All MIBs › NETSCREEN-VPN-PHASETWO-MIB
Organization: Juniper Networks, Inc.
Last Updated: 2004-05-03
Category: IPSec/VPN
Description: Manages IPsec Phase 2 proposal parameters, PFS groups, and encapsulation mode on Juniper NetScreen firewalls.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is NETSCREEN-VPN-PHASETWO-MIB?
NETSCREEN-VPN-PHASETWO-MIB is a private MIB from Juniper Networks' NetScreen firewall/VPN appliance line, focused on IPsec IKE Phase 2 (quick mode) negotiation parameters. It exposes configuration data covering per-proposal PFS group, encapsulation mode, ESP encryption/authentication transforms, AH authentication, and security-association lifetime measured in seconds or kilobytes. Rather than hardware counters, this module is used to monitor the software/configuration status of VPN tunnels -- confirming that the negotiated cryptographic parameters and lifetimes match policy and that a given Phase 2 proposal is correctly defined. It works alongside NetScreen's companion Phase 1 (IKE) VPN MIB and general IPsec concepts, though it is a proprietary NetScreen schema rather than a direct IETF IPsec MIB implementation. It is typically deployed by security administrators managing site-to-site or remote-access IPsec VPNs on NetScreen (and later Juniper ScreenOS) firewalls. Engineers can download the NETSCREEN-VPN-PHASETWO-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-VPN-PHASETWO-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Juniper NetScreen firewall/VPN gateway
Monitoring Examples
An administrator would poll the nsVpnPhTwoTable/nsVpnPhTwoEntry indexed by nsVpnPhTwoIndex to read nsVpnPhTwoName, nsVpnPhTwoPFS, nsVpnPhTwoEncapMethod, nsVpnPhTwoESPEncryp, nsVpnPhTwoESPAuth, and nsVpnPhTwoLifetime/nsVpnPhTwoLifetimeMeasure for each configured Phase 2 proposal. A mismatch between the expected PFS group or ESP cipher and the configured value would indicate a misconfigured or downgraded VPN tunnel that could fail to establish or use weaker encryption than policy requires. Lifetime values like nsVpnPhTwoLifetimeKb can also be checked to ensure SAs rekey within the intended interval.
What Can Be Monitored
- VPN Phase 2 proposal name
- PFS group setting
- encapsulation method
- ESP encryption/authentication algorithm
- AH authentication algorithm
- SA lifetime (seconds/KB)
Imported Objects
From NETSCREEN-SMI
| netscreenVpn | OBJECT-IDENTITY |
| netscreenVpnMibModule | OBJECT-IDENTITY |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE |
From SNMPv2-TC
| DisplayString |
OIDs
RFC description
NetScreen/Juniper VPN Phase Two MIB for monitoring and configuring IPsec Phase Two (Quick Mode) settings on NetScreen firewalls and VPN devices.
Start monitoring Juniper NetScreen firewall/VPN gateway (IKE Phase 2/quick mode) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.