NETSCREEN-POLICY-MIB

All MIBs › NETSCREEN-POLICY-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2004-05-03

Category: Firewall

Description: Handles security policy rules on Juniper NetScreen firewalls, including match criteria, assigned actions, and hit counters.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETSCREEN-POLICY-MIB?

NETSCREEN-POLICY-MIB is a NetScreen (later Juniper Networks) proprietary MIB reporting firewall security-policy configuration. Its policy table, keyed by ID, records virtual system, source/destination zone and address, service, action, NAT/fixed-port/DIP-ID settings, VPN/L2TP tunnel binding, authentication requirement, log/count enable, alarm thresholds (bytes-per-second/minute), schedule, traffic-shaping enable/priority, DiffServ enable, and active status. As a configuration/status MIB it lets an administrator audit a specific firewall policy's action, logging, and traffic-shaping settings. It is deployed on NetScreen (Juniper) security appliances. Engineers can download the NETSCREEN-POLICY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-POLICY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

NetScreen (Juniper Networks) security appliances

Monitoring Examples

An administrator checks nsPlyAction and nsPlyLogEnable for a specific policy to confirm traffic between two zones is being logged as expected on a NetScreen (Juniper) security appliance.

What Can Be Monitored

firewall policy configuration and logging

Imported Objects

From NETSCREEN-SMI

netscreenPolicy

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

How to Use in IPNetwork Monitor

Example using nsPlyMonTotalPacket OID:

Select a NetScreen (Juniper Networks) security appliance (firewall policy configuration) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nsPlyMonTotalPacket into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports total packets go through this policy. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
netscreenPolicyMibModule	1.3.6.1.4.1.3224.10.0			This module defines NetScreen private MIBs for Policy Monitoring
nsPlyTable	1.3.6.1.4.1.3224.10.1		not-accessible	A firewall provides a network boundary with a single point of entry and exit-a choke point.You can screen and direct all that traffic through the implementation of a set of access policies. Access policies allow you to permit, deny, encrypt, authenticate, prioritize, schedule, and monitor the traffic attemption to cross your firewall. This table collects all the policy configuration information existing in NetScreen Device.
nsPlyEntry	1.3.6.1.4.1.3224.10.1.1		not-accessible	Each entry in the nsPlyTable holds a set of configuration parameters associatied with an instance of policy.
I32 nsPlyId	1.3.6.1.4.1.3224.10.1.1.1	Integer32	read-only	Each policy is identified by a unique policy ID.
I32 nsPlyVsys	1.3.6.1.4.1.3224.10.1.1.2	Integer32	read-only	Vitural system's name this polic entry belongs to.
STR nsPlySrcZone	1.3.6.1.4.1.3224.10.1.1.3	DisplayString	read-only	Traffic through a firewall means that traffic flows from one security zone to another. This object describes the source zone name traffic flow passes.
STR nsPlyDstZone	1.3.6.1.4.1.3224.10.1.1.4	DisplayString	read-only	Traffic through a firewall means that traffic flows from one security zone to another. This object describes the destination zone name traffic flow passes.
STR nsPlySrcAddr	1.3.6.1.4.1.3224.10.1.1.5	DisplayString	read-only	Addresses are objects that identify network devices such as hosts and networks by their location in relation to the firwall on which security zone.To create an access policy for specific addresses, you must first create entries for the relevant hosts and networks in the address book.Source IP address indicates the address in source zone, 0.0.0.0 means any address.
STR nsPlyDstAddr	1.3.6.1.4.1.3224.10.1.1.6	DisplayString	read-only	Addresses are objects that identify network devices such as hosts and networks by their location in relation to the firwall-on which security zone.To create an access policy for specific addresses, you must first create entries for the relevant hosts and networks in the address book.Source IP address indicates the address in destination zone, 0.0.0.0 means any address.
INT nsPlyService	1.3.6.1.4.1.3224.10.1.1.7	INTEGER	read-only	Sevices are objects that identify application protocols using layer 4 information such as standard and accepted TCP and UDP port numbers for application services like Telnet, FTP, SMTP and HTTP. This object indicates all the traffic service type this policy allows. 'Any' means all this policy allows all service go through. 'Other' could be a configured service or not in the list. See nsPlyServiceName for service name.
INT nsPlyAction	1.3.6.1.4.1.3224.10.1.1.8	INTEGER	read-only	Actions objects that describe what the firewall does to the traffic it receives. Permit allows the packet to pass the firewall. Deny blocks the packet from traversing the firewall. Tunnel encapsulates outgoing IP packets and decapsulates incoming IP packets.
INT nsPlyNat	1.3.6.1.4.1.3224.10.1.1.9	INTEGER	read-only	You can apply NAT at the interface level or at the policy level. With policy-based NAT, you can translate the source address on either incoming or outging network and VPN traffic. This object indicates if this is a policy-based NAT.
INT nsPlyFixPort	1.3.6.1.4.1.3224.10.1.1.10	INTEGER	read-only	When in policy-based NAT, the new secure address can come from either a Dynamic IP or from a Mapped IP. This object indicates if poliy-based NAT uses fix port when working on NAT mode.
I32 nsPlyDipId	1.3.6.1.4.1.3224.10.1.1.11	Integer32	read-only	This object indicates the Dynamic ID chosen for NAT policy.
STR nsPlyVpnTunnel	1.3.6.1.4.1.3224.10.1.1.12	DisplayString	read-only	VPN tunnel this access policy applies to.
STR nsPlyL2tpTunnel	1.3.6.1.4.1.3224.10.1.1.13	DisplayString	read-only	L2TP tunnel this access policy applies to.
INT nsPlyAuth	1.3.6.1.4.1.3224.10.1.1.14	INTEGER	read-only	This object indicates the selecting this option requires the user at the source address to authenticate his/her identiry by supplying a user name and password before traffic is allowed to graverw the firewall or enter the VPN tunnel.
INT nsPlyLogEnable	1.3.6.1.4.1.3224.10.1.1.15	INTEGER	read-only	When you enable logging in an access policy, the NetScreen device logs all connections to which that paticular access policy applies.
INT nsPlyCountEnable	1.3.6.1.4.1.3224.10.1.1.16	INTEGER	read-only	When you enable counting in an access plicy, the NetScreen device counts the total number of bytes of traffic to which this access policy applies and records the informaiton in historical graphs.
I32 nsPlyAlarmBPS	1.3.6.1.4.1.3224.10.1.1.17	Integer32	read-only	User can set a threshold that triggers an alarm when the traffic permitted by the access policy exceeds a specified number of bytes per second.
I32 nsPlyAlarmBPM	1.3.6.1.4.1.3224.10.1.1.18	Integer32	read-only	User can set a threshold that triggers an alarm when the traffic permitted by the access policy exceeds a specified number of bytes per Minute.
STR nsPlySchedule	1.3.6.1.4.1.3224.10.1.1.19	DisplayString	read-only	By associating a schedule to an access policy, you can determine when the access policy is in effect.
INT nsPlyTrafficShapeEnable	1.3.6.1.4.1.3224.10.1.1.20	INTEGER	read-only	User can set parameters for the control and shaping of traffic for each access policy.
INT nsPlyTrafficPriority	1.3.6.1.4.1.3224.10.1.1.21	INTEGER	read-only	Traffic priority for this policy.
INT nsPlyDSEnable	1.3.6.1.4.1.3224.10.1.1.22	INTEGER	read-only	Differentiated Services is a system for tagging traffic at a position within a hierarchy of priority.
INT nsPlyActiveStatus	1.3.6.1.4.1.3224.10.1.1.23	INTEGER	read-only	Show the status of one policy entry.
STR nsPlyName	1.3.6.1.4.1.3224.10.1.1.24	DisplayString	read-only	policy name (optional)
STR nsPlyServiceName	1.3.6.1.4.1.3224.10.1.1.25	DisplayString	read-only	Sevices name that identify application protocols using layer 4 information such as standard and accepted TCP and UDP port numbers for application services like Telnet, FTP, SMTP and HTTP. This object indicates all the traffic service type this policy allows. 'Any' means all this policy allows all service go through.
nsPlyMonTable	1.3.6.1.4.1.3224.10.2		not-accessible	traffic information for the policy-based traffic.
nsPlyMonEntry	1.3.6.1.4.1.3224.10.2.1		not-accessible	An entry holds a set of traffic counters of a specific policy.
I32 nsPlyMonId	1.3.6.1.4.1.3224.10.2.1.1	Integer32	read-only	Policy Id, also used as index in this table
I32 nsPlyMonVsys	1.3.6.1.4.1.3224.10.2.1.2	Integer32	read-only	vsys this policy belongs to
I32 nsPlyMonPackPerSec	1.3.6.1.4.1.3224.10.2.1.3	Integer32	read-only	Packets go through this policy per second
I32 nsPlyMonPackPerMin	1.3.6.1.4.1.3224.10.2.1.4	Integer32	read-only	Packets go through this policy per minute
C32 nsPlyMonTotalPacketEx	1.3.6.1.4.1.3224.10.2.1.5	Counter32	read-only	total packets go through this policy
I32 nsPlyMonBytePerSec	1.3.6.1.4.1.3224.10.2.1.6	Integer32	read-only	Bytes go through this policy per second
I32 nsPlyMonBytePerMin	1.3.6.1.4.1.3224.10.2.1.7	Integer32	read-only	Bytes go through this policy per minute
C32 nsPlyMonTotalByte	1.3.6.1.4.1.3224.10.2.1.8	Counter32	read-only	Total bytes go through this policy
I32 nsPlyMonSessionPerSec	1.3.6.1.4.1.3224.10.2.1.9	Integer32	read-only	Sessions go through this policy per second
I32 nsPlyMonSessionPerMin	1.3.6.1.4.1.3224.10.2.1.10	Integer32	read-only	Sessions go through this policy per minute
C32 nsPlyMonTotalSession	1.3.6.1.4.1.3224.10.2.1.11	Counter32	read-only	Total Sessions go through this policy

RFC description

Manages security policy rules, match criteria, action assignments, and hit counts on Juniper NetScreen firewalls.

Start monitoring NetScreen (Juniper Networks) security appliance (firewall policy configuration) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETSCREEN-POLICY-MIB