JUNIPER-JS-POLICY-MIB

All MIBs › JUNIPER-JS-POLICY-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2007-05-07

Category: Domain: Security, VPN and Security, Vendor: Juniper

Description: Provides managed objects for security policy configuration, hit counts, and rule statistics on Juniper Networks SRX and J-series appliances.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is JUNIPER-JS-POLICY-MIB?

JUNIPER-JS-POLICY-MIB is Juniper's enterprise MIB for monitoring security policy configuration, hit counts, and rule statistics on SRX and J-series appliances—security policies control what traffic is permitted between zones based on source, destination, and schedule. It exposes policy rule identification, per-policy hit/match counters, and zone-to-zone traffic permission state. It is a software/security-configuration monitoring MIB—tracking how often each security policy rule is matched lets an admin confirm rules are being enforced as expected and identify unused or overly broad rules, rather than monitoring physical hardware. It is a Juniper enterprise-specific MIB (jnx tree) built on JUNOS security-zone/policy concepts rather than a standard IETF policy MIB. It is typically deployed on Juniper SRX and J-series firewalls enforcing zone-based security policies at enterprise or branch-office network edges. Network engineers evaluating or troubleshooting this functionality can download the JUNIPER-JS-POLICY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in JUNIPER-JS-POLICY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks SRX security devices
Juniper Networks J-series routers/appliances

Monitoring Examples

No object names were included in the sample data, but based on the stated purpose an admin would typically poll a policy table for per-rule hit counters to verify that a specific zone-to-zone policy (e.g., trust-to-untrust) is actively matching traffic, and to spot a policy with zero hits that may indicate a misconfiguration or an obsolete rule that can be removed.

What Can Be Monitored

security policy hit counts
policy rule configuration state
zone-to-zone traffic permission status

Imported Objects

From JUNIPER-JS-SMI

jnxJsPolicies

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TimeStamp

How to Use in IPNetwork Monitor

Example using jnxJsPolicyStatsInputBytes OID:

Select a Juniper SRX/J-series security device (security policy hit counters) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type jnxJsPolicyStatsInputBytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of input bytes enters the FW through this policy. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
jnxJsSecPolicyMIB	1.3.6.1.4.1.2636.3.39.1.4.1			This module defines the mib for policy monitoring. A security policy, which can be configured from the user interface controls the traffic flow from one zone to another zone by defining the kind(s) of traffic permitted from specified IP sources to specified IP destinations at scheduled times. Juniper security device enforce the security policies rules for the transit traffic in terms of which traffic can pass through the firewall, and the actions taken on the traffic as it passes through the firewall.
jnxJsPolicyNotifications	1.3.6.1.4.1.2636.3.39.1.4.1.0
jnxJsPolicyObjects	1.3.6.1.4.1.2636.3.39.1.4.1.1
I32 jnxJsPolicyNumber	1.3.6.1.4.1.2636.3.39.1.4.1.1.1	Integer32	read-only	The number of policies (regardless of their current state) present on this system.
jnxJsPolicyTable	1.3.6.1.4.1.2636.3.39.1.4.1.1.2		not-accessible	The table exposes the security policy entries. Security devices/routers provide a network boundary with a single point of entry and exit point, which allows the screening and directing of traffic through the implementation of access policies. The access policies can permit, deny, encrypt, authenticate, prioirtize, schedule and monitor the traffic flow through the firewall. This table lists entries of policy. The number of policies are given by jnxJsPolicyNumber.
jnxJsPolicyEntry	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1		not-accessible	An entry contains a security policy. The security policies are configured under from-zone, to-zone direction. Under a specific zone direction, each security policy contains name, match-criteria, action, and other options.
STR jnxJsPolicyFromZone	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.1	DisplayString	not-accessible	The attribute displays the from zone name.
STR jnxJsPolicyToZone	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.2	DisplayString	not-accessible	The attribute exposes the to-zone name.
STR jnxJsPolicyName	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.3	DisplayString	not-accessible	The name of the policy defined. It consists of up to 256 ascii characters and uniquely identifies the policy entry.
I32 jnxJsPolicySequenceNumber	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.4	Integer32	read-only	The attribute indicates the policy sequence order of the policy within a specific from-zone and to-zone pair. Policies are matched in a sequence where the ordering is specified by this number.
INT jnxJsPolicyAction	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.5	INTEGER	read-only	The attribute indicates the actions performed when the criteria is matched. The action permit, deny and reject are used configured policies.
STR jnxJsPolicyScheduler	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.6	DisplayString	read-only	The name of the schedule attached to this policy. Certain schedule has a specified duration and this may effect the status of the policy.
INT jnxJsPolicyState	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.7	INTEGER	read-only	The state of this policy: active, inactive, or unavailable. The state can be effected by the scheduler if the scheduler has a specified duration.
INT jnxJsPolicyStatsAvailability	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.8	INTEGER	read-only	The statistics availability of this policy. The attribute indicates whether the statistics counters are available and are actively updated. If available, there would exists a matching jnxJsPolicyStatsEntry for the policy.
I32 jnxJsPolicyPerSecBytesThreshold	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.9	Integer32	read-only	The attribute indicates the threshold value of bytes per second.
I32 jnxJsPolicyPerMinKbytesThreshold	1.3.6.1.4.1.2636.3.39.1.4.1.1.2.1.10	Integer32	read-only	The attribute indicates the threshold value of kbyte per min.
jnxJsPolicyStatsTable	1.3.6.1.4.1.2636.3.39.1.4.1.1.3		not-accessible	The table exposes the security policy statistics entries. These statistics can be enabled and disabled by configuration on a per policy basis.
jnxJsPolicyStatsEntry	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1		not-accessible	An entry contains a security policy. The security policies are configured under from-zone, to-zone direction. Under a specific zone direction, each security policy contains name, match-criteria, action, and other options.
TIM jnxJsPolicyStatsCreationTime	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.1	TimeStamp	read-only	The creation timestamp of the policy statistics entry. The timestamp is modified during the creation and deletion of the policy statistics entry. When the timestamp changes, the policy entry statistics is assumed to be a new statistics entry and not associated with previous statistic entry of the same indices.
C64 jnxJsPolicyStatsInputBytesEx	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.2	Counter64	read-only	The number of input bytes enters the FW through this policy.
G32 jnxJsPolicyStatsInputByteRate	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.3	Gauge32	read-only	The number of input bytes per second or the rate that enters the FW through this policy.
C64 jnxJsPolicyStatsOutputBytes	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.4	Counter64	read-only	The number of output bytes associated with this policy.
G32 jnxJsPolicyStatsOutputByteRate	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.5	Gauge32	read-only	The number of output bytes per second or the rate associated with this policy.
C32 jnxJsPolicyStatsInputPackets	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.6	Counter32	read-only	The number of input packets enters the FW through this policy.
G32 jnxJsPolicyStatsInputPacketRate	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.7	Gauge32	read-only	The number of input packets per second or the input packet rate of the FW through this policy.
C32 jnxJsPolicyStatsOutputPackets	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.8	Counter32	read-only	The number of output packets associated with this policy.
G32 jnxJsPolicyStatsOutputPacketRate	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.9	Gauge32	read-only	The number of output packets per second or the rate associated with this policy.
C32 jnxJsPolicyStatsNumSessions	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.10	Counter32	read-only	The number of sessions associated with this policy.
G32 jnxJsPolicyStatsSessionRate	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.11	Gauge32	read-only	The rate of the sessions associated with this policy.
C32 jnxJsPolicyStatsSessionDeleted	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.12	Counter32	read-only	The number of sessions associated with this policy.
C32 jnxJsPolicyStatsLookups	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.13	Counter32	read-only	The number of policy lookups performed.
C32 jnxJsPolicyStatsCountAlarm	1.3.6.1.4.1.2636.3.39.1.4.1.1.3.1.14	Counter32	read-only	The number of alarm counted when the traffic exceeds certain threshold configuration.
jnxJsPolicyTrapVars	1.3.6.1.4.1.2636.3.39.1.4.1.2

RFC description

Juniper security policy MIB for firewall policy monitoring and traffic control enforcement.

Start monitoring Juniper SRX/J-series security device (security policy hit counters) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download JUNIPER-JS-POLICY-MIB