RAPID-POLICY-MIB

All MIBs › RAPID-POLICY-MIB

Organization: WatchGuard Technologies, Inc.

Last Updated: 2001-05-21

Category: Firewall / Security Appliance, WatchGuard

Description: Manages WatchGuard Firebox firewall policy rules, actions, and traffic match statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is RAPID-POLICY-MIB?

RAPID-POLICY-MIB is a vendor-specific module originating from the RapidStream system, later associated with WatchGuard Firebox firewall appliances, and it manages firewall policy rules, action definitions, and traffic-match statistics. It exposes categories of data covering configured security policies (rule matching criteria and actions such as allow/deny/NAT) and counters reflecting how much traffic has matched each rule. Its monitoring value centers on operational/software status of the firewall's policy engine: tracking per-rule hit counts and match statistics reveals whether expected traffic is being permitted or blocked as intended, and sudden drops in expected traffic can flag a misapplied or malfunctioning policy rule. It has no strong dependency on other standard MIBs beyond generic SNMP SMI conventions, being a largely self-contained enterprise definition. It is typically deployed on WatchGuard/RapidStream firewall appliances at network perimeters for policy auditing and traffic visibility. Engineers can download the RAPID-POLICY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in RAPID-POLICY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

WatchGuard Firebox firewall
RapidStream firewall appliance

Monitoring Examples

No sample object names were available in the provided source excerpt for this MIB, so specific object/table references cannot be grounded here; based on its stated purpose, a realistic scenario would involve polling per-policy traffic match counters to detect an unexpectedly idle rule (suggesting misconfiguration) or an unexpectedly high hit count (suggesting a rule too permissive for its intended traffic).

What Can Be Monitored

firewall policy rule definitions
policy action (allow/deny/NAT)
per-rule traffic match statistics
rule hit counters

Imported Objects

From RAPID-MIB

rapidstream

OBJECT-IDENTITY

From SNMPv2-SMI

Counter64
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32
enterprises

From SNMPv2-TC

DateAndTime

How to Use in IPNetwork Monitor

Example using rsPolicyBytes OID:

Select a WatchGuard Firebox firewall, RapidStream firewall appliance (policy rule/traffic statistics) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rsPolicyBytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the total traffic in bytes since setting up this policy. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
rsPolicyMIB	1.3.6.1.4.1.4355.4			The MIB module describes various policy objects of RapidStream system.
rsPolicyToTunnel	1.3.6.1.4.1.4355.4.1			This is the base object identifier for all tunnels information of the policies.
U32 rsPolicyToTunnelNum	1.3.6.1.4.1.4355.4.1.1	Unsigned32	read-only	The total number of tunnels in the policytotunnel table.
rsPolicyToTunnelTable	1.3.6.1.4.1.4355.4.1.2		not-accessible	This is the policytotunnel table of all the policies.
rsPolicyToTunnelEntry	1.3.6.1.4.1.4355.4.1.2.1		not-accessible	An entry (conceptual row) containing the tunnels information.
I32 rsPolicyToTunnelPolicyID	1.3.6.1.4.1.4355.4.1.2.1.1	Integer32	read-only	The policy identifier of this entity.
I32 rsPolicyToTunnelTunnelID	1.3.6.1.4.1.4355.4.1.2.1.2	Integer32	read-only	The tunnel identifier of this entity.
rsPolicyStatistics	1.3.6.1.4.1.4355.4.2			This is the base object identifier for all RASVPN user.
U32 rsPolicyTableNum	1.3.6.1.4.1.4355.4.2.1	Unsigned32	read-only	The total number of policies in the policy table.
rsPolicyTable	1.3.6.1.4.1.4355.4.2.2		not-accessible	This is the policytotunnel table of the policies.
rsPolicyEntry	1.3.6.1.4.1.4355.4.2.2.1		not-accessible	An entry (conceptual row) containing the policy information.
I32 rsPolicyID	1.3.6.1.4.1.4355.4.2.2.1.1	Integer32	read-only	The policy identifier of this policy.
OCT rsPolicyName	1.3.6.1.4.1.4355.4.2.2.1.2	OCTET STRING	read-only	The policy name of this policy
C64 rsPolicyBytesEx	1.3.6.1.4.1.4355.4.2.2.1.3	Counter64	read-only	Total traffic in bytes since setting up this policy.
C64 rsPolicyPackets	1.3.6.1.4.1.4355.4.2.2.1.4	Counter64	read-only	Total traffic in packets since setting up this policy.
C64 rsPolicyIpsecDecryptErr	1.3.6.1.4.1.4355.4.2.2.1.5	Counter64	read-only	Total number of packets discarded due to decryption errors since setting up this policy.
C64 rsPolicyIpsecAuthErr	1.3.6.1.4.1.4355.4.2.2.1.6	Counter64	read-only	Total number of packets discarded due to authentication errors since setting up this policy.
C64 rsPolicyIpsecReplayErr	1.3.6.1.4.1.4355.4.2.2.1.7	Counter64	read-only	Total number of packets discarded due to replay errors since setting up this policy.
C64 rsPolicyIpsecPadErr	1.3.6.1.4.1.4355.4.2.2.1.8	Counter64	read-only	Total number of packets discarded due to pad value errors since setting up this policy.
C64 rsPolicyIpsecPolicyErr	1.3.6.1.4.1.4355.4.2.2.1.9	Counter64	read-only	Total number of packets discarded due to policy errors since setting up this policy.
C64 rsPolicyFwDisc	1.3.6.1.4.1.4355.4.2.2.1.10	Counter64	read-only	Total number of packets discarded by firewall policies since setting up this policy.
C64 rsPolicyOtherDisc	1.3.6.1.4.1.4355.4.2.2.1.11	Counter64	read-only	Total number of packets discarded due to errors other than firewall errors, ipsec errors since setting up this policy.
C64 rsPolicyActiveStreams	1.3.6.1.4.1.4355.4.2.2.1.12	Counter64	read-only	Total number of the active connections since setting up this policy.
C64 rsPolicyIpsecDisc	1.3.6.1.4.1.4355.4.2.2.1.13	Counter64	read-only	Total number of packets discarded by IPSEC errors (decryption error, authentication error, replay error) since setting up this policy.
C64 rsPolicyDisc	1.3.6.1.4.1.4355.4.2.2.1.14	Counter64	read-only	Total number of packets discarded since setting up this policy.
C64 rsPolicyNumTunl	1.3.6.1.4.1.4355.4.2.2.1.15	Counter64	read-only	Total number of tunnels belong to this policy
C64 rsPolicySingleCntrNum	1.3.6.1.4.1.4355.4.2.2.1.16	Counter64	read-only	Total number of single counters handled by this policy.
INT rsPolicyLogging	1.3.6.1.4.1.4355.4.2.2.1.17	INTEGER	read-only	Indicates whether if the logging of this policy has been enabled.

RFC description

RapidStream policy and VPN tunnel management, tracking policy-to-tunnel mappings and associated statistics.

Start monitoring WatchGuard Firebox firewall, RapidStream firewall appliance (policy rule/traffic statistics) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RAPID-POLICY-MIB