WATCHGUARD-IPSEC-TUNNEL-MIB

All MIBs › WATCHGUARD-IPSEC-TUNNEL-MIB

Organization: WatchGuard Technologies, Inc.

Last Updated: 2007-01-25

Category: WatchGuard Security Appliances

Description: Manages WatchGuard IPsec VPN tunnel parameters, security associations, encryption settings, and throughput statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is WATCHGUARD-IPSEC-TUNNEL-MIB?

WATCHGUARD-IPSEC-TUNNEL-MIB is a WatchGuard Technologies vendor-specific MIB that models active IPsec tunnels on WatchGuard security appliances, defining a single wgIpsecTunnelTable indexed by wgIpsecTunnelID with a wide SEQUENCE covering tunnel endpoints (wgIpsecTunnelLocalAddr, wgIpsecTunnelPeerAddr), security association parameters (wgIpsecTunnelInSpi, wgIpsecTunnelOutSpi, wgIpsecTunnelEspEncryptAlg, wgIpsecTunnelEspAuthAlg, wgIpsecTunnelMode, wgIpsecTunnelKeyMode), and traffic/error counters (wgIpsecTunnelInKbytes, wgIpsecTunnelOutKbytes, wgIpsecTunnelInDecryptErrors, wgIpsecTunnelInAuthErrors, wgIpsecTunnelInReplayErrors). It also captures traffic-selector detail (wgIpsecTunnelSelectorRemoteIPOne/Two, wgIpsecTunnelSelectorLocalIPType) and UDP-encapsulation state (wgIpsecTunnelUdpEncap, wgIpsecTunnelPeerUdpPort) for NAT-traversed tunnels, useful for spotting decryption/authentication/replay failures, rekey frequency anomalies, or tunnels that have silently dropped selector traffic. It is deployed on WatchGuard Firebox/XTM security appliances and depends on the base WATCHGUARD-MIB for its enterprise registration point; security teams can download the WATCHGUARD-IPSEC-TUNNEL-MIB file to load it into their MIB browser to monitor VPN tunnel health.

IPNetwork Monitor allows you to monitor SNMP objects defined in WATCHGUARD-IPSEC-TUNNEL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

WatchGuard Firebox and XTM security appliances

Monitoring Examples

An operator polls wgIpsecTunnelTable (indexed by wgIpsecTunnelID) to check wgIpsecTunnelInDecryptErrors and wgIpsecTunnelInAuthErrors against wgIpsecTunnelInPackets for a given peer; a rising error count alongside stagnant wgIpsecTunnelAccSecs would indicate the tunnel's security association has desynchronized, likely due to a key mismatch between the two gateways.

What Can Be Monitored

active IPsec tunnel count and per-tunnel identity
encryption/authentication algorithm in use
inbound/outbound traffic byte and packet counters
decrypt/authentication/replay error counters
rekey count and UDP-encapsulation/NAT-traversal state

Imported Objects

From SNMPv2-SMI

Counter32
Counter64
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32
enterprises

