WATCHGUARD-IPSEC-ENDPOINT-PAIR-MIB

All MIBs › WATCHGUARD-IPSEC-ENDPOINT-PAIR-MIB

Organization: WatchGuard Technologies, Inc.

Last Updated: 2007-01-25

Category: WatchGuard Security Appliances

Description: Monitors WatchGuard IPsec endpoint pair configurations, tunnel states, and traffic statistics per endpoint.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is WATCHGUARD-IPSEC-ENDPOINT-PAIR-MIB?

WATCHGUARD-IPSEC-ENDPOINT-PAIR-MIB is a vendor-specific MIB from WatchGuard Technologies that models IPsec Endpoint Pairs — pairs of security gateways connected by zero or more tunnel-mode IPsec SAs — so that a management station can build a topological view of which gateways are tunneled to which. It exposes wgIpsecEndpointPairTable (indexed by wgIpsecEndpointPairIndex) with per-pair local/peer addresses, inbound/outbound SA counts (wgIpsecEndpointPairInSAs/OutSAs), aggregated traffic in Kbytes and packets, and error counters for decrypt, authentication, replay, policy, pad-value, and other receive/send failures, plus a parallel set of entity-wide totals under wgIpsecEndpointPairStatistics and a wgIpsecEndpointPairPeerIPToTunnelTable mapping peer IPs to tunnel IDs. This gives an operator both per-tunnel and aggregate visibility into IPsec health and throughput without needing to correlate individual SA-level data manually. It depends on the WATCHGUARD-MIB base OID tree for its enterprise placement. Deployed on WatchGuard Firebox/XTM appliances functioning as IPsec gateways, the WATCHGUARD-IPSEC-ENDPOINT-PAIR-MIB MIB gives network administrators a topological view of tunnel-connected security gateways.

IPNetwork Monitor allows you to monitor SNMP objects defined in WATCHGUARD-IPSEC-ENDPOINT-PAIR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

WatchGuard Firebox/XTM security appliances

Monitoring Examples

An operator polls wgIpsecEndpointPairTable to review wgIpsecEndpointPairInSAs/OutSAs and wgIpsecEndpointPairInAccKbytes/OutAccKbytes for a given local/peer address pair; rising wgIpsecEndpointPairDecryptErrors or wgIpsecEndpointPairAuthErrors on that same row would indicate a misconfigured or failing tunnel between the two gateways.

What Can Be Monitored

IPsec endpoint pair inbound/outbound SA counts
aggregated tunnel traffic byte/packet counters
decrypt/auth/replay/policy/pad error counters
peer-IP-to-tunnel mapping table
entity-wide global IPsec tunnel statistics

Imported Objects

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32
enterprises

From WATCHGUARD-MIB

watchguard

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using wgIpsecEndpointPairTotalInAccKbytes OID:

Select a WatchGuard Firebox/XTM security appliance (IPsec endpoint-pair SA-count/traffic/error status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type wgIpsecEndpointPairTotalInAccKbytes into the Find box to locate it in the OID tree, then select it and click OK. The total inbound IPsec traffic of this entity. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in Kbytes), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
wgIpsecEndpointPair	1.3.6.1.4.1.3097.5.1.1			This is the base object identifier for all IPSec tunnel information.
C32 wgIpsecEndpointPairAuthErrors	1.3.6.1.4.1.3097.5.1.1.2.1.11	Counter32	read-only	Total number of packets discarded due to authentication error since the establish of this connection.
C32 wgIpsecEndpointPairDecryptErrors	1.3.6.1.4.1.3097.5.1.1.2.1.10	Counter32	read-only	Total number of packets discarded due to decryption error since the establish of this connection.
wgIpsecEndpointPairEntry	1.3.6.1.4.1.3097.5.1.1.2.1		not-accessible	An entry (conceptual row) containing the information on a IPSec tunnel between two IPSec security gateways.
C32 wgIpsecEndpointPairInAccKbytes	1.3.6.1.4.1.3097.5.1.1.2.1.6	Counter32	read-only	Total inbound traffic in Kbytes since the establish of this connection.
I32 wgIpsecEndpointPairIndex	1.3.6.1.4.1.3097.5.1.1.2.1.1	Integer32	read-only	The running index of this IPSec endpoint pair.
C32 wgIpsecEndpointPairInPackets	1.3.6.1.4.1.3097.5.1.1.2.1.8	Counter32	read-only	Total number of inbound packets since the establish of this connection.
U32 wgIpsecEndpointPairInSAs	1.3.6.1.4.1.3097.5.1.1.2.1.4	Unsigned32	read-only	The number of inbound IPSEC SA's within this IPSec endpoint pair.
IP wgIpsecEndpointPairLocalAddr	1.3.6.1.4.1.3097.5.1.1.2.1.2	IpAddress	read-only	The local IP address of the current IPSec ednpoint pair.
wgIpsecEndpointPairMIB	1.3.6.1.4.1.3097.5.1			This is the base object identifier for all IPSec tunnel branches.
wgIpsecEndpointPairModule	1.3.6.1.4.1.3097.5			The MIB module describes generic Ipsec Endpoint Pair information of WatchGuard system. Mainly, the information obtained from this MIB is used to constructed topological view of IPSec security gateways that are connected by IPSec tunnels. An IPSec Endpoint Pair is a pair of security gateways that are connected with 0 or more IPSec SA's in tunnel mode. It contains information of aggregated information of tunnel mode SA's between two security gateways. An IPSec Endpoint Pair is identified by a pair of IP addresses. Therefore, if an IPSec security gateway X has 2 external IP addresses while IPsec secruity gateway Y has 3 external IP addresses, there are potentially 6 IPsec Endpoint Pairs between X and Y.
U32 wgIpsecEndpointPairNum	1.3.6.1.4.1.3097.5.1.1.1	Unsigned32	read-only	The total number of entries in the wgIpsecEndpointPairTable.
C32 wgIpsecEndpointPairOtherReceiveErrors	1.3.6.1.4.1.3097.5.1.1.2.1.15	Counter32	read-only	The number of packets discarded due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element.
C32 wgIpsecEndpointPairOutAccKbytes	1.3.6.1.4.1.3097.5.1.1.2.1.7	Counter32	read-only	Total outound traffic in Kbytes since the establish of this connection.
C32 wgIpsecEndpointPairOutPackets	1.3.6.1.4.1.3097.5.1.1.2.1.9	Counter32	read-only	Total number of outound packets since the establish of this connection.
U32 wgIpsecEndpointPairOutSAs	1.3.6.1.4.1.3097.5.1.1.2.1.5	Unsigned32	read-only	The number of outbound IPSEC SA's within this IPSec endpoint pair.
C32 wgIpsecEndpointPairPadErrors	1.3.6.1.4.1.3097.5.1.1.2.1.14	Counter32	read-only	Total number of packets discarded due to pad value error since the establish of this connection.
IP wgIpsecEndpointPairPeerAddr	1.3.6.1.4.1.3097.5.1.1.2.1.3	IpAddress	read-only	The remote IP address of the current IPSec endpoint pair.
wgIpsecEndpointPairPeerIPToTunnel	1.3.6.1.4.1.3097.5.1.3			This is the base object identifier for all tunnels information of the policies.
