STONESOFT-FIREWALL-MIB

All MIBs › STONESOFT-FIREWALL-MIB

Organization: Forcepoint LLC

Last Updated: 2016-08-17

Category: Firewall / Security Appliance, Security / Access Control

Description: Manages Forcepoint Stonesoft next-generation firewall policy enforcement, connection state, and traffic statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is STONESOFT-FIREWALL-MIB?

STONESOFT-FIREWALL-MIB is a proprietary Forcepoint (formerly McAfee/Stonesoft) MIB for the vendor's next-generation firewall (NGFW), covering security policy enforcement, connection state, and traffic statistics. It exposes software identity data (version, active policy name and timestamp), connection performance counters (accepted/dropped/logged/accounted/rejected packets, current connection count), and per-interface traffic statistics, plus fault-oriented notifications. Its monitoring emphasis spans both software status - confirming the correct firmware and policy revision is active - and ongoing security/performance health via connection and drop/reject counters that reveal blocked attacks or misapplied rules. It complements standard IF-MIB interface indexing for its per-interface stats and uses SNMPv2 notification conventions for its firewallEvents/firewallEventsV2 traps. Typical deployment is Forcepoint Stonesoft NGFW appliances at the network perimeter. Engineers can download the STONESOFT-FIREWALL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in STONESOFT-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Forcepoint Stonesoft next-generation firewall (NGFW)

Monitoring Examples

Polling fwConnNumber alongside fwAccepted, fwDropped, and fwRejected gives a real-time view of connection volume and how much traffic the firewall is blocking, while fwSoftwareVersion and fwPolicyTime confirm which firmware and policy revision is currently active after a policy push. fwIfStatsTable/Entry (indexed by fwIfStatsIndex) exposes per-interface traffic counters, letting an admin spot an interface where dropped/rejected counts spike unexpectedly, which could indicate a misapplied rule or an attack in progress; firewallEvents/firewallEventsV2 traps notify on significant security events.

What Can Be Monitored

software version
active security policy and policy timestamp
current connection count
accepted/dropped/rejected/logged packet counts
per-interface traffic statistics

Imported Objects

From HCNUM-TC

CounterBasedGauge64

From INET-ADDRESS-MIB

InetAddressIPv4
InetAddressIPv6

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION
TimeStamp

From STONESOFT-SMI-MIB

stonesoftFirewall	OBJECT-IDENTITY
stonesoftModules	OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using fwAccepted OID:

