1379 lines
51 KiB
Plaintext
1379 lines
51 KiB
Plaintext
|
-- *****************************************************************
|
||
|
|
-- CISCO-FIREWALL-MIB
|
||
|
|
--
|
||
|
|
-- April, 1999 Jim Fitzgerald
|
||
|
|
--
|
||
|
|
-- Copyright (c) 1999-2005, 2020 by cisco Systems Inc.
|
||
|
|
-- All rights reserved.
|
||
|
|
-- *****************************************************************
|
||
|
|
|
||
|
|
CISCO-FIREWALL-MIB DEFINITIONS ::= BEGIN
|
||
|
|
|
||
|
|
IMPORTS
|
||
|
|
OBJECT-GROUP,
|
||
|
|
NOTIFICATION-GROUP,
|
||
|
|
MODULE-COMPLIANCE
|
||
|
|
FROM SNMPv2-CONF
|
||
|
|
MODULE-IDENTITY,
|
||
|
|
OBJECT-TYPE,
|
||
|
|
NOTIFICATION-TYPE,
|
||
|
|
Counter32,
|
||
|
|
Gauge32,
|
||
|
|
Unsigned32,
|
||
|
|
IpAddress
|
||
|
|
FROM SNMPv2-SMI
|
||
|
|
DateAndTime,
|
||
|
|
TEXTUAL-CONVENTION,
|
||
|
|
RowPointer
|
||
|
|
FROM SNMPv2-TC
|
||
|
|
SnmpAdminString
|
||
|
|
FROM SNMP-FRAMEWORK-MIB
|
||
|
|
InterfaceIndexOrZero
|
||
|
|
FROM IF-MIB
|
||
|
|
ciscoMgmt
|
||
|
|
FROM CISCO-SMI;
|
||
|
|
|
||
|
|
|
||
|
|
ciscoFirewallMIB MODULE-IDENTITY
|
||
|
|
LAST-UPDATED "202010010000Z"
|
||
|
|
ORGANIZATION "Cisco Systems, Inc."
|
||
|
|
CONTACT-INFO
|
||
|
|
"Cisco Systems
|
||
|
|
Customer Service
|
||
|
|
|
||
|
|
Postal: 170 W Tasman Drive
|
||
|
|
San Jose, CA 95134
|
||
|
|
USA
|
||
|
|
|
||
|
|
Tel: +1 800 553-NETS
|
||
|
|
|
||
|
|
E-mail: cs-pix@cisco.com
|
||
|
|
cs-iosfw@cisco.com"
|
||
|
|
DESCRIPTION
|
||
|
|
"MIB module for monitoring Cisco Firewalls."
|
||
|
|
REVISION "202010010000Z"
|
||
|
|
DESCRIPTION
|
||
|
|
"Added the cps current and cps Peak under cfwSystem as
|
||
|
|
scalars."
|
||
|
|
REVISION "200512060000Z"
|
||
|
|
DESCRIPTION
|
||
|
|
"Added the copyright statement and updated the imports
|
||
|
|
such that Unsigned32 is imported from SNMPv2-SMI instead
|
||
|
|
of CISCO-TC. Added a new NOTIFICATION-GROUP
|
||
|
|
ciscoFirewallMIBNotificationGroupRev1 to include all the
|
||
|
|
notifications defined in the MIB. Obsoleted the
|
||
|
|
OBJECT-GROUP ciscoFirewallMIBNotificationGroup. Deprecated
|
||
|
|
the MODULE-COMPLIANCE ciscoFirewallMIBCompliance and added
|
||
|
|
a new MODULE-COMPLIANCE ciscoFirewallMIBComplianceRev1."
|
||
|
|
REVISION "9904291200Z"
|
||
|
|
DESCRIPTION
|
||
|
|
"Initial version of this MIB module."
|
||
|
|
::= { ciscoMgmt 147 }
|
||
|
|
|
||
|
|
|
||
|
|
ciscoFirewallMIBObjects OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIB 1 }
|
||
|
|
|
||
|
|
cfwEvents OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIBObjects 1 }
|
||
|
|
|
||
|
|
cfwBasicEvents OBJECT IDENTIFIER
|
||
|
|
::= { cfwEvents 1 }
|
||
|
|
|
||
|
|
cfwNetEvents OBJECT IDENTIFIER
|
||
|
|
::= { cfwEvents 2 }
|
||
|
|
|
||
|
|
cfwSystem OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIBObjects 2 }
|
||
|
|
|
||
|
|
cfwStatus OBJECT IDENTIFIER
|
||
|
|
::= { cfwSystem 1 }
|
||
|
|
|
||
|
|
cfwStatistics OBJECT IDENTIFIER
|
||
|
|
::= { cfwSystem 2 }
|
||
|
|
|
||
|
|
|
||
|
|
-- Textual Conventions
|
||
|
|
|
||
|
|
ResourceStatistics ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to identify various statistics
|
||
|
|
that are related to the resources on a firewall.
|
||
|
|
|
||
|
|
highUse : The highest load the resource has had for a
|
||
|
|
time period. The time period will be
|
||
|
|
implementation dependent.
|
||
|
|
highLoad : The highest load the resource has had since
|
||
|
|
startup.
