VPN-MIB

All MIBs › VPN-MIB

Category: VPN and Tunneling

Description: Provides management objects for monitoring and configuring Virtual Private Network tunnels, peers, and traffic statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is VPN-MIB?

VPN-MIB is a private MIB (commonly associated with WAN/VPN access router platforms) for monitoring and configuring Virtual Private Network tunnels, WAN interfaces, and their associated traffic statistics. It exposes both configuration data (wanIfTable entries per WAN interface) and performance/fault counters such as frames received/transmitted/discarded, receive overruns, aborts, alignment errors, CRC errors, oversized frames, and no-buffer conditions. This makes it directly useful for monitoring the operational health of VPN/WAN links: rising error or discard counters on a wanIfEntry signal a degraded or failing WAN circuit underlying a VPN tunnel, while frame counts confirm the tunnel is passing traffic. It builds on concepts parallel to the standard IF-MIB interface counter model, applied specifically to WAN/VPN interfaces, though it is not itself an IETF-standard module. It is typically deployed on VPN gateway or WAN access routers where administrators need per-tunnel/per-interface traffic and error visibility. Engineers can download the VPN-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in VPN-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

VPN gateway / WAN access router

Monitoring Examples

An administrator polling wanIfTable/wanIfEntry by wanIfIndex can compare wanIfFramesRcvd and wanIfFramesXmit to confirm bidirectional traffic flow across a VPN tunnel's WAN interface. A rising wanIfRcvCRCErr or wanIfRcvAlignErr count would indicate a physical-layer or framing problem on the WAN link, while wanIfRcvNoBuff increments suggest the device is dropping frames due to buffer exhaustion under high load.

What Can Be Monitored

WAN interface frames received/transmitted
frame discard count
receive overrun/abort count
CRC and alignment error count
oversized frame count
no-buffer drop count

