All MIBs › NETSCREEN-CERTIFICATE-MIB
Organization: Juniper Networks, Inc.
Last Updated: 2004-05-03
Category: IPSec/VPN
Description: Manages digital certificate inventory, validity periods, and enrollment status on Juniper NetScreen firewall devices.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is NETSCREEN-CERTIFICATE-MIB?
NETSCREEN-CERTIFICATE-MIB is a Juniper NetScreen (ScreenOS) vendor MIB for monitoring VPN digital certificate configuration used in IPsec VPN authentication. It exposes tables for certificate definitions (LDAP/CRL lookup settings, X.509 data) and certificate configuration entries scoped per virtual system (vsys), covering certificate enrollment and revocation-checking parameters. Its monitoring value is software/configuration status: administrators track certificate validity references, CRL refresh intervals, and per-vsys certificate type assignments to ensure VPN peers can authenticate correctly and certificates don't silently expire or fail revocation checks. It depends on the broader NetScreen VPN and virtual-system (vsys) MIB framework for context on which VPN tunnels and vsys instances a certificate applies to. It is deployed on Juniper NetScreen firewall/VPN gateway appliances in enterprise perimeter security environments using PKI-based VPN authentication. Engineers can download the NETSCREEN-CERTIFICATE-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-CERTIFICATE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Juniper NetScreen firewall/VPN gateway
Monitoring Examples
An administrator would walk nsVpnCertDefTable/nsVpnCertDefEntry to review nsVpnCertDefLdap and nsVpnCertDefCrlUrl settings, confirming the CRL distribution point is reachable so certificate revocation checks succeed. Checking nsVpnCertDefRefresh reveals how often the CRL is refreshed, and a stale value combined with VPN authentication failures would point to an expired or unrefreshed revocation list. The nsVpnCertCfgTable's nsVpnCertCfgType per nsVpnCertDefVsys shows which certificate type each virtual system is configured to use.
What Can Be Monitored
- certificate LDAP/CRL configuration
- CRL refresh interval
- certificate type per virtual system
- X.509 certificate reference data
Imported Objects
From NETSCREEN-SMI
| netscreenVpn | OBJECT-IDENTITY |
| netscreenVpnMibModule | OBJECT-IDENTITY |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE |
From SNMPv2-TC
| DisplayString |
OIDs
RFC description
VPN certificate configuration and monitoring for Juniper NetScreen security appliances, managing SSL certificate lifecycle.
Start monitoring Juniper NetScreen firewall/VPN gateway (VPN certificates) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.