RAPID-IPSEC-ENDPOINT-PAIR-MIB

All MIBs › RAPID-IPSEC-ENDPOINT-PAIR-MIB

Organization: WatchGuard Technologies, Inc.

Last Updated: 2000--0-3-

Category: Firewall / Security Appliance, IPsec / VPN, WatchGuard

Description: Monitors IPsec VPN endpoint pair configuration and tunnel connectivity on WatchGuard Firebox.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is RAPID-IPSEC-ENDPOINT-PAIR-MIB?

The RAPID-IPSEC-ENDPOINT-PAIR-MIB is a RapidStream-originated module (RapidStream's security appliance technology was later folded into WatchGuard's Firebox product line) that models "IPSec Endpoint Pairs" -- the aggregated relationship between two IPsec security gateways connected by one or more tunnel-mode Security Associations. It belongs to the VPN/security topology category, exposing configuration and status data about how gateway pairs are related and tunneled rather than raw traffic counters. Its practical monitoring value is around the software/connectivity status of the VPN subsystem: an administrator uses it to confirm that expected gateway pairs remain tunnelled together and to detect a pair that has lost all active SAs, which signals a VPN outage between two sites. It builds conceptually on IPsec/IKE tunnel-mode SA concepts from the IETF IPsec standards, though it defines its own vendor object set rather than importing directly from an IETF IPsec MIB. It is deployed on RapidStream/WatchGuard Firebox gateways used to construct site-to-site or hub-and-spoke encrypted network topologies, where RAPID-IPSEC-ENDPOINT-PAIR-MIB SNMP monitoring helps confirm gateway pairs remain properly tunnelled.

IPNetwork Monitor allows you to monitor SNMP objects defined in RAPID-IPSEC-ENDPOINT-PAIR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

WatchGuard Firebox security gateway
RapidStream IPsec VPN gateway

Monitoring Examples

No specific object or table names were available in the supplied data for this module, so exact OIDs can't be cited; based on the module description, it would define an endpoint-pair table where each row represents a gateway pair and aggregates the count/status of tunnel-mode SAs between them. An administrator would monitor such a table for pairs showing zero active SAs, which indicates the tunnel connecting two sites has gone down and needs investigation.

What Can Be Monitored

IPsec endpoint pair connectivity status
tunnel-mode SA count between gateway pairs
VPN topology between security gateways

Imported Objects

From RAPID-MIB

rapidstream

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32
enterprises

How to Use in IPNetwork Monitor

Example using rsIpsecEndpointPairTotalInAccKbytes OID:

Select a WatchGuard Firebox security gateway, RapidStream IPsec VPN gateway (endpoint-pair topology) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rsIpsecEndpointPairTotalInAccKbytes into the Find box to locate it in the OID tree, then select it and click OK. The total inbound IPsec traffic of this entity. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in Kbytes), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
rsIpsecEndpointPairModule	1.3.6.1.4.1.4355.5			The MIB module describes generic Ipsec Endpoint Pair information of RapidStream system. Mainly, the information obtained from this MIB is used to constructed topological view of IPSec security gateways that are connected by IPSec tunnels. An IPSec Endpoint Pair is a pair of security gateways that are connected with 0 or more IPSec SA's in tunnel mode. It contains information of aggregated information of tunnel mode SA's between two security gateways. An IPSec Endpoint Pair is identified by a pair of IP addresses. Therefore, if an IPSec security gateway X has 2 external IP addresses while IPsec secruity gateway Y has 3 external IP addresses, there are potentially 6 IPsec Endpoint Pairs between X and Y.
rsIpsecEndpointPairMIB	1.3.6.1.4.1.4355.5.1			This is the base object identifier for all IPSec tunnel branches.
rsIpsecEndpointPair	1.3.6.1.4.1.4355.5.1.1			This is the base object identifier for all IPSec tunnel information.
U32 rsIpsecEndpointPairNum	1.3.6.1.4.1.4355.5.1.1.1	Unsigned32	read-only	The total number of entries in the rsIpsecEndpointPairTable.
rsIpsecEndpointPairTable	1.3.6.1.4.1.4355.5.1.1.2		not-accessible	This is the connection table describing all current IPSec tunnels exist on this entity.
rsIpsecEndpointPairEntry	1.3.6.1.4.1.4355.5.1.1.2.1		not-accessible	An entry (conceptual row) containing the information on a IPSec tunnel between two IPSec security gateways.
I32 rsIpsecEndpointPairIndex	1.3.6.1.4.1.4355.5.1.1.2.1.1	Integer32	read-only	The running index of this IPSec endpoint pair.
IP rsIpsecEndpointPairLocalAddr	1.3.6.1.4.1.4355.5.1.1.2.1.2	IpAddress	read-only	The local IP address of the current IPSec ednpoint pair.
IP rsIpsecEndpointPairPeerAddr	1.3.6.1.4.1.4355.5.1.1.2.1.3	IpAddress	read-only	The remote IP address of the current IPSec endpoint pair.
U32 rsIpsecEndpointPairInSAs	1.3.6.1.4.1.4355.5.1.1.2.1.4	Unsigned32	read-only	The number of inbound IPSEC SA's within this IPSec endpoint pair.
U32 rsIpsecEndpointPairOutSAs	1.3.6.1.4.1.4355.5.1.1.2.1.5	Unsigned32	read-only	The number of outbound IPSEC SA's within this IPSec endpoint pair.
C32 rsIpsecEndpointPairInAccKbytes	1.3.6.1.4.1.4355.5.1.1.2.1.6	Counter32	read-only	Total inbound traffic in Kbytes since the establish of this connection.
C32 rsIpsecEndpointPairOutAccKbytes	1.3.6.1.4.1.4355.5.1.1.2.1.7	Counter32	read-only	Total outound traffic in Kbytes since the establish of this connection.
C32 rsIpsecEndpointPairInPackets	1.3.6.1.4.1.4355.5.1.1.2.1.8	Counter32	read-only	Total number of inbound packets since the establish of this connection.
C32 rsIpsecEndpointPairOutPackets	1.3.6.1.4.1.4355.5.1.1.2.1.9	Counter32	read-only	Total number of outound packets since the establish of this connection.
C32 rsIpsecEndpointPairDecryptErrors	1.3.6.1.4.1.4355.5.1.1.2.1.10	Counter32	read-only	Total number of packets discarded due to decryption error since the establish of this connection.
C32 rsIpsecEndpointPairAuthErrors	1.3.6.1.4.1.4355.5.1.1.2.1.11	Counter32	read-only	Total number of packets discarded due to authentication error since the establish of this connection.
C32 rsIpsecEndpointPairReplayErrors	1.3.6.1.4.1.4355.5.1.1.2.1.12	Counter32	read-only	Total number of packets discarded due to replay error since the establish of this connection.
C32 rsIpsecEndpointPairPolicyErrors	1.3.6.1.4.1.4355.5.1.1.2.1.13	Counter32	read-only	Total number of packets discarded due to policy error since the establish of this connection.