|
||
|
|
maximum : The maximum amount of the resource that is
|
||
|
|
available.
|
||
|
|
minimum : The minimum amount of the resource that is
|
||
|
|
available.
|
||
|
|
low : The lowest amount of the resource that has been
|
||
|
|
available since startup.
|
||
|
|
high : The highest amount of the resource that has been
|
||
|
|
available since startup.
|
||
|
|
average : The average amount of the resource that has been
|
||
|
|
available since startup.
|
||
|
|
free : The amount of the resource that is currently
|
||
|
|
available since startup.
|
||
|
|
inUse : The amount of the resource that is currently
|
||
|
|
in use, eg. CPU usage, memory usage."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
highUse(1),
|
||
|
|
highLoad(2),
|
||
|
|
maximum(3),
|
||
|
|
minimum(4),
|
||
|
|
low(5),
|
||
|
|
high(6),
|
||
|
|
average(7),
|
||
|
|
free(8),
|
||
|
|
inUse(9)
|
||
|
|
}
|
||
|
|
|
||
|
|
Hardware ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various hardware
|
||
|
|
resouces that can be monitored by the firewall.
|
||
|
|
|
||
|
|
memory - identifies memory.
|
||
|
|
disk - identifies disk.
|
||
|
|
power - identifies power.
|
||
|
|
netInterface - identifies a network interface.
|
||
|
|
tape - identifies a tape drive.
|
||
|
|
controller - identifies hardware controller.
|
||
|
|
cpu - identifies CPU.
|
||
|
|
primaryUnit - identifies the primary unit of the two
|
||
|
|
identical firewalls configured redundancy.
|
||
|
|
secondaryUnit - identifies the secondary unit of the two
|
||
|
|
identical firewalls configured redundancy.
|
||
|
|
other - identifies other hardware."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
memory(1),
|
||
|
|
disk(2),
|
||
|
|
power(3),
|
||
|
|
netInterface(4),
|
||
|
|
cpu(5),
|
||
|
|
primaryUnit(6),
|
||
|
|
secondaryUnit(7),
|
||
|
|
other(8)
|
||
|
|
}
|
||
|
|
|
||
|
|
Services ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various services
|
||
|
|
that are monitored by the firewall.
|
||
|
|
|
||
|
|
otherFWService - a service that does not fit into any
|
||
|
|
other category.
|
||
|
|
fileXferFtp - identifies FTP, File Transfer Protocol.
|
||
|
|
fileXferTftp - identifies TFTP, Trivial File
|
||
|
|
Transfer Protocol
|
||
|
|
fileXferFtps - identifies FTP, File Transfer
|
||
|
|
Protocol running over Secure Sockets Layer.
|
||
|
|
loginTelnet - identifies telnet
|
||
|
|
loginRlogin - identifies rlogin.
|
||
|
|
loginTelnets - identifies telnet over
|
||
|
|
Secure Sockets Layer(SSL).
|
||
|
|
remoteExecSunRPC - identifies Sun Remote
|
||
|
|
Procedure Call Protocol.
|
||
|
|
remoteExecMSRPC - identifies Microsoft Remote
|
||
|
|
Procedure Call Protocol.
|
||
|
|
remoteExecRsh - identifies the remote shell.
|
||
|
|
remoteExecXserver - identifies the Xwindows server.
|
||
|
|
webHttp - identifies Hyper Text Transfer Protocol.
|
||
|
|
webHttps - identifies the secure HTTP protocol.
|
||
|
|
mailSmtp - identifies SMTP, Simple Mail Transfer Protocol.
|
||
|
|
mailSmtps - identifies SMTP, Simple Mail Transfer Protocol
|
||
|
|
running over Secure Sockets Layer (SSL).
|
||
|
|
multimediaStreamworks - identifies streamworks.
|
||
|
|
multimediaH323 - identifies H323.
|
||
|
|
multimediaNetShow - identifies NetShow.
|
||
|
|
multimediaVDOLive - identifies vDOLive.
|
||
|
|
multimediaRealAV - identifies RealAV.
|
||
|
|
multimediaRTSP - identifies Real Time Streaming Protocol
|
||
|
|
dbOracle - identifies Oracle's SQL*Net.
|
||
|
|
dbMSsql - identifies MicroSoft SQL.
|
||
|
|
contInspProgLang - identifies a payload as a programming
|
||
|
|
language such as Java or ActiveX.
|
||
|
|
contInspUrl - identifies a payload as a URL.
|
||
|
|
directoryNis - identifies NIS, Network Information Service.
|
||
|
|
directoryDns - identifies DNS, Domain Name Service.
|
||
|
|
directoryNetbiosns - identifies NetBIOSNS - NetBIOS Name Service.
|
||
|
|
directoryNetbiosdgm - identifies NetBIOSNS - NetBIOS
|
||
|
|
datagram Service.
|
||
|
|
directoryNetbiosssn - identifies NetBIOSNS - NetBIOS
|
||
|
|
Session Service.
|
||
|
|
directoryWins - identifies Windows Internet Naming
|
||
|
|
Service (WINS).
|
||
|
|
qryWhois - identifies WhoIs service.
|
||
|
|
qryFinger - identifies finger.
