PAN-COMMON-MIB

All MIBs › PAN-COMMON-MIB

Organization: Palo Alto Networks

Last Updated: 2010-01-07

Category: Security

Description: Defines common objects and base identifiers shared across Palo Alto Networks firewall MIB modules.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is PAN-COMMON-MIB?

PAN-COMMON-MIB is a Palo Alto Networks proprietary MIB defining objects common to every Palo Alto Networks product. Its objects report software and hardware version, serial number, time-zone offset and daylight-saving setting, and the current content-update versions for VPN client, application signatures, antivirus, threat prevention, and URL filtering. As a software-status/inventory MIB it lets an administrator confirm content-signature versions are current — a critical security-posture check — alongside basic device identity. It is deployed on all Palo Alto Networks firewall/security products. Engineers can download the PAN-COMMON-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in PAN-COMMON-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Palo Alto Networks firewall/security products

Monitoring Examples

A security team monitors panSysThreatVersion and panSysAvVersion across a fleet of firewalls to confirm content signatures are staying current with the vendor's latest releases.

What Can Be Monitored

software/content signature versions
device identity (serial, versions)

Imported Objects

From PAN-GLOBAL-REG

panCommonMib	OBJECT-IDENTITY
panModules	OBJECT-IDENTITY

From PAN-GLOBAL-TC

TcChassisType

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TruthValue

How to Use in IPNetwork Monitor

Example using panSessionUtilization OID:

Select a Palo Alto Networks PAN-OS firewall as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type panSessionUtilization into the Find box to locate it in the OID tree, then select it and click OK. It reports the current session-table utilization on this firewall, as a percentage. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if session-table utilization exceeds 85-90%, since running close to the session limit can cause new connections to be dropped. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
panCommonMibModule	1.3.6.1.4.1.25461.1.1.3			A MIB module containing definitions of managed objects implemented by all Palo Alto Networks' products.
panCommonConfMib	1.3.6.1.4.1.25461.2.1.1			Sub-tree for MIB conformance statements.
panCommonObjs	1.3.6.1.4.1.25461.2.1.2			Sub-tree for common MIB objects.
panSys	1.3.6.1.4.1.25461.2.1.2.1			Sub-tree for common system objects.
STR panSysSwVersion	1.3.6.1.4.1.25461.2.1.2.1.1	DisplayString	read-only	Full software version. The first two components of the full version are the major and minor versions. The third component indicates the maintenance release number and the fourth, the build number.
STR panSysHwVersion	1.3.6.1.4.1.25461.2.1.2.1.2	DisplayString	read-only	Hardware version of the unit.
STR panSysSerialNumber	1.3.6.1.4.1.25461.2.1.2.1.3	DisplayString	read-only	The serial number of the unit. If not available, an empty string is returned.
I32 panSysTimeZoneOffset	1.3.6.1.4.1.25461.2.1.2.1.4	Integer32	read-only	The offset in seconds from UTC of the system's time zone. Values are negative for locations west of UTC and positive for locations east of UTC.
T/F panSysDaylightSaving	1.3.6.1.4.1.25461.2.1.2.1.5	TruthValue	read-only	Whether daylight savings are in currently in effect for the system's time zone.
STR panSysVpnClientVersion	1.3.6.1.4.1.25461.2.1.2.1.6	DisplayString	read-only	Currently installed VPN client package version. If package is not installed, 0.0.0 is returned.
STR panSysAppVersion	1.3.6.1.4.1.25461.2.1.2.1.7	DisplayString	read-only	Currently installed application definition version. If no application definition is found, 0 is returned.
STR panSysAvVersion	1.3.6.1.4.1.25461.2.1.2.1.8	DisplayString	read-only	Currently installed antivirus version. If no antivirus is found, 0 is returned.
STR panSysThreatVersion	1.3.6.1.4.1.25461.2.1.2.1.9	DisplayString	read-only	Currently installed threat definition version. If no threat definition is found, 0 is returned.
STR panSysUrlFilteringVersion	1.3.6.1.4.1.25461.2.1.2.1.10	DisplayString	read-only	Currently installed URL filtering version. If no URL filtering is installed, 0 is returned.
STR panSysHAState	1.3.6.1.4.1.25461.2.1.2.1.11	DisplayString	read-only	Current high-availability state.
STR panSysHAPeerState	1.3.6.1.4.1.25461.2.1.2.1.12	DisplayString	read-only	Current peer high-availability state.
panChassis	1.3.6.1.4.1.25461.2.1.2.2			Sub-tree for common chassis information.
STR panChassisType	1.3.6.1.4.1.25461.2.1.2.2.1	DisplayString	read-only	Chassis type for this Palo Alto device.
panSession	1.3.6.1.4.1.25461.2.1.2.3			Sub-tree for common session information.
I32 panSessionUtilizationEx	1.3.6.1.4.1.25461.2.1.2.3.1	Integer32	read-only	Session table utilization percentage. Values should be between 0 and 100.
I32 panSessionMax	1.3.6.1.4.1.25461.2.1.2.3.2	Integer32	read-only	Total number of sessions supported.
I32 panSessionActive	1.3.6.1.4.1.25461.2.1.2.3.3	Integer32	read-only	Total number of active sessions.
I32 panSessionActiveTcp	1.3.6.1.4.1.25461.2.1.2.3.4	Integer32	read-only	Total number of active TCP sessions.
I32 panSessionActiveUdp	1.3.6.1.4.1.25461.2.1.2.3.5	Integer32	read-only	Total number of active UDP sessions.
I32 panSessionActiveICMP	1.3.6.1.4.1.25461.2.1.2.3.6	Integer32	read-only	Total number of active ICMP sessions.
panCommonEvents	1.3.6.1.4.1.25461.2.1.3			Sub-tree for common MIB events.
panCommonEventObjs	1.3.6.1.4.1.25461.2.1.3.1			Branch for objects meant only to be sent in event varbinds.
STR panCommonEventDescr	1.3.6.1.4.1.25461.2.1.3.1.1	DisplayString	accessible-for-notify	String that provides a textual description of the event.
panCommonEventEvents	1.3.6.1.4.1.25461.2.1.3.2			Branch for the events themselves.
panCommonEventEventsV2	1.3.6.1.4.1.25461.2.1.3.2.0			Branch for SNMPv2 events. The OIDs for SNMPv2 events should have a zero as the next-to-last sub-identifier (as specified in RFC1902).
NTF panCommonEventLog	1.3.6.1.4.1.25461.2.1.3.2.0.1			A config/system/firewall/threat log

RFC description

Palo Alto Networks common management MIB providing core device management information, system status, and general network appliance monitoring.

Start monitoring Palo Alto Networks firewall/security products (software/content-version identity) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PAN-COMMON-MIB