TPT-NGFW-POLICY-MIB

All MIBs › TPT-NGFW-POLICY-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention

Description: Manages Trend Micro TippingPoint NGFW security policy rules, zones, and enforcement actions.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-NGFW-POLICY-MIB?

TPT-NGFW-POLICY-MIB is Trend Micro's enterprise MIB (inherited from the TippingPoint product line) for Next-Generation Firewall products, focused on policy enforcement events rather than device inventory. It defines a rich set of notification objects that report firewall rule and IPS (Intrusion Prevention System) policy actions, including event source, event type, severity, correlation ID, the specific rule name matched, the interfaces involved, and source IP address details. Rather than hardware sensors, this MIB's monitoring value is squarely in software/security status: it lets an administrator see, in near real time, which firewall/IPS rule fired, what action was taken (block, quarantine, allow), and the severity of the event, which is essential for detecting active attacks or policy misconfigurations. Its scope covers "Firewall rules, IPS, Reputation profiles, Quarantine" as stated in the module description, implying it works together with Trend Micro's broader NGFW MIB family for interface and system status. This MIB is deployed on Trend Micro TippingPoint Next-Generation Firewall appliances protecting enterprise and data-center network perimeters. Engineers can download the TPT-NGFW-POLICY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-NGFW-POLICY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Keysight (Ixia) TippingPoint Next-Generation Firewall/IPS appliances (formerly Trend Micro/HP/3Com TippingPoint)

Monitoring Examples

An administrator would subscribe to traps carrying tptNgfwPolicyNotifyRuleName, tptNgfwPolicyNotifyActionType, and tptNgfwPolicyNotifyEventSeverity to see which policy rule triggered an enforcement action and how severe it was rated. Correlating tptNgfwPolicyNotifyCorrelationId across multiple notifications lets an analyst group related events from the same attack session, while tptNgfwPolicyNotifyInInterface/tptNgfwPolicyNotifyOutInterface identify which network segment the traffic traversed. A burst of high-severity notifications sharing the same tptNgfwPolicyNotifySrcIpAddrType/source address would flag a single host as the likely source of an ongoing attack.

What Can Be Monitored

firewall/IPS rule name matched
policy action taken (block/allow/quarantine)
event severity
event correlation ID
source/destination interface
source IP address

