptual row is enabled or disabled.
cufwInspectionTable	1.3.6.1.4.1.9.9.491.1.2.3		not-accessible	This table identifies if an application protocol has been configured for inspection and if so, the name of the firewall policy or the inspection configuration that configures the specified protocol for inspection. The table also identifies if the specified protocol is actively being inspected. This table may be used by an administrator to quickly identify if a protocol is being subjected to application inspection by the managed firewall.
cufwL2FwGlobals	1.3.6.1.4.1.9.9.491.1.6.1
cuFwL2FwGrp	1.3.6.1.4.1.9.9.491.1.6
I32 cufwL2GlobalArpCacheSize	1.3.6.1.4.1.9.9.491.1.6.1.2	Integer32	read-only	The value indicates the configured maximum size of the ARP cache used for management traffic.
G32 cufwL2GlobalArpOverflowRate5	1.3.6.1.4.1.9.9.491.1.6.1.9	Gauge32	read-only	The number of times an existing entry from the ARP cache had to be ejected in order to insert a new entry in the last 300 seconds. This counter is accumulated since the last reboot of the firewall.
T/F cufwL2GlobalEnableArpInspection	1.3.6.1.4.1.9.9.491.1.6.1.3	TruthValue	read-write	The value indicates if ARP inspection, which is a security feature, is enabled globally on the managed firewall.
T/F cufwL2GlobalEnableStealthMode	1.3.6.1.4.1.9.9.491.1.6.1.1	TruthValue	read-only	The value indicates if the firewall is operating in transparent (layer 2) mode or not. When operating in transparent mode, the firewall operates as a bridge while performing firewalling functions.
C64 cufwL2GlobalNumArpRequests	1.3.6.1.4.1.9.9.491.1.6.1.5	Counter64	read-only	The number of ARP requests issued by the transparent firewall to resolve a destination IP address. This counter is accumulated since the last reboot of the firewall.
C64 cufwL2GlobalNumBadArpResponses	1.3.6.1.4.1.9.9.491.1.6.1.10	Counter64	read-only	The number of malformed ARP responses received by the firewall in trying to resolve the MAC address of the destination IP address in an incoming frame. This counter is accumulated since the last reboot of the firewall.
C64 cufwL2GlobalNumDrops	1.3.6.1.4.1.9.9.491.1.6.1.8	Counter64	read-only	The number of times the firewall dropped an incoming frame because the destination MAC address is missing in the bridge table. This counter is accumulated since the last reboot of the firewall.
C64 cufwL2GlobalNumFloods	1.3.6.1.4.1.9.9.491.1.6.1.7	Counter64	read-only	The number of times the firewall floods a frame to be forwarded to the egress interfaces because the destination MAC address is missing in the bridge table. This counter is accumulated since the last reboot of the firewall.
C64 cufwL2GlobalNumIcmpRequests	1.3.6.1.4.1.9.9.491.1.6.1.6	Counter64	read-only	The number of ICMP traceroute requests issued by the transparent firewall to resolve a destination IP address. This counter is accumulated since the last reboot of the firewall.
C64 cufwL2GlobalNumSpoofedArpResps	1.3.6.1.4.1.9.9.491.1.6.1.11	Counter64	read-only	The number of spoofed ARP responses received by the firewall. Such an event would occur when the firewall encounters an ARP response mapping an IP address to a different MAC Address from the one present in the local ARP cache. This counter is accumulated since the last reboot of the firewall.
cuFwNotifCntlGrp	1.3.6.1.4.1.9.9.491.1.7
C64 cufwPolAppConnNumAborted	1.3.6.1.4.1.9.9.491.1.1.4.4.1.11	Counter64	read-only	The number of connections that were abnormally terminated after successful establishment, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'.
G32 cufwPolAppConnNumActive	1.3.6.1.4.1.9.9.491.1.1.4.4.1.10	Gauge32	read-only	The number of connections that are currently active, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'.
C64 cufwPolAppConnNumAttempted	1.3.6.1.4.1.9.9.491.1.1.4.4.1.5	Counter64	read-only	The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
G32 cufwPolAppConnNumHalfOpen	1.3.6.1.4.1.9.9.491.1.1.4.4.1.9	Gauge32	read-only	The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'.
