SONICWALL-FIREWALL-IP-STATISTICS-MIB

All MIBs › SONICWALL-FIREWALL-IP-STATISTICS-MIB

Organization: DELL SonicWall

Last Updated: 2015-01-08

Category: Dell SonicWall Network Security

Description: Tracks Dell SonicWall firewall IP traffic statistics including connection counts, bytes, and protocol distribution.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is SONICWALL-FIREWALL-IP-STATISTICS-MIB?

This is a vendor-specific MIB from SonicWall (formerly under Dell) covering IP-layer traffic statistics on their firewall appliances. It exposes connection-cache metrics, per-interface throughput/usage figures, NAT translation counts, and VPN/IPSec statistics, spanning both traffic performance data and system resource utilization. Notably for hardware/software status monitoring, it exposes CPU utilization broken out by function (sonicCurrentCPUUtil, sonicCurrentManagementCPUUtil, sonicCurrentFwdAndInspectCPUUtil) and RAM utilization (sonicCurrentRAMUtil), letting an admin directly track the firewall's processing load and memory pressure alongside its traffic-forwarding health. It is a self-contained enterprise MIB with SMI-derived types and no strong dependency on other standard MIBs beyond the base SNMP framework. It is deployed by network/security administrators monitoring the operational load and traffic patterns of SonicWall firewall appliances at network edges. Network engineers evaluating or troubleshooting this functionality can download the SONICWALL-FIREWALL-IP-STATISTICS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in SONICWALL-FIREWALL-IP-STATISTICS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

SonicWall firewall appliance

Monitoring Examples

An admin would poll sonicCurrentCPUUtil and sonicCurrentRAMUtil to watch overall firewall load, and sonicCurrentFwdAndInspectCPUUtil specifically to see how much CPU is consumed by packet forwarding/inspection versus management overhead (sonicCurrentManagementCPUUtil). Walking sonicIfStatTable/sonicIfStatEntry (keyed by sonicIfIndex) shows per-interface sonicIfUsage and sonicIfThroughput, while sonicCurrentConnCacheEntries approaching sonicMaxConnCacheEntries would reveal the connection table nearing capacity, a common precursor to dropped new connections.

What Can Be Monitored

CPU utilization (overall, management, forwarding/inspection)
RAM utilization
connection cache usage vs. maximum
per-interface throughput and usage
NAT translation count
VPN/IPSec statistics

Imported Objects

From RFC1155-SMI

Counter
Gauge

From SNMPv2-SMI

Counter32
Counter64
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TruthValue

From SONICWALL-SMI

sonicwallFw

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using sonicSyslogMessage OID:

