PULSESECURE-PSG-MIB

All MIBs › PULSESECURE-PSG-MIB

Organization: Pulse Secure

Last Updated: 2016-07-07

Category: Security, VPN

Description: Manages Pulse Secure SSL VPN gateway configuration, active user session counts, tunnel statistics, and system health.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is PULSESECURE-PSG-MIB?

PULSESECURE-PSG-MIB is Pulse Secure's proprietary MIB for managing their SSL VPN gateway appliances (descended from the earlier Juniper/IVE-based Secure Access product line), covering configuration, session, and system-health data. It exposes user session counts by service type (web, mail, meeting), authentication server configuration, product identification/version, and core system resource utilization. It strongly emphasizes monitoring both hardware/system and software status — iveCpuUtil and iveMemoryUtil report CPU and memory load on the gateway, logFullPercent tracks log storage fill level, and productName/productVersion/fileName report the running software version and applied configuration/firmware file, all critical for capacity and health monitoring of the VPN appliance. As a vendor-private MIB derived from the earlier Juniper IVE MIB lineage, it has no significant dependency on external IETF standards beyond core SNMP conventions. It is deployed on Pulse Secure (Ivanti) SSL VPN gateway appliances at enterprise network edges providing remote access. Engineers can download the PULSESECURE-PSG-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in PULSESECURE-PSG-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Pulse Secure (Ivanti) SSL VPN gateway appliances

Monitoring Examples

An administrator can poll iveCpuUtil and iveMemoryUtil to check whether the VPN gateway is under resource strain, and cross-reference iveConcurrentUsers or signedInWebUsers/signedInMailUsers to see if a high user load is the cause. If logFullPercent approaches 100, it signals the appliance's log partition is nearly full and needs rotation, while blockedIP can be checked to confirm whether a suspicious source is currently being blocked by the gateway's security policy.

What Can Be Monitored

CPU utilization
memory utilization
concurrent/signed-in user counts by service
log storage fill percentage
blocked IP addresses
running software product name/version

Imported Objects

From RFC1155-SMI

IpAddress
NetworkAddress

From SNMPv2-SMI

Counter64
Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
enterprises

How to Use in IPNetwork Monitor

Example using iveTotalHits OID:

Select a Pulse Secure (Ivanti) SSL VPN gateway appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type iveTotalHits into the Find box to locate it in the OID tree, then select it and click OK. The Total number of hits to the IVE since last reboot. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
pulsesecure_gateway	1.3.6.1.4.1.12532			This file defines the private Pulse Secure MIB extensions.
G32 logFullPercent	1.3.6.1.4.1.12532.1	Gauge32	read-only	Percentage of log file full
G32 signedInWebUsers	1.3.6.1.4.1.12532.2	Gauge32	read-only	Number of Signed-In Web Users
G32 signedInMailUsers	1.3.6.1.4.1.12532.3	Gauge32	read-only	Number of Signed-In Mail Users
IP blockedIP	1.3.6.1.4.1.12532.4	IpAddress	accessible-for-notify	IP Address that is blocked due to consecutive failed login attempts
OCT authServerName	1.3.6.1.4.1.12532.5	OCTET STRING	accessible-for-notify	Name of an external authentication server
OCT productName	1.3.6.1.4.1.12532.6	OCTET STRING	read-only	IVE Licensed Product Name
OCT productVersion	1.3.6.1.4.1.12532.7	OCTET STRING	read-only	IVE System Software Version
OCT fileName	1.3.6.1.4.1.12532.8	OCTET STRING	accessible-for-notify	File name
G32 meetingUserCount	1.3.6.1.4.1.12532.9	Gauge32	accessible-for-notify	the number of concurrent meeting users
G32 iveCpuUtil	1.3.6.1.4.1.12532.10	Gauge32	read-only	The CPU Utilization of the IVE system
G32 iveMemoryUtil	1.3.6.1.4.1.12532.11	Gauge32	read-only	The Memory Utilization of the IVE system
G32 iveConcurrentUsers	1.3.6.1.4.1.12532.12	Gauge32	read-only	The Total number of Concurrent user Licenses used for the IVE Node
G32 clusterConcurrentUsers	1.3.6.1.4.1.12532.13	Gauge32	read-only	The Total number of Concurrent user Licenses used for the Cluster
C64 iveTotalHitsEx	1.3.6.1.4.1.12532.14	Counter64	read-only	The Total number of hits to the IVE since last reboot
C64 iveFileHits	1.3.6.1.4.1.12532.15	Counter64	read-only	The Total number of File hits to the IVE since last reboot
C64 iveWebHits	1.3.6.1.4.1.12532.16	Counter64	read-only	The Total number of hits via the Web Interface since the last reboot
C64 iveAppletHits	1.3.6.1.4.1.12532.17	Counter64	read-only	The Total number of applet hits to the IVE since last reboot
C64 ivetermHits	1.3.6.1.4.1.12532.18	Counter64	read-only	The Total number of terminal hits to the IVE since last reboot
C64 iveSAMHits	1.3.6.1.4.1.12532.19	Counter64	read-only	The Total number of SAM(Secure Application manager)hits of since last reboot
C64 iveNCHits	1.3.6.1.4.1.12532.20	Counter64	read-only	The Total number of NC(Network Connect) hits of since last reboot
C64 meetingHits	1.3.6.1.4.1.12532.21	Counter64	read-only	The Total number of Meeting hits of since last reboot
G32 meetingCount	1.3.6.1.4.1.12532.22	Gauge32	accessible-for-notify	the number of concurrent meetings
OCT logName	1.3.6.1.4.1.12532.23	OCTET STRING	accessible-for-notify	Name of the log (admin/user/event)
G32 iveSwapUtil	1.3.6.1.4.1.12532.24	Gauge32	read-only	The Swap Utilization of the IVE system
G32 diskFullPercent	1.3.6.1.4.1.12532.25	Gauge32	read-only	Percentage of disk space full
blockedIPList	1.3.6.1.4.1.12532.26		read-only	Table of 10 most recently blocked IPs
ipEntry	1.3.6.1.4.1.12532.26.1		not-accessible	An entry containing a blocked IP
I32 ipIndex	1.3.6.1.4.1.12532.26.1.1	Integer32	read-only	Index for IP Table
IP ipValue	1.3.6.1.4.1.12532.26.1.2	IpAddress	read-only	Blocked IP Entry
OCT logID	1.3.6.1.4.1.12532.27	OCTET STRING	accessible-for-notify	The unique ID of the log message.
OCT logType	1.3.6.1.4.1.12532.28	OCTET STRING	accessible-for-notify	String stating whether log message is major or critical.
OCT logDescription	1.3.6.1.4.1.12532.29	OCTET STRING	accessible-for-notify	The actual log message string.