C64 cufwPolAppConnNumPolicyDeclined	1.3.6.1.4.1.9.9.491.1.1.4.4.1.7	Counter64	read-only	The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
C64 cufwPolAppConnNumResDeclined	1.3.6.1.4.1.9.9.491.1.1.4.4.1.8	Counter64	read-only	The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
C64 cufwPolAppConnNumSetupsAborted	1.3.6.1.4.1.9.9.491.1.1.4.4.1.6	Counter64	read-only	The number of connection setup attempts, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', associated with the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget', that were aborted before the connections could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwPolAppConnNumPolicyDeclined' and 'cufwPolAppConnNumResDeclined'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats.
CFW cufwPolAppConnPolicy	1.3.6.1.4.1.9.9.491.1.1.4.4.1.1	CFWPolicy	not-accessible	The identity of the firewall policy for which this conceptual row contains the connection activity summary.
CFW cufwPolAppConnPolicyTarget	1.3.6.1.4.1.9.9.491.1.1.4.4.1.3	CFWPolicyTarget	not-accessible	The identity of the entity to which the firewall policy 'cufwPolAppProtocol' refers. This could be an interface object (most commonly), another object or group of objects defined in the firewall configuration.
CFW cufwPolAppConnPolicyTargetType	1.3.6.1.4.1.9.9.491.1.1.4.4.1.2	CFWPolicyTargetType	not-accessible	The type of the entity to which the firewall policy 'cufwPolAppConnPolicy' has been applied. This could be an interface type (most commonly), the type of another object or a group of objects defined in the firewall configuration. When this object is set to 'targetALL', the value of index object cufwAppConnPolicyTarget is ignored.
CFW cufwPolAppConnProtocol	1.3.6.1.4.1.9.9.491.1.1.4.4.1.4	CFWApplicationProtocol	not-accessible	The layer7 protocol for which this conceptual row summarizes the connection activity for this firewall.
C64 cufwPolConnNumAborted	1.3.6.1.4.1.9.9.491.1.1.4.3.1.11	Counter64	read-only	The number of connections that were abnormally terminated after successful establishment, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'.
G32 cufwPolConnNumActive	1.3.6.1.4.1.9.9.491.1.1.4.3.1.10	Gauge32	read-only	The number of connections that are currently active, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'.
C64 cufwPolConnNumAttempted	1.3.6.1.4.1.9.9.491.1.1.4.3.1.5	Counter64	read-only	The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'.
G32 cufwPolConnNumHalfOpen	1.3.6.1.4.1.9.9.491.1.1.4.3.1.9	Gauge32	read-only	The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'.
C64 cufwPolConnNumPolicyDeclined	1.3.6.1.4.1.9.9.491.1.1.4.3.1.7	Counter64	read-only	The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'.
C64 cufwPolConnNumResDeclined	1.3.6.1.4.1.9.9.491.1.1.4.3.1.8	Counter64	read-only	The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'.
C64 cufwPolConnNumSetupsAborted	1.3.6.1.4.1.9.9.491.1.1.4.3.1.6	Counter64	read-only	The number of connection setup attempts, corresponding to the protocol denoted by 'cufwPolConnProtocol', associated with the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget', that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwPolConnNumPolicyDeclined' and 'cufwPolConnNumResDeclined'.
CFW cufwPolConnPolicy	1.3.6.1.4.1.9.9.491.1.1.4.3.1.1	CFWPolicy	not-accessible	The identity of the firewall policy for which this conceptual row contains the connection activity summary.
CFW cufwPolConnPolicyTarget	1.3.6.1.4.1.9.9.491.1.1.4.3.1.3	CFWPolicyTarget	not-accessible	The identity of the entity to which the firewall policy 'cufwPolConnPolicy' is applied. This could be an interface object (most commonly), another object or group of objects defined in the firewall configuration.
CFW cufwPolConnPolicyTargetType	1.3.6.1.4.1.9.9.491.1.1.4.3.1.2	CFWPolicyTargetType	not-accessible	The type of the entity to which the firewall policy 'cufwPolConnPolicy' has been applied. This could be an interface type (most commonly), the type of another object or a group of objects defined in the firewall configuration. When this object is set to 'targetALL', the value of index object cufwConnPolicyTarget is ignored.