Imported Objects

From RFC-1212

OBJECT-TYPE

From RFC-1215

TRAP-TYPE

From RFC1155-SMI

Counter
Gauge
IpAddress
NetworkAddress
TimeTicks
enterprises
mgmt

From SNMPv2-TC

DisplayString

OIDs

OID symbolic	OID numeric	Type	Access	Description
vpnet	1.3.6.1.4.1.1866
NTF skipHdrErr	1.3.6.1.4.1.1866.0.1			SKIP header error. e.g. this packet was not IPSec AH or IPSec ESP.
NTF skipNCounterErr	1.3.6.1.4.1.1866.0.2			SKIP Count N error. Not used.
NTF skipAlgMismatch	1.3.6.1.4.1.1866.0.3			SKIP Algorithm mismatch. The parameters of the VPN that a packet belonged to did not match the VPN parameters in the SKIP header.
NTF authFailure	1.3.6.1.4.1.1866.0.4			SKIP Authentication error. The authentication key in the offending packet was not correct. This trap shows up on the VPNmanager as Invalid Authentication Signature.
NTF authHdrErr	1.3.6.1.4.1.1866.0.5			SKIP Authentication Header error. Not used.
NTF encryptHdrErr	1.3.6.1.4.1.1866.0.6			SKIP Encryption Header error. The packet's ESP trailer wasn't correct.
NTF authFailureLimitErr	1.3.6.1.4.1.1866.0.7			Client Configuration Download failure limit reached.
vpnmib	1.3.6.1.4.1.1866.7
waninterface	1.3.6.1.4.1.1866.7.1
wanIfTable	1.3.6.1.4.1.1866.7.1.1		not-accessible
wanIfEntry	1.3.6.1.4.1.1866.7.1.1.1		not-accessible
INT wanIfIndex	1.3.6.1.4.1.1866.7.1.1.1.1	INTEGER	read-only	A unique value for each interface. 1 - Private port 2 - Public port
INT wanIfFramesRcvd	1.3.6.1.4.1.1866.7.1.1.1.2	INTEGER	read-only	Total frames received on this interface.
INT wanIfFramesXmit	1.3.6.1.4.1.1866.7.1.1.1.3	INTEGER	read-only	Total frames transmitted on this interface.
INT wanIfFramesDisc	1.3.6.1.4.1.1866.7.1.1.1.4	INTEGER	read-only	Total frames discarded on this interface.
INT wanIfRcvOvrn	1.3.6.1.4.1.1866.7.1.1.1.5	INTEGER	read-only	Total frames received on this interface with data overrun errors.
INT wanIfRcvAbort	1.3.6.1.4.1.1866.7.1.1.1.6	INTEGER	read-only	Total frames received on this interface aborted by the sender.
INT wanIfRcvAlignErr	1.3.6.1.4.1.1866.7.1.1.1.7	INTEGER	read-only	Total frames received on this interface with alignment errors.
INT wanIfRcvCRCErr	1.3.6.1.4.1.1866.7.1.1.1.8	INTEGER	read-only	Total frames received on this interface with CRC errors.
INT wanIfRcvFrameLong	1.3.6.1.4.1.1866.7.1.1.1.9	INTEGER	read-only	Total frames received on this interface with length errors.
INT wanIfRcvNoBuff	1.3.6.1.4.1.1866.7.1.1.1.10	INTEGER	read-only	Total frames for which there were no receive buffers available.
INT wanIfXmitUnderrun	1.3.6.1.4.1.1866.7.1.1.1.11	INTEGER	read-only	Total frames with transmit underrun errors.
INT wanIfXmitTimeout	1.3.6.1.4.1.1866.7.1.1.1.12	INTEGER	read-only	Total times we've timed out trying to transmit a frame.
INT wanIfXmitNoBuff	1.3.6.1.4.1.1866.7.1.1.1.13	INTEGER	read-only	Total times there were no transmit buffers available when trying to transmit a frame.
CTR wanIfRcvByteRate	1.3.6.1.4.1.1866.7.1.1.1.14	Counter	read-only	last 16 second average KB per second of data received.
CTR wanIfXmitByteRate	1.3.6.1.4.1.1866.7.1.1.1.15	Counter	read-only	last 16 second average KB per second of data sent.
vpns	1.3.6.1.4.1.1866.7.2
vpnTable	1.3.6.1.4.1.1866.7.2.1		not-accessible
vpnEntry	1.3.6.1.4.1.1866.7.2.1.1		not-accessible
INT vpnIndex	1.3.6.1.4.1.1866.7.2.1.1.1	INTEGER	read-only	A unique value for each VPN. Ranges from 1 to (number of VPNs configured + number of clients configured). So, this table will not map 1-to-1 with the VPNs configured via VPNmanager when VPNRemote clients are configured as part of a VPN. Each client has it's own physical VPN on a VSU.
STR vpnDescr	1.3.6.1.4.1.1866.7.2.1.1.2	DisplayString	read-only	Textual description of this interface. Currently (1/9/98) just shows the VPN decimal id.
INT vpnSkipInPktDecap	1.3.6.1.4.1.1866.7.2.1.1.3	INTEGER	read-only	Total incoming SKIP-decapsulated packets for this VPN.
INT vpnSkipOutPktEncap	1.3.6.1.4.1.1866.7.2.1.1.4	INTEGER	read-only	Total outgoing SKIP-encapsulated packets for this VPN.
INT vpnSkipInPktParseErr	1.3.6.1.4.1.1866.7.2.1.1.5	INTEGER	read-only	Total incoming packets for this VPN with IPSec header errors.
INT vpnSkipInKPUpdt	1.3.6.1.4.1.1866.7.2.1.1.6	INTEGER	read-only	Number of Kp (key material) updates for incoming traffic this VPN. Not currently supported.
INT vpnSkipOutKPUpdt	1.3.6.1.4.1.1866.7.2.1.1.7	INTEGER	read-only	Number of Kp (key material) updates for outgoing traffic this VPN. Not currently supported.
INT vpnOutFrag	1.3.6.1.4.1.1866.7.2.1.1.8	INTEGER	read-only	Total outgoing packets for this VPN that had to be fragmented.