wgIpsecEndpointPairPeerIPToTunnelEntry	1.3.6.1.4.1.3097.5.1.3.2.1		not-accessible	An entry (conceptual row) containing the peer ip and tunnel information.
U32 wgIpsecEndpointPairPeerIPToTunnelNum	1.3.6.1.4.1.3097.5.1.3.1	Unsigned32	read-only	The total number of tunnels in the peeriptotunnel table.
IP wgIpsecEndpointPairPeerIPToTunnelPeerIP	1.3.6.1.4.1.3097.5.1.3.2.1.1	IpAddress	read-only	The peer ip of the peeriptotunnel table.
wgIpsecEndpointPairPeerIPToTunnelTable	1.3.6.1.4.1.3097.5.1.3.2		not-accessible	The peeriptotunnel table in the endpointpair mib.
I32 wgIpsecEndpointPairPeerIPToTunnelTunnelID	1.3.6.1.4.1.3097.5.1.3.2.1.2	Integer32	read-only	The tunnel id of the peeriptotunnel table.
C32 wgIpsecEndpointPairPolicyErrors	1.3.6.1.4.1.3097.5.1.1.2.1.13	Counter32	read-only	Total number of packets discarded due to policy error since the establish of this connection.
C32 wgIpsecEndpointPairReplayErrors	1.3.6.1.4.1.3097.5.1.1.2.1.12	Counter32	read-only	Total number of packets discarded due to replay error since the establish of this connection.
C32 wgIpsecEndpointPairSendErrors	1.3.6.1.4.1.3097.5.1.1.2.1.16	Counter32	read-only	The number of packets discarded due to any error. This may include errors due to a lack of transmit buffers.
wgIpsecEndpointPairStatistics	1.3.6.1.4.1.3097.5.1.2			This is the base object identifier for all objects which are global counters for IPSec tunnels.
wgIpsecEndpointPairTable	1.3.6.1.4.1.3097.5.1.1.2		not-accessible	This is the connection table describing all current IPSec tunnels exist on this entity.
C32 wgIpsecEndpointPairTotalAuthErrors	1.3.6.1.4.1.3097.5.1.2.8	Counter32	read-only	Total number of packets on this entity discarded due to authentication errors.
C32 wgIpsecEndpointPairTotalDecryptErrors	1.3.6.1.4.1.3097.5.1.2.7	Counter32	read-only	Total number of packets on this entity discarded due to encryption error.
C32 wgIpsecEndpointPairTotalInAccKbytesEx	1.3.6.1.4.1.3097.5.1.2.3	Counter32	read-only	The total inbound IPsec traffic of this entity.
C32 wgIpsecEndpointPairTotalInPackets	1.3.6.1.4.1.3097.5.1.2.5	Counter32	read-only	The total inbound IPsec packets of this entity.
G32 wgIpsecEndpointPairTotalInSAs	1.3.6.1.4.1.3097.5.1.2.1	Gauge32	read-only	The total number of active inbound SA's in the entity.
C32 wgIpsecEndpointPairTotalOtherReceiveErrors	1.3.6.1.4.1.3097.5.1.2.12	Counter32	read-only	The total number of packets on this entity discarded due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element.
C32 wgIpsecEndpointPairTotalOutAccKbytes	1.3.6.1.4.1.3097.5.1.2.4	Counter32	read-only	The total outbound IPsec traffic of this entity.
C32 wgIpsecEndpointPairTotalOutPackets	1.3.6.1.4.1.3097.5.1.2.6	Counter32	read-only	The total outbound IPsec packets of this entity.
G32 wgIpsecEndpointPairTotalOutSAs	1.3.6.1.4.1.3097.5.1.2.2	Gauge32	read-only	The total number of active outbound SA's in the entity.
C32 wgIpsecEndpointPairTotalPadErrors	1.3.6.1.4.1.3097.5.1.2.11	Counter32	read-only	Total number of packets on this entity discarded due to pad value error.
C32 wgIpsecEndpointPairTotalPolicyErrors	1.3.6.1.4.1.3097.5.1.2.10	Counter32	read-only	Total number of packets discarded due to policy errors on this entity.
C32 wgIpsecEndpointPairTotalReplayErrors	1.3.6.1.4.1.3097.5.1.2.9	Counter32	read-only	Total number of packets discarded due to replay errors on this entity.
C32 wgIpsecEndpointPairTotalSendErrors	1.3.6.1.4.1.3097.5.1.2.13	Counter32	read-only	The total number of packets discarded due to any error on this entity.

RFC description

Describes IPSec endpoint pair information and tunnel mode security associations between WatchGuard security gateways.

Start monitoring WatchGuard Firebox/XTM security appliances (IPsec endpoint-pair SA-count/traffic/error status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download WATCHGUARD-IPSEC-ENDPOINT-PAIR-MIB