NETSCREEN-INTERFACE-MIB

All MIBs › NETSCREEN-INTERFACE-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2004-05-03

Category: Firewall

Description: Manages physical and logical interface configuration, IP addressing, and traffic statistics on NetScreen firewalls.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETSCREEN-INTERFACE-MIB?

NETSCREEN-INTERFACE-MIB manages and monitors physical and logical interface configuration on Juniper NetScreen ScreenOS firewalls, covering IP addressing, virtual system (vsys) assignment, security zone binding, and interface operating mode. It exposes primarily configuration data, per-interface IP address, netmask, gateway, management IP, and zone/vsys association, alongside an interface status object reflecting administrative/operational state. While not a deep hardware-sensor MIB, it supports monitoring of interface software status: engineers poll the status object to confirm an interface is up and correctly bound to its intended zone and vsys, catching misconfigurations or unexpected interface state changes that would affect firewall policy enforcement. It parallels but does not replace the standard IF-MIB, adding NetScreen-specific concepts (vsys, zone) on top of basic interface identity. It is deployed on Juniper NetScreen firewalls in enterprise and service-provider environments using ScreenOS's virtual-system and zone-based security model. Network engineers evaluating or troubleshooting this functionality can download the NETSCREEN-INTERFACE-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-INTERFACE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper NetScreen (ScreenOS) firewall

Monitoring Examples

An administrator polls nsIfTable/nsIfEntry by nsIfIndex to check nsIfStatus for a given nsIfName, confirming the interface is up and that nsIfZone and nsIfVsys match the intended security zone and virtual system assignment. If nsIfIp or nsIfNetmask on a management interface (nsIfMngIp) doesn't match the expected address, that mismatch would explain a loss of remote management access. Checking nsIfMode reveals whether an interface is set to NAT, route, or transparent mode, which is critical context when diagnosing why traffic through that interface is being translated unexpectedly.

What Can Be Monitored

interface IP address and netmask
interface zone assignment
interface vsys assignment
interface administrative/operational status
interface operating mode (NAT/route/transparent)
management IP address

Imported Objects

From NETSCREEN-SMI

netscreenInterface

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
PhysAddress

How to Use in IPNetwork Monitor

Example using nsIfFlowInByte OID:

