All MIBs › NETSCREEN-ZONE-MIB
Organization: Juniper Networks, Inc.
Last Updated: 2004-05-03
Category: Firewall, VLAN Management
Description: Manages security zone definitions, interface bindings, and intra-zone policy on Juniper NetScreen ScreenOS.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is NETSCREEN-ZONE-MIB?
NETSCREEN-ZONE-MIB manages security zone definitions on Juniper NetScreen ScreenOS firewalls, the core building block of ScreenOS's zone-based security model that groups interfaces for policy enforcement. It exposes configuration data for each zone, its ID, name, type (e.g., Layer 3, Layer 2, tunnel), and virtual-system (vsys) association, rather than traffic counters or hardware sensors. Its monitoring value lies in confirming the software configuration integrity of the security architecture: an administrator checks this MIB to ensure zones are correctly defined and bound to the intended vsys, since a missing or misconfigured zone can silently break policy enforcement or interface-to-zone mapping. It is tightly coupled to NETSCREEN-INTERFACE-MIB, since interfaces reference the zones defined here, and to the ScreenOS vsys (virtual system) concept used across the NetScreen MIB family. It is deployed on Juniper NetScreen firewalls in enterprise and multi-tenant (vsys-based) security deployments. Network engineers evaluating or troubleshooting this functionality can download the NETSCREEN-ZONE-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-ZONE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Juniper NetScreen (ScreenOS) firewall
Monitoring Examples
An administrator walks nsZoneCfgTable/nsZoneCfgEntry by nsZoneCfgId to confirm a zone's nsZoneCfgName and nsZoneCfgType match the intended design (e.g., a DMZ zone of type Layer 3). If nsZoneCfgVsys shows a zone bound to the wrong virtual system, interfaces or policies expected to apply to that zone in a specific vsys would not take effect, a common cause of policy-not-matching support cases. Comparing the zone list here against nsIfZone values in NETSCREEN-INTERFACE-MIB lets the operator confirm every configured interface points to a zone that actually exists.
What Can Be Monitored
- configured security zone names
- zone ID and type
- zone-to-vsys binding
- zone configuration consistency with interfaces
Imported Objects
From NETSCREEN-SMI
| netscreenZone | OBJECT-IDENTITY |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE |
From SNMPv2-TC
| DisplayString |
OIDs
RFC description
Security zone monitoring and configuration for Juniper NetScreen firewalls.
Start monitoring Juniper NetScreen firewalls with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.