JUNIPER-JS-AUTH-MIB

All MIBs › JUNIPER-JS-AUTH-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2007-05-14

Category: Domain: Security, RADIUS and AAA, VPN and Security, Vendor: Juniper

Description: Provides managed objects for authentication firewall and access control on Juniper Networks SRX and J-series security devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is JUNIPER-JS-AUTH-MIB?

JUNIPER-JS-AUTH-MIB is a Juniper Networks proprietary MIB (JUNOSe/security services) reporting firewall access-authentication activity, tracking users authenticating to pass through security zones. Its objects cover counts of pending, successful, and failed authentication attempts and a running total, alongside per-user detail: username, requested service description, failure reason, client IP address, a failure flag, and service-availability status. As a security-status MIB it lets an administrator watch authentication failure rates and drill into which specific users/services are failing. It is deployed on Juniper security platforms enforcing firewall access authentication. Engineers can download the JUNIPER-JS-AUTH-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in JUNIPER-JS-AUTH-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks security platforms (firewall access authentication)

Monitoring Examples

A security team monitors jnxJsFwAuthNumFailedUsers against jnxJsFwAuthTotalUsers to catch a spike in authentication failures that could indicate a credential-stuffing attempt against the firewall's auth service.

What Can Be Monitored

authentication attempt counts (pending/success/failure)
per-user failure reason

Imported Objects

From JUNIPER-JS-SMI

jnxJsAuth

OBJECT-IDENTITY

From SNMPv2-SMI

Counter64
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
jnxJsAuthMIB	1.3.6.1.4.1.2636.3.39.1.2.1			Firewall and security features restrict the accessing of protected resources (ideally on different zones) behind a firewall based on their source ip and other credentials. This module defines the objects pertain to access authentication.
jnxJsAuthNotifications	1.3.6.1.4.1.2636.3.39.1.2.1.0
NTF jnxJsFwAuthFailure	1.3.6.1.4.1.2636.3.39.1.2.1.0.1			A firewall user authentication status trap signifies whether a user using the pass-through firewall authentication mechanism has been rejected due to reason specified in the trap. jnxJsFwAuthUserName is the user. jnxClientIPAddress is the ip address the user came from. jnxJsFwAuthServiceDesc specifies the application by which the authentication was performed. jnxJsFwAuthReason indicates the reason for failure.
NTF jnxJsFwAuthServiceUp	1.3.6.1.4.1.2636.3.39.1.2.1.0.2			Firewall user authentication service has started.
NTF jnxJsFwAuthServiceDown	1.3.6.1.4.1.2636.3.39.1.2.1.0.3			Firewall user authentication service has stopped.
NTF jnxJsFwAuthCapacityExceeded	1.3.6.1.4.1.2636.3.39.1.2.1.0.4			Firewall user authentication maximum capacity has been exceeded. jnxJsFwAuthTotalUsers indicates the total number of users being authenticated. And it has exceeds the maximum allowable users.
jnxJsAuthObjects	1.3.6.1.4.1.2636.3.39.1.2.1.1
jnxJsFwAuthStats	1.3.6.1.4.1.2636.3.39.1.2.1.1.1
C64 jnxJsFwAuthNumPendingUsers	1.3.6.1.4.1.2636.3.39.1.2.1.1.1.1	Counter64	read-only	Number of users currently waiting to be authenticated by the firewall user authentication mechanism.
C64 jnxJsFwAuthNumSuccUsers	1.3.6.1.4.1.2636.3.39.1.2.1.1.1.2	Counter64	read-only	Number of users currently allowed access by the firewall user authentication mechanism.
C64 jnxJsFwAuthNumFailedUsers	1.3.6.1.4.1.2636.3.39.1.2.1.1.1.3	Counter64	read-only	Number of users currently failed to be authenticated by the firewall user authentication mechanism.
C64 jnxJsFwAuthTotalUsers	1.3.6.1.4.1.2636.3.39.1.2.1.1.1.4	Counter64	read-only	Total number of users that are accessing or attempting to access resources managed by the firewall user authentication mechanism.
jnxJsAuthTrapVars	1.3.6.1.4.1.2636.3.39.1.2.1.1.2
STR jnxJsFwAuthUserName	1.3.6.1.4.1.2636.3.39.1.2.1.1.2.1	DisplayString	accessible-for-notify	The name of the user who is attempting or has been authenticated.
STR jnxJsFwAuthServiceDesc	1.3.6.1.4.1.2636.3.39.1.2.1.1.2.2	DisplayString	accessible-for-notify	The service or application name that the enthentication is performed for: telnet, ftp, http.
STR jnxJsFwAuthReason	1.3.6.1.4.1.2636.3.39.1.2.1.1.2.3	DisplayString	accessible-for-notify	The reason for the trap being generated: authentication failure due to: timeout, invalid password, invalid username, etc.
IP jnxJsFwAuthClientIpAddr	1.3.6.1.4.1.2636.3.39.1.2.1.1.2.4	IpAddress	accessible-for-notify	The authentication client's IP Address.

RFC description

Manages firewall user authentication statistics and access control on Juniper security appliances including authentication limits and thresholds.

Start monitoring Juniper Networks security platform (firewall access authentication) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download JUNIPER-JS-AUTH-MIB

What Is JUNIPER-JS-AUTH-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description