Select a Forcepoint Stonesoft next-generation firewall (policy/connection statistics) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type fwAccepted into the Find box to locate it in the OID tree, then select it and click OK. It reports the number of accepted packets. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
I32 adslAttenuationDown	1.3.6.1.4.1.1369.5.2.1.12.11	Integer32	read-only	An estimate of the average loop attenuation downstream.
I32 adslAttenuationUp	1.3.6.1.4.1.1369.5.2.1.12.10	Integer32	read-only	An estimate of the average loop attenuation upstream.
I32 adslBitErrorsDown	1.3.6.1.4.1.1369.5.2.1.12.21	Integer32	read-only	The number of bit errors downstream.
I32 adslBitErrorsUp	1.3.6.1.4.1.1369.5.2.1.12.20	Integer32	read-only	The number of bit errors upstream.
STR adslChannel	1.3.6.1.4.1.1369.5.2.1.12.2	DisplayString	read-only	Channel type
STR adslConnStatus	1.3.6.1.4.1.1369.5.2.1.12.3	DisplayString	read-only	The status of the DSL link or communication status with DSL modem in case of communication error.
TIM adslConnUptime	1.3.6.1.4.1.1369.5.2.1.12.4	TimeStamp	read-only	Uptime of current ADSL connection.
I32 adslHecErrorsDown	1.3.6.1.4.1.1369.5.2.1.12.15	Integer32	read-only	The total number of header error checksum errors downstream.
I32 adslHecErrorsUp	1.3.6.1.4.1.1369.5.2.1.12.14	Integer32	read-only	The total number of header error checksum errors upstream.
I32 adslInOctets	1.3.6.1.4.1.1369.5.2.1.12.6	Integer32	read-only	Number of bytes received by ADSL interface
I32 adslLcdErrorsDown	1.3.6.1.4.1.1369.5.2.1.12.19	Integer32	read-only	The total of lost-cell-delineation errors downstream.
I32 adslLcdErrorsUp	1.3.6.1.4.1.1369.5.2.1.12.18	Integer32	read-only	The total of lost-cell-delineation errors upstream.
STR adslLineStatus	1.3.6.1.4.1.1369.5.2.1.12.5	DisplayString	read-only	Current status of DSL line.
STR adslModulation	1.3.6.1.4.1.1369.5.2.1.12.1	DisplayString	read-only	Modulation protocol
I32 adslNoiseMarginDown	1.3.6.1.4.1.1369.5.2.1.12.13	Integer32	read-only	This is a signal-to-noise ratio (SNR) margin for traffic going downstream
I32 adslNoiseMarginUp	1.3.6.1.4.1.1369.5.2.1.12.12	Integer32	read-only	This is a signal-to-noise ratio (SNR) margin for traffic going upstream
I32 adslOcdErrorsDown	1.3.6.1.4.1.1369.5.2.1.12.17	Integer32	read-only	The number of out-of-cell delineation errors downstream.
I32 adslOcdErrorsUp	1.3.6.1.4.1.1369.5.2.1.12.16	Integer32	read-only	The number of out-of-cell delineation errors upstream.
I32 adslOutOctets	1.3.6.1.4.1.1369.5.2.1.12.7	Integer32	read-only	Number of bytes transmitted by ADSL interface
I32 adslSynchroSpeedDown	1.3.6.1.4.1.1369.5.2.1.12.9	Integer32	read-only	The actual rate at which data is flowing downstream.
I32 adslSynchroSpeedUp	1.3.6.1.4.1.1369.5.2.1.12.8	Integer32	read-only	The actual rate at which data is flowing upstream.
firewallAdslGroup	1.3.6.1.4.1.1369.5.2.3.1.6			A collection of objects giving information about the ADSL modem parameters
firewallCompliance1	1.3.6.1.4.1.1369.5.2.3.2.1			The compliance statement for firewalls
firewallCompliances	1.3.6.1.4.1.1369.5.2.3.2
firewallConformance	1.3.6.1.4.1.1369.5.2.3
firewallEvents	1.3.6.1.4.1.1369.5.2.2
firewallEventsV2	1.3.6.1.4.1.1369.5.2.2.0
firewallGeneralInformationGroup	1.3.6.1.4.1.1369.5.2.3.1.1			A collection of objects giving general information about the firewall