CFW cufwPolConnProtocol	1.3.6.1.4.1.9.9.491.1.1.4.3.1.4	CFWNetworkProtocol	not-accessible	The (L3-L4) protocol corresponding to which this conceptual row summarizes the connection activity on the firewall.
cufwPolicyAppConnSummaryEntry	1.3.6.1.4.1.9.9.491.1.1.4.4.1		not-accessible	Each entry contains the summary of connection activity for a specific layer 7 protocol in a specific policy applied to the specified policy target.
cufwPolicyAppConnSummaryTable	1.3.6.1.4.1.9.9.491.1.1.4.4		not-accessible	This table lists the summary of firewall connections pertaining to Layer 7 protocols, catalogued on a per policy basis Each entry in the table lists the connection summary of a distinct application protocol, configured on the specified policy on the firewall, and pertaining to a specified target to which the policy has been applied. If a policy is bound to a target, it would have one or more entries in this table. If the policy is detached from the target, all entries corresponding to the association between the policy and the target are elminated from this table. Although the information is indexed by policy targets as well, one may aggregate the connection summary for a specific policy across all the target to which the policy is currently applied by setting cufwAppConnPolicyTargetType = 'targetALL'
cufwPolicyConnSummaryEntry	1.3.6.1.4.1.9.9.491.1.1.4.3.1		not-accessible	Each entry contains the summary of connection activity for a specific protocol in a specific policy applied to the specified policy target.
cufwPolicyConnSummaryTable	1.3.6.1.4.1.9.9.491.1.1.4.3		not-accessible	This table lists the summary of firewall connections for layer3-layer 4 protocols catalogued on a per policy basis. Each entry in the table lists the connection summary of a distinct network protocol, configured on the specified policy on the firewall, and pertaining to a specified target to which the policy is currently applied. If a policy is bound to a target, it would have one or more entries in this table. If the policy is detached from the target, all entries corresponding to the association between the policy and the target are elminated from this table. Although the information is indexed by policy targets as well, one may aggregate the connection summary for a specific policy across all the target to which the policy is currently applied by setting cufwConnPolicyTargetType = 'targetAll'
C64 cufwUrlfAllowModeReqNumAllowed	1.3.6.1.4.1.9.9.491.1.3.1.11	Counter64	read-only	The number of URL access requests that were allowed by the firewall when the URL filtering server was not available. This value is accumulated from the last reboot of the firewall.
C64 cufwUrlfAllowModeReqNumDenied	1.3.6.1.4.1.9.9.491.1.3.1.12	Counter64	read-only	The number of URL access requests that were declined by the firewall when the URL filtering server was not available. This value is accumulated from the last reboot of the firewall.
T/F cufwUrlfFunctionEnabled	1.3.6.1.4.1.9.9.491.1.3.1.1	TruthValue	read-write	URL Filtering Operation _________ 2.2 Request \| \| \|---------->\| Server \| \| \| \| _________ __\|_ \|_________\| \| \|\|FW \| \|_________\| \|____\|\|URLF Server\| 2.1 URLF Req \|___________\| 1) Client sends a Request containing a URL to the Server 2.1) FW extracts the URL from the Request and sends it to URL Filtering Server (or Verifies the URL locally) 2.2) FW also forwards the original Request from the Client to the Server 3) Any Responses from the Server received before receiving a response from URLF Server are cached by the FW 4) URLF Response indicates whether the URL access should be allowed or denied 5) If the URLF Response allows the URL, FW forwards the URL Access responses from the Server to the Client 6) If the URLF Response indicates that the URL access should be denied, FW drops all the cached URL responses and forces the connection between the Client and the Server to be terminated Specifically, the object cufwUrlfFunctionEnabled indicates if the URL filtering function is enabled. When this MIB object contains the value 'false', the firewall device will not perform URL filtering function, even if it contains configuration pertaining to other aspects of URL filtering.
cufwUrlFilterGlobals	1.3.6.1.4.1.9.9.491.1.3.1
cuFwUrlFilterGrp	1.3.6.1.4.1.9.9.491.1.3
cufwUrlFilterResourceUsage	1.3.6.1.4.1.9.9.491.1.3.2
cufwUrlFilterServers	1.3.6.1.4.1.9.9.491.1.3.3
C64 cufwUrlfNumServerRetries	1.3.6.1.4.1.9.9.491.1.3.1.17	Counter64	read-only	The number of URL access authorization requests re-sent by the firewall to the URL Filtering Servers because a response was not received within the configured time interval. This value is accumulated from the last reboot of the firewall.
C64 cufwUrlfNumServerTimeouts	1.3.6.1.4.1.9.9.491.1.3.1.16	Counter64	read-only	The number of times the firewall failed to receive a response from the configured URL filtering servers for a request to authorize a URL access request. This is equal to the number of times a firewall removed a URL access request from the queue of pending requests because no response was received from the URL filtering server(s). This value is accumulated from the last reboot of the firewall.