C32 rsIpsecEndpointPairPadErrors	1.3.6.1.4.1.4355.5.1.1.2.1.14	Counter32	read-only	Total number of packets discarded due to pad value error since the establish of this connection.
C32 rsIpsecEndpointPairOtherReceiveErrors	1.3.6.1.4.1.4355.5.1.1.2.1.15	Counter32	read-only	The number of packets discarded due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element.
C32 rsIpsecEndpointPairSendErrors	1.3.6.1.4.1.4355.5.1.1.2.1.16	Counter32	read-only	The number of packets discarded due to any error. This may include errors due to a lack of transmit buffers.
rsIpsecEndpointPairStatistics	1.3.6.1.4.1.4355.5.1.2			This is the base object identifier for all objects which are global counters for IPSec tunnels.
G32 rsIpsecEndpointPairTotalInSAs	1.3.6.1.4.1.4355.5.1.2.1	Gauge32	read-only	The total number of active inbound SA's in the entity.
G32 rsIpsecEndpointPairTotalOutSAs	1.3.6.1.4.1.4355.5.1.2.2	Gauge32	read-only	The total number of active outbound SA's in the entity.
C32 rsIpsecEndpointPairTotalInAccKbytesEx	1.3.6.1.4.1.4355.5.1.2.3	Counter32	read-only	The total inbound IPsec traffic of this entity.
C32 rsIpsecEndpointPairTotalOutAccKbytes	1.3.6.1.4.1.4355.5.1.2.4	Counter32	read-only	The total outbound IPsec traffic of this entity.
C32 rsIpsecEndpointPairTotalInPackets	1.3.6.1.4.1.4355.5.1.2.5	Counter32	read-only	The total inbound IPsec packets of this entity.
C32 rsIpsecEndpointPairTotalOutPackets	1.3.6.1.4.1.4355.5.1.2.6	Counter32	read-only	The total outbound IPsec packets of this entity.
C32 rsIpsecEndpointPairTotalDecryptErrors	1.3.6.1.4.1.4355.5.1.2.7	Counter32	read-only	Total number of packets on this entity discarded due to encryption error.
C32 rsIpsecEndpointPairTotalAuthErrors	1.3.6.1.4.1.4355.5.1.2.8	Counter32	read-only	Total number of packets on this entity discarded due to authentication errors.
C32 rsIpsecEndpointPairTotalReplayErrors	1.3.6.1.4.1.4355.5.1.2.9	Counter32	read-only	Total number of packets discarded due to replay errors on this entity.
C32 rsIpsecEndpointPairTotalPolicyErrors	1.3.6.1.4.1.4355.5.1.2.10	Counter32	read-only	Total number of packets discarded due to policy errors on this entity.
C32 rsIpsecEndpointPairTotalPadErrors	1.3.6.1.4.1.4355.5.1.2.11	Counter32	read-only	Total number of packets on this entity discarded due to pad value error.
C32 rsIpsecEndpointPairTotalOtherReceiveErrors	1.3.6.1.4.1.4355.5.1.2.12	Counter32	read-only	The total number of packets on this entity discarded due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element.
C32 rsIpsecEndpointPairTotalSendErrors	1.3.6.1.4.1.4355.5.1.2.13	Counter32	read-only	The total number of packets discarded due to any error on this entity.
rsIpsecEndpointPairPeerIPToTunnel	1.3.6.1.4.1.4355.5.1.3			This is the base object identifier for all tunnels information of the policies.
U32 rsIpsecEndpointPairPeerIPToTunnelNum	1.3.6.1.4.1.4355.5.1.3.1	Unsigned32	read-only	The total number of tunnels in the peeriptotunnel table.
rsIpsecEndpointPairPeerIPToTunnelTable	1.3.6.1.4.1.4355.5.1.3.2		not-accessible	The peeriptotunnel table in the endpointpair mib.
rsIpsecEndpointPairPeerIPToTunnelEntry	1.3.6.1.4.1.4355.5.1.3.2.1		not-accessible	An entry (conceptual row) containing the peer ip and tunnel information.
IP rsIpsecEndpointPairPeerIPToTunnelPeerIP	1.3.6.1.4.1.4355.5.1.3.2.1.1	IpAddress	read-only	The peer ip of the peeriptotunnel table.
I32 rsIpsecEndpointPairPeerIPToTunnelTunnelID	1.3.6.1.4.1.4355.5.1.3.2.1.2	Integer32	read-only	The tunnel id of the peeriptotunnel table.

RFC description

Manages IPSec tunnel endpoints and security associations on WatchGuard RapidStream gateways.

Start monitoring WatchGuard Firebox security gateway, RapidStream IPsec VPN gateway (endpoint-pair topology) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RAPID-IPSEC-ENDPOINT-PAIR-MIB