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
TEXTUAL-CONVENTION

From TPT-NGFW-REG-MIB

tpt-ngfw-compls
tpt-ngfw-eventsV2
tpt-ngfw-groups
tpt-ngfw-objs
tpt-ngfw-params

From TPT-NGFW-SYSTEM-INFO-MIB

tptNgfwSystemSerial

OBJECT-TYPE

OIDs

OID symbolic	OID numeric	Type	Access	Description
tptNgfwPolicyGroup	1.3.6.1.4.1.10734.3.9.1.1.7			Policy group consisting of firewall, IPS, Reputation, and Quarantine information.
tptNgfwPolicyNotificationGroup	1.3.6.1.4.1.10734.3.9.1.1.8			Notification sent from TippingPoint Next-generation Firewall rules and inspection profiles.
tptNgfwPolicyCompl	1.3.6.1.4.1.10734.3.9.1.2.4			Compliance for TippingPoint Next-generation Firewall policies.
tptNgfwPolicy	1.3.6.1.4.1.10734.3.9.2.4			Policy information and notifications for TippingPoint Next-Generation Firewall products. This includes Firewall rules, IPS, Reputation profiles, Quarantine. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
NTF tptNgfwPolicyNotify	1.3.6.1.4.1.10734.3.9.3.0.10			A notification sent when a firewall rule, IPS, Reputation, or Quarantine profile detects a network event of interest.
DAT tptNgfwPolicyNotifyTime	1.3.6.1.4.1.10734.3.9.3.1.20	DateAndTime	accessible-for-notify	The time when the firewall detected a network event and generated this policy notification.
EVE tptNgfwPolicyNotifyEventSource	1.3.6.1.4.1.10734.3.9.3.1.21	EventSource	accessible-for-notify	The policy component (Firewall, IPS, Reputation, Quarantine) that detected a network event and generated this notification.
FIR tptNgfwPolicyNotifyEventType	1.3.6.1.4.1.10734.3.9.3.1.22	FirewallEventType	accessible-for-notify	If the notify event was generated by the firewall, this object indicates what type of event was detected.
EVE tptNgfwPolicyNotifyEventSeverity	1.3.6.1.4.1.10734.3.9.3.1.23	EventSeverity	accessible-for-notify	The severity of the detected network event.
STR tptNgfwPolicyNotifyCorrelationId	1.3.6.1.4.1.10734.3.9.3.1.24	SnmpAdminString	accessible-for-notify	A 128-bit identifier in decimal format. This ID is used to correlate firewall events. For example, a firewall session started and ended notification will have the same correlation ID.
ACT tptNgfwPolicyNotifyActionType	1.3.6.1.4.1.10734.3.9.3.1.25	ActionType	accessible-for-notify	The type of action taken on network traffic matching a firewall rule or inspection profile.
STR tptNgfwPolicyNotifyAction	1.3.6.1.4.1.10734.3.9.3.1.26	SnmpAdminString	accessible-for-notify	This object provides additional description of a firewall action. For example, when a quarantine action occurs, this object details if the action was to place traffic in or out of quarantine.
STR tptNgfwPolicyNotifyActionSetName	1.3.6.1.4.1.10734.3.9.3.1.27	SnmpAdminString	accessible-for-notify	The action set name associated with the firewall rule that detected an event.
STR tptNgfwPolicyNotifyRuleName	1.3.6.1.4.1.10734.3.9.3.1.28	SnmpAdminString	accessible-for-notify	The firewall rule name that has generated the notification.
STR tptNgfwPolicyNotifyInInterface	1.3.6.1.4.1.10734.3.9.3.1.29	SnmpAdminString	accessible-for-notify	The interface name that is receiving the traffic that triggered a firewall action.
STR tptNgfwPolicyNotifyOutInterface	1.3.6.1.4.1.10734.3.9.3.1.30	SnmpAdminString	accessible-for-notify	The interface name sending the suspect traffic.
IPt tptNgfwPolicyNotifySrcIpAddrType	1.3.6.1.4.1.10734.3.9.3.1.31	InetAddressType	accessible-for-notify	The IP address type of the network traffic source.
IP tptNgfwPolicyNotifySrcIpAddr	1.3.6.1.4.1.10734.3.9.3.1.32	InetAddress	accessible-for-notify	The source IP address generating the network traffic that has triggered a firewall action.
U32 tptNgfwPolicyNotifySrcPort	1.3.6.1.4.1.10734.3.9.3.1.33	Unsigned32	accessible-for-notify	The source port generating the network traffic.
IP tptNgfwPolicyNotifySrcTransIpAddr	1.3.6.1.4.1.10734.3.9.3.1.34	InetAddress	accessible-for-notify	The translated (NAT) source IP address.
U32 tptNgfwPolicyNotifySrcTransPort	1.3.6.1.4.1.10734.3.9.3.1.35	Unsigned32	accessible-for-notify	The translated (NAT) source port.
IPt tptNgfwPolicyNotifyDestIpAddrType	1.3.6.1.4.1.10734.3.9.3.1.36	InetAddressType	accessible-for-notify	The destination IP address type.