G32 cufwUrlfRequestsDeniedRate1	1.3.6.1.4.1.9.9.491.1.3.1.7	Gauge32	read-only	The rate at which URL access requests were denied by this firewall, due to a directive from a URL filtering server, a static policy configured on the firewall, due to resource constraints or any other reason, averaged over the last 60 seconds.
G32 cufwUrlfRequestsDeniedRate5	1.3.6.1.4.1.9.9.491.1.3.1.8	Gauge32	read-only	The rate at which URL access requests were denied by this firewall, due to a directive from a URL filtering server, a static policy configured on the firewall, due to resource constraints or any other reason, averaged over the last 300 seconds.
C64 cufwUrlfRequestsNumAllowed	1.3.6.1.4.1.9.9.491.1.3.1.5	Counter64	read-only	The number of URL access requests allowed by this firewall, due to a directive from a URL filtering server or a static policy configured on the firewall. This value is accumulated from the last reboot of the firewall.
C64 cufwUrlfRequestsNumCacheAllowed	1.3.6.1.4.1.9.9.491.1.3.1.9	Counter64	read-only	The number of URL access requests allowed by the firewall because of a cached entry holding the result from a previous URL access request that was handled either by a URLF Server or exclusive domain configuration. This value is accumulated from the last reboot of the firewall.
C64 cufwUrlfRequestsNumCacheDenied	1.3.6.1.4.1.9.9.491.1.3.1.10	Counter64	read-only	The number of URL access requests denied by the firewall because of a cached entry holding the result from a previous URL access request that was handled either by a URLF Server or exclusive domain configuration. This value is accumulated from the last reboot of the firewall.
C64 cufwUrlfRequestsNumDenied	1.3.6.1.4.1.9.9.491.1.3.1.6	Counter64	read-only	The number of URL access requests declined by this firewall, due to a directive from a URL filtering server, a static policy configured on the firewall, due to resource constraints or any other reason. This value is accumulated from the last reboot of the firewall.
C64 cufwUrlfRequestsNumProcessed	1.3.6.1.4.1.9.9.491.1.3.1.2	Counter64	read-only	The number of URL access requests processed by this firewall. This value is accumulated from the last reboot of the firewall.
C64 cufwUrlfRequestsNumResDropped	1.3.6.1.4.1.9.9.491.1.3.1.13	Counter64	read-only	The number of incoming URL access requests that were dropped by the firewall because of resource constraints. This value is accumulated from the last reboot of the firewall.
G32 cufwUrlfRequestsProcRate1	1.3.6.1.4.1.9.9.491.1.3.1.3	Gauge32	read-only	The number of URL access requests processed per seconds by this firewall averaged over the last 60 seconds.
G32 cufwUrlfRequestsProcRate5	1.3.6.1.4.1.9.9.491.1.3.1.4	Gauge32	read-only	The number of URL access requests processed per second by this firewall averaged over the last 300 seconds.
G32 cufwUrlfRequestsResDropRate1	1.3.6.1.4.1.9.9.491.1.3.1.14	Gauge32	read-only	The rate at which incoming URL access requests were dropped by the firewall because of resource constraints, averaged over the last 60 seconds.
G32 cufwUrlfRequestsResDropRate5	1.3.6.1.4.1.9.9.491.1.3.1.15	Gauge32	read-only	The rate at which incoming URL access requests were dropped by the firewall because of resource constraints, averaged over the last 300 seconds.
C64 cufwUrlfResponsesNumLate	1.3.6.1.4.1.9.9.491.1.3.1.18	Counter64	read-only	The number of responses from URL filtering servers which were received after the original URL access request was removed from the queue of pending requests. This value is accumulated from the last reboot of the firewall.
G32 cufwUrlfResTotalRequestCacheSize	1.3.6.1.4.1.9.9.491.1.3.2.1	Gauge32	read-only	The amount of memory occupied by all the caches used in the firewall to cache pending URL access requests.
G32 cufwUrlfResTotalRespCacheSize	1.3.6.1.4.1.9.9.491.1.3.2.2	Gauge32	read-only	The amount of memory occupied by all the caches used in the firewall to cache responses for URL requests received from servers while awaiting a response from URL filter server.
IP cufwUrlfServerAddress	1.3.6.1.4.1.9.9.491.1.3.3.1.1.2	InetAddress	not-accessible	The value of the IP address of the URL filtering server.
IPt cufwUrlfServerAddrType	1.3.6.1.4.1.9.9.491.1.3.3.1.1.1	InetAddressType	not-accessible	The type of the IP address of the URL filtering server.
