WATCHGUARD-POLICY-MIB

All MIBs › WATCHGUARD-POLICY-MIB

Organization: WatchGuard Technologies, Inc.

Last Updated: 2007-01-25

Category: WatchGuard Security Appliances

Description: Covers WatchGuard firewall policy rules, the traffic actions they trigger, and per-policy connection and byte counts.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is WATCHGUARD-POLICY-MIB?

WATCHGUARD-POLICY-MIB is a WatchGuard-specific module describing the firewall's policy objects -- the rule-based traffic-handling policies that define how traffic is permitted, denied, or otherwise handled on a WatchGuard security appliance. It exposes per-policy configuration (rule definitions and actions) along with per-policy connection and byte counters. Its monitoring value is primarily traffic/software-behavior oriented: tracking how much traffic each firewall policy is handling and how many connections are active under each rule, which helps confirm policies are working as intended and surfaces unusually high traffic or connection volumes. No specific dependency on other MIBs is apparent from the minimal module description. It is deployed on WatchGuard firewall/UTM appliances in perimeter security roles at small-to-midsize business or branch-office networks. Engineers can download the WATCHGUARD-POLICY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in WATCHGUARD-POLICY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

WatchGuard firewall/UTM appliance

Monitoring Examples

No sample object or table names were extracted for this module, so specific identifiers cannot be cited; an administrator would typically poll per-policy connection and byte counters to see which firewall rules are carrying the most traffic and detect an anomalous surge suggesting a misconfigured rule or an attack. Without a verified object list, further detail would be speculative rather than grounded in the MIB.

What Can Be Monitored

firewall policy rule configuration
per-policy connection counts
per-policy byte counters
traffic handling actions

Imported Objects

From SNMPv2-SMI

Counter64
IpAddress
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32
enterprises

From SNMPv2-TC

DateAndTime

From WATCHGUARD-MIB

watchguard

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using wgPolicyBytes OID:

Select a WatchGuard firewall/UTM appliance (per-policy connection/byte-counter status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type wgPolicyBytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the total traffic in bytes since setting up this policy. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
C64 wgPolicyActiveStreams	1.3.6.1.4.1.3097.4.2.2.1.12	Counter64	read-only	Total number of the active connections since setting up this policy.
C64 wgPolicyBytesEx	1.3.6.1.4.1.3097.4.2.2.1.3	Counter64	read-only	Total traffic in bytes since setting up this policy.
C64 wgPolicyCurrActiveConns	1.3.6.1.4.1.3097.4.2.2.1.18	Counter64	read-only	Total number of currently active connections for this policy.
C64 wgPolicyDisc	1.3.6.1.4.1.3097.4.2.2.1.14	Counter64	read-only	Total number of packets discarded since setting up this policy.
wgPolicyEntry	1.3.6.1.4.1.3097.4.2.2.1		not-accessible	An entry (conceptual row) containing the policy information.
C64 wgPolicyFwDisc	1.3.6.1.4.1.3097.4.2.2.1.10	Counter64	read-only	Total number of packets discarded by firewall policies since setting up this policy.
I32 wgPolicyID	1.3.6.1.4.1.3097.4.2.2.1.1	Integer32	read-only	The policy identifier of this policy.
C64 wgPolicyIpsecAuthErr	1.3.6.1.4.1.3097.4.2.2.1.6	Counter64	read-only	Total number of packets discarded due to authentication errors since setting up this policy.
C64 wgPolicyIpsecDecryptErr	1.3.6.1.4.1.3097.4.2.2.1.5	Counter64	read-only	Total number of packets discarded due to decryption errors since setting up this policy.
C64 wgPolicyIpsecDisc	1.3.6.1.4.1.3097.4.2.2.1.13	Counter64	read-only	Total number of packets discarded by IPSEC errors (decryption error, authentication error, replay error) since setting up this policy.
C64 wgPolicyIpsecPadErr	1.3.6.1.4.1.3097.4.2.2.1.8	Counter64	read-only	Total number of packets discarded due to pad value errors since setting up this policy.
C64 wgPolicyIpsecPolicyErr	1.3.6.1.4.1.3097.4.2.2.1.9	Counter64	read-only	Total number of packets discarded due to policy errors since setting up this policy.
C64 wgPolicyIpsecReplayErr	1.3.6.1.4.1.3097.4.2.2.1.7	Counter64	read-only	Total number of packets discarded due to replay errors since setting up this policy.
INT wgPolicyLogging	1.3.6.1.4.1.3097.4.2.2.1.17	INTEGER	read-only	Indicates whether if the logging of this policy has been enabled.
wgPolicyMIB	1.3.6.1.4.1.3097.4			The MIB module describes various policy objects of WatchGuard system.
OCT wgPolicyName	1.3.6.1.4.1.3097.4.2.2.1.2	OCTET STRING	read-only	The policy name of this policy
C64 wgPolicyNumTunl	1.3.6.1.4.1.3097.4.2.2.1.15	Counter64	read-only	Total number of tunnels belong to this policy
C64 wgPolicyOtherDisc	1.3.6.1.4.1.3097.4.2.2.1.11	Counter64	read-only	Total number of packets discarded due to errors other than firewall errors, ipsec errors since setting up this policy.
C64 wgPolicyPackets	1.3.6.1.4.1.3097.4.2.2.1.4	Counter64	read-only	Total traffic in packets since setting up this policy.
C64 wgPolicySingleCntrNum	1.3.6.1.4.1.3097.4.2.2.1.16	Counter64	read-only	Total number of single counters handled by this policy.
wgPolicyStatistics	1.3.6.1.4.1.3097.4.2			This is the base object identifier for all policy related statistical counters.
wgPolicyTable	1.3.6.1.4.1.3097.4.2.2		not-accessible	This is the policytotunnel table of the policies.
U32 wgPolicyTableNum	1.3.6.1.4.1.3097.4.2.1	Unsigned32	read-only	The total number of policies in the policy table.
wgPolicyToTunnel	1.3.6.1.4.1.3097.4.1			This is the base object identifier for all tunnels information of the policies.
wgPolicyToTunnelEntry	1.3.6.1.4.1.3097.4.1.2.1		not-accessible	An entry (conceptual row) containing the tunnels information.
U32 wgPolicyToTunnelNum	1.3.6.1.4.1.3097.4.1.1	Unsigned32	read-only	The total number of tunnels in the policytotunnel table.
I32 wgPolicyToTunnelPolicyID	1.3.6.1.4.1.3097.4.1.2.1.1	Integer32	read-only	The policy identifier of this entity.
wgPolicyToTunnelTable	1.3.6.1.4.1.3097.4.1.2		not-accessible	This is the policytotunnel table of all the policies.
I32 wgPolicyToTunnelTunnelID	1.3.6.1.4.1.3097.4.1.2.1.2	Integer32	read-only	The tunnel identifier of this entity.

RFC description

Manages WatchGuard firewall policy rules, traffic handling actions, and per-policy connection and byte counters.

Start monitoring WatchGuard firewall/UTM appliance (per-policy connection/byte-counter status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download WATCHGUARD-POLICY-MIB