OCT ivsName	1.3.6.1.4.1.12532.30	OCTET STRING	accessible-for-notify	Virtual System name
OCT ocspResponderURL	1.3.6.1.4.1.12532.31	OCTET STRING	accessible-for-notify	Name of an OCSP Responder
OCT fanDescription	1.3.6.1.4.1.12532.32	OCTET STRING	accessible-for-notify	The status of the fans
OCT psDescription	1.3.6.1.4.1.12532.33	OCTET STRING	accessible-for-notify	The status of the power supplies
OCT raidDescription	1.3.6.1.4.1.12532.34	OCTET STRING	accessible-for-notify	The status of the RAID
OCT clusterName	1.3.6.1.4.1.12532.35	OCTET STRING	accessible-for-notify	Cluster Name
OCT nodeList	1.3.6.1.4.1.12532.36	OCTET STRING	accessible-for-notify	List of disabled nodes
OCT vipType	1.3.6.1.4.1.12532.37	OCTET STRING	accessible-for-notify	Whether the VIP is external or internal
OCT currentVIP	1.3.6.1.4.1.12532.38	OCTET STRING	accessible-for-notify	Current value of VIP being changed
OCT newVIP	1.3.6.1.4.1.12532.39	OCTET STRING	accessible-for-notify	New value for the VIp being changed
OCT nicEvent	1.3.6.1.4.1.12532.40	OCTET STRING	accessible-for-notify	Type of event that generated a the Trap: admin, external
OCT nodeName	1.3.6.1.4.1.12532.41	OCTET STRING	accessible-for-notify	Node Name
G32 iveTemperature	1.3.6.1.4.1.12532.42	Gauge32	read-only	The Temperature of MAG application blade. Other platform such as SA and IC will return 0
G32 iveVPNTunnels	1.3.6.1.4.1.12532.43	Gauge32	read-only	The number of concurrent Pulse IPSec and NC users
G32 iveSSLConnections	1.3.6.1.4.1.12532.44	Gauge32	read-only	Total number of SSL connection
OCT esapVersion	1.3.6.1.4.1.12532.45	OCTET STRING	read-only	Active ESAP Version
OCT vipChangeReason	1.3.6.1.4.1.12532.46	OCTET STRING	accessible-for-notify	Reason for the VIP node change
OCT processName	1.3.6.1.4.1.12532.47	OCTET STRING	accessible-for-notify	Process Name
G32 iveTotalSignedInUsers	1.3.6.1.4.1.12532.48	Gauge32	read-only	The Total number of Users Logged In for the Cluster
G32 vpnACLSPercentage	1.3.6.1.4.1.12532.49	Gauge32	accessible-for-notify	The percentage of system ACL entries reached
G32 vpnACLSCount	1.3.6.1.4.1.12532.50	Gauge32	accessible-for-notify	The number of system ACL entries reached
OCT blockedIPv6	1.3.6.1.4.1.12532.51	OCTET STRING	accessible-for-notify	IPv6 Address that is blocked due to consecutive failed login attempts
iveTraps	1.3.6.1.4.1.12532.251
NTF iveLogNearlyFull	1.3.6.1.4.1.12532.251.4			Log file nearly full
NTF iveLogFull	1.3.6.1.4.1.12532.251.5			Log file full
NTF iveMaxConcurrentUsersSignedIn	1.3.6.1.4.1.12532.251.6			Maximum number of concurrent users signed in
NTF iveTooManyFailedLoginAttempts	1.3.6.1.4.1.12532.251.7			Too many failed login attempts from IPv4 address
NTF externalAuthServerUnreachable	1.3.6.1.4.1.12532.251.8			External authentication server is not responding
NTF iveStart	1.3.6.1.4.1.12532.251.9			IVE startup under administrator's instruction.
NTF iveShutdown	1.3.6.1.4.1.12532.251.10			IVE shutdown under administrator's instruction.
NTF iveReboot	1.3.6.1.4.1.12532.251.11			IVE reboot under administrator's instruction.
NTF archiveServerUnreachable	1.3.6.1.4.1.12532.251.12			Archive server is not responding
NTF archiveServerLoginFailed	1.3.6.1.4.1.12532.251.13			Could not login into archive server. Verify FTP username and password.
NTF archiveFileTransferFailed	1.3.6.1.4.1.12532.251.14			Could not store file on archive server
NTF meetingUserLimit	1.3.6.1.4.1.12532.251.15			Concurrent user count over license limit
NTF iveRestart	1.3.6.1.4.1.12532.251.16			IVE has restarted under administrator's instruction.
NTF meetingLimit	1.3.6.1.4.1.12532.251.17			Concurrent meeting count over license limit
NTF iveDiskNearlyFull	1.3.6.1.4.1.12532.251.18			Disk space nearly full
NTF iveDiskFull	1.3.6.1.4.1.12532.251.19			Disk space full
