NETSCREEN-NAT-MIB

All MIBs › NETSCREEN-NAT-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2005-03-03

Category: Firewall

Description: Monitors Network Address Translation session counts, policy-based NAT rules, and address mapping on NetScreen firewalls.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETSCREEN-NAT-MIB?

NETSCREEN-NAT-MIB is a Juniper NetScreen firewall MIB covering Network Address Translation configuration and status, including Mapped IP (MIP), Dynamic IP (DIP) pools, and Virtual IP (VIP) mappings used for inbound/outbound address translation. It exposes tables describing NAT rule mappings, MIP index/IP/netmask/host bindings, DIP pool entries, and VIP definitions, per virtual system (vsys) on multi-tenant firewalls. Its monitoring value is chiefly configuration/software status rather than hardware: confirming NAT mappings are correctly provisioned and, per the module's later addition of a DIP pool utilization attribute, tracking how heavily a DIP address pool is being consumed, which can reveal address exhaustion before it causes failed outbound connections. It is a NetScreen vendor-private MIB used alongside the NETSCREEN-RESOURCE-MIB and general system MIBs on the same platform. It is deployed on Juniper NetScreen/SSG firewall appliances performing address translation at the network edge, and administrators typically open a NETSCREEN-NAT-MIB MIB Browser session to review the MIP, DIP, and VIP configuration objects.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-NAT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper NetScreen/SSG firewall appliance

Monitoring Examples

An admin would poll nsNatMipTable/nsNatMipEntry indexed by nsNatMipIndex to verify each nsNatMipIp/nsNatMipNetmask maps correctly to nsNatMipHost, and check nsNatMipVsys to confirm the mapping belongs to the correct virtual system in a multi-tenant deployment. The nsNatDipTable/nsNatDipEntry, indexed by nsNatDipIndex, would be monitored for DIP pool utilization to catch address pool exhaustion before new outbound sessions start failing. nsNatVip readings would be checked to confirm virtual IP port-forwarding mappings remain as configured.

What Can Be Monitored

MIP (mapped IP) address bindings
DIP pool utilization
VIP (virtual IP) mappings
NAT mapping per virtual system (vsys)

Imported Objects

From NETSCREEN-SMI

netscreenNAT

OBJECT-IDENTITY

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

OIDs

OID symbolic	OID numeric	Type	Access	Description
netscreenNATMibModule	1.3.6.1.4.1.3224.11.0			Added dip pool utilization attribute
nsNatMipTable	1.3.6.1.4.1.3224.11.1		not-accessible	Mapped IP(MIP) is a direct one-to-one maping of traffic destined for one IP address ot another IP address. On NetScreen device, MIP addresses for tunnel and untrusted interfaces can be created.
nsNatMipEntry	1.3.6.1.4.1.3224.11.1.1		not-accessible	An entry containing attributes of a mip address
I32 nsNatMipIndex	1.3.6.1.4.1.3224.11.1.1.1	Integer32	read-only	A unique value for each address. Its value ranges between 0 and 65535 and may not be contingous.
IP nsNatMipIp	1.3.6.1.4.1.3224.11.1.1.2	IpAddress	read-only	mip address. A MIP must be in the same subnet as the tunnel interface to which it is linked to; however, for the untrusted interface, a MIP does not need to be in the same subnet. In either case, a MIP must not be the same as the interface address or be in any DIP pool that might also be on that subnet.
IP nsNatMipNetmask	1.3.6.1.4.1.3224.11.1.1.3	IpAddress	read-only	Subnet mask for this MIP.
IP nsNatMipHost	1.3.6.1.4.1.3224.11.1.1.4	IpAddress	read-only	Host ip address mip mapping to.
IP nsNatMipIfIp	1.3.6.1.4.1.3224.11.1.1.5	IpAddress	read-only	Interface's ip address that a MIP is linked to.
IP nsNatMipIfNetmask	1.3.6.1.4.1.3224.11.1.1.6	IpAddress	read-only	Interface's netmask that a MIP is linked to.
I32 nsNatMipVsys	1.3.6.1.4.1.3224.11.1.1.7	Integer32	read-only	Virtual system this mip belongs to.
nsNatDipTable	1.3.6.1.4.1.3224.11.2		not-accessible	A DIP(Dynamic IP) pool is a range of IP addresses from which the NetScreen device can dynamically take addresses to use when performing NAT on the source IP address of outgoing or incoming IP packets.
nsNatDipEntry	1.3.6.1.4.1.3224.11.2.1		not-accessible	An entry containing attributes of a dynamic address
I32 nsNatDipIndex	1.3.6.1.4.1.3224.11.2.1.1	Integer32	read-only	A unique value for each address. Its value ranges between 0 and 65535 and may not be contigous.
I32 nsNatDipId	1.3.6.1.4.1.3224.11.2.1.2	Integer32	read-only	DIP pool id.
IP nsNatDipLow	1.3.6.1.4.1.3224.11.2.1.3	IpAddress	read-only	Start IP Address Range. The range of addresses in a DIP pool must be in the same subnet as the interface IP address, but the DIP pool should not contain the interface IP or any MIP or VIP address that might on that subnet.
IP nsNatDipHigh	1.3.6.1.4.1.3224.11.2.1.4	IpAddress	read-only	End IP Address Range. The range of addresses in a DIP pool must be in the same subnet as the interface IP address, but the DIP pool should not contain the interface IP or any MIP or VIP address that might on that subnet.
IP nsNatDipIfIp	1.3.6.1.4.1.3224.11.2.1.5	IpAddress	read-only	Interface's ip address that a DIP is linked to.
IP nsNatDipIfNetmask	1.3.6.1.4.1.3224.11.2.1.6	IpAddress	read-only	interface's ip address that a DIP is linked to.
INT nsNatDipPTEnable	1.3.6.1.4.1.3224.11.2.1.7	INTEGER	read-only	Enable Port Translation
I32 nsNatDipVsys	1.3.6.1.4.1.3224.11.2.1.8	Integer32	read-only	virtual system this dip belongs to
I32 nsNatDipUtil	1.3.6.1.4.1.3224.11.2.1.9	Integer32	read-only	dip pool utilzation for this entry. Only applicable to fixed dip. If this is not a fixed dip this will return 0
nsNatVip	1.3.6.1.4.1.3224.11.3
nsNatVipCfgTable	1.3.6.1.4.1.3224.11.3.1		not-accessible	VIP(Virtual IP) allows you to map routable IP addresses to internal servers, therby providing transparent connections for a NAT networks to the Internet. This table collects all VIP configurations in NetScreen device.
nsNatVipCfgEntry	1.3.6.1.4.1.3224.11.3.1.1		not-accessible	Each entry in the nsNatVipCfgTable holds a set of configuration parameters associated with an instance of VIP.
I32 nsNatVipCfgIndex	1.3.6.1.4.1.3224.11.3.1.1.1	Integer32	read-only	A unique value for each vip configuation. Its value ranges between 1 and 65535 and may not be contingous.
IP nsNatVipCfgIp	1.3.6.1.4.1.3224.11.3.1.1.2	IpAddress	read-only	The IP address for the VIP, which must be in the same subnet as the untrusted interface and can even be the same address as the untrusted interface.
I32 nsNatVipCfgPort	1.3.6.1.4.1.3224.11.3.1.1.3	Integer32	read-only	The port number for communication between the trusted server and the untrusted interfce on the NetScreen device.
STR nsNatVipCfgService	1.3.6.1.4.1.3224.11.3.1.1.4	DisplayString	read-only	Service for the server on the trusted interface.
INT nsNatVipCfgStatus	1.3.6.1.4.1.3224.11.3.1.1.5	INTEGER	read-only	The status of the server on the trusted/DMZ interface.
INT nsNatVipCfgLoadBalance	1.3.6.1.4.1.3224.11.3.1.1.6	INTEGER	read-only	Load balance algorithm for the Virtual IP servers.
nsNatVipServerTable	1.3.6.1.4.1.3224.11.3.2		not-accessible	Ballancing the loads on NetScreen servers allow traffic intended for a server(one IP address on the untrusted network) to be mapped to several different IP addresses on the DMZ or trusted network. There can be up to eight servers in one load balancing group, which apperas as a single virtual server.This table collects all the server pool configurations for the virtual ip server.
nsNatVipServerEntry	1.3.6.1.4.1.3224.11.3.2.1		not-accessible	An entry containing attributes of a vip configuration's server pool.
I32 nsNatVipServerIndex	1.3.6.1.4.1.3224.11.3.2.1.1	Integer32	read-only	A unique value for each vip server configuation. Its value ranges between 1 and 65535 and may not be contigous.
IP nsNatVipServerVIP	1.3.6.1.4.1.3224.11.3.2.1.2	IpAddress	read-only	The IP address for the VIP.
I32 nsNatVipServerService	1.3.6.1.4.1.3224.11.3.2.1.3	Integer32	read-only	Service provideing through the VIP.
INT nsNatVipServerLoadBalance	1.3.6.1.4.1.3224.11.3.2.1.4	INTEGER	read-only	Load balance algorithm for the vitural IP servers.
IP nsNatVipServerIp	1.3.6.1.4.1.3224.11.3.2.1.5	IpAddress	read-only	Virtual IP server's IP address.
I32 nsNatVipServerWeight	1.3.6.1.4.1.3224.11.3.2.1.6	Integer32	read-only	Loadbalance algorithm weight.
INT nsNatVipServerStatus	1.3.6.1.4.1.3224.11.3.2.1.7	INTEGER	read-only	Virtual IP server's status.

RFC description

Juniper NetScreen firewall MIB providing SNMP objects for monitoring and managing Network Address Translation (NAT) functionality on NetScreen security devices.

Start monitoring Juniper NetScreen/SSG firewall appliance (NAT MIP/DIP/VIP) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETSCREEN-NAT-MIB

What Is NETSCREEN-NAT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description