Select a Juniper NetScreen firewall as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nsIfFlowInByte into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the incoming byte number arriving at the this interface. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
netscreenInterfaceMibModule	1.3.6.1.4.1.3224.9.0			This module defines the object that are used to monitor NS's interface configuration
nsIfTable	1.3.6.1.4.1.3224.9.1		not-accessible	All NetScreen devices have a trusted interface and an untrusted interface. The NetScreen-10 and -100 also have a DMZ interface. Additionally, on each of the virtual systems supported by the NetScreen-1000 there can be on or more tursted subinterfaces linking a particular virtual system to one or more virtual LANs. Other interfaces-some physical, some logical, and some virtual-provide exclusive channels for administrative traffic, or for communication among member in a redundant group. In this table, it will collect following interface: tursted interface, untrusted interface, DMZ interface, Management Interface and Subinterface.
nsIfEntry	1.3.6.1.4.1.3224.9.1.1		not-accessible	nsIfEntry collects some attributes about NetScreen interface settings.
I32 nsIfIndex	1.3.6.1.4.1.3224.9.1.1.1	Integer32	read-only	Interface number which uniquely identifies an interface.
STR nsIfName	1.3.6.1.4.1.3224.9.1.1.2	DisplayString	read-only	Each interface has a readable name such as 'trust', 'trust/1', etc.
I32 nsIfVsys	1.3.6.1.4.1.3224.9.1.1.3	Integer32	read-only	According NetScreen's concepts, each interface belongs to one virtual system. This attribute displays the virtual system name an interface belongs to. If the device is device which doesn't support vsys such as NS-100, we can logically think all the setting belongs to 'root' vsys.
I32 nsIfZone	1.3.6.1.4.1.3224.9.1.1.4	Integer32	read-only	Each interface belongs to one security zone. This attribute displays the security zone name an interface belongs to.
INT nsIfStatus	1.3.6.1.4.1.3224.9.1.1.5	INTEGER	read-only	The interface status which indicates interface's operational status.
IP nsIfIp	1.3.6.1.4.1.3224.9.1.1.6	IpAddress	read-only	Each interface must be assigned an IP address.
IP nsIfNetmask	1.3.6.1.4.1.3224.9.1.1.7	IpAddress	read-only	Each interface must belong to a subnet represented by netmask.
IP nsIfGateway	1.3.6.1.4.1.3224.9.1.1.8	IpAddress	read-only	Default gateway ip address.
IP nsIfMngIp	1.3.6.1.4.1.3224.9.1.1.9	IpAddress	read-only	Trusted, untrusted and DMZ interfaces can have two IP address: an interface IP address that corresponds to the physical port through which that interface connects to a network, and a Manage IP address that can be used to receive administrative traffic
INT nsIfMode	1.3.6.1.4.1.3224.9.1.1.10	INTEGER	read-only	NetScreen interface can has three operation modes. They are transparent, nat and route.
PHY nsIfMAC	1.3.6.1.4.1.3224.9.1.1.11	PhysAddress	read-only	MAC address the interface has.
INT nsIfMngTelnet	1.3.6.1.4.1.3224.9.1.1.12	INTEGER	read-only	This attribute is used to indicate whether the interface permits telnet management.
INT nsIfMngSCS	1.3.6.1.4.1.3224.9.1.1.13	INTEGER	read-only	This attribute is used to indicate whether the interface permits Secure Command Shell management.
INT nsIfMngWEB	1.3.6.1.4.1.3224.9.1.1.14	INTEGER	read-only	This attribute is used to indicate whether the interface permits WEB UI management.
INT nsIfMngSSL	1.3.6.1.4.1.3224.9.1.1.15	INTEGER	read-only	This attribute is used to indicate whether the interface permits SSL management.
INT nsIfMngSNMP	1.3.6.1.4.1.3224.9.1.1.16	INTEGER	read-only	This attribute is used to indicate whether the interface permits SNMP management.
INT nsIfMngGlobal	1.3.6.1.4.1.3224.9.1.1.17	INTEGER	read-only	This attribute is used to indicate whether the interface permits NS Global management.
INT nsIfMngGlobalPro	1.3.6.1.4.1.3224.9.1.1.18	INTEGER	read-only	This attribute is used to indicate whether the interface permits NS Global Pro management.
INT nsIfMngPing	1.3.6.1.4.1.3224.9.1.1.19	INTEGER	read-only	This attribute is used to indicate whether the interface permits Ping go-through.
INT nsIfMngIdentReset	1.3.6.1.4.1.3224.9.1.1.20	INTEGER	read-only	This attribute is used to indicate whether the interface permits ident reset.
I32 nsIfInfo	1.3.6.1.4.1.3224.9.1.1.21	Integer32	read-only	Internal id assigned to this interface. Stays persistent across resets.
STR nsIfDescr	1.3.6.1.4.1.3224.9.1.1.22	DisplayString	read-only	Each interface has a a configurable descriptor string.
nsIfSecondaryIpTable	1.3.6.1.4.1.3224.9.2		not-accessible	In some ScreenOS, it supports multiple IP addresses and related subnets based on the same interface. This table collects the multiple IP addresses configuration on an interface.
nsIfSecondaryIpEntry	1.3.6.1.4.1.3224.9.2.1		not-accessible	nsIfSecondaryIpEntry collects some attributes about multiple IP configurations on an interface.
I32 nsIfSecondaryIpIndex	1.3.6.1.4.1.3224.9.2.1.1	Integer32	read-only	The table index used as primary key when retrieving the table.
I32 nsIfSecondaryIpIfIdx	1.3.6.1.4.1.3224.9.2.1.2	Integer32	read-only	The index value which uniquely identifies an interface the secodary ip belongs to. The interface identified by a particular value of this index is the same interface as identified by the same value of ifIndex.
I32 nsIfSecondaryIpVsys	1.3.6.1.4.1.3224.9.2.1.3	Integer32	read-only	According NetScreen's concepts, each interface belongs to one virtual system. This attribute displays the virtual system ID an interface belongs to. If the device is device which doesn't support vsys such as NS-100, we can logically think all the setting belongs to 'root' vsys.
I32 nsIfSecondaryIpZone	1.3.6.1.4.1.3224.9.2.1.4	Integer32	read-only	each interface belongs to one security zone. this attribute displays the security zone name an interface belongs to.
IP nsIfSecondaryIpAddress	1.3.6.1.4.1.3224.9.2.1.5	IpAddress	read-only	Ip Address value.
IP nsIfSecondaryIpNetmask	1.3.6.1.4.1.3224.9.2.1.6	IpAddress	read-only	Subnet of a ip belongs to.
I32 nsIfSecondaryIpIfInfo	1.3.6.1.4.1.3224.9.2.1.7	Integer32	read-only	Internal id assigned to this interface. Stays persistent across resets.
nsIfFlowTable	1.3.6.1.4.1.3224.9.3		not-accessible	nsIfFlowTable is used to get flow statistical information of the interface.
nsIfFlowEntry	1.3.6.1.4.1.3224.9.3.1		not-accessible	Table entry collect some attributes about interface flow counters.
I32 nsIfFlowIfIdx	1.3.6.1.4.1.3224.9.3.1.1	Integer32	read-only	Unique interface id, also used as table index.
I32 nsIfFlowVsys	1.3.6.1.4.1.3224.9.3.1.2	Integer32	read-only	According NetScreen's concepts. each interface belongs to one virtual system. This attribute displays the virtual system name an interface belongs to.
C32 nsIfFlowInByteEx	1.3.6.1.4.1.3224.9.3.1.3	Counter32	read-only	Incoming byte number arriving at the this interface
C32 nsIfFlowInPacket	1.3.6.1.4.1.3224.9.3.1.4	Counter32	read-only	Incoming packet number arriving at the this interface
C32 nsIfFlowOutByte	1.3.6.1.4.1.3224.9.3.1.5	Counter32	read-only	Outgoing byte number sending through this interface
C32 nsIfFlowOutPacket	1.3.6.1.4.1.3224.9.3.1.6	Counter32	read-only	Outgoing packet number sending through this interface
C32 nsIfFlowInVpn	1.3.6.1.4.1.3224.9.3.1.7	Counter32	read-only	VPN packet go through this interface
C32 nsIfInVlan	1.3.6.1.4.1.3224.9.3.1.8	Counter32	read-only	Incoming vlan packet
C32 nsIfOutVlan	1.3.6.1.4.1.3224.9.3.1.9	Counter32	read-only	Outgoing vlan packet
I32 nsIfFlowIfInfo	1.3.6.1.4.1.3224.9.3.1.10	Integer32	read-only	Internal id assigned to this interface. Stays persistent across resets.
nsIfMonTable	1.3.6.1.4.1.3224.9.4		not-accessible	This table collects some of dropped packet counters of interface
nsIfMonEntry	1.3.6.1.4.1.3224.9.4.1		not-accessible	An entry containing tunnel information
I32 nsIfMonIfIdx	1.3.6.1.4.1.3224.9.4.1.1	Integer32	read-only	Unique interface id, also used as table index.
I32 nsIfMonVsys	1.3.6.1.4.1.3224.9.4.1.2	Integer32	read-only	According NetScreen's concepts, each interface belongs to one virtual system. This attribute displays the virtual system name an interface belongs to.
C32 nsIfMonPlyDeny	1.3.6.1.4.1.3224.9.4.1.3	Counter32	read-only	Packet drop since denied by policy.
C32 nsIfMonAuthFail	1.3.6.1.4.1.3224.9.4.1.4	Counter32	read-only	Packet drop due to authentication failed.
C32 nsIfMonUrlBlock	1.3.6.1.4.1.3224.9.4.1.5	Counter32	read-only	Packet drop due to URL blocking.
C32 nsIfMonTrMngQueue	1.3.6.1.4.1.3224.9.4.1.6	Counter32	read-only	packet queue up due to traffic management
C32 nsIfMonTrMngDrop	1.3.6.1.4.1.3224.9.4.1.7	Counter32	read-only	Packet drop due to traffic management
C32 nsIfMonEncFail	1.3.6.1.4.1.3224.9.4.1.8	Counter32	read-only	IPSec enc failed due to sa not available, no ipak, etc
C32 nsIfMonNoSa	1.3.6.1.4.1.3224.9.4.1.9	Counter32	read-only	packet drop due to no sa found for incomig spi
C32 nsIfMonNoSaPly	1.3.6.1.4.1.3224.9.4.1.10	Counter32	read-only	packet drop due to no policy associated with found sa
C32 nsIfMonSaInactive	1.3.6.1.4.1.3224.9.4.1.11	Counter32	read-only	packet drop due to sa not active
C32 nsIfMonSaPolicyDeny	1.3.6.1.4.1.3224.9.4.1.12	Counter32	read-only	packet drop due to denial by sa policy
I32 nsIfMonIfInfo	1.3.6.1.4.1.3224.9.4.1.13	Integer32	read-only	Internal id assigned to this interface. Stays persistent across resets.

RFC description

Monitors interface configuration, traffic flow, and management access on Juniper NetScreen security appliances.

Start monitoring Juniper NetScreen firewalls with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETSCREEN-INTERFACE-MIB