XG-FIREWALL-MIB

All MIBs › XG-FIREWALL-MIB

Organization: Sophos PLC

Last Updated: 2017-03-20

Category: Network Security and Firewalls, Sophos Security

Description: Monitors Sophos XG Firewall policy enforcement, threat detection events, and network security statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is XG-FIREWALL-MIB?

The XG-FIREWALL-MIB is a vendor-specific MIB for the Sophos XG Firewall unified threat management appliance, exposing device identity, security subsystem versions, and system resource statistics. It covers categories such as appliance identity (model, key), subsystem software versions (web-category, antivirus, anti-spam, IDP engines), and system resource stats (CPU, disk, memory) plus overall system status. Its monitoring emphasis is squarely on hardware/software health: CPU and memory usage track processing and memory load, disk capacity and usage track storage health, sysStatus and sysInstall track overall device and installation state, and version objects confirm security engines are current. There is no apparent dependency on other standard MIBs; it is a self-contained Sophos enterprise MIB. It is deployed on Sophos XG Firewall appliances (physical or virtual) at network perimeters, monitored by NMS/SIEM tooling for both security and operational health. Network engineers evaluating or troubleshooting this functionality can download the XG-FIREWALL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in XG-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Sophos XG Firewall appliance

Monitoring Examples

An admin would poll cpuPercentUsage and diskPercentUsage/memoryCapacity to watch for resource exhaustion on the firewall appliance, and check sysStatus to confirm the system is reporting healthy operation. avVersion, asVersion, and idpVersion let an operator confirm the antivirus, anti-spam, and intrusion-detection signature engines are on current versions, flagging an appliance that has fallen behind on security updates.

What Can Be Monitored

CPU utilization
memory capacity/usage
disk capacity/usage
system status
AV/IDP/anti-spam/web-category engine versions
firmware/software version

Imported Objects

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
enterprises
snmpModules

From SNMPv2-TC

DateAndTime
DisplayString
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using httpHits OID:

Select a Sophos XG Firewall appliance (CPU/memory/disk/security-engine-version status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type httpHits into the Find box to locate it in the OID tree, then select it and click OK. The total number of HTTP hits processed by the firewall. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
SER apacheService	1.3.6.1.4.1.21067.2.1.2.10.11	ServiceStatsType	read-only
DAT appExpiryDate	1.3.6.1.4.1.21067.2.1.3.1.2	DateAndTime	read-only
STR applianceKey	1.3.6.1.4.1.21067.2.1.1.1	DisplayString	read-only
STR applianceModel	1.3.6.1.4.1.21067.2.1.1.2	DisplayString	read-only
REG appRegStatus	1.3.6.1.4.1.21067.2.1.3.1.1	RegistrationStatusType	read-only
DAT asExpiryDate	1.3.6.1.4.1.21067.2.1.3.4.2	DateAndTime	read-only
SER asService	1.3.6.1.4.1.21067.2.1.2.10.7	ServiceStatsType	read-only
SUB asSubStatus	1.3.6.1.4.1.21067.2.1.3.4.1	SubscriptionStatusType	read-only
STR asVersion	1.3.6.1.4.1.21067.2.1.1.6	DisplayString	read-only
avAlerts	1.3.6.1.4.1.21067.2.1.4.4
DAT avExpiryDate	1.3.6.1.4.1.21067.2.1.3.3.2	DateAndTime	read-only
SER avService	1.3.6.1.4.1.21067.2.1.2.10.6	ServiceStatsType	read-only
SUB avSubStatus	1.3.6.1.4.1.21067.2.1.3.3.1	SubscriptionStatusType	read-only
STR avVersion	1.3.6.1.4.1.21067.2.1.1.5	DisplayString	read-only
I32 cpuPercentUsage	1.3.6.1.4.1.21067.2.1.2.2.1	Integer32	read-only	% cpu usage
cpuStatus	1.3.6.1.4.1.21067.2.1.2.2
cscAlerts	1.3.6.1.4.1.21067.2.1.4.8
SER dataBaseService	1.3.6.1.4.1.21067.2.1.2.10.15	ServiceStatsType	read-only
dgdAlerts	1.3.6.1.4.1.21067.2.1.4.5
SER dgdService	1.3.6.1.4.1.21067.2.1.2.10.20	ServiceStatsType	read-only
G32 diskCapacity	1.3.6.1.4.1.21067.2.1.2.3.1	Gauge32	read-only	Disk capacity in MB
G32 diskPercentUsage	1.3.6.1.4.1.21067.2.1.2.3.2	Gauge32	read-only	% Disk usage
diskStatus	1.3.6.1.4.1.21067.2.1.2.3
SER dnsService	1.3.6.1.4.1.21067.2.1.2.10.8	ServiceStatsType	read-only
dosAlerts	1.3.6.1.4.1.21067.2.1.4.7
SER droutingService	1.3.6.1.4.1.21067.2.1.2.10.18	ServiceStatsType	read-only
C64 ftpHits	1.3.6.1.4.1.21067.2.1.2.8	Counter64	read-only
SER ftpService	1.3.6.1.4.1.21067.2.1.2.10.4	ServiceStatsType	read-only
NTF ftpVirus	1.3.6.1.4.1.21067.2.1.4.4.5
SER garnerService	1.3.6.1.4.1.21067.2.1.2.10.17	ServiceStatsType	read-only
NTF gwLiveDead	1.3.6.1.4.1.21067.2.1.4.5.1
HAM haMode	1.3.6.1.4.1.21067.2.1.2.5	HaModeType	read-only
SER haService	1.3.6.1.4.1.21067.2.1.2.10.9	ServiceStatsType	read-only
NTF highConfDiskUsage	1.3.6.1.4.1.21067.2.1.4.2.1
NTF highCpuUsage	1.3.6.1.4.1.21067.2.1.4.1
highDiskUsage	1.3.6.1.4.1.21067.2.1.4.2
highMemUsage	1.3.6.1.4.1.21067.2.1.4.3
NTF highPhyMemUsage	1.3.6.1.4.1.21067.2.1.4.3.1
NTF highReportDiskUsage	1.3.6.1.4.1.21067.2.1.4.2.3
NTF highSigDiskUsage	1.3.6.1.4.1.21067.2.1.4.2.2
NTF highSwapMemUsage	1.3.6.1.4.1.21067.2.1.4.3.2
C64 httpHitsEx	1.3.6.1.4.1.21067.2.1.2.7	Counter64	read-only
SER httpService	1.3.6.1.4.1.21067.2.1.2.10.5	ServiceStatsType	read-only
NTF httpVirus	1.3.6.1.4.1.21067.2.1.4.4.1
NTF icmpFlood	1.3.6.1.4.1.21067.2.1.4.7.4
NTF idpAlert	1.3.6.1.4.1.21067.2.1.4.6.1
idpAlerts	1.3.6.1.4.1.21067.2.1.4.6
DAT idpExpiryDate	1.3.6.1.4.1.21067.2.1.3.5.2	DateAndTime	read-only
SER idpService	1.3.6.1.4.1.21067.2.1.2.10.10	ServiceStatsType	read-only
