STONESOFT-NETNODE-MIB

All MIBs › STONESOFT-NETNODE-MIB

Organization: Forcepoint LLC

Last Updated: 2016-05-06

Category: Firewall / Security Appliance

Description: Manages Stonesoft network node identity, cluster membership, and component operational status.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is STONESOFT-NETNODE-MIB?

STONESOFT-NETNODE-MIB is a Stonesoft (a security appliance vendor, later acquired by McAfee/Forcepoint) MIB for managing generic network node identity, cluster membership, and operational status of Stonesoft security appliances such as firewalls and clustered security nodes. It exposes cluster and member identifiers, node operational state, CPU load, login/session activity timestamps, hardware monitoring event notifications, appliance model and serial number, and policy-apply timing. Its monitoring value directly covers hardware/software status: nodeOperState and nodeHwmonEvent reveal operational and hardware-health condition, nodeCPULoad tracks CPU utilization, and nodePolicyApplyTime/nodeLastLoginTime track software/security-policy lifecycle and administrative access events. It defines its own generic network-node model rather than explicitly importing from another standard MIB, though it parallels concepts found in general system/host MIBs. It is typically deployed on Stonesoft (StoneGate) firewall and security appliance clusters in enterprise perimeter security environments. Engineers can download the STONESOFT-NETNODE-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in STONESOFT-NETNODE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Stonesoft (StoneGate) firewall and security appliance clusters

Monitoring Examples

An operator would poll nodeOperState and nodeCPULoad to confirm a Stonesoft cluster member is up and not overloaded, and watch nodeHwmonEvent for hardware monitoring alerts such as a fan or power fault. Checking nodeClusterId and nodeMemberId together with nodePolicyApplyTime would reveal whether a specific cluster node has successfully applied the latest security policy, while a stale nodeLastLoginTime alongside an unexpected nodeOperState change could indicate an unauthorized access attempt or node failover event.

What Can Be Monitored

node operational state
CPU load
hardware monitoring events/alarms
cluster and member identity
policy apply timestamp
last login time/activity

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
TimeStamp

From STONESOFT-SMI-MIB

stonesoftModules	OBJECT-IDENTITY
stonesoftNetworkNode	OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using nodeOperState OID:

Select a Forcepoint Stonesoft (StoneGate) firewall/security appliance cluster (node/cluster status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nodeOperState into the Find box to locate it in the OID tree, then select it and click OK. The operative (clustering) state of the node. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value is 'unknown', or it goes 'offline'/'lockedOffline' unexpectedly, since 'online'/'standby'/'lockedOnline' are all normal depending on this node's role in the cluster. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
stonesoftNetworkNodeMibModule	1.3.6.1.4.1.1369.3.4			MIB for generic network nodes
netNodeObjects	1.3.6.1.4.1.1369.6.1.1
I32 nodeClusterId	1.3.6.1.4.1.1369.6.1.1.1	Integer32	read-only	The identification number of the cluster this node belongs to
I32 nodeMemberId	1.3.6.1.4.1.1369.6.1.1.2	Integer32	read-only	Node's member identification within the cluster
INT nodeOperStateEx	1.3.6.1.4.1.1369.6.1.1.3	INTEGER	read-only	The operative (clustering) state of the node
I32 nodeCPULoad	1.3.6.1.4.1.1369.6.1.1.4	Integer32	read-only	The CPU load percentage on the node
STR nodeLastLogin	1.3.6.1.4.1.1369.6.1.1.5	DisplayString	read-only	The most recent login event on the node
TIM nodeLastLoginTime	1.3.6.1.4.1.1369.6.1.1.6	TimeStamp	read-only	Timestamp of the most recent login event on the node
nodeTestTable	1.3.6.1.4.1.1369.6.1.1.7		not-accessible	This table contains an entry for each test instance that was configured to send a trap on test failure
nodeTestEntry	1.3.6.1.4.1.1369.6.1.1.7.1		not-accessible	Row for a test instance
U32 nodeTestIndex	1.3.6.1.4.1.1369.6.1.1.7.1.1	Unsigned32	not-accessible	Unique positive integer index of the nodeTest instance
STR nodeTestIdentity	1.3.6.1.4.1.1369.6.1.1.7.1.2	DisplayString	read-only	Identification string of a nodeTest
INT nodeTestResult	1.3.6.1.4.1.1369.6.1.1.7.1.3	INTEGER	read-only	The most recent result of the nodeTest
TIM nodeTestResultTime	1.3.6.1.4.1.1369.6.1.1.7.1.4	TimeStamp	read-only	The timestamp of the most recent result of the nodeTest
STR nodeHwmonEvent	1.3.6.1.4.1.1369.6.1.1.8	DisplayString	read-only	Reason for the hardware monitoring event
STR nodeApplianceModel	1.3.6.1.4.1.1369.6.1.1.9	DisplayString	read-only	Appliance model name
STR nodeSerialNumber	1.3.6.1.4.1.1369.6.1.1.10	DisplayString	read-only	Appliance serial number
STR nodePosCode	1.3.6.1.4.1.1369.6.1.1.11	DisplayString	read-only	Appliance POS code
DAT nodeLoginTime	1.3.6.1.4.1.1369.6.1.1.12	DateAndTime	read-only	The most recent login event on the node
DAT nodePolicyApplyTime	1.3.6.1.4.1.1369.6.1.1.13	DateAndTime	read-only	The time when the security policy was installed to the node
netNodeEvents	1.3.6.1.4.1.1369.6.1.2
netNodeEventsV2	1.3.6.1.4.1.1369.6.1.2.0
NTF nodeOnline	1.3.6.1.4.1.1369.6.1.2.0.1			A node has gone to an online state
NTF nodeOffline	1.3.6.1.4.1.1369.6.1.2.0.2			A node has gone to an offline or standby state
NTF nodeBoot	1.3.6.1.4.1.1369.6.1.2.0.3			A node has booted up
NTF nodeShutdown	1.3.6.1.4.1.1369.6.1.2.0.4			A node is shutting down
NTF nodeUserLogin	1.3.6.1.4.1.1369.6.1.2.0.5			A user has started a login session
NTF nodeTestFailure	1.3.6.1.4.1.1369.6.1.2.0.6			NodeTest has failed
NTF nodeHwmon	1.3.6.1.4.1.1369.6.1.2.0.7			Hardware monitoring system has detected problems
NTF nodeFailedUserLogin	1.3.6.1.4.1.1369.6.1.2.0.8			Failed user login
NTF nodeUserLogout	1.3.6.1.4.1.1369.6.1.2.0.9			A user has finished session
netNodeConformance	1.3.6.1.4.1.1369.6.1.3
netNodeGroups	1.3.6.1.4.1.1369.6.1.3.1
nodeIdentificationGroup	1.3.6.1.4.1.1369.6.1.3.1.1			A collection of objects identifying the node in a cluster
nodeStatusGroup	1.3.6.1.4.1.1369.6.1.3.1.2			A collection of objects giving information about the status of the node
nodeLoginGroup	1.3.6.1.4.1.1369.6.1.3.1.3			A collection of objects giving information about logins into the node
nodeTesterGroup	1.3.6.1.4.1.1369.6.1.3.1.4			A collection of objects giving information about the tests in the test subsystem of the node
nodeStatusNotificationsGroup	1.3.6.1.4.1.1369.6.1.3.1.5			A collection of notifications informing about changes in a node's status
nodeLoginNotificationsGroup	1.3.6.1.4.1.1369.6.1.3.1.6			A collection of notifications informing about user logins
nodeTesterNotificationsGroup	1.3.6.1.4.1.1369.6.1.3.1.7			A collection of notifications informing about test failures
nodeHwmonGroup	1.3.6.1.4.1.1369.6.1.3.1.8			A collection of objects giving information about hardware monitoring events in the node
nodeHwmonNotificationsGroup	1.3.6.1.4.1.1369.6.1.3.1.9			A collection of notifications informing about hardware monitoring issues
netNodeCompliances	1.3.6.1.4.1.1369.6.1.3.2
nodeCompliance1	1.3.6.1.4.1.1369.6.1.3.2.1			The compliance statement for network nodes

RFC description

Generic network node monitoring for firewalls, gateways, and security appliances.

Start monitoring Forcepoint Stonesoft (StoneGate) firewall/security appliance cluster (node/cluster status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download STONESOFT-NETNODE-MIB