IP tptNgfwPolicyNotifyDestIpAddr	1.3.6.1.4.1.10734.3.9.3.1.37	InetAddress	accessible-for-notify	The source IP address receiving network traffic that triggered a firewall action.
U32 tptNgfwPolicyNotifyDestPort	1.3.6.1.4.1.10734.3.9.3.1.38	Unsigned32	accessible-for-notify	The source port receiving the network traffic.
IP tptNgfwPolicyNotifyDestTransIpAddr	1.3.6.1.4.1.10734.3.9.3.1.39	InetAddress	accessible-for-notify	The translated (NAT) destination IP address.
U32 tptNgfwPolicyNotifyDestTransPort	1.3.6.1.4.1.10734.3.9.3.1.40	Unsigned32	accessible-for-notify	The translated (NAT) destination port.
STR tptNgfwPolicyNotifyProtocol	1.3.6.1.4.1.10734.3.9.3.1.41	SnmpAdminString	accessible-for-notify	The transport protocol of the suspect traffic.
STR tptNgfwPolicyNotifyApplicationName	1.3.6.1.4.1.10734.3.9.3.1.42	SnmpAdminString	accessible-for-notify	The application name generating network traffic that has triggered a firewall rule.
STR tptNgfwPolicyNotifyUserName	1.3.6.1.4.1.10734.3.9.3.1.43	SnmpAdminString	accessible-for-notify	The user name, if available, that is responsible for generating network traffic triggering a firewall action.
C64 tptNgfwPolicyNotifyBytesIn	1.3.6.1.4.1.10734.3.9.3.1.44	Counter64	accessible-for-notify	Source to destination bytes.
C64 tptNgfwPolicyNotifyBytesOut	1.3.6.1.4.1.10734.3.9.3.1.45	Counter64	accessible-for-notify	Destination to source bytes.
C64 tptNgfwPolicyNotifyStartTimeSec	1.3.6.1.4.1.10734.3.9.3.1.46	Counter64	accessible-for-notify	The time, in seconds, from EPOC (January 1, 1970 00:00:00) when the event was detected.
C64 tptNgfwPolicyNotifyStartTimeNano	1.3.6.1.4.1.10734.3.9.3.1.47	Counter64	accessible-for-notify	The fractional time, in nanoseconds, when the event was detected.
C64 tptNgfwPolicyNotifyRateLimit	1.3.6.1.4.1.10734.3.9.3.1.48	Counter64	accessible-for-notify	The rate-limit, in kbps, of the action set associated with this notification.
PAC tptNgfwPolicyNotifyPktTraceVer	1.3.6.1.4.1.10734.3.9.3.1.49	PacketTraceVersion	accessible-for-notify	The packet trace version.
U32 tptNgfwPolicyNotifyPktTraceId	1.3.6.1.4.1.10734.3.9.3.1.50	Unsigned32	accessible-for-notify	The bucket identifier for a packet trace.
U32 tptNgfwPolicyNotifyPktTraceBegin	1.3.6.1.4.1.10734.3.9.3.1.51	Unsigned32	accessible-for-notify	The starting sequence number for a packet trace.
U32 tptNgfwPolicyNotifyPktTraceEnd	1.3.6.1.4.1.10734.3.9.3.1.52	Unsigned32	accessible-for-notify	The ending sequence number for a packet trace.
STR tptNgfwPolicyNotifyFilterName	1.3.6.1.4.1.10734.3.9.3.1.53	SnmpAdminString	accessible-for-notify	The descriptive name of the filter maching the data stream.
STR tptNgfwPolicyNotifyProfileName	1.3.6.1.4.1.10734.3.9.3.1.54	SnmpAdminString	accessible-for-notify	Profile name.
STR tptNgfwPolicyNotifyPolicyName	1.3.6.1.4.1.10734.3.9.3.1.55	SnmpAdminString	accessible-for-notify	The firewall policy name that matched network traffic and caused the firewall to take an action.
STR tptNgfwPolicyNotifyVlanId	1.3.6.1.4.1.10734.3.9.3.1.56	SnmpAdminString	accessible-for-notify	The VLAN tag that the network traffic occured on.
C64 tptNgfwPolicyNotifyHitCount	1.3.6.1.4.1.10734.3.9.3.1.57	Counter64	accessible-for-notify	Hit count. The number of times, the firewall detected a particulare event as defined by a rule or inspection profile.
STR tptNgfwPolicyNotifyMsgParams	1.3.6.1.4.1.10734.3.9.3.1.58	SnmpAdminString	accessible-for-notify	A string containing parameters (separated by vertical bars) matching the Message in the Digital Vaccine (the XML tag is Message).
U32 tptNgfwPolicyNotifyPeriod	1.3.6.1.4.1.10734.3.9.3.1.59	Unsigned32	accessible-for-notify	The aggregation period, in minutes, when the condition is frist detected and this notification sent.

RFC description

Manages security policies and notifications on TippingPoint Next-Generation Firewalls, including firewall rules, IPS profiles, and quarantine controls.

Start monitoring Keysight TippingPoint NGFW/IPS appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-NGFW-POLICY-MIB

What Is TPT-NGFW-POLICY-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description