All MIBs › NETSCREEN-VPN-MANUAL-MIB
Organization: Juniper Networks, Inc.
Last Updated: 2004-05-03
Category: IPSec/VPN
Description: Configures manually keyed IPsec VPN tunnels with static SPI and key material on Juniper NetScreen firewalls.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is NETSCREEN-VPN-MANUAL-MIB?
NETSCREEN-VPN-MANUAL-MIB is a Juniper NetScreen (ScreenOS) private enterprise MIB for configuring manually-keyed IPsec VPN tunnels, where encryption/authentication keys are statically configured rather than negotiated via IKE. It exposes a table of manual-key tunnel entries describing the tunnel name, remote gateway, local/remote security index values, tunnel type, and the ESP encryption/authentication algorithms or AH hash in use. As a configuration-state MIB, it is useful for monitoring VPN software health by confirming per-tunnel monitoring is enabled (nsVpnManualKeyMonitorEnable) and that configured algorithms (nsVpnManualKeyEspEncAlg/nsVpnManualKeyEspAuthAlg/nsVpnManualKeyAhHash) match the expected security policy on both tunnel endpoints. It depends conceptually on IPsec/ESP/AH standards (RFC 2401 family) which define the cryptographic algorithms it references. It is typically used in legacy or point-to-point site-to-site VPN deployments where static, manually-keyed tunnels are preferred over dynamic IKE-negotiated ones. Engineers can download the NETSCREEN-VPN-MANUAL-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-VPN-MANUAL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Juniper NetScreen firewall
- NetScreen ScreenOS security appliance
Monitoring Examples
An admin walks nsVpnManualKeyTable/nsVpnManualKeyEntry to list each tunnel by nsVpnManualKeyTunName and confirm the nsVpnManualKeyGW remote gateway address and nsVpnManualKeyEspEncAlg encryption algorithm match the peer's configuration. Checking nsVpnManualKeyMonitorEnable per entry confirms whether the device is actively tracking that tunnel's up/down state. A mismatch in nsVpnManualKeySILocal/nsVpnManualKeySIRemote SPI values against the peer device is a common cause of a manual-key tunnel failing to pass traffic.
What Can Be Monitored
- manual-key VPN tunnel inventory
- remote gateway address per tunnel
- ESP/AH encryption and authentication algorithm
- tunnel monitoring enable status
- security parameter index (SPI) values
Imported Objects
From NETSCREEN-SMI
| netscreenVpn | OBJECT-IDENTITY |
| netscreenVpnMibModule | OBJECT-IDENTITY |
From SNMPv2-SMI
| Integer32 | |
| IpAddress | |
| MODULE-IDENTITY | |
| OBJECT-TYPE |
From SNMPv2-TC
| DisplayString |
OIDs
RFC description
Configures VPN manual key settings including encryption algorithms, authentication, and tunnel parameters.
Start monitoring Juniper NetScreen firewall (ScreenOS manually-keyed IPsec VPN) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.