Select a SonicWall firewall appliance (IP traffic/NAT/VPN statistics, CPU/RAM utilization) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type sonicSyslogMessage into the Find box to locate it in the OID tree, then select it and click OK. It reports the running total of syslog message generated since startup. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
sonicwallFwStatsModule	1.3.6.1.4.1.8741.1.3			The Generic MIB Module for SonicWALL Firewall.
sonicwallFwStats	1.3.6.1.4.1.8741.1.3.1
INT sonicMaxConnCacheEntries	1.3.6.1.4.1.8741.1.3.1.1	INTEGER	read-only	Maximum number of connection cache entries allowed through the firewall
GAU sonicCurrentConnCacheEntries	1.3.6.1.4.1.8741.1.3.1.2	Gauge	read-only	Number of active connection cache entries through the firewall
GAU sonicCurrentCPUUtil	1.3.6.1.4.1.8741.1.3.1.3	Gauge	read-only	Instantaneous CPU Utilization in percent
GAU sonicCurrentRAMUtil	1.3.6.1.4.1.8741.1.3.1.4	Gauge	read-only	Instantaneous RAM Utilization in percent
GAU sonicNatTranslationCount	1.3.6.1.4.1.8741.1.3.1.5	Gauge	read-only	Current number of dynamic NAT translations being performed.
GAU sonicCurrentManagementCPUUtil	1.3.6.1.4.1.8741.1.3.1.6	Gauge	read-only	Instantaneous management CPU Utilization in percent.
GAU sonicCurrentFwdAndInspectCPUUtil	1.3.6.1.4.1.8741.1.3.1.7	Gauge	read-only	Instantaneous Forwarding/Inspection CPU Utilization in percent.
sonicIfStatTable	1.3.6.1.4.1.8741.1.3.1.8		not-accessible	List of physical interfaces and their current usage in percentage.
sonicIfStatEntry	1.3.6.1.4.1.8741.1.3.1.8.1		not-accessible	Interface status entry.
INT sonicIfIndex	1.3.6.1.4.1.8741.1.3.1.8.1.1	INTEGER	read-only	A unique value for each interface. Its value ranges between 1 and the value of ifNumber. The value for each interface must remain constant at least from one re-initialization of the entity's network management system to the next re- initialization.
INT sonicIfUsage	1.3.6.1.4.1.8741.1.3.1.8.1.2	INTEGER	read-only	Interface bandwidth usage value in percentage.
INT sonicIfThroughput	1.3.6.1.4.1.8741.1.3.1.8.1.3	INTEGER	read-only	Interface throughput value in bits per second.
sonicwallFwVPNStats	1.3.6.1.4.1.8741.1.3.2
sonicwallFwVpnIPSecStats	1.3.6.1.4.1.8741.1.3.2.1
sonicSAStatTable	1.3.6.1.4.1.8741.1.3.2.1.1		not-accessible	This table provides statistics for each Security Association.
sonicSAStatEntry	1.3.6.1.4.1.8741.1.3.2.1.1.1		not-accessible	Entries in table cannot be added or deleted. This table is completely controlled by the agent. Each SA statistics will be represented by an entry in this table.
CTR sonicIpsecSaIndex	1.3.6.1.4.1.8741.1.3.2.1.1.1.1	Counter	read-only	Phase2 SA index.
IP sonicSAStatPeerGateway	1.3.6.1.4.1.8741.1.3.2.1.1.1.2	IpAddress	read-only	Peer gateway address where the tunnel gets terminated .
IP sonicSAStatSrcAddrBegin	1.3.6.1.4.1.8741.1.3.2.1.1.1.3	IpAddress	read-only	First address of the Source network for the phase2 SA .
IP sonicSAStatSrcAddrEnd	1.3.6.1.4.1.8741.1.3.2.1.1.1.4	IpAddress	read-only	Last address of the Source network for the phase2 SA .
IP sonicSAStatDstAddrBegin	1.3.6.1.4.1.8741.1.3.2.1.1.1.5	IpAddress	read-only	First address of the destination network for the phase2 SA .
IP sonicSAStatDstAddrEnd	1.3.6.1.4.1.8741.1.3.2.1.1.1.6	IpAddress	read-only	Last address of the destination network for the phase2 SA .
STR sonicSAStatCreateTime	1.3.6.1.4.1.8741.1.3.2.1.1.1.7	DisplayString	read-only	Time this phase2 SA was actually created in GMT.
CTR sonicSAStatEncryptPktCount	1.3.6.1.4.1.8741.1.3.2.1.1.1.8	Counter	read-only	Total encrypted packet count for this phase2 SA.
CTR sonicSAStatEncryptByteCount	1.3.6.1.4.1.8741.1.3.2.1.1.1.9	Counter	read-only	Total encrypted byte count for this phase2 SA.
CTR sonicSAStatDecryptPktCount	1.3.6.1.4.1.8741.1.3.2.1.1.1.10	Counter	read-only	Total decrypted packet count for this phase2 SA.
CTR sonicSAStatDecryptByteCount	1.3.6.1.4.1.8741.1.3.2.1.1.1.11	Counter	read-only	Total decrypted byte count for this phase2 SA.
CTR sonicSAStatInFragPktCount	1.3.6.1.4.1.8741.1.3.2.1.1.1.12	Counter	read-only	Incoming Fragmented packet count for this phase2 SA
CTR sonicSAStatOutFragPktCount	1.3.6.1.4.1.8741.1.3.2.1.1.1.13	Counter	read-only	Outgoing Fragmented packet count for this phase2 SA
STR sonicSAStatUserName	1.3.6.1.4.1.8741.1.3.2.1.1.1.14	DisplayString	read-only	Name of the security policy used for creating this phase2 SA.
sonicwallFwHWStats	1.3.6.1.4.1.8741.1.3.3
sonicwallFwHWSensorStats	1.3.6.1.4.1.8741.1.3.3.3
sonicwallSensorsTable	1.3.6.1.4.1.8741.1.3.3.3.1		not-accessible	This lists all the sensors and their value in SonicWALL firewall device.
sonicwallSensorsEntry	1.3.6.1.4.1.8741.1.3.3.3.1.1		not-accessible	SonicWALL sensor entry
