NETSCREEN-VPN-MON-MIB

All MIBs › NETSCREEN-VPN-MON-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2004-05-03

Category: IPSec/VPN

Description: Monitors VPN tunnel liveness, rekey events, and SA lifetime counters on Juniper NetScreen ScreenOS firewalls.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETSCREEN-VPN-MON-MIB?

NETSCREEN-VPN-MON-MIB monitors VPN tunnel status on Juniper NetScreen ScreenOS firewalls, tracking tunnel liveness, rekey activity, and security-association (SA) parameters such as encryption/authentication algorithms and key type. It exposes per-tunnel status and configuration data, including inbound/outbound SPI (security parameter index) values, tunnel type, VPN and virtual-system name, and the negotiated ESP/AH algorithms, giving visibility into whether a VPN tunnel is correctly established and using the expected cryptographic parameters. This MIB is used heavily for software-status monitoring of the VPN subsystem: administrators poll it to detect tunnels that have dropped, failed to rekey, or negotiated unexpected (weaker) algorithms, which directly affects both connectivity and security posture. It complements NETSCREEN-ZONE-MIB and NETSCREEN-INTERFACE-MIB since VPN tunnels are bound to specific zones/vsys and interfaces on the firewall. It is deployed wherever NetScreen firewalls terminate site-to-site or remote-access IPsec VPNs, such as branch-to-headquarters links or partner extranet connections. Engineers can download the NETSCREEN-VPN-MON-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-VPN-MON-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper NetScreen (ScreenOS) firewall

Monitoring Examples

An operator polls nsVpnMonTable/nsVpnMonEntry by nsVpnMonIndex to check nsVpnMonInPlyId and nsVpnMonOutPlyId (inbound/outbound SPIs) for a given nsVpnMonVpnName, confirming the tunnel has valid, matching security associations on both directions. If nsVpnMonEspEncAlg or nsVpnMonEspAuthAlg reports an unexpected algorithm (e.g., a weaker cipher than configured), that would flag a policy or negotiation problem worth investigating. Missing or stale entries in nsVpnMonTable for a tunnel that should be up would indicate the VPN has dropped, prompting the admin to check nsVpnMonTunnelType and nsVpnMonVsysName to isolate which vsys/tunnel type is affected.

What Can Be Monitored

VPN tunnel up/down status
inbound/outbound SPI values
ESP encryption algorithm in use
ESP/AH authentication algorithm
VPN tunnel type and key type
tunnel-to-vsys/VPN name mapping

Imported Objects

From NETSCREEN-SMI

netscreenVpn	OBJECT-IDENTITY
netscreenVpnMibModule	OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks

From SNMPv2-TC

DisplayString

How to Use in IPNetwork Monitor

Example using nsVpnMonBytesIn OID:

Select a Juniper NetScreen firewall as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nsVpnMonBytesIn into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the incoming bytes through this sa. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
netscreenVpnMonMibModule	1.3.6.1.4.1.3224.4.0.1			This module defines the object that are used to monitor VPN tunnels
netscreenVpnMon	1.3.6.1.4.1.3224.4.1
nsVpnMonTable	1.3.6.1.4.1.3224.4.1.1		not-accessible	A list of active VPN tunnel entries.
nsVpnMonEntry	1.3.6.1.4.1.3224.4.1.1.1		not-accessible	A VPN tunnel entry containing attributes for both IKE Phase 1 and Phase 2 as well as associated policy
I32 nsVpnMonIndex	1.3.6.1.4.1.3224.4.1.1.1.1	Integer32	read-only	A unique value for each active VPN tunnel. Its value ranges between 1 and 65535 and may not be contiguous. Due to the dynamic nature of active VPN tunnels, the index has no other meaning but a pure index
I32 nsVpnMonInPlyId	1.3.6.1.4.1.3224.4.1.1.1.2	Integer32	read-only	The incoming policy ID for which this tunnel is created for. -1 means no policy associates with this SA.
I32 nsVpnMonOutPlyId	1.3.6.1.4.1.3224.4.1.1.1.3	Integer32	read-only	The outgoing policy ID for which this tunnel is created for. -1 means no policy associates with this SA.
STR nsVpnMonVpnName	1.3.6.1.4.1.3224.4.1.1.1.4	DisplayString	read-only	A textual string contains information about the VPN entity from which this tunnel was derived.
STR nsVpnMonVsysName	1.3.6.1.4.1.3224.4.1.1.1.5	DisplayString	read-only	A textual string contains the Virtual system to which this tunnel belongs.
INT nsVpnMonTunnelType	1.3.6.1.4.1.3224.4.1.1.1.6	INTEGER	read-only	Protocol type used for the tunnel
INT nsVpnMonEspEncAlg	1.3.6.1.4.1.3224.4.1.1.1.7	INTEGER	read-only	a value which identifies a particular algorithm to be used to provide secrecy protection for ESP.
INT nsVpnMonEspAuthAlg	1.3.6.1.4.1.3224.4.1.1.1.8	INTEGER	read-only	The ESP Authentication Algorithm used in the IPsec.
INT nsVpnMonAhAlg	1.3.6.1.4.1.3224.4.1.1.1.9	INTEGER	read-only	a value which identifies a particular algorithm to be used to provide integrity protection for AH.
INT nsVpnMonKeyType	1.3.6.1.4.1.3224.4.1.1.1.10	INTEGER	read-only	a value which identifies a key exchange protocol to be used for the negotiation
INT nsVpnMonP1Auth	1.3.6.1.4.1.3224.4.1.1.1.11	INTEGER	read-only	a value which identifies Phase 1 authentication method
INT nsVpnMonVpnType	1.3.6.1.4.1.3224.4.1.1.1.12	INTEGER	read-only	The type of this VPN tunnel, either a dialup or site-to-site
IP nsVpnMonRmtGwIp	1.3.6.1.4.1.3224.4.1.1.1.13	IpAddress	read-only	The peer Gateway's IP address
STR nsVpnMonRmtGwId	1.3.6.1.4.1.3224.4.1.1.1.14	DisplayString	read-only	The peer Gateway's ID
IP nsVpnMonMyGwIp	1.3.6.1.4.1.3224.4.1.1.1.15	IpAddress	read-only	The local Gateway's IP address
STR nsVpnMonMyGwId	1.3.6.1.4.1.3224.4.1.1.1.16	DisplayString	read-only	The local Gateway's ID
I32 nsVpnMonOutSpi	1.3.6.1.4.1.3224.4.1.1.1.17	Integer32	read-only	The SPI for outgoing packets
I32 nsVpnMonInSpi	1.3.6.1.4.1.3224.4.1.1.1.18	Integer32	read-only	The SPI for incoming packets
INT nsVpnMonMonState	1.3.6.1.4.1.3224.4.1.1.1.19	INTEGER	read-only	The monitoring status, if it is on, an icmp ping will be sent over the tunnel periodically to test the connectivity and latency
INT nsVpnMonTunnelState	1.3.6.1.4.1.3224.4.1.1.1.20	INTEGER	read-only	The current tunnel status determined by the icmp ping if The monitoring status is on.
INT nsVpnMonP1State	1.3.6.1.4.1.3224.4.1.1.1.21	INTEGER	read-only	The IKE's Phase 1 status
I32 nsVpnMonP1LifeTime	1.3.6.1.4.1.3224.4.1.1.1.22	Integer32	read-only	an active Phase 1 sa's time left before re-key. -1 means unlimited lifetime.
INT nsVpnMonP2State	1.3.6.1.4.1.3224.4.1.1.1.23	INTEGER	read-only	The IKE's Phase 2 status
I32 nsVpnMonP2LifeTime	1.3.6.1.4.1.3224.4.1.1.1.24	Integer32	read-only	an active Phase 2 sa's time left before re-key. -1 means unlimited life time.
I32 nsVpnMonP2LifeBytes	1.3.6.1.4.1.3224.4.1.1.1.25	Integer32	read-only	an active Phase 2 sa's bytes left before re-key. -1 means unlimited life bytes.
I32 nsVpnMonDelayAvg	1.3.6.1.4.1.3224.4.1.1.1.26	Integer32	read-only	a kind of rolling average of latency, in milliseconds. -1 has no meaning here, which means nsVpnMonDelayAvg has not been calculated yet.
I32 nsVpnMonDelayLast	1.3.6.1.4.1.3224.4.1.1.1.27	Integer32	read-only	latency in last sample, in milliseconds. -1 means either vpn tunnel is inactive or vpn tunnel monitor is not turned on.
I32 nsVpnMonAvail	1.3.6.1.4.1.3224.4.1.1.1.28	Integer32	read-only	percentage over 30 samples
I32 nsVpnMonSaId	1.3.6.1.4.1.3224.4.1.1.1.29	Integer32	read-only	SA identifier, also used as table index
I32 nsVpnMonGroupId	1.3.6.1.4.1.3224.4.1.1.1.30	Integer32	read-only	Group Identifier
I32 nsVpnMonUsrId	1.3.6.1.4.1.3224.4.1.1.1.31	Integer32	read-only	User Identifier
TIK nsVpnMonStartSessRequestTime	1.3.6.1.4.1.3224.4.1.1.1.32	TimeTicks	read-only	Start Session request timestamp
TIK nsVpnMonStartSessEstTime	1.3.6.1.4.1.3224.4.1.1.1.33	TimeTicks	read-only	Start Session establish timestamp
TIK nsVpnMonEndSessTime	1.3.6.1.4.1.3224.4.1.1.1.34	TimeTicks	read-only	End Session timestamp [when session terminates]
C32 nsVpnMonBytesInEx	1.3.6.1.4.1.3224.4.1.1.1.35	Counter32	read-only	Incoming bytes through this sa.
C32 nsVpnMonBytesOut	1.3.6.1.4.1.3224.4.1.1.1.36	Counter32	read-only	Outgoing bytes through this sa.
C32 nsVpnMonPacketsIn	1.3.6.1.4.1.3224.4.1.1.1.37	Counter32	read-only	Incoming packets through this sa.
C32 nsVpnMonPacketsOut	1.3.6.1.4.1.3224.4.1.1.1.38	Counter32	read-only	Outgoing packets through this sa.
I32 nsVpnMonIfIndex	1.3.6.1.4.1.3224.4.1.1.1.39	Integer32	read-only	interface index.
TIK nsVpnMonUpdateTime	1.3.6.1.4.1.3224.4.1.1.1.40	TimeTicks	read-only	Timestamp [Whenever any member of the row gets updated, the timestamp is updated]
STR nsVpnMonDN	1.3.6.1.4.1.3224.4.1.1.1.41	DisplayString	read-only	DN name
I32 nsVpnMonIfInfo	1.3.6.1.4.1.3224.4.1.1.1.42	Integer32	read-only	Internal id assigned to this interface. Stays persistent across resets.

RFC description

Monitors VPN tunnel status, encryption algorithms, and connection statistics for Juniper NetScreen devices.

Start monitoring Juniper NetScreen firewalls with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETSCREEN-VPN-MON-MIB