firewallGeneralNotifGroup	1.3.6.1.4.1.1369.5.2.3.1.2			A collection of notification giving information about general events in the firewall
firewallGeneralStatsGroup	1.3.6.1.4.1.1369.5.2.3.1.4			A collection of objects giving general information about the firewall traffic statistics
firewallGroups	1.3.6.1.4.1.1369.5.2.3.1
firewallHardwareGroup	1.3.6.1.4.1.1369.5.2.3.1.5			A collection of objects giving information about the hardware parameters
firewallIfaceStatsGroup	1.3.6.1.4.1.1369.5.2.3.1.3			A collection of objects giving information about the current firewall interface related traffic statistics
firewallObjects	1.3.6.1.4.1.1369.5.2.1
firewallVpnEpGroup	1.3.6.1.4.1.1369.5.2.3.1.7			A collection of objects giving information about the configured VPN end-point pairs
C64 fwAcceptedEx	1.3.6.1.4.1.1369.5.2.1.5	Counter64	read-only	Number of accepted packets
C64 fwAccounted	1.3.6.1.4.1.1369.5.2.1.8	Counter64	read-only	Number of accounted packets
fwADSL	1.3.6.1.4.1.1369.5.2.1.12
NUM fwConnNumber	1.3.6.1.4.1.1369.5.2.1.4	CounterBasedGauge64	read-only	Number of current connections
U32 fwCpuHwIrq	1.3.6.1.4.1.1369.5.2.1.11.1.1.9	Unsigned32	read-only	The percentage of time the CPU has been servicing hardware interrupts
U32 fwCpuIdle	1.3.6.1.4.1.1369.5.2.1.11.1.1.7	Unsigned32	read-only	The percentage of time the CPU was idle
U32 fwCpuIoWait	1.3.6.1.4.1.1369.5.2.1.11.1.1.8	Unsigned32	read-only	The percentage of time the CPU has been waiting for I/O to complete
STR fwCpuName	1.3.6.1.4.1.1369.5.2.1.11.1.1.2	DisplayString	read-only	Name of data current line concern
U32 fwCpuNice	1.3.6.1.4.1.1369.5.2.1.11.1.1.6	Unsigned32	read-only	The percentage of time the CPU has spent running users' processes that have been niced
U32 fwCpuSoftIrq	1.3.6.1.4.1.1369.5.2.1.11.1.1.10	Unsigned32	read-only	The percentage of time the CPU has been servicing software interrupts
fwCpuStatsEntry	1.3.6.1.4.1.1369.5.2.1.11.1.1		not-accessible	Row with information about cpu usage
I32 fwCpuStatsId	1.3.6.1.4.1.1369.5.2.1.11.1.1.1	Integer32	not-accessible	A unique value, greater than zero, for each CPU in the managed system. First element with Id '0' is designed for total values.
fwCpuStatsTable	1.3.6.1.4.1.1369.5.2.1.11.1		not-accessible	This table contains an entry for each cpu in a system and total usage of all cpus.
U32 fwCpuSystem	1.3.6.1.4.1.1369.5.2.1.11.1.1.5	Unsigned32	read-only	The percentage of time the CPU has spent running the kernel and its processes
U32 fwCpuTotal	1.3.6.1.4.1.1369.5.2.1.11.1.1.3	Unsigned32	read-only	The total CPU load percentage
U32 fwCpuUser	1.3.6.1.4.1.1369.5.2.1.11.1.1.4	Unsigned32	read-only	The percentage of time the CPU has spent running users' processes that are not niced
fwDiskStatsEntry	1.3.6.1.4.1.1369.5.2.1.11.3.1		not-accessible	Row of information concerning one partition
fwDiskStatsTable	1.3.6.1.4.1.1369.5.2.1.11.3		not-accessible	Table contains an entry for each partition mounted in a system.
C64 fwDropped	1.3.6.1.4.1.1369.5.2.1.6	Counter64	read-only	Number of dropped packets
fwHardware	1.3.6.1.4.1.1369.5.2.1.11
C64 fwIfAcceptedBytes	1.3.6.1.4.1.1369.5.2.1.10.1.8	Counter64	read-only	Number of accepted bytes by firewall rules
C64 fwIfAcceptedPkts	1.3.6.1.4.1.1369.5.2.1.10.1.3	Counter64	read-only	Number of accepted packets by firewall rules