INT vpnOctetsIn	1.3.6.1.4.1.1866.7.2.1.1.9	INTEGER	read-only	Total bytes received for this VPN.
INT vpnOctetsOut	1.3.6.1.4.1.1866.7.2.1.1.10	INTEGER	read-only	Total bytes sent for this VPN.
INT vpnNOutOfOrder	1.3.6.1.4.1.1866.7.2.1.1.11	INTEGER	read-only	Counter N out-of-order errors for this VPN. Not currently supported.
INT vpnSkipAlgMismatch	1.3.6.1.4.1.1866.7.2.1.1.12	INTEGER	read-only	Total number of packets belonging to this VPN with SKIP Algorithm mismatches. That is, the parameters of the VPN that this packet belongs to does not match the VPN parameters in the packet's SKIP header.
INT vpnAuthInPktInvdSig	1.3.6.1.4.1.1866.7.2.1.1.13	INTEGER	read-only	Total number of packets belonging to this VPN with SKIP Authentication errors. That is, the authentication key in the offending packet was not correct. This type of attack results in an authFailure trap which shows up on the VPNmanager as Invalid Authentication Signature.
INT vpnAuthInPktParseErr	1.3.6.1.4.1.1866.7.2.1.1.14	INTEGER	read-only	Not currently supported.
INT vpnEncryptImpEncap	1.3.6.1.4.1.1866.7.2.1.1.15	INTEGER	read-only	Total outgoing packets encrypted for this VPN.
INT vpnEncryptInPktParseErr	1.3.6.1.4.1.1866.7.2.1.1.16	INTEGER	read-only	Total packets belonging to this VPN that had parse errors. For example, encrypted data was not on a 8-byte boundary or the ESP trailer was not of the appropriate size.
log	1.3.6.1.4.1.1866.7.3
logTable	1.3.6.1.4.1.1866.7.3.1		not-accessible
logEntry	1.3.6.1.4.1.1866.7.3.1.1		not-accessible
INT logIndex	1.3.6.1.4.1.1866.7.3.1.1.1	INTEGER	read-only
INT logTime	1.3.6.1.4.1.1866.7.3.1.1.2	INTEGER	read-only
INT logAttackType	1.3.6.1.4.1.1866.7.3.1.1.3	INTEGER	read-only	The type of packet error that caused us to perceive this as an attack. 1 - SKIP header error. e.g. this packet was not IPSec AH or IPSec ESP. 2 - SKIP Counter N error. Not currently (1/9/98) supported. 3 - SKIP Algorithm mismatch. The parameters of the VPN that this packet belongs to does not match the VPN parameters in the SKIP header. 4 - SKIP Authentication error. The authentication key in the offending packet was not correct. This type of attack results in an authFailure trap which shows up on the VPNmanager as Invalid Authentication Signature. 5 - SKIP Authentication Header error. Not supported. 6 - SKIP Encryption Header error. The packet's ESP trailer wasn't correct.
STR logDescription	1.3.6.1.4.1.1866.7.3.1.1.4	DisplayString	read-only
vsuSystem	1.3.6.1.4.1.1866.7.4
CTR cpuUtilization	1.3.6.1.4.1.1866.7.4.1	Counter	read-only
activeSessions	1.3.6.1.4.1.1866.7.5
activeSessionTable	1.3.6.1.4.1.1866.7.5.1		not-accessible
activeSessionEntry	1.3.6.1.4.1.1866.7.5.1.1		not-accessible
STR asName	1.3.6.1.4.1.1866.7.5.1.1.1	DisplayString	read-only	A VPNremote client name or a VSU name as defined in VPNmanager.
TIK asLength	1.3.6.1.4.1.1866.7.5.1.1.2	TimeTicks	read-only	Length of this session in seconds.
IP asOrgIPAddress	1.3.6.1.4.1.1866.7.5.1.1.3	IpAddress	read-only	VPNremote client's originating IP address or remote VSU IP address.
IP asXlateIPAddress	1.3.6.1.4.1.1866.7.5.1.1.4	IpAddress	read-only	VPNremote client's assigned address from the Client IP Address pool if configured. If the Client IP Address pool is not configured or this session is from a VSU then this attribute is empty.
STR asDescr	1.3.6.1.4.1.1866.7.5.1.1.5	DisplayString	read-only	Textual description of this VPN indicating what key management is being used and what encryption, authentication and compression algorithms are being used. For example: IKE, 3DES, MD5, Compression.
CTR asPktsIn	1.3.6.1.4.1.1866.7.5.1.1.6	Counter	read-only	Number of packets sent to this VSU from the VPNremote Client or remote VSU indicated by asName during this session.
CTR asPktsOut	1.3.6.1.4.1.1866.7.5.1.1.7	Counter	read-only	Number of packets sent from this VSU to the VPNremote Client or remote VSU indicated by asName during this session.
CTR asBytesIn	1.3.6.1.4.1.1866.7.5.1.1.8	Counter	read-only	Number of bytes sent to this VSU from the VPNremote Client or remote VSU indicated by asName during this session.
CTR asBytesOut	1.3.6.1.4.1.1866.7.5.1.1.9	Counter	read-only	Number of bytes sent from this VSU to the VPNremote Client or remote VSU indicated by asName during this session.

RFC description

Management of VPN interfaces, session states, and network traffic accounting on WAN and public ports.

Start monitoring VPN gateway / WAN access router (per-interface frame/error/discard counter status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download VPN-MIB

What Is VPN-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description