JUNIPER-FIREWALL-MIB

All MIBs › JUNIPER-FIREWALL-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2016-01-23

Category: Domain: Security, Vendor: Juniper

Description: Defines managed objects for firewall filter statistics, policer counters, and security policy monitoring on Juniper Networks routing platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is JUNIPER-FIREWALL-MIB?

JUNIPER-FIREWALL-MIB defines managed objects for firewall filter statistics, policer counters, and security policy monitoring on Juniper routing platforms. It exposes traffic-filtering counters—per-filter and per-term packet/byte match counts, and policer (rate-limiting) drop counters. It is used to monitor the software-level enforcement status of configured firewall filters and policers, such as how many packets matched a filter term or were dropped by a policer—a traffic/performance counter monitoring tool rather than physical hardware health. It is a Juniper enterprise-specific MIB used alongside JUNOS CLI-defined firewall filter objects rather than a standard IETF firewall MIB. It is typically deployed on Juniper routers and switches where firewall filters and policers are applied to interfaces for security or QoS enforcement, and administrators can download the JUNIPER-FIREWALL-MIB file to load into their MIB browser for reference.

IPNetwork Monitor allows you to monitor SNMP objects defined in JUNIPER-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks routers
Juniper Networks switches (JUNOS-based)

Monitoring Examples

No sample object names were supplied for this MIB, but based on its purpose an admin would typically poll per-filter-term counter tables for packet/byte match counts on a given firewall filter, and policer counter tables for dropped or rate-limited packets—for example, a spike in policer-drop counts indicating a traffic-rate violation or possible attack.

What Can Be Monitored

firewall filter match counters
policer packet drop counts
per-term traffic statistics

Imported Objects

From JUNIPER-SMI

jnxMibs

OBJECT-IDENTITY

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

How to Use in IPNetwork Monitor

Example using jnxFWPackets OID:

Select a Juniper Networks router/switch, JUNO (firewall filter/policer counters) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type jnxFWPackets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of packets being counted pertaining to the specified counter or policer. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
jnxFirewalls	1.3.6.1.4.1.2636.3.5			This is Juniper Networks' implementation of enterprise specific MIB for firewalls filters/policers.
jnxFirewallsTable	1.3.6.1.4.1.2636.3.5.1		not-accessible	A list of firewalls entries. NOTE: This table is deprecated and exists for backward compatibility. The user is encouraged to use jnxFirewallCounterTable. This table does not handle: 1) counter and filter names greater than 24 characters 2) counters with same names but different types (the first duplicate is returned only)
jnxFirewallsEntry	1.3.6.1.4.1.2636.3.5.1.1		not-accessible	An entry of firewalls table.
STR jnxFWFilter	1.3.6.1.4.1.2636.3.5.1.1.1	DisplayString	read-only	The name of the firewall filter.
STR jnxFWCounter	1.3.6.1.4.1.2636.3.5.1.1.2	DisplayString	read-only	The name of the counter, policer or Hier policer. This name is specific within the firewall filter. Whether this object is associated with a counter, policer or a Hier policer is indicated by jnxFWType. See DESCRIPTION of jnxFirewallsTable for details on this assumption.
INT jnxFWType	1.3.6.1.4.1.2636.3.5.1.1.3	INTEGER	read-only	The type of the object jnxFWCounter. What it is associated with a counter, policer or Hier policer.
C64 jnxFWPacketsEx	1.3.6.1.4.1.2636.3.5.1.1.4	Counter64	read-only	The number of packets being counted pertaining to the specified counter or policer.
C64 jnxFWBytes	1.3.6.1.4.1.2636.3.5.1.1.5	Counter64	read-only	The number of bytes being counted pertaining to the specified counter. For policers, this field is always zero because policers do not count number of bytes.
jnxFirewallCounterTable	1.3.6.1.4.1.2636.3.5.2		not-accessible	A list of firewall filter counters.
jnxFirewallCounterEntry	1.3.6.1.4.1.2636.3.5.2.1		not-accessible	An entry of firewalls table.
STR jnxFWCounterFilterName	1.3.6.1.4.1.2636.3.5.2.1.1	DisplayString	not-accessible	The name of the firewall filter.
STR jnxFWCounterName	1.3.6.1.4.1.2636.3.5.2.1.2	DisplayString	not-accessible	The name of the counter, policer or Hier policer. This name is specific within the firewall filter. Whether this object is associated with a counter, policer or a Hier policer is indicated by jnxFWCounterType.
INT jnxFWCounterType	1.3.6.1.4.1.2636.3.5.2.1.3	INTEGER	not-accessible	The type of the object jnxFWCounterName identifies. What it is associated with - a counter, policer or Hier policer. It is possible to have two counters of the same name and different type.
C64 jnxFWCounterPacketCount	1.3.6.1.4.1.2636.3.5.2.1.4	Counter64	read-only	The number of packets being counted pertaining to the specified counter or policer.
C64 jnxFWCounterByteCount	1.3.6.1.4.1.2636.3.5.2.1.5	Counter64	read-only	The number of bytes being counted pertaining to the specified counter. For policers, this field is always zero because policers do not count number of bytes.
STR jnxFWCounterDisplayFilterName	1.3.6.1.4.1.2636.3.5.2.1.6	DisplayString	read-only	The name of the firewall filter.
STR jnxFWCounterDisplayName	1.3.6.1.4.1.2636.3.5.2.1.7	DisplayString	read-only	The name of the counter, policer or Hier policer. Whether this object is associated with a counter, policer or Hier policer is indicated by jnxFWCounterType.
INT jnxFWCounterDisplayType	1.3.6.1.4.1.2636.3.5.2.1.8	INTEGER	read-only	The type of the object jnxFWCounterName identifies. What it is associated with - a counter, policer or Hier policer. It is possible to have two counters of the same name and different type.
jnxFWCntrXTable	1.3.6.1.4.1.2636.3.5.3		not-accessible	An extended list of firewall filter counters. This table maintains the additional statistics for the additional policer counters and is only supported on MX platform for now.
jnxFWCntrXEntry	1.3.6.1.4.1.2636.3.5.3.1		not-accessible	An entry of extended firewall table.
C64 jnxFWCntrPolicerOfferedPktCount	1.3.6.1.4.1.2636.3.5.3.1.1	Counter64	read-only
C64 jnxFWCntrPolicerOfferedByteCount	1.3.6.1.4.1.2636.3.5.3.1.2	Counter64	read-only
C64 jnxFWCntrPolicerOutSpecPktCount	1.3.6.1.4.1.2636.3.5.3.1.3	Counter64	read-only
C64 jnxFWCntrPolicerOutSpecByteCount	1.3.6.1.4.1.2636.3.5.3.1.4	Counter64	read-only
C64 jnxFWCntrPolicerTxPktCount	1.3.6.1.4.1.2636.3.5.3.1.5	Counter64	read-only
C64 jnxFWCntrPolicerTxByteCount	1.3.6.1.4.1.2636.3.5.3.1.6	Counter64	read-only

RFC description

Monitors firewall filters, policers, and packet/byte counters on Juniper Networks security devices.

Start monitoring Juniper Networks router/switch, JUNOS (firewall filter/policer counters) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download JUNIPER-FIREWALL-MIB