NTF logMessageTrap	1.3.6.1.4.1.12532.251.20			The TRAP generated from a log message.
NTF memUtilNotify	1.3.6.1.4.1.12532.251.21			IVE memory utilization above threshold
NTF cpuUtilNotify	1.3.6.1.4.1.12532.251.22			IVE CPU utilization above threshold
NTF swapUtilNotify	1.3.6.1.4.1.12532.251.23			IVE swap utilization above threshold
NTF iveMaxConcurrentUsersVirtualSystem	1.3.6.1.4.1.12532.251.24			Maximum number of concurrent Virtual System users signed in
NTF ocspResponderConnectionFailed	1.3.6.1.4.1.12532.251.25			OCSP Responder cannot be connected
NTF iveFanNotify	1.3.6.1.4.1.12532.251.26			The status of the fans has changed
NTF ivePowerSupplyNotify	1.3.6.1.4.1.12532.251.27			The status of the power supplies has changed
NTF iveRaidNotify	1.3.6.1.4.1.12532.251.28			The status of the RAID has changed
NTF iveClusterDisableNodeTrap	1.3.6.1.4.1.12532.251.29			A Given node(s) in a cluster has(have) been disabled
NTF iveClusterChangedVIPTrap	1.3.6.1.4.1.12532.251.30			A external/internal VIP has changed from its current value to a new one
NTF iveNetExternalInterfaceDownTrap	1.3.6.1.4.1.12532.251.31			The External interface has gone down, reason is in nicEvent
NTF iveClusterDeleteTrap	1.3.6.1.4.1.12532.251.32			Cluster delete inititaed by nodeName
NTF iveNetInternalInterfaceDownTrap	1.3.6.1.4.1.12532.251.33			The Internal interface has gone down, reason is in nicEvent
NTF iveNetManagementInterfaceDownTrap	1.3.6.1.4.1.12532.251.34			The Management interface has gone down, reason is in nicEvent
NTF iveTemperatureNotify	1.3.6.1.4.1.12532.251.35			IVE Temperature is above threshold
NTF iveVIPNodeChanged	1.3.6.1.4.1.12532.251.36			Notifies that VIP node has changed. nodeName is the new node which is hosting the VIP. vipChangeReason specifies the reason for the change.
NTF iveProcessesNearMaxLimit	1.3.6.1.4.1.12532.251.37			The count of processes (by processName) is about reach to maximum limit
NTF iveProcessesReachedMaxLimit	1.3.6.1.4.1.12532.251.38			The count of processes (by processName) has reached to maximum limit
NTF iveACLsNearMaxLimit	1.3.6.1.4.1.12532.251.39			The percentage of ACL entries has reached maximum supported limit
NTF iveACLsCrossedMaxLimit	1.3.6.1.4.1.12532.251.40			The count of ACL entries has crossed maximum supported limit
NTF iveTooManyFailedLoginAttemptsIPv6	1.3.6.1.4.1.12532.251.41			Too many failed login attempts from IPv6 address
iveSAProduct	1.3.6.1.4.1.12532.252
iveICProduct	1.3.6.1.4.1.12532.253
iveMAGProduct	1.3.6.1.4.1.12532.254
iveProductMAG2600	1.3.6.1.4.1.12532.254.1
iveMAG2600	1.3.6.1.4.1.12532.254.1.1
iveProductMAG4610	1.3.6.1.4.1.12532.254.2
iveMAG4610	1.3.6.1.4.1.12532.254.2.1
iveProductSM160	1.3.6.1.4.1.12532.254.3
iveMAGSM160	1.3.6.1.4.1.12532.254.3.1
iveProductSM360	1.3.6.1.4.1.12532.254.4
iveMAGSM360	1.3.6.1.4.1.12532.254.4.1
iveVAProduct	1.3.6.1.4.1.12532.255
iveProductVASPE	1.3.6.1.4.1.12532.255.1
iveVASPE	1.3.6.1.4.1.12532.255.1.1
iveProductVADTE	1.3.6.1.4.1.12532.255.2
iveVADTE	1.3.6.1.4.1.12532.255.2.1
ivePSAProduct	1.3.6.1.4.1.12532.256
iveProductPSA300	1.3.6.1.4.1.12532.256.1
ivePSA300	1.3.6.1.4.1.12532.256.1.1
iveProductPSA3000	1.3.6.1.4.1.12532.256.2
ivePSA3000	1.3.6.1.4.1.12532.256.2.1
iveProductPSA5000	1.3.6.1.4.1.12532.256.3
ivePSA5000	1.3.6.1.4.1.12532.256.3.1
iveProductPSA7000f	1.3.6.1.4.1.12532.256.4
ivePSA7000f	1.3.6.1.4.1.12532.256.4.1
iveProductPSA7000c	1.3.6.1.4.1.12532.256.5
ivePSA7000c	1.3.6.1.4.1.12532.256.5.1
iveProductPSA10000	1.3.6.1.4.1.12532.256.6
ivePSA10000	1.3.6.1.4.1.12532.256.6.1

RFC description

Vendor-private MIB for Pulse Secure gateway appliances (enterprises 12532); monitors system metrics including log fullness and user sessions.

Start monitoring Pulse Secure (Ivanti) SSL VPN gateway appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PULSESECURE-PSG-MIB