All MIBs › NETSCREEN-VPN-PHASEONE-MIB
Organization: Juniper Networks, Inc.
Last Updated: 2004-05-03
Category: IPSec/VPN
Description: Manages IKE Phase 1 proposal parameters, authentication methods, and exchange mode on NetScreen firewalls.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is NETSCREEN-VPN-PHASEONE-MIB?
NETSCREEN-VPN-PHASEONE-MIB is a Juniper Networks (formerly NetScreen) enterprise MIB that models IKE Phase 1 negotiation settings used to establish the secure channel for IPSec VPN tunnels on NetScreen/ScreenOS firewalls. Its single nsVpnPhOneTable, indexed by nsVpnPhOneIndex, exposes configuration objects including nsVpnPhOneAuthMethod (preshare, rsa-sig, dsa-sig, etc.), nsVpnPhOneDhGroup, nsVpnPhOneEncryp (null/des/des3/aes variants), nsVpnPhOneHash (md5/sha), and nsVpnPhOneLifetime/nsVpnPhOneLifetimeMeasure, plus nsVpnPhOneVsys to associate a proposal with a virtual system. As a configuration-only MIB it does not expose live tunnel-up/down state, but polling it lets an operator verify which Phase 1 proposals are defined and whether their cryptographic parameters match expectations across VPN peers. It depends on the NETSCREEN-SMI enterprise tree for its OID registration and is deployed on NetScreen/Juniper ScreenOS firewall appliances terminating site-to-site or remote-access IPSec VPNs. Administrators managing these devices often turn to a NETSCREEN-VPN-PHASEONE-MIB MIB Browser to inspect and compare Phase 1 proposal settings across multiple firewalls.
IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-VPN-PHASEONE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- NetScreen / Juniper ScreenOS firewall appliances
Monitoring Examples
An operator polls nsVpnPhOneTable entries (indexed by nsVpnPhOneIndex) to compare nsVpnPhOneEncryp, nsVpnPhOneHash, and nsVpnPhOneDhGroup against the values expected for a given VPN peer's proposal; a mismatch in nsVpnPhOneAuthMethod or an unexpectedly weak nsVpnPhOneEncryp value (e.g. null or des) would indicate a misconfigured or downgraded Phase 1 proposal likely to cause tunnel negotiation failures.
What Can Be Monitored
- IKE Phase 1 proposal table entries
- authentication method configuration
- Diffie-Hellman group and encryption/hash algorithm settings
- proposal lifetime and lifetime units
- virtual system (vsys) association
Imported Objects
From NETSCREEN-SMI
| netscreenVpn | OBJECT-IDENTITY |
| netscreenVpnMibModule | OBJECT-IDENTITY |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE |
From SNMPv2-TC
| DisplayString |
OIDs
RFC description
NetScreen VPN Phase One (IKE) negotiation MIB defining configuration attributes for IPSec security association establishment between VPN peers.
Start monitoring NetScreen/Juniper ScreenOS firewall appliance (IKE Phase 1 proposals) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.