From SNMPv2-TC

DateAndTime

From WATCHGUARD-MIB

watchguard

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
wgInfoModule	1.3.6.1.4.1.3097.6			The MIB module describes various tunnel objects of WatchGuard system.
wgIpsecTunnelMIB	1.3.6.1.4.1.3097.6.5			This is the base object identifier for all tunnel branches.
wgIpsecTunnel	1.3.6.1.4.1.3097.6.5.1			This is the base object identifier for all tunnel information.
U32 wgIpsecTunnelNum	1.3.6.1.4.1.3097.6.5.1.1	Unsigned32	read-only	The total number of entries in the wgIpsecTunnelTable.
wgIpsecTunnelTable	1.3.6.1.4.1.3097.6.5.1.2		not-accessible	This is the connection table describing all current tunnels exist on this entity.
wgIpsecTunnelEntry	1.3.6.1.4.1.3097.6.5.1.2.1		not-accessible	An entry (conceptual row) containing the information on a tunnel between two security gateways.
I32 wgIpsecTunnelID	1.3.6.1.4.1.3097.6.5.1.2.1.1	Integer32	read-only	The running index of this tunnel.
IP wgIpsecTunnelLocalAddr	1.3.6.1.4.1.3097.6.5.1.2.1.2	IpAddress	read-only	The local IP address of the current tunnel.
IP wgIpsecTunnelPeerAddr	1.3.6.1.4.1.3097.6.5.1.2.1.3	IpAddress	read-only	The remote IP address of the current tunnel.
I32 wgIpsecTunnelInSpi	1.3.6.1.4.1.3097.6.5.1.2.1.4	Integer32	read-only	The security parameters index of inbound SA's within this tunnel.
I32 wgIpsecTunnelOutSpi	1.3.6.1.4.1.3097.6.5.1.2.1.5	Integer32	read-only	The security parameters index of outbound SA's within this tunnel.
DAT wgIpsecTunnelCreateTime	1.3.6.1.4.1.3097.6.5.1.2.1.6	DateAndTime	read-only	The date and time when the tunnel is created.
U32 wgIpsecTunnelDeviceID	1.3.6.1.4.1.3097.6.5.1.2.1.7	Unsigned32	read-only	The identifier of target device where the SA resides.
INT wgIpsecTunnelEspEncryptAlg	1.3.6.1.4.1.3097.6.5.1.2.1.8	INTEGER	read-only	The encryption algorithm used in the tunnel. It's 0 if ESP is not used.
INT wgIpsecTunnelEspAuthAlg	1.3.6.1.4.1.3097.6.5.1.2.1.9	INTEGER	read-only	The authentication algorithm used in the tunnel. It's 0 if ESP is not used.
INT wgIpsecTunnelAhAuthAlg	1.3.6.1.4.1.3097.6.5.1.2.1.10	INTEGER	read-only	The AH authentication algorithm used in the tunnel. It's 0 if AH is not used.
INT wgIpsecTunnelMode	1.3.6.1.4.1.3097.6.5.1.2.1.11	INTEGER	read-only	The tunnel/transport mode of the tunnel.
INT wgIpsecTunnelKeyMode	1.3.6.1.4.1.3097.6.5.1.2.1.12	INTEGER	read-only	The key mode of the tunnel.
TIK wgIpsecTunnelLifeTime	1.3.6.1.4.1.3097.6.5.1.2.1.13	TimeTicks	read-only	The life time (in hundredths of a second) of the tunnel.
C32 wgIpsecTunnelLifeLength	1.3.6.1.4.1.3097.6.5.1.2.1.14	Counter32	read-only	The maximum traffic in bytes that the tunnel is allowed to support.
C32 wgIpsecTunnelInSaBytes	1.3.6.1.4.1.3097.6.5.1.2.1.15	Counter32	read-only	Current active inbound SA bytes of the tunnel.
C32 wgIpsecTunnelOutSaBytes	1.3.6.1.4.1.3097.6.5.1.2.1.16	Counter32	read-only	Current active outbound SA bytes of the tunnel.
C32 wgIpsecTunnelAccSecs	1.3.6.1.4.1.3097.6.5.1.2.1.17	Counter32	read-only	The number of seconds that the tunnel has existed.
INT wgIpsecTunnelSelectorProtocol	1.3.6.1.4.1.3097.6.5.1.2.1.18	INTEGER	read-only	The ip protocol number that this SA selector carries, or 0 if it carries any protocol.
INT wgIpsecTunnelSelectorRemoteIPType	1.3.6.1.4.1.3097.6.5.1.2.1.19	INTEGER	read-only	The type of remote IP address of the SA selector in the entity.
IP wgIpsecTunnelSelectorRemoteIPOne	1.3.6.1.4.1.3097.6.5.1.2.1.20	IpAddress	read-only	The first remote IP address of the SA selector in the entity. It's IP address if remote IP of this selector only has one address. It's IP address of subnet if the remote IP of this selector is IP subnet. It's the start IP address if the remote IP of this selector has a range of addresses.
IP wgIpsecTunnelSelectorRemoteIPTwo	1.3.6.1.4.1.3097.6.5.1.2.1.21	IpAddress	read-only	The second remote IP address of the SA selector in the entity. It's 0 if remote IP of this selector only has one address. It's netmask of subnet if the remote IP of this selector is IP subnet. It's the end IP address if the remote IP of this selector has a range of addresses.
INT wgIpsecTunnelSelectorRemotePort	1.3.6.1.4.1.3097.6.5.1.2.1.22	INTEGER	read-only	The remote port used by this selector in the entity.
INT wgIpsecTunnelSelectorLocalIPType	1.3.6.1.4.1.3097.6.5.1.2.1.23	INTEGER	read-only	The type of local IP address of the SA selector in the entity.
IP wgIpsecTunnelSelectorLocalIPOne	1.3.6.1.4.1.3097.6.5.1.2.1.24	IpAddress	read-only	The first local IP address of the SA selector in the entity. It's IP address if local IP of this selector only has one address. It's IP address of subnet if the local IP of this selector is IP subnet. It's the start IP address if the local IP of this selector has a range of IP addresses.
IP wgIpsecTunnelSelectorLocalIPTwo	1.3.6.1.4.1.3097.6.5.1.2.1.25	IpAddress	read-only	The second local IP address of the SA selector in the entity. It's 0 if local IP of this selector only has one address. It's netmask of subnet if the local IP of this selector is IP subnet. It's the end IP address if the local IP of this selector has a range of IP addresses.
INT wgIpsecTunnelSelectorLocalPort	1.3.6.1.4.1.3097.6.5.1.2.1.26	INTEGER	read-only	The local port used by this selector in the entity.
C32 wgIpsecTunnelNumRekey	1.3.6.1.4.1.3097.6.5.1.2.1.27	Counter32	read-only	The number of rekeys of the tunnel.
C32 wgIpsecTunnelInKbytes	1.3.6.1.4.1.3097.6.5.1.2.1.28	Counter32	read-only	Total inbound traffic in Kbytes since the establish of this tunnel.
C32 wgIpsecTunnelOutKbytes	1.3.6.1.4.1.3097.6.5.1.2.1.29	Counter32	read-only	Total outound traffic in Kbytes since the establish of this connection.
C32 wgIpsecTunnelInPackets	1.3.6.1.4.1.3097.6.5.1.2.1.30	Counter32	read-only	Total number of inbound packets since the establish of this connection.
C32 wgIpsecTunnelOutPackets	1.3.6.1.4.1.3097.6.5.1.2.1.31	Counter32	read-only	Total number of outound packets since the establish of this connection.
C32 wgIpsecTunnelInDecryptErrors	1.3.6.1.4.1.3097.6.5.1.2.1.32	Counter32	read-only	Total number of packets discarded due to decryption error since the establish of this connection.
C32 wgIpsecTunnelInAuthErrors	1.3.6.1.4.1.3097.6.5.1.2.1.33	Counter32	read-only	Total number of packets discarded due to authentication error since the establish of this connection.
C32 wgIpsecTunnelInReplayErrors	1.3.6.1.4.1.3097.6.5.1.2.1.34	Counter32	read-only	Total number of packets discarded due to replay error since the establish of this connection.
C32 wgIpsecTunnelInOtherErrors	1.3.6.1.4.1.3097.6.5.1.2.1.35	Counter32	read-only	The number of packets discarded due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element.
C32 wgIpsecTunnelOutDecryptErrors	1.3.6.1.4.1.3097.6.5.1.2.1.36	Counter32	read-only	Total number of packets discarded due to decryption error since the establish of this connection.
C32 wgIpsecTunnelOutAuthErrors	1.3.6.1.4.1.3097.6.5.1.2.1.37	Counter32	read-only	Total number of packets discarded due to authentication error since the establish of this connection.
C32 wgIpsecTunnelOutReplayErrors	1.3.6.1.4.1.3097.6.5.1.2.1.38	Counter32	read-only	Total number of packets discarded due to replay error since the establish of this connection.
C32 wgIpsecTunnelOutOtherErrors	1.3.6.1.4.1.3097.6.5.1.2.1.39	Counter32	read-only	The number of packets discarded due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element.
INT wgIpsecTunnelUdpEncap	1.3.6.1.4.1.3097.6.5.1.2.1.40	INTEGER	read-only	Indicates whether if UDP encapsulated IPSec has been enabled.
INT wgIpsecTunnelPeerUdpPort	1.3.6.1.4.1.3097.6.5.1.2.1.41	INTEGER	read-only	The peer's UDP port of current tunnel when UDP encapsulated IPSec is enabled.
IP wgIpsecTunnelOrigPeerAddr	1.3.6.1.4.1.3097.6.5.1.2.1.42	IpAddress	read-only	The original peer ip address of current tunnel when UDP encapsulated IPSec is enabled

RFC description

Monitors IPsec tunnel statistics and connection information for WatchGuard security gateway appliances.

Start monitoring WatchGuard Firebox and XTM security appliances (per-tunnel SA/traffic/decrypt-error status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download WATCHGUARD-IPSEC-TUNNEL-MIB

What Is WATCHGUARD-IPSEC-TUNNEL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description