All MIBs › SFOS-FIREWALL-MIB
Organization: Sophos PLC
Last Updated: 2018-12-18
Description: Sophos XG Firewall MIB providing HA state, system resource counters, and traffic statistics for Sophos XG/SFOS next-generation firewall appliances
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is SFOS-FIREWALL-MIB?
SFOS-FIREWALL-MIB is Sophos's vendor-specific module for its XG Firewall / SFOS-based next-generation firewall appliances, exposing device identity, software/signature versions, and live operational and traffic statistics. It covers configuration-type data (device name, type, firmware version, app key) alongside runtime counters for user activity and protocol traffic (live user count, HTTP/FTP hit counts) and resource data such as disk capacity. It is explicitly useful for monitoring both software status, firmware version and web-category/IPS signature database versions, and operational health including device uptime and disk capacity, making it valuable for spotting stale signature updates, clock drift, or disk space exhaustion. There is no indication of dependency on external standard MIBs in this excerpt; the objects live under the vendor's own sfosXGMIB/sfosXGMIBObjects tree. It is deployed on Sophos XG/SFOS next-generation firewall appliances protecting enterprise network perimeters. Engineers can download the SFOS-FIREWALL-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in SFOS-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Sophos XG Firewall / SFOS-based next-generation firewall appliance
Monitoring Examples
An administrator would poll sfosUpTime to confirm the firewall hasn't unexpectedly rebooted, and check sfosDeviceFWVersion, sfosWebcatVersion, and sfosIPSVersion together to verify firmware and signature databases are current, a stale sfosIPSVersion could mean the appliance stopped receiving intrusion-prevention updates. sfosLiveUsersCount, sfosHTTPHits, and sfosFTPHits give a real-time read on user load and protocol traffic, useful for spotting an unusual spike suggesting a policy misconfiguration or an internal host generating excessive traffic, while sfosDiskCapacity would be watched to catch log storage filling up before it impacts logging or reporting.
What Can Be Monitored
- device uptime
- firmware version
- web-category and IPS signature versions
- live/active user count
- HTTP and FTP hit counts
- disk capacity
Imported Objects
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType | |
| InetPortNumber |
From IPV6-TC
| Ipv6Address |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Counter32 | |
| Counter64 | |
| Gauge32 | |
| Integer32 | |
| IpAddress | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| TimeTicks | |
| enterprises |
From SNMPv2-TC
| DisplayString | |
| MacAddress | |
| PhysAddress | |
| TEXTUAL-CONVENTION |
How to Use in IPNetwork Monitor
Example using sfosHTTPHits OID:
OIDs
RFC description
Manages Sophos XG Firewall SNMP configuration and allows remote configuration of SNMP message generation parameters.
Start monitoring Sophos XG Firewall / SFOS-based next-generation firewall appliance (firmware/signature version, traffic counters) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.