G32 cufwUrlfServerAvgRespTime1	1.3.6.1.4.1.9.9.491.1.3.3.1.1.13	Gauge32	read-only	The average round-trip response time of the URL filtering server computed over the last 60 seconds. A value of zero indicates that there was insufficient data to compute this value over the last time interval.
G32 cufwUrlfServerAvgRespTime5	1.3.6.1.4.1.9.9.491.1.3.3.1.1.14	Gauge32	read-only	The average round-trip response time of the URL filtering server computed over the last 300 seconds. A value of zero indicates that there was insufficient data to compute this value over the last time interval.
cufwUrlfServerEntry	1.3.6.1.4.1.9.9.491.1.3.3.1.1		not-accessible	Each entry contains the configuration of a specific URL filtering server.
C64 cufwUrlfServerNumRetries	1.3.6.1.4.1.9.9.491.1.3.3.1.1.10	Counter64	read-only	The number of URL access authorization requests re-sent by the firewall to the URL Filtering Server corresponding to this conceptual row, because a response was not received within the configured time interval from the server. This value is counted from the last reboot of the managed device.
C64 cufwUrlfServerNumTimeouts	1.3.6.1.4.1.9.9.491.1.3.3.1.1.9	Counter64	read-only	The number of times the firewall failed to receive a response from the URL filtering server corresponding to this conceptual row, for a request to authorize a URL access request. This is equal to the number of times a firewall removed a URL access request from the queue of pending requests because no response was received from the URL filtering server. This value is accumulated from the last reboot of the firewall.
INE cufwUrlfServerPort	1.3.6.1.4.1.9.9.491.1.3.3.1.1.3	InetPortNumber	not-accessible	The value of the port at which the URL filtering server listens for incoming requests.
C64 cufwUrlfServerReqsNumAllowed	1.3.6.1.4.1.9.9.491.1.3.3.1.1.7	Counter64	read-only	The number of URL access requests allowed by the URL filtering server corresponding to this conceptual row. This counter does not include late responses. This value is counted from the last reboot of the managed device.
C64 cufwUrlfServerReqsNumDenied	1.3.6.1.4.1.9.9.491.1.3.3.1.1.8	Counter64	read-only	The number of URL access requests denied by the URL filtering server corresponding to this conceptual row. This counter does not include late responses. This value is counted from the last reboot of the managed device.
C64 cufwUrlfServerReqsNumProcessed	1.3.6.1.4.1.9.9.491.1.3.3.1.1.6	Counter64	read-only	The number of URL access requests forwarded by the managed firewall device to the URL filtering server corresponding to this conceptual row. This value is counted from the last reboot of the managed device.
C64 cufwUrlfServerRespsNumLate	1.3.6.1.4.1.9.9.491.1.3.3.1.1.12	Counter64	read-only	The number of URL access responses received by the managed firewall from the URL filtering server corresponding to this conceptual row after the original URL access request was removed from the queue of pending requests. This value is counted from the last reboot of the managed device.
C64 cufwUrlfServerRespsNumReceived	1.3.6.1.4.1.9.9.491.1.3.3.1.1.11	Counter64	read-only	The number of URL access responses received by the firewall from the URL filtering server corresponding to this conceptual row. This counter does not include late responses. This value is counted from the last reboot of the managed device.
CFW cufwUrlfServerStatus	1.3.6.1.4.1.9.9.491.1.3.3.1.1.5	CFWUrlServerStatus	read-only	The status of the URL filtering server corresponding to this conceptual row.
cufwUrlfServerTable	1.3.6.1.4.1.9.9.491.1.3.3.1		not-accessible	This table lists the URL filtering servers configured on the managed device and their performance statistics. This table is not meant as a device to configure URL filtering servers.
CFW cufwUrlfServerVendor	1.3.6.1.4.1.9.9.491.1.3.3.1.1.4	CFWUrlfVendorId	read-only	The vendor type of the URL filtering server.
C64 cufwUrlfUrlAccRespsNumResDropped	1.3.6.1.4.1.9.9.491.1.3.1.19	Counter64	read-only	The number of transport packets constituting responses to URL access requests that were dropped by the firewall due to resource constraints waiting for a response from the filtering server. This value is accumulated from the last reboot of the firewall.

RFC description

Cisco firewall statistics and status monitoring MIB covering policies, protocols, and performance metrics.

Start monitoring Cisco ASA firewalls / IOS zone-based firewall devices with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-UNIFIED-FIREWALL-MIB

What Is CISCO-UNIFIED-FIREWALL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description