All MIBs › NETSCREEN-VPN-IKE-MIB
Organization: Juniper Networks, Inc.
Last Updated: 2004-05-03
Category: IPSec/VPN
Description: Monitors IKE Phase 1 and Phase 2 SA negotiation, proposal sets, and key exchange on NetScreen VPN gateways.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is NETSCREEN-VPN-IKE-MIB?
NETSCREEN-VPN-IKE-MIB is a Juniper NetScreen (ScreenOS) vendor MIB for monitoring IKE (Internet Key Exchange) VPN negotiation state, covering both Phase 1 and Phase 2 security association setup. It exposes a table of configured IKE gateways/tunnels with negotiation mode, proposal sets for Phase 2, gateway-to-tunnel bindings, and replay-protection processing settings. Its monitoring value is software/protocol status: administrators track whether IKE negotiations are completing successfully and which cryptographic proposals are in use, since a mismatch in proposals or replay settings would prevent a VPN tunnel from establishing. It depends on the broader NetScreen VPN tunnel and IPsec policy MIBs, since IKE negotiation state here underpins the actual data-plane tunnels managed elsewhere. It is deployed on Juniper NetScreen firewall/VPN gateway appliances terminating site-to-site or remote-access IPsec VPNs, where NETSCREEN-VPN-IKE-MIB SNMP monitoring tracks whether IKE negotiations are completing successfully.
IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-VPN-IKE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Juniper NetScreen firewall/VPN gateway
Monitoring Examples
An administrator would walk nsVpnIkeTable/nsVpnIkeEntry, checking nsVpnIkeGWTun to map an IKE gateway to its associated tunnel and reviewing nsVpnIkePh2ProOne through nsVpnIkePh2ProFour for the accepted Phase 2 proposal sets. If nsVpnIkeMonitorEnable is set but the tunnel repeatedly fails to renegotiate, comparing nsVpnIkeTransMode against the peer's expected transport/tunnel mode would reveal a configuration mismatch. The nsVpnIkeReplayProc setting indicates whether anti-replay checking is active for that IKE association.
What Can Be Monitored
- IKE gateway-to-tunnel mapping
- Phase 2 proposal sets
- IKE transport mode
- replay protection processing
- IKE monitoring enable state
Imported Objects
From NETSCREEN-SMI
| netscreenVpn | OBJECT-IDENTITY |
| netscreenVpnMibModule | OBJECT-IDENTITY |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE |
From SNMPv2-TC
| DisplayString |
OIDs
RFC description
Monitors VPN IKE (Internet Key Exchange) configuration and status on NetScreen devices, including IPSec security associations.
Start monitoring Juniper NetScreen firewall/VPN gateway (IKE Phase 1/2 negotiation) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.