SONICWALL-FIREWALL-TRAP-MIB

Description: Defines Dell SonicWall firewall event traps for security incidents, policy violations, and operational alerts.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

SONICWALL-FIREWALL-TRAP-MIB is a vendor-specific MIB from Dell SonicWALL (formerly SonicWALL) that defines SNMP trap/notification objects sent by SonicWALL firewall appliances for security incidents, policy violations, and other operational alerts. It exposes trap-payload objects describing the event, including trap type and description, source/destination IP and MAC addresses, source/destination ports, IP protocol type, and free-text messages/service-area names associated with the triggering event. In monitoring terms this MIB is entirely about real-time security/fault event notification rather than polled counters, letting a security operations team receive and parse firewall-generated traps to identify what kind of security event occurred, such as an intrusion attempt or policy block, and the exact flow involved. It has no apparent dependency on other standard MIBs beyond the base SNMP notification framework, functioning as a self-contained trap-definition module. It is deployed wherever Dell/SonicWALL firewalls are configured to forward security and operational alerts to a central SNMP trap receiver or SIEM. Network engineers evaluating or troubleshooting this functionality can download the SONICWALL-FIREWALL-TRAP-MIB file directly to load it into their MIB browser.

A security team's trap receiver would parse an incoming SonicWALL trap's swTrapInfoTrapType and swTrapInfoTrapDescription to classify the event, then inspect swTrapInfoSrcIpAddress/swTrapInfoDstIpAddress and swTrapInfoSrcPort/swTrapInfoDstPort to identify the exact flow that triggered it. The swTrapInfoTable holds these fields as trap varbinds accompanying each sonicwallFwTrapInfo notification, and swTrapInfoSaName can identify the security service/rule area involved. A burst of traps sharing the same swTrapInfoSrcIpAddress and an intrusion or policy-violation trap type would point to a single source actively probing or attacking the network. This MIB is used purely for security-event notification, not routine performance polling.

SonicWall firewall SNMP MIB defining trap notifications for various firewall security events. Includes trap types for antivirus alerts, content filtering, IPSEC events, TCP scan detection, and security subscription status notifications.