|
||
|
|
qryIdent - identifies Ident.
|
||
|
|
fsNfsStatus - identifies Network File System (NFS) Status.
|
||
|
|
fsNfs - identifies Network File System (NFS).
|
||
|
|
fsCifs - identifies CIFS, Common Internet
|
||
|
|
File Service.
|
||
|
|
protoIcmp - identifies ICMP, Internet Control Message Protocol.
|
||
|
|
protoTcp - identifies TCP, Transmission Control Protocol.
|
||
|
|
protoUdp - identifies UDP, User Datagram Protocol.
|
||
|
|
protoIp - identifies IP, Internet Protocol.
|
||
|
|
protoSnmp - identifies SNMP, Simple Network Management Protocol."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
otherFWService(1),
|
||
|
|
fileXferFtp(2),
|
||
|
|
fileXferTftp(3),
|
||
|
|
fileXferFtps(4),
|
||
|
|
loginTelnet(5),
|
||
|
|
loginRlogin(6),
|
||
|
|
loginTelnets(7),
|
||
|
|
remoteExecSunRPC(8),
|
||
|
|
remoteExecMSRPC(9),
|
||
|
|
remoteExecRsh(10),
|
||
|
|
remoteExecXserver(11),
|
||
|
|
webHttp(12),
|
||
|
|
webHttps(13),
|
||
|
|
mailSmtp(14),
|
||
|
|
multimediaStreamworks(15),
|
||
|
|
multimediaH323(16),
|
||
|
|
multimediaNetShow(17),
|
||
|
|
multimediaVDOLive(18),
|
||
|
|
multimediaRealAV(19),
|
||
|
|
multimediaRTSP(20),
|
||
|
|
dbOracle(21),
|
||
|
|
dbMSsql(22),
|
||
|
|
contInspProgLang(23),
|
||
|
|
contInspUrl(24),
|
||
|
|
directoryNis(25),
|
||
|
|
directoryDns(26),
|
||
|
|
directoryNetbiosns(27),
|
||
|
|
directoryNetbiosdgm(28),
|
||
|
|
directoryNetbiosssn(29),
|
||
|
|
directoryWins(30),
|
||
|
|
qryWhois(31),
|
||
|
|
qryFinger(32),
|
||
|
|
qryIdent(33),
|
||
|
|
fsNfsStatus(34),
|
||
|
|
fsNfs(35),
|
||
|
|
fsCifs(36),
|
||
|
|
protoIcmp(37),
|
||
|
|
protoTcp(38),
|
||
|
|
protoUdp(39),
|
||
|
|
protoIp(40),
|
||
|
|
protoSnmp(41)
|
||
|
|
}
|
||
|
|
|
||
|
|
HardwareStatus ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various events
|
||
|
|
that are related to the resources on a firewall.
|
||
|
|
other : Generic resource event.
|
||
|
|
up : The resource is in service.
|
||
|
|
down : The resource is not in service.
|
||
|
|
error : There has been an error for this resource.
|
||
|
|
overTemp : The resource is overheating.
|
||
|
|
busy : The resource is busy.
|
||
|
|
noMedia : A device doesn't have its needed media.
|
||
|
|
backup : Processing has switched to the backup.
|
||
|
|
active : This is the active unit.
|
||
|
|
standby : This is the standby unit."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
other(1),
|
||
|
|
up(2),
|
||
|
|
down(3),
|
||
|
|
error(4),
|
||
|
|
overTemp(5),
|
||
|
|
busy(6),
|
||
|
|
noMedia(7),
|
||
|
|
backup(8),
|
||
|
|
active(9),
|
||
|
|
standby(10)
|
||
|
|
}
|
||
|
|
|
||
|
|
SecurityEvent ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various
|
||
|
|
security-related events and statistics on a firewall.
|
||
|
|
|
||
|
|
other : Generic attack event.
|
||
|
|
none : No attack is occurring, an informational
|
||
|
|
event.
|
||
|
|
dos : A denial of service attack has been detected.
|
||
|
|
recon : A pattern of reconnaissance activity has been
|
||
|
|
detected.
|
||
|
|
pakFwd : A packet forwarding attack has been detected.
|
||
|
|
addrSpoof : A spoofed address has been detected.
|
||
|
|
svcSpoof : A spoofed service (eg., DNS) has been detected.
|
||
|
|
thirdParty : This site is being used as a third-party for
|
||
|
|
an attack on another network. For example, the
|
||
|
|
'smurf' attack or email spamming.
|
||
|
|
complete : An attack has terminated
|
||
|
|
invlPak : An invalid packet with attack characteristics
|
||
|
|
has been detected.
|
||
|
|
illegCmd : An illegal command has been found.
|
||
|
|
policy : An attempt has reen made to violate a security
|
||
|
|
policy."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
other(1),
|
||
|
|
none(2),
|
||
|
|
dos(3),
|
||
|
|
recon(4),
|
||
|
|
pakFwd(5),
|
||
|
|
addrSpoof(6),
|
||
|
|
svcSpoof(7),
|
||
|
|
thirdParty(8),
|
||
|
|
complete(9),
|
||
|
|
invalPak(10),
|
||
|
|
illegCom(11),
|
||
|
|
policy(12)
|
||
|
|
}
|
||
|
|
|
||
|
|
ContentInspectionEvent ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Content inspection events, these events report that
|
||
|
|
something was found in the application payload. The
|
||
|
|
details entry in the event can report on what was
|
||
|
|
found (eg., virus, company private info., etc), what it
|
||
|
|
was found in (eg., html, win32 executable, e-mail), and
|
||
|
|
what was done with it (eg., the quarantine location).