I32 sonicwallSensorsIndex	1.3.6.1.4.1.8741.1.3.3.3.1.1.1	Integer32	read-only	Index that identifies the sensor
I32 sonicwallSensorsId	1.3.6.1.4.1.8741.1.3.3.3.1.1.2	Integer32	read-only	Index that identifies the sensor ID
STR sonicwallSensorsDevice	1.3.6.1.4.1.8741.1.3.3.3.1.1.3	DisplayString	read-only	Sensor descriptive name
I32 sonicwallSensorsValue	1.3.6.1.4.1.8741.1.3.3.3.1.1.4	Integer32	read-only	Sensor value
STR sonicwallSensorsUnit	1.3.6.1.4.1.8741.1.3.3.3.1.1.5	DisplayString	read-only	Sensor unit
sonicwallFwSyslogStats	1.3.6.1.4.1.8741.1.3.4
sonicwallFwSyslogSetting	1.3.6.1.4.1.8741.1.3.4.1
SYS sonicSyslogFacility	1.3.6.1.4.1.8741.1.3.4.1.1	SyslogFacility	read-only	Syslog facility configured on firewall.
T/F sonicSyslogOverrideSetting	1.3.6.1.4.1.8741.1.3.4.1.2	TruthValue	read-only	When using SonicWALL ViewPoint for reporting solution, this object indicates whether the appliance overrides Syslog settings with reporting software settings.
INT sonicSyslogFormat	1.3.6.1.4.1.8741.1.3.4.1.3	INTEGER	read-only	Syslog format configured on firewall. The following Syslog formats can be specified: Default - Use the default SonicWALL Syslog format. WebTrends - Use the WebTrends Syslog format. You must have WebTrends software installed on your system. Enhanced Syslog - Use the Enhanced SonicWALL Syslog format. ArcSight - Use the ArcSight Syslog format. A Syslog server must be configured with the ArcSight Logger application to decode the ArcSight messages.
STR sonicSyslogID	1.3.6.1.4.1.8741.1.3.4.1.4	DisplayString	read-only	The Syslog ID field is included in all generated syslog messages, prefixed by id=. The Syslog ID field is disabled when the Override Syslog Settings with Reporting Software Settings option is enabled.
T/F sonicSyslogEventRateLimitEnable	1.3.6.1.4.1.8741.1.3.4.1.5	TruthValue	read-only	This object indicates whether the appliance enables rate limiting of events to prevent the internal or external logging mechanism from being overwhelmed by log events.
GAU sonicSyslogEventRateLimit	1.3.6.1.4.1.8741.1.3.4.1.6	Gauge	read-only	Event rate limiting: Maximum Events Per Second.
T/F sonicSyslogDataRateLimitEnable	1.3.6.1.4.1.8741.1.3.4.1.7	TruthValue	read-only	This object indicates whether the appliance enables rate limiting of data to prevent the internal or external logging mechanism from being overwhelmed by log events.
GAU sonicSyslogDataRateLimit	1.3.6.1.4.1.8741.1.3.4.1.8	Gauge	read-only	Data rate limiting: Maximum Bytes Per Second.
T/F sonicSyslogNDPPEnable	1.3.6.1.4.1.8741.1.3.4.1.9	TruthValue	read-only	This object indicates whether the appliance enables NDPP Enforcement for Syslog Server.
sonicwallFwSyslogServer	1.3.6.1.4.1.8741.1.3.4.2
U32 sonicSyslogMaxServers	1.3.6.1.4.1.8741.1.3.4.2.1	Unsigned32	read-only	The maximum number of syslog servers that can be configured for the system in sonicSyslogTable.
sonicSyslogServerTable	1.3.6.1.4.1.8741.1.3.4.2.2		not-accessible	This table contains entries of syslog servers for the appliance. The maximum number of entries is indicated by the object sonicwallSyslogMaxServers.
sonicSyslogServerEntry	1.3.6.1.4.1.8741.1.3.4.2.2.1		not-accessible	An entry containing info about syslog server configured by SonicWALL firewall appliance
INT sonicSyslogServerIndex	1.3.6.1.4.1.8741.1.3.4.2.2.1.1	INTEGER	read-only	Index that identifies the syslog server
IP sonicSyslogServerAddr	1.3.6.1.4.1.8741.1.3.4.2.2.1.2	IpAddress	read-only	Syslog server address.
INT sonicSyslogServerPort	1.3.6.1.4.1.8741.1.3.4.2.2.1.3	INTEGER	read-only	Syslog server port.
sonicwallFwSyslogStatistic	1.3.6.1.4.1.8741.1.3.4.3
C32 sonicSyslogMessageEx	1.3.6.1.4.1.8741.1.3.4.3.1	Counter32	read-only	Running total of syslog message generated since startup.
C32 sonicSyslogStreamData	1.3.6.1.4.1.8741.1.3.4.3.2	Counter32	read-only	Running total of syslog stream data generated since startup.
sonicwallFwDpiSslStats	1.3.6.1.4.1.8741.1.3.5
GAU sonicDpiSslConnCountCur	1.3.6.1.4.1.8741.1.3.5.1	Gauge	read-only	Current SSL-inspected connections through the firewall.
GAU sonicDpiSslConnCountHighWater	1.3.6.1.4.1.8741.1.3.5.2	Gauge	read-only	Highwater SSL-inspected connections through the firewall.
GAU sonicDpiSslConnCountMax	1.3.6.1.4.1.8741.1.3.5.3	Gauge	read-only	Maximum SSL-inspected connections through the firewall.

RFC description

Vendor-private MIB for SonicWall firewalls, enabling SNMP monitoring of IP traffic statistics, VPN tunnel status, and firewall performance metrics.

Start monitoring SonicWall firewall appliance (IP traffic/NAT/VPN statistics, CPU/RAM utilization) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SONICWALL-FIREWALL-IP-STATISTICS-MIB