IPFWADM-MIB

All MIBs › IPFWADM-MIB

Category: Domain: Security, IP and Core Protocols, VPN and Security

Description: IP firewall administration MIB providing SNMP objects for firewall rule management and access control list configuration.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is IPFWADM-MIB?

IPFWADM-MIB is a vendor-neutral, Linux-associated MIB for monitoring the legacy ipfwadm firewall/accounting tool, the predecessor to ipchains and iptables. It exposes an accounting table of firewall rules describing source and destination address/netmask, protocol, matching interface, and traffic direction. Its monitoring focus is software firewall/ACL rule status and traffic matching - similar in spirit to IPFILTER - letting an admin confirm which rules are active and how traffic is mapping to them, a security/software service health indicator rather than a hardware telemetry source. It has no major dependency on other MIBs beyond standard SNMP and IP addressing conventions. It is deployed on legacy Linux-based firewalls/routers still running the ipfwadm packet filtering tool. Engineers can download the IPFWADM-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in IPFWADM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, Linux-associated MIB
Linux-based firewall/router running ipfwadm

Monitoring Examples

ipFwAccTable/ipFwAccEntry keyed by ipFwAccIndex exposes ipFwAccSrcAddr/ipFwAccSrcNetMask and ipFwAccDstAddr/ipFwAccDstNetMask to identify which address ranges a rule covers, along with ipFwAccProto and ipFwAccViaName/ipFwAccViaAddr for the matching interface, and ipFwAccDir/ipFwAccBidir for traffic direction. An admin would monitor these fields to confirm a rule is correctly scoped and watch for unexpected traffic matching a rule believed to be unused.

What Can Be Monitored

firewall rule source/destination address and netmask
protocol matched by rule
rule direction (bidirectional or not)
matching interface (via name/address)
rule index

Imported Objects

From RFC1155-SMI

Counter

From SNMPv2-SMI

IpAddress
OBJECT-TYPE

From SNMPv2-TC

DisplayString

From UCD-SNMP-MIB

ucdExperimental	OBJECT-IDENTITY
ucdavis	MODULE-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
ipFwAccTable	1.3.6.1.4.1.2021.13.1		not-accessible	A table with the accounting rules of the IP firewall
ipFwAccEntry	1.3.6.1.4.1.2021.13.1.1		not-accessible	An accounting rule of the IP firewall
INT ipFwAccIndex	1.3.6.1.4.1.2021.13.1.1.1	INTEGER	read-only	Reference index for each firewall rule.
IP ipFwAccSrcAddr	1.3.6.1.4.1.2021.13.1.1.2	IpAddress	read-only	The source address in the firewall rule.
IP ipFwAccSrcNetMask	1.3.6.1.4.1.2021.13.1.1.3	IpAddress	read-only	The netmask of the source address in the firewall rule.
IP ipFwAccDstAddr	1.3.6.1.4.1.2021.13.1.1.4	IpAddress	read-only	The destination address in the firewall rule.
IP ipFwAccDstNetMask	1.3.6.1.4.1.2021.13.1.1.5	IpAddress	read-only	The netmask of the destination address in the firewall rule.
STR ipFwAccViaName	1.3.6.1.4.1.2021.13.1.1.6	DisplayString	read-only	The name of the interface to which the rule applies. If no interface is associated with the present rule, this should contain a dash (-) .
IP ipFwAccViaAddr	1.3.6.1.4.1.2021.13.1.1.7	IpAddress	read-only	The address of the interface to which the rule applies. Using this parameter makes sense when multiple addresses are associated to the same physical interface. If not defined for the current rule this should be set to 0.
INT ipFwAccProto	1.3.6.1.4.1.2021.13.1.1.8	INTEGER	read-only	The protocol(s) to which the rule applies.
INT ipFwAccBidir	1.3.6.1.4.1.2021.13.1.1.9	INTEGER	read-only	Whether the rule works in both directions (i.e. with the source and destination parts swapped) or not.
INT ipFwAccDir	1.3.6.1.4.1.2021.13.1.1.10	INTEGER	read-only	Whether the rule applies to packets entering or exiting the kernel.
CTR ipFwAccBytes	1.3.6.1.4.1.2021.13.1.1.11	Counter	read-only	The number of bytes that matched this rule since the last reset of the counters.
CTR ipFwAccPackets	1.3.6.1.4.1.2021.13.1.1.12	Counter	read-only	The number of packets that matched this rule since the last reset of the counters.
INT ipFwAccNrSrcPorts	1.3.6.1.4.1.2021.13.1.1.13	INTEGER	read-only	The number of ports that refer to the source address.
INT ipFwAccNrDstPorts	1.3.6.1.4.1.2021.13.1.1.14	INTEGER	read-only	The number of ports that refer to the destination address.
INT ipFwAccSrcIsRange	1.3.6.1.4.1.2021.13.1.1.15	INTEGER	read-only	Interpret the first two ports of the source part as the upper and lower limit of an interval or not.
INT ipFwAccDstIsRange	1.3.6.1.4.1.2021.13.1.1.16	INTEGER	read-only	Interpret the first two ports of the destination part as the upper and lower limit of an interval or not.
INT ipFwAccPort1	1.3.6.1.4.1.2021.13.1.1.17	INTEGER	read-only	Port number 1.
INT ipFwAccPort2	1.3.6.1.4.1.2021.13.1.1.18	INTEGER	read-only	Port number 2.
INT ipFwAccPort3	1.3.6.1.4.1.2021.13.1.1.19	INTEGER	read-only	Port number 3.
INT ipFwAccPort4	1.3.6.1.4.1.2021.13.1.1.20	INTEGER	read-only	Port number 4.
INT ipFwAccPort5	1.3.6.1.4.1.2021.13.1.1.21	INTEGER	read-only	Port number 5.
INT ipFwAccPort6	1.3.6.1.4.1.2021.13.1.1.22	INTEGER	read-only	Port number 6.
INT ipFwAccPort7	1.3.6.1.4.1.2021.13.1.1.23	INTEGER	read-only	Port number 7.
INT ipFwAccPort8	1.3.6.1.4.1.2021.13.1.1.24	INTEGER	read-only	Port number 8.
INT ipFwAccPort9	1.3.6.1.4.1.2021.13.1.1.25	INTEGER	read-only	Port number 9.
INT ipFwAccPort10	1.3.6.1.4.1.2021.13.1.1.26	INTEGER	read-only	Port number 10.

RFC description

Provides read-only access to IP firewall accounting rules and traffic counters for Linux systems.

Start monitoring Linux-based firewalls/routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download IPFWADM-MIB

What Is IPFWADM-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description