SUB idpSubStatus	1.3.6.1.4.1.21067.2.1.3.5.1	SubscriptionStatusType	read-only
STR idpVersion	1.3.6.1.4.1.21067.2.1.1.7	DisplayString	read-only
SER imap4Service	1.3.6.1.4.1.21067.2.1.2.10.2	ServiceStatsType	read-only
NTF imap4Virus	1.3.6.1.4.1.21067.2.1.4.4.4
C64 imapHits	1.3.6.1.4.1.21067.2.1.2.9.2	Counter64	read-only
liAntispam	1.3.6.1.4.1.21067.2.1.3.4
liAntivirus	1.3.6.1.4.1.21067.2.1.3.3
liAppliance	1.3.6.1.4.1.21067.2.1.3.1
liIdp	1.3.6.1.4.1.21067.2.1.3.5
liSupport	1.3.6.1.4.1.21067.2.1.3.2
G32 liveUsers	1.3.6.1.4.1.21067.2.1.2.6	Gauge32	read-only
liWebcat	1.3.6.1.4.1.21067.2.1.3.6
mailHits	1.3.6.1.4.1.21067.2.1.2.9
G32 memoryCapacity	1.3.6.1.4.1.21067.2.1.2.4.1	Gauge32	read-only	Memory capacity in MB
G32 memoryPercentUsage	1.3.6.1.4.1.21067.2.1.2.4.2	Gauge32	read-only	% usage of main memory
memoryStatus	1.3.6.1.4.1.21067.2.1.2.4
SER networkService	1.3.6.1.4.1.21067.2.1.2.10.16	ServiceStatsType	read-only
SER ntpService	1.3.6.1.4.1.21067.2.1.2.10.12	ServiceStatsType	read-only
NTF opcodeFail	1.3.6.1.4.1.21067.2.1.4.8.1
C64 pop3Hits	1.3.6.1.4.1.21067.2.1.2.9.1	Counter64	read-only
SER pop3Service	1.3.6.1.4.1.21067.2.1.2.10.1	ServiceStatsType	read-only
NTF pop3Virus	1.3.6.1.4.1.21067.2.1.4.4.3
NTF serviceFail	1.3.6.1.4.1.21067.2.1.4.8.2
serviceStats	1.3.6.1.4.1.21067.2.1.2.10
sfosSystem	1.3.6.1.4.1.21067.2.1
C64 smtpHits	1.3.6.1.4.1.21067.2.1.2.9.3	Counter64	read-only
SER smtpService	1.3.6.1.4.1.21067.2.1.2.10.3	ServiceStatsType	read-only
NTF smtpVirus	1.3.6.1.4.1.21067.2.1.4.4.2
sophos	1.3.6.1.4.1.21067			This MIB module defines MIB objects which provide mechanisms to remotely configure the parameters used by XG-Firewall Agent for the generation of SNMP messages.
SER sshdService	1.3.6.1.4.1.21067.2.1.2.10.19	ServiceStatsType	read-only
SER sslvpnService	1.3.6.1.4.1.21067.2.1.2.10.14	ServiceStatsType	read-only
DAT supportExpiryDate	1.3.6.1.4.1.21067.2.1.3.2.2	DateAndTime	read-only
SUP supportSubStatus	1.3.6.1.4.1.21067.2.1.3.2.1	SupportStatusType	read-only
G32 swapCapacity	1.3.6.1.4.1.21067.2.1.2.4.3	Gauge32	read-only	Swap Capacity in MB
G32 swapPercentUsage	1.3.6.1.4.1.21067.2.1.2.4.4	Gauge32	read-only	% usage of swap
NTF synFlood	1.3.6.1.4.1.21067.2.1.4.7.1
sysAlerts	1.3.6.1.4.1.21067.2.1.4
sysInstall	1.3.6.1.4.1.21067.2.1.1
sysLicense	1.3.6.1.4.1.21067.2.1.3
sysStatus	1.3.6.1.4.1.21067.2.1.2
DAT systemDate	1.3.6.1.4.1.21067.2.1.2.1	DateAndTime	read-only
NTF tcpFlood	1.3.6.1.4.1.21067.2.1.4.7.2
SER tomcatService	1.3.6.1.4.1.21067.2.1.2.10.13	ServiceStatsType	read-only
NTF udpFlood	1.3.6.1.4.1.21067.2.1.4.7.3
DAT webcatExpiryDate	1.3.6.1.4.1.21067.2.1.3.6.2	DateAndTime	read-only
SUB webcatSubStatus	1.3.6.1.4.1.21067.2.1.3.6.1	SubscriptionStatusType	read-only
STR webcatVersion	1.3.6.1.4.1.21067.2.1.1.4	DisplayString	read-only
xG_Firewall	1.3.6.1.4.1.21067.2
STR xG_FirewallVersion	1.3.6.1.4.1.21067.2.1.1.3	DisplayString	read-only

RFC description

SNMP configuration and monitoring for Sophos XG firewall appliance parameters and service status.

Start monitoring Sophos XG Firewall appliance (CPU/memory/disk/security-engine-version status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download XG-FIREWALL-MIB