|
||
|
|
|
||
|
|
other : A content inspection event. Used to indicate
|
||
|
|
that some content inspection has occurred that
|
||
|
|
is not covered by the other content inspection
|
||
|
|
enumerations.
|
||
|
|
okay : The check of the content was okay, nothing 'bad'
|
||
|
|
was found.
|
||
|
|
error : There was an error while checking the content.
|
||
|
|
found : Something was found that the content inspection
|
||
|
|
engine has determined merits attention.
|
||
|
|
clean : The content inspection engine has found something
|
||
|
|
that violates the security policy and has
|
||
|
|
neutralized the content in the data flow.
|
||
|
|
reject : The content inspection engine has found something
|
||
|
|
that violates the security policy and has discarded
|
||
|
|
the content.
|
||
|
|
saved : The content inspection engine has found something
|
||
|
|
that violates the security policy and has stored
|
||
|
|
it in a quarentine storage area."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
other(1),
|
||
|
|
okay(2),
|
||
|
|
error(3),
|
||
|
|
found(4),
|
||
|
|
clean(5),
|
||
|
|
reject(6),
|
||
|
|
saved(7)
|
||
|
|
}
|
||
|
|
|
||
|
|
ConnectionEvent ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various events
|
||
|
|
and statistics that are related to the connections that
|
||
|
|
occur on a firewall.
|
||
|
|
|
||
|
|
other : A generic connection event.
|
||
|
|
accept : A connection has been acccepted.
|
||
|
|
error : An error has occurred for a connection.
|
||
|
|
drop : The connection has been dropped.
|
||
|
|
close : A connection has been closed.
|
||
|
|
timeout : A connection has been timed out.
|
||
|
|
refused : A connection has been refused.
|
||
|
|
reset : A connection has been reset.
|
||
|
|
noResp : A connection has received no response."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
other(1),
|
||
|
|
accept(2),
|
||
|
|
error(3),
|
||
|
|
drop(4),
|
||
|
|
close(5),
|
||
|
|
timeout(6),
|
||
|
|
refused(7),
|
||
|
|
reset(8),
|
||
|
|
noResp(9)
|
||
|
|
}
|
||
|
|
|
||
|
|
ConnectionStat ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various
|
||
|
|
connections statistics.
|
||
|
|
|
||
|
|
other : A generic connection event.
|
||
|
|
totalOpen : Total open connections since reboot.
|
||
|
|
currentOpen : The number of connections currently open.
|
||
|
|
currentClosing : The number of connections currently closing.
|
||
|
|
currentHalfOpen : The number of connections currently half-open.
|
||
|
|
currentInUse : The number of connections currently in use.
|
||
|
|
high : The highest number of connections in use at
|
||
|
|
any one time since system startup."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
other(1),
|
||
|
|
totalOpen(2),
|
||
|
|
currentOpen(3),
|
||
|
|
currentClosing(4),
|
||
|
|
currentHalfOpen(5),
|
||
|
|
currentInUse(6),
|
||
|
|
high(7)
|
||
|
|
}
|
||
|
|
|
||
|
|
AccessEvent ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various events
|
||
|
|
and statistics that are related to the access control on a
|
||
|
|
firewall.
|
||
|
|
|
||
|
|
other : Miscellaneous access event.
|
||
|
|
grant : A service has allowed access based on all
|
||
|
|
of its access checks.
|
||
|
|
deny : a client was denied use of a service.
|
||
|
|
denyMult : A client was denied use of a service
|
||
|
|
multiple times.
|
||
|
|
error : An error has ocurred during the access
|
||
|
|
control process."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
other(1),
|
||
|
|
grant(2),
|
||
|
|
deny(3),
|
||
|
|
denyMult(4),
|
||
|
|
error(5)
|
||
|
|
}
|
||
|
|
|
||
|
|
AuthenticationEvent ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This textual convention is used to describe various events
|
||
|
|
and statistics that are related to authorization.
|
||
|
|
|
||
|
|
other : Miscellaneous authentication event.
|
||
|
|
succ : A client successfuly authenticated.
|
||
|
|
error : Error while authenticating.
|
||
|
|
fail : A client failed an authenticating.
|
||
|
|
succPriv : A client accessed a service with special
|
||
|
|
privileges.
|
||
|
|
failPriv : A client failed to access a service with
|
||
|
|
special privileges.
|
||
|
|
failMult : Multiple failed authentication attempts by
|
||
|
|
a client."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
other(1),
|
||
|
|
succ(2),
|
||
|
|
error(3),
|
||
|
|
fail(4),
|
||
|
|
succPriv(5),
|
||
|
|
failPriv(6),
|
||
|
|
failMult(7)
|
||
|
|
}
|
||
|
|
|
||
|
|
GenericEvent ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Generic Events - events for which there is no more specific
|
||
|
|
enumeration
|
||
|
|
abnormal : An abnormal event has occurred that is neither
|
||
|
|
'okay' nor an 'error'.