C64 fwIfAccountedBytes	1.3.6.1.4.1.1369.5.2.1.10.1.11	Counter64	read-only	Number of accounted bytes by firewall rules
C64 fwIfAccountedPkts	1.3.6.1.4.1.1369.5.2.1.10.1.6	Counter64	read-only	Number of accounted packets by firewall rules
C64 fwIfDroppedBytes	1.3.6.1.4.1.1369.5.2.1.10.1.9	Counter64	read-only	Number of dropped bytes by firewall rules
C64 fwIfDroppedPkts	1.3.6.1.4.1.1369.5.2.1.10.1.4	Counter64	read-only	Number of dropped packets by firewall rules
C64 fwIfForwardedBytes	1.3.6.1.4.1.1369.5.2.1.10.1.14	Counter64	read-only	Number of forwarded bytes by firewall rules
C64 fwIfForwardedPkts	1.3.6.1.4.1.1369.5.2.1.10.1.13	Counter64	read-only	Number of forwarded packets by firewall rules
C64 fwIfLoggedBytes	1.3.6.1.4.1.1369.5.2.1.10.1.10	Counter64	read-only	Number of logged bytes by firewall rules
C64 fwIfLoggedPkts	1.3.6.1.4.1.1369.5.2.1.10.1.5	Counter64	read-only	Number of logged packets by firewall rules
STR fwIfName	1.3.6.1.4.1.1369.5.2.1.10.1.2	DisplayString	read-only	Name of interface
C64 fwIfRejectedBytes	1.3.6.1.4.1.1369.5.2.1.10.1.12	Counter64	read-only	Number of rejected bytes by firewall rules
C64 fwIfRejectedPkts	1.3.6.1.4.1.1369.5.2.1.10.1.7	Counter64	read-only	Number of rejected packets by firewall rules
fwIfStatsEntry	1.3.6.1.4.1.1369.5.2.1.10.1		not-accessible	Row for an interface
I32 fwIfStatsIndex	1.3.6.1.4.1.1369.5.2.1.10.1.1	Integer32	not-accessible	A unique value, greater than zero, for each interface or interface sub-layer in the managed system.
fwIfStatsTable	1.3.6.1.4.1.1369.5.2.1.10		not-accessible	This table contains an entry for each interface in system
C64 fwLogged	1.3.6.1.4.1.1369.5.2.1.7	Counter64	read-only	Number of logged packets
NUM fwMemBytesBuffers	1.3.6.1.4.1.1369.5.2.1.11.2.7	CounterBasedGauge64	read-only	Amount of memory used as buffers
NUM fwMemBytesCached	1.3.6.1.4.1.1369.5.2.1.11.2.8	CounterBasedGauge64	read-only	Amount of memory used as cache
NUM fwMemBytesTotal	1.3.6.1.4.1.1369.5.2.1.11.2.4	CounterBasedGauge64	read-only	Number of available bytes of physical memory
NUM fwMemBytesUnused	1.3.6.1.4.1.1369.5.2.1.11.2.6	CounterBasedGauge64	read-only	Amount of unused bytes of physical memory
NUM fwMemBytesUsed	1.3.6.1.4.1.1369.5.2.1.11.2.5	CounterBasedGauge64	read-only	Amount of memory being in use
fwMemoryInfo	1.3.6.1.4.1.1369.5.2.1.11.2
STR fwMountPointName	1.3.6.1.4.1.1369.5.2.1.11.3.1.3	DisplayString	read-only	Name of a mount point
NUM fwPartitionAvail	1.3.6.1.4.1.1369.5.2.1.11.3.1.6	CounterBasedGauge64	read-only	Information about amount of free space on partition (in kilobytes)
STR fwPartitionDevName	1.3.6.1.4.1.1369.5.2.1.11.3.1.2	DisplayString	read-only	A unique name of a device
I32 fwPartitionIndex	1.3.6.1.4.1.1369.5.2.1.11.3.1.1	Integer32	not-accessible	A unique value, greater than zero, for each partition
NUM fwPartitionSize	1.3.6.1.4.1.1369.5.2.1.11.3.1.4	CounterBasedGauge64	read-only	Total size of the partition
NUM fwPartitionUsed	1.3.6.1.4.1.1369.5.2.1.11.3.1.5	CounterBasedGauge64	read-only	Amount of used space of the partition (in kilobytes)
NTF fwPolicyInstall	1.3.6.1.4.1.1369.5.2.2.0.1			A firewall policy was (re)installed
TIM fwPolicyTime	1.3.6.1.4.1.1369.5.2.1.3	TimeStamp	read-only	The time when the security policy was installed to the firewall
C64 fwRejected	1.3.6.1.4.1.1369.5.2.1.9	Counter64	read-only	Number of rejected packets
STR fwSecurityPolicy	1.3.6.1.4.1.1369.5.2.1.2	DisplayString	read-only	Name of the current security policy on the firewall
STR fwSoftwareVersion	1.3.6.1.4.1.1369.5.2.1.1	DisplayString	read-only	Version string of the firewall software
NUM fwSwapBytesTotal	1.3.6.1.4.1.1369.5.2.1.11.2.1	CounterBasedGauge64	read-only	Total swap space
NUM fwSwapBytesUnused	1.3.6.1.4.1.1369.5.2.1.11.2.3	CounterBasedGauge64	read-only	Amount of unused space of swap
NUM fwSwapBytesUsed	1.3.6.1.4.1.1369.5.2.1.11.2.2	CounterBasedGauge64	read-only	Used space of swap
fwVpnEp4Entry	1.3.6.1.4.1.1369.5.2.1.13.1		not-accessible	Row for an IPv4 VPN end-point pair
I32 fwVpnEp4Index	1.3.6.1.4.1.1369.5.2.1.13.1.1	Integer32	not-accessible	A unique value, greater than zero, for each end-point pair.
C32 fwVpnEp4IpsecSa	1.3.6.1.4.1.1369.5.2.1.13.1.7	Counter32	read-only	Number of currently established IPsec SAs between the end-point pair
ADR fwVpnEp4Local	1.3.6.1.4.1.1369.5.2.1.13.1.2	InetAddressIPv4	read-only	Local IPv4 end-point address
C64 fwVpnEp4ReceivedBytes	1.3.6.1.4.1.1369.5.2.1.13.1.5	Counter64	read-only	Number of received bytes between the end-point pair
ADR fwVpnEp4Remote	1.3.6.1.4.1.1369.5.2.1.13.1.3	InetAddressIPv4	read-only	Remote IPv4 end-point address
NUM fwVpnEp4RemoteType	1.3.6.1.4.1.1369.5.2.1.13.1.4	VpnEndpointType	read-only	The type of remote VPN end-point
C64 fwVpnEp4SentBytes	1.3.6.1.4.1.1369.5.2.1.13.1.6	Counter64	read-only	Number of sent bytes between the end-point pair
fwVpnEp4Table	1.3.6.1.4.1.1369.5.2.1.13		not-accessible	This table contains an entry for each IPv4 VPN end-point pair
fwVpnEp6Entry	1.3.6.1.4.1.1369.5.2.1.14.1		not-accessible	Row for an IPv6 VPN end-point pair
I32 fwVpnEp6Index	1.3.6.1.4.1.1369.5.2.1.14.1.1	Integer32	not-accessible	A unique value, greater than zero, for each end-point pair.
C32 fwVpnEp6IpsecSa	1.3.6.1.4.1.1369.5.2.1.14.1.7	Counter32	read-only	Number of currently established IPsec SAs between the end-point pair
ADR fwVpnEp6Local	1.3.6.1.4.1.1369.5.2.1.14.1.2	InetAddressIPv6	read-only	Local IPv6 end-point address
C64 fwVpnEp6ReceivedBytes	1.3.6.1.4.1.1369.5.2.1.14.1.5	Counter64	read-only	Number of received bytes between the end-point pair
ADR fwVpnEp6Remote	1.3.6.1.4.1.1369.5.2.1.14.1.3	InetAddressIPv6	read-only	Remote IPv6 end-point address
NUM fwVpnEp6RemoteType	1.3.6.1.4.1.1369.5.2.1.14.1.4	VpnEndpointType	read-only	The type of remote VPN end-point
C64 fwVpnEp6SentBytes	1.3.6.1.4.1.1369.5.2.1.14.1.6	Counter64	read-only	Number of sent bytes between the end-point pair
fwVpnEp6Table	1.3.6.1.4.1.1369.5.2.1.14		not-accessible	This table contains an entry for each IPv6 VPN end-point pair
stonesoftFirewallMibModule	1.3.6.1.4.1.1369.3.3			MIB for Forcepoint's Stonesoft NGFW

RFC description

Stonesoft/Forcepoint enterprise MIB for NGFW (Next-Generation Firewall) engines that manages firewall-specific objects including security policies, software versions, and firewall events. Provides SNMP monitoring and configuration capabilities for firewall/VPN, IPS, and Layer 2 Firewall roles.

Start monitoring Forcepoint Stonesoft next-generation firewall (policy/connection statistics) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download STONESOFT-FIREWALL-MIB