STORMSHIELD-IF-MIB

All MIBs › STORMSHIELD-IF-MIB

Organization: Stormshield

Last Updated: 2017-02-20

Category: Firewall / Security Appliance, Stormshield

Description: Manages Stormshield firewall network interface configuration, link status, and traffic statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is STORMSHIELD-IF-MIB?

STORMSHIELD-IF-MIB is a vendor module from Stormshield (a network security/firewall vendor, formerly Netasq) covering the network interfaces on its firewall/UTM appliances. It exposes interface-oriented data: per-interface configuration, link/operational status, and traffic statistics. Its monitoring emphasis is on hardware and software interface status - link up/down state and throughput/error counters reveal whether a firewall's physical or virtual interfaces (WAN, LAN, DMZ) are healthy and passing expected traffic volumes. It functions as a Stormshield-specific companion/extension to the standard IETF IF-MIB rather than a replacement for it. It is deployed on Stormshield SNS security appliances protecting enterprise or branch-office network perimeters, and administrators can download the STORMSHIELD-IF-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in STORMSHIELD-IF-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Stormshield firewall/UTM appliance

Monitoring Examples

No concrete object or table names were supplied for this module, so specific identifiers can't be quoted, but the description points to per-interface link-status and traffic-counter data analogous to an IF-MIB style ifTable/ifXTable extension. An administrator would poll such an interface table to confirm a firewall's WAN interface remains up and watch traffic byte/packet counters for unusual spikes indicating an attack or misrouted traffic. A link-down status on a critical interface would be the primary anomaly this MIB is meant to surface.

What Can Be Monitored

interface link status
interface traffic statistics (bytes/packets)
interface configuration state

Imported Objects

From RFC1213-MIB

DisplayString

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From STORMSHIELD-SMI-MIB

stormshieldMIB

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using snsifPktAccepted OID:

Select a Stormshield SNS firewall/UTM appliance (interface link/traffic status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type snsifPktAccepted into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports number of accepted packets. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
snsif	1.3.6.1.4.1.11256.1.4			stormshield Interface MIBS
snsifTable	1.3.6.1.4.1.11256.1.4.1		not-accessible	List of interfaces
snsifEntry	1.3.6.1.4.1.11256.1.4.1.1		not-accessible	Each entry in the snsifTable holds a set of information.
INT snsifIndex	1.3.6.1.4.1.11256.1.4.1.1.1	INTEGER	read-only	A unique value for the table. Its value ranges between 1 and 65535 and may not be contigous. the index has no other meaning but a pure index
STR snsifUserName	1.3.6.1.4.1.11256.1.4.1.1.2	SnmpAdminString	read-only	User interface name
STR snsifName	1.3.6.1.4.1.11256.1.4.1.1.3	DisplayString	read-only	System interface name
STR snsifAddr	1.3.6.1.4.1.11256.1.4.1.1.4	DisplayString	read-only	Interface address
STR snsifMask	1.3.6.1.4.1.11256.1.4.1.1.5	DisplayString	read-only	Interface mask
STR snsifType	1.3.6.1.4.1.11256.1.4.1.1.6	DisplayString	read-only	Interface type
I32 snsifColor	1.3.6.1.4.1.11256.1.4.1.1.7	Integer32	read-only
I32 snsifMacThroughput	1.3.6.1.4.1.11256.1.4.1.1.8	Integer32	read-only
I32 snsifCurThroughput	1.3.6.1.4.1.11256.1.4.1.1.9	Integer32	read-only	incoming + outgoing current throughput in B/s
I32 snsifMaxThroughput	1.3.6.1.4.1.11256.1.4.1.1.10	Integer32	read-only	incoming + outgoing maximum throughput in B/s
C64 snsifPktAcceptedEx	1.3.6.1.4.1.11256.1.4.1.1.11	Counter64	read-only	number of accepted packets
C64 snsifPktBlocked	1.3.6.1.4.1.11256.1.4.1.1.12	Counter64	read-only	number of packets that have been blocked
C64 snsifPktFragmented	1.3.6.1.4.1.11256.1.4.1.1.13	Counter64	read-only	number of fragmented packets
C64 snsifPktTcp	1.3.6.1.4.1.11256.1.4.1.1.14	Counter64	read-only	Number of TCP packets forwarded
C64 snsifPktUdp	1.3.6.1.4.1.11256.1.4.1.1.15	Counter64	read-only	Number of UDP packets forwarded
C64 snsifPktIcmp	1.3.6.1.4.1.11256.1.4.1.1.16	Counter64	read-only	Number of ICMP packets forwarded
C64 snsifTotalBytes	1.3.6.1.4.1.11256.1.4.1.1.17	Counter64	read-only	data bytes forwarded
C64 snsifTcpBytes	1.3.6.1.4.1.11256.1.4.1.1.18	Counter64	read-only	incoming + outgoing TCP data bytes
C64 snsifUdpBytes	1.3.6.1.4.1.11256.1.4.1.1.19	Counter64	read-only	incoming + outgoing UDP data bytes
C64 snsifIcmpBytes	1.3.6.1.4.1.11256.1.4.1.1.20	Counter64	read-only	incoming + outgoing ICMP data bytes
C64 snsifTcpConn	1.3.6.1.4.1.11256.1.4.1.1.21	Counter64	read-only	TCP connection established
C64 snsifUdpConn	1.3.6.1.4.1.11256.1.4.1.1.22	Counter64	read-only	UDP connection established
I32 snsifTcpConnCount	1.3.6.1.4.1.11256.1.4.1.1.23	Integer32	read-only	current TCP connection count
I32 snsifUdpConnCount	1.3.6.1.4.1.11256.1.4.1.1.24	Integer32	read-only	current UCP connection count
I32 snsifInCurThroughput	1.3.6.1.4.1.11256.1.4.1.1.25	Integer32	read-only	Incoming Current throughput in B/s
I32 snsifOutCurThroughput	1.3.6.1.4.1.11256.1.4.1.1.26	Integer32	read-only	Outgoing Current throughput in B/s
I32 snsifInMaxThroughput	1.3.6.1.4.1.11256.1.4.1.1.27	Integer32	read-only	Incoming maximum throughput in B/s
I32 snsifOutMaxThroughput	1.3.6.1.4.1.11256.1.4.1.1.28	Integer32	read-only	Outgoing maximum throughput in B/s
C64 snsifInTotalBytes	1.3.6.1.4.1.11256.1.4.1.1.29	Counter64	read-only	Incoming data bytes
C64 snsifOutTotalBytes	1.3.6.1.4.1.11256.1.4.1.1.30	Counter64	read-only	Outgoing data bytes
C64 snsifInTcpBytes	1.3.6.1.4.1.11256.1.4.1.1.31	Counter64	read-only	Incoming TCP data bytes
C64 snsifOutTcpBytes	1.3.6.1.4.1.11256.1.4.1.1.32	Counter64	read-only	Outgoing TCP data bytes
C64 snsifInUdpBytes	1.3.6.1.4.1.11256.1.4.1.1.33	Counter64	read-only	Incoming UDP data bytes
C64 snsifOutUdpBytes	1.3.6.1.4.1.11256.1.4.1.1.34	Counter64	read-only	Outgoing UDP data bytes
C64 snsifInIcmpBytes	1.3.6.1.4.1.11256.1.4.1.1.35	Counter64	read-only	Incoming ICMP data bytes
C64 snsifOutIcmpBytes	1.3.6.1.4.1.11256.1.4.1.1.36	Counter64	read-only	Outgoing ICMP data bytes
I32 snsifProtected	1.3.6.1.4.1.11256.1.4.1.1.37	Integer32	read-only	Is interface protected ?
STR snsifDrvName	1.3.6.1.4.1.11256.1.4.1.1.38	DisplayString	read-only	Driver interface name

RFC description

Stormshield security appliance interface statistics and traffic monitoring.

Start monitoring Stormshield SNS firewall/UTM appliance (interface link/traffic status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download STORMSHIELD-IF-MIB