|
||
|
|
okay : A normal event occurred or the system has changed
|
||
|
|
from an abnormal state to a normal state
|
||
|
|
error : An error event occurred"
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
abnormal(1),
|
||
|
|
okay(2),
|
||
|
|
error(3)
|
||
|
|
}
|
||
|
|
|
||
|
|
-- The cfwBasicEventsGroup
|
||
|
|
--
|
||
|
|
-- This group defines the table containing information that is
|
||
|
|
-- for every logged event on the firewall. The table is
|
||
|
|
-- defined along with one variable to obtain the index value of
|
||
|
|
-- the last row in the table. The table is indexed by the
|
||
|
|
-- integer-valued cfwBasicEventIndex which is assigned to events
|
||
|
|
-- in ascending chronological order, such that the oldest event
|
||
|
|
-- stored in the table has the numerically smallest value of
|
||
|
|
-- cfwBasicEventIndex."
|
||
|
|
--
|
||
|
|
-- The index of the last row also indicates the total number
|
||
|
|
-- modulo 2**32 of events logged in the table since reboot.
|
||
|
|
-- Events are not retained across reboots.
|
||
|
|
|
||
|
|
cfwBasicEventsTableLastRow OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The index value of the most recently created row
|
||
|
|
in the cfwBasicEventsTable. This number starts at
|
||
|
|
1 and increase by one with each new log entry. When
|
||
|
|
this number wraps, all events are deleted."
|
||
|
|
::= { cfwBasicEvents 1 }
|
||
|
|
|
||
|
|
cfwBasicEventsTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF CfwBasicEventsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table of basic data for firewall events. The agent
|
||
|
|
may choose to delete the instances of cfwBasicEventsEntry
|
||
|
|
as required because of lack of memory. The oldest Events
|
||
|
|
will be selected first for deletion."
|
||
|
|
::= { cfwBasicEvents 2 }
|
||
|
|
|
||
|
|
cfwBasicEventsEntry OBJECT-TYPE
|
||
|
|
SYNTAX CfwBasicEventsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An entry in the table, containing general information
|
||
|
|
about an event. This table will always be sparse, i.e.,
|
||
|
|
each row will instanciate only a subet of the columnar
|
||
|
|
objects."
|
||
|
|
INDEX { cfwBasicEventIndex }
|
||
|
|
::= { cfwBasicEventsTable 1 }
|
||
|
|
|
||
|
|
CfwBasicEventsEntry ::= SEQUENCE {
|
||
|
|
cfwBasicEventIndex Unsigned32,
|
||
|
|
cfwBasicEventTime DateAndTime,
|
||
|
|
cfwBasicSecurityEventType SecurityEvent,
|
||
|
|
cfwBasicContentInspEventType ContentInspectionEvent,
|
||
|
|
cfwBasicConnectionEventType ConnectionEvent,
|
||
|
|
cfwBasicAccessEventType AccessEvent,
|
||
|
|
cfwBasicAuthenticationEventType AuthenticationEvent,
|
||
|
|
cfwBasicGenericEventType GenericEvent,
|
||
|
|
cfwBasicEventDescription SnmpAdminString,
|
||
|
|
cfwBasicEventDetailsTableRow RowPointer
|
||
|
|
}
|
||
|
|
|
||
|
|
cfwBasicEventIndex OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An index that uniquely identifies an entry in the
|
||
|
|
log table. These indices are assigned beginning
|
||
|
|
with 1 and increase by one with each new event logged."
|
||
|
|
::= { cfwBasicEventsEntry 1 }
|
||
|
|
|
||
|
|
cfwBasicEventTime OBJECT-TYPE
|
||
|
|
SYNTAX DateAndTime
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The time that the event occurred."
|
||
|
|
::= { cfwBasicEventsEntry 2 }
|
||
|
|
|
||
|
|
cfwBasicSecurityEventType OBJECT-TYPE
|
||
|
|
SYNTAX SecurityEvent
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of security-related event that this row contains.
|
||
|
|
If the event is not security-related this object will not
|
||
|
|
be instantiated."
|
||
|
|
::= { cfwBasicEventsEntry 3 }
|
||
|
|
|
||
|
|
cfwBasicContentInspEventType OBJECT-TYPE
|
||
|
|
SYNTAX ContentInspectionEvent
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of content inspection-related event that this row
|
||
|
|
contains. If the event is not content inspection-related
|
||
|
|
this object will not be instantiated."
|
||
|
|
::= { cfwBasicEventsEntry 4 }
|
||
|
|
|
||
|
|
cfwBasicConnectionEventType OBJECT-TYPE
|
||
|
|
SYNTAX ConnectionEvent
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of connection-related event that this row contains.
|
||
|
|
If the event is not connection-related this object will not
|
||
|
|
be instantiated."
|
||
|
|
::= { cfwBasicEventsEntry 5 }
|
||
|
|
|
||
|
|
cfwBasicAccessEventType OBJECT-TYPE
|
||
|
|
SYNTAX AccessEvent
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of access-related event that this row contains.
|
||
|
|
If the event is not access-related this object will not be
|
||
|
|
instantiated."
|
||
|
|
::= { cfwBasicEventsEntry 6 }
|
||
|
|
|
||
|
|
cfwBasicAuthenticationEventType OBJECT-TYPE
|
||
|
|
SYNTAX AuthenticationEvent
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of authentication-related event that this row
|
||
|
|
contains. If the event is not authentication-related this
|
||
|
|
object will not be instantiated."
|
||
|
|
::= { cfwBasicEventsEntry 7 }
|
||
|
|
|
||
|
|
cfwBasicGenericEventType OBJECT-TYPE
|
||
|
|
SYNTAX GenericEvent
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of generic event that this row contains. If the
|
||
|
|
event does not fall into one of the other categories this
|
||
|
|
object will be populated. Otherwise, this object will not
|
||
|
|
be instantiated."
|
||
|
|
::= { cfwBasicEventsEntry 8 }
|
||
|
|
|
||
|
|
cfwBasicEventDescription OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A description of the event. The value of the object may
|
||
|
|
be a zero-length string."
|
||
|
|
::= { cfwBasicEventsEntry 9 }
|
||
|
|
|
||
|
|
cfwBasicEventDetailsTableRow OBJECT-TYPE
|
||
|
|
SYNTAX RowPointer
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A pointer to a row in the table containing details
|
||
|
|
about this event. Generally, the table will be the
|
||
|
|
cfwNetEventsTable but a Cisco-defined table may also
|
||
|
|
appear here. If there there is no more detailed
|
||
|
|
information for this event the value of this object
|
||
|
|
will have the value {0 0}."
|
||
|
|
::= { cfwBasicEventsEntry 10 }
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
-- Network Events
|
||
|
|
--
|
||
|
|
-- A details table with information related to network events
|
||
|
|
-- or events involving "users" of the firewall resources and services
|
||
|
|
-- (eg., traffic flows through the firewall or a user authenticating
|
||
|
|
-- to use a firewall service).
|
||
|
|
|
||
|
|
cfwNetEventsTableLastRow OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The index value of the last row in the
|
||
|
|
cfwNetEventsTable. This number starts at 1 and
|
||
|
|
increase by one with each new log entry. When this
|
||
|
|
number wraps, all events are deleted."
|
||
|
|
::= { cfwNetEvents 1 }
|
||
|
|
|
||
|
|
cfwNetEventsTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF CfwNetEventsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table of detailed data for network events. The
|
||
|
|
agent may choose to delete the instances of
|
||
|
|
cfwBasicEventsEntry as required because of lack of
|
||
|
|
memory. It is an implementation-specific matter as
|
||
|
|
to when this deletion may occur. It is recommended
|
||
|
|
that the oldest log instances are deleted first."
|
||
|
|
::= { cfwNetEvents 2 }
|
||
|
|
|
||
|
|
cfwNetEventsEntry OBJECT-TYPE
|
||
|
|
SYNTAX CfwNetEventsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An entry in the table, containing detailed information
|
||
|
|
about an event. Note that this table may be sparse.
|
||
|
|
If Network Address Translation is not enabled
|
||
|
|
cfwNetEventInsideSrcIpAddress and
|
||
|
|
cfwNetEventInsideDstIpAddress will not be instantiated
|
||
|
|
in the row. If Port Address Translation is not enabled
|
||
|
|
cfwNetEventInsideSrcIpPort and
|
||
|
|
cfwNetEventInsideDstIpPort will not be instantiated
|
||
|
|
in the row. Entries are added to this table at the
|
||
|
|
same time that events are added to the cfwBasicEventsTable.
|
||
|
|
These two tables may be configured to be different
|
||
|
|
sizes so there may not be a one-to-one correspondence
|
||
|
|
between rows in the two tables."
|
||
|
|
INDEX { cfwNetEventIndex }
|
||
|
|
::= { cfwNetEventsTable 1 }
|
||
|
|
|
||
|
|
CfwNetEventsEntry ::= SEQUENCE {
|
||
|
|
cfwNetEventIndex Unsigned32,
|
||
|
|
cfwNetEventInterface InterfaceIndexOrZero,
|
||
|
|
cfwNetEventSrcIpAddress IpAddress,
|
||
|
|
cfwNetEventInsideSrcIpAddress IpAddress,
|
||
|
|
cfwNetEventDstIpAddress IpAddress,
|
||
|
|
cfwNetEventInsideDstIpAddress IpAddress,
|
||
|
|
cfwNetEventSrcIpPort INTEGER,
|
||
|
|
cfwNetEventInsideSrcIpPort INTEGER,
|
||
|
|
cfwNetEventDstIpPort INTEGER,
|
||
|
|
cfwNetEventInsideDstIpPort INTEGER,
|
||
|
|
cfwNetEventService Services,
|
||
|
|
cfwNetEventServiceInformation SnmpAdminString,
|
||
|
|
cfwNetEventIdentity SnmpAdminString,
|
||
|
|
cfwNetEventDescription SnmpAdminString
|
||
|
|
}
|
||
|
|
|
||
|
|
cfwNetEventIndex OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An index that uniquely identifies an entry in the
|
||
|
|
log table. These indices are assigned beginning with
|
||
|
|
one and increase by one with each new log entry. When
|
||
|
|
this number wraps, all events are deleted in order to
|
||
|
|
allow the NMS to differentiate between old and new
|
||
|
|
events."
|
||
|
|
::= { cfwNetEventsEntry 1 }
|
||
|
|
|
||
|
|
cfwNetEventInterface OBJECT-TYPE
|
||
|
|
SYNTAX InterfaceIndexOrZero
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The interface most closely associated with this event.
|
||
|
|
For example, for an event that relates to the receipt of
|
||
|
|
a packet, this object identifies the interface on which
|
||
|
|
the packet was received. If there are multiple interfaces
|
||
|
|
associated with an event, the interface most closely
|
||
|
|
associated with the cause of the event will be used.
|
||
|
|
For example, for an event for the setup of a TCP
|
||
|
|
connection, the interface on the initiator's side
|
||
|
|
of the connection would be preferred. If there is no
|
||
|
|
associated interface, then this object has the value zero."
|
||
|
|
::= { cfwNetEventsEntry 2 }
|
||
|
|
|
||
|
|
cfwNetEventSrcIpAddress OBJECT-TYPE
|
||
|
|
SYNTAX IpAddress
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Source IP address in the IP packet that caused the
|
||
|
|
event. If there is no packet associated with the
|
||
|
|
event this object has the value of zero. If the event is
|
||
|
|
the result of multiple packets with different source
|
||
|
|
addresses, this value may be zero or an address taken
|
||
|
|
from an arbitrarily chosen packet in the sequence of
|
||
|
|
packets causing the event."
|
||
|
|
::= { cfwNetEventsEntry 3 }
|
||
|
|
|
||
|
|
cfwNetEventInsideSrcIpAddress OBJECT-TYPE
|
||
|
|
SYNTAX IpAddress
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Source IP address after Network Address Translation
|
||
|
|
has been applied. If NAT has not been applied to the
|
||
|
|
source address in this packet this object will not
|
||
|
|
be instantiated, resulting in a sparse table. If the
|
||
|
|
event is the result of multiple packets with different
|
||
|
|
source addresses, this value may be zero or an address
|
||
|
|
taken from an arbitrarily chosen packet in the sequence
|
||
|
|
of packets causing the event."
|
||
|
|
::= { cfwNetEventsEntry 4 }
|
||
|
|
|
||
|
|
cfwNetEventDstIpAddress OBJECT-TYPE
|
||
|
|
SYNTAX IpAddress
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Destination IP address in the IP packet that caused
|
||
|
|
the event. If there is no packet associated with
|
||
|
|
the event this object has the value of zero. If the event
|
||
|
|
is the result of multiple packets with different destination
|
||
|
|
addresses, this value may be zero or an address taken
|
||
|
|
from an arbitrarily chosen packet in the sequence of
|
||
|
|
packets causing the event."
|
||
|
|
::= { cfwNetEventsEntry 5 }
|
||
|
|
|
||
|
|
cfwNetEventInsideDstIpAddress OBJECT-TYPE
|
||
|
|
SYNTAX IpAddress
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Destination IP address after Network Address Translation
|
||
|
|
has been applied. If NAT has not been applied to the
|
||
|
|
destination address in this packet this object will not
|
||
|
|
be instantiated, resulting in a sparse table. If the event
|
||
|
|
is the result of multiple packets with different destination
|
||
|
|
addresses, this value may be zero or an address taken
|
||
|
|
from an arbitrarily chosen packet in the sequence of
|
||
|
|
packets causing the event."
|
||
|
|
::= { cfwNetEventsEntry 6 }
|
||
|
|
|
||
|
|
cfwNetEventSrcIpPort OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER (0..65535)
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Source UDP/TCP port in the IP packet that caused
|
||
|
|
the event. If there is no packet associated with the
|
||
|
|
event this object has the value of zero. If the event
|
||
|
|
is the result of multiple packets with different source
|
||
|
|
ports, this value may be zero or a port taken from an
|
||
|
|
arbitrarily chosen packet in the sequence of packets
|
||
|
|
causing the event."
|
||
|
|
::= { cfwNetEventsEntry 7 }
|
||
|
|
|
||
|
|
cfwNetEventInsideSrcIpPort OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER (0..65535)
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Source UDP/TCP port after Port Address Translation
|
||
|
|
has been applied. If PAT has not been applied to the
|
||
|
|
source port in this packet this object will not be
|
||
|
|
instantiated, resulting in a sparse table. If the
|
||
|
|
event is the result of multiple packets with different
|
||
|
|
source ports, this value may be zero or a port taken
|
||
|
|
from an arbitrarily chosen packet in the sequence of
|
||
|
|
packets causing the event."
|
||
|
|
::= { cfwNetEventsEntry 8 }
|
||
|
|
|
||
|
|
cfwNetEventDstIpPort OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER (0..65535)
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Destination UDP/TCP port in the IP packet that caused
|
||
|
|
the event. If there is no packet associated with the
|
||
|
|
event this object has the value of zero. If the event is
|
||
|
|
the result of multiple packets with different destination
|
||
|
|
ports, this value may be zero or a port taken from an
|
||
|
|
arbitrarily chosen packet in the sequence of packets
|
||
|
|
causing the event."
|
||
|
|
::= { cfwNetEventsEntry 9 }
|
||
|
|
|
||
|
|
cfwNetEventInsideDstIpPort OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER (0..65535)
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Destination UDP/TCP port after Port Address Translation
|
||
|
|
has been applied. If PAT has not been applied to the
|
||
|
|
Destination port in this packet this object will not be
|
||
|
|
instantiated, resulting in a sparse table. If the event
|
||
|
|
is the result of multiple packets with different
|
||
|
|
destination ports, this value may be zero or a port
|
||
|
|
taken from an arbitrarily chosen packet in the sequence
|
||
|
|
of packets causing the event."
|
||
|
|
::= { cfwNetEventsEntry 10 }
|
||
|
|
|
||
|
|
cfwNetEventService OBJECT-TYPE
|
||
|
|
SYNTAX Services
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The identification of the type of service involved
|
||
|
|
with this event."
|
||
|
|
::= { cfwNetEventsEntry 11 }
|
||
|
|
|
||
|
|
cfwNetEventServiceInformation OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Specific service information. This can be used to
|
||
|
|
describe the particular service indentified by
|
||
|
|
cfwNetEventService and can reflect whether the service
|
||
|
|
is a local service or a gateway service. For example,
|
||
|
|
if the value for cfwNetEventService is loginTelnet
|
||
|
|
then the string provided might be 'local telnet'."
|
||
|
|
::= { cfwNetEventsEntry 12 }
|
||
|
|
|
||
|
|
cfwNetEventIdentity OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This object will contain a description of the entity that
|
||
|
|
caused the event. The entity could be a userid, username,
|
||
|
|
processid or other identifier for the entity using the service.
|
||
|
|
If there is no such information then this object will contain
|
||
|
|
a zero-length string."
|
||
|
|
::= { cfwNetEventsEntry 13 }
|
||
|
|
|
||
|
|
cfwNetEventDescription OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A detailed description of the event."
|
||
|
|
::= { cfwNetEventsEntry 14 }
|
||
|
|
|
||
|
|
|
||
|
|
-- The cfwHardwareStatus
|
||
|
|
--
|
||
|
|
-- The resource information related queries, this table is for
|
||
|
|
-- providing the status of the resources on the firewall. Resources
|
||
|
|
-- can include hardware or software modules on the firewall.
|
||
|
|
|
||
|
|
cfwHardwareStatusTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF CfwHardwareStatusEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table of firewall cfwHardwareStatusEntry entries."
|
||
|
|
::= { cfwStatus 1 }
|
||
|
|
|
||
|
|
cfwHardwareStatusEntry OBJECT-TYPE
|
||
|
|
SYNTAX CfwHardwareStatusEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An entry in the table, containing status information
|
||
|
|
about a resource."
|
||
|
|
INDEX { cfwHardwareType }
|
||
|
|
::= { cfwHardwareStatusTable 1 }
|
||
|
|
|
||
|
|
CfwHardwareStatusEntry ::= SEQUENCE {
|
||
|
|
cfwHardwareType Hardware,
|
||
|
|
cfwHardwareInformation SnmpAdminString,
|
||
|
|
cfwHardwareStatusValue HardwareStatus,
|
||
|
|
cfwHardwareStatusDetail SnmpAdminString
|
||
|
|
}
|
||
|
|
|
||
|
|
cfwHardwareType OBJECT-TYPE
|
||
|
|
SYNTAX Hardware
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The hardware type for which this row provides
|
||
|
|
status information."
|
||
|
|
::= { cfwHardwareStatusEntry 1 }
|
||
|
|
|
||
|
|
cfwHardwareInformation OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A detailed textual description of the resource
|
||
|
|
identified by cfwHardwareType."
|
||
|
|
::= { cfwHardwareStatusEntry 2 }
|
||
|
|
|
||
|
|
cfwHardwareStatusValue OBJECT-TYPE
|
||
|
|
SYNTAX HardwareStatus
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This object contains the current status of the resource."
|
||
|
|
::= { cfwHardwareStatusEntry 3 }
|
||
|
|
|
||
|
|
cfwHardwareStatusDetail OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A detailed textual description of the current status of
|
||
|
|
the resource which may provide a more specific description
|
||
|
|
than cfwHardwareStatusValue."
|
||
|
|
::= { cfwHardwareStatusEntry 4 }
|
||
|
|
|
||
|
|
|
||
|
|
-- The cfwBufferStatistics
|
||
|
|
--
|
||
|
|
-- This table is for providing the statistics for the buffers
|
||
|
|
-- on the firewall.
|
||
|
|
|
||
|
|
cfwBufferStatsTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF CfwBufferStatsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A table conatining status information about a firewall's
|
||
|
|
buffers."
|
||
|
|
::= { cfwStatistics 1 }
|
||
|
|
|
||
|
|
cfwBufferStatsEntry OBJECT-TYPE
|
||
|
|
SYNTAX CfwBufferStatsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An entry in the table, containing status information
|
||
|
|
about a particular statistic for the set of buffers
|
||
|