JUNIPER-IDP-MIB

All MIBs › JUNIPER-IDP-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2006-05-18

Category: Domain: Security, Vendor: Juniper

Description: Defines managed objects for Intrusion Detection and Prevention (IDP) policy statistics and attack monitoring on Juniper Networks SRX devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is JUNIPER-IDP-MIB?

JUNIPER-IDP-MIB is a Juniper Networks enterprise MIB for the Intrusion Detection and Prevention (IDP) feature on Juniper SRX security devices, reporting sensor resource usage and attack/policy statistics. It exposes hardware/software resource metrics for the IDP sensor engine, including CPU usage, memory usage, session table utilization versus maximum, and free disk space, each paired with a configurable alert threshold. Its central purpose is monitoring the operational health of the security-inspection engine itself: high CPU or memory usage, session table exhaustion, or low free disk space (which would prevent logging) can all degrade or disable IDP inspection, making these hardware/software health indicators critical for a security device. It is a Juniper-specific module but conceptually parallels host-resource style MIBs (HOST-RESOURCES-MIB) applied to a dedicated security sensor. It is deployed on Juniper SRX/IDP-enabled firewall and intrusion-prevention appliances protecting network perimeters. Engineers can download the JUNIPER-IDP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in JUNIPER-IDP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks SRX firewall/IDP security appliances

Monitoring Examples

An administrator polls jnxIdpSensorCpuUsage and jnxIdpSensorMemUsage against jnxIdpSensorCpuThreshold and jnxIdpSensorMemThreshold to catch the IDP sensor approaching resource exhaustion, which would cause it to drop packet inspection under load. jnxIdpSensorSessAllocated compared to jnxIdpSensorSessMaximum reveals session-table pressure, and jnxIdpSensorFreeDiskSpace against jnxIdpSensorDiskSpaceThreshold flags when logging/capture storage is running low. Crossing any of these thresholds is expected to fire a jnxIdpTrap notification for proactive alerting.

What Can Be Monitored

IDP sensor CPU usage
IDP sensor memory usage
session table allocation vs. maximum
free disk space
configurable resource alert thresholds

Imported Objects

From JUNIPER-SMI

jnxMibs	OBJECT-IDENTITY
jnxTraps	OBJECT-IDENTITY

From SNMPv2-SMI

Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using jnxIdpSensorCpuUsage OID:

Select a Juniper firewall as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type jnxIdpSensorCpuUsage into the Find box to locate it in the OID tree, then select it and click OK. It reports cPU utilization as a percentage. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Gauge32-type OID, Value bounds is the most useful condition here — trigger an alert if utilization exceeds 85%, a common warning threshold before sustained high load affects performance. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
jnxIdpMIB	1.3.6.1.4.1.2636.3.9			The Structure of IDP MIBS for Juniper Networks.
jnxIdpSensor	1.3.6.1.4.1.2636.3.9.1
G32 jnxIdpSensorCpuUsageEx	1.3.6.1.4.1.2636.3.9.1.1	Gauge32	read-only	CPU utilization as a percentage.
G32 jnxIdpSensorMemUsage	1.3.6.1.4.1.2636.3.9.1.2	Gauge32	read-only	Memory utilization as a percentage.
G32 jnxIdpSensorSessAllocated	1.3.6.1.4.1.2636.3.9.1.3	Gauge32	read-only	Number of sessions currently allocated for this IDP.
INT jnxIdpSensorSessMaximum	1.3.6.1.4.1.2636.3.9.1.4	INTEGER	read-only	Maximum number of sessions supported by this IDP.
G32 jnxIdpSensorFreeDiskSpace	1.3.6.1.4.1.2636.3.9.1.5	Gauge32	read-only	Free disk space available on this IDP.
INT jnxIdpSensorCpuThreshold	1.3.6.1.4.1.2636.3.9.1.6	INTEGER	read-only	CPU alert threshold as a percentage.
INT jnxIdpSensorMemThreshold	1.3.6.1.4.1.2636.3.9.1.7	INTEGER	read-only	Memory alert threshold as a percentage.
INT jnxIdpSensorSessThreshold	1.3.6.1.4.1.2636.3.9.1.8	INTEGER	read-only	Session alert threshold as a percentage.
INT jnxIdpSensorDiskSpaceThreshold	1.3.6.1.4.1.2636.3.9.1.9	INTEGER	read-only	Disk space alert threshold as a percentage.
jnxIdpTrap	1.3.6.1.4.1.2636.4.12
jnxIdpTrapsPrefix	1.3.6.1.4.1.2636.4.12.0
NTF jnxIdpSessionCountNotify	1.3.6.1.4.1.2636.4.12.0.1			Session count has exceeded threshold.
NTF jnxIdpSessionCountLimitRestored	1.3.6.1.4.1.2636.4.12.0.2			Session count has returned to normal.
NTF jnxIdpCPUUtilizationNotify	1.3.6.1.4.1.2636.4.12.0.3			CPU utilization has exceeded threshold.
NTF jnxIdpCPUUtilizationLimitRestored	1.3.6.1.4.1.2636.4.12.0.4			CPU utilization has returned to normal.
NTF jnxIdpMemoryNotify	1.3.6.1.4.1.2636.4.12.0.5			RAM memory utilization has exceeded threshold.
NTF jnxIdpMemoryLimitRestored	1.3.6.1.4.1.2636.4.12.0.6			RAM memory utilization has returned to normal.
NTF jnxIdpDiskUtilizationNotify	1.3.6.1.4.1.2636.4.12.0.7			Hard disk space utilization has exceeded threshold.
NTF jnxIdpDiskUtilizationLimitRestored	1.3.6.1.4.1.2636.4.12.0.8			Hard disk space utilization has returned to normal.

RFC description

Monitors Juniper Intrusion Detection and Prevention (IDP) sensor CPU, memory, session allocation, and disk space usage.

Start monitoring Juniper firewalls with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download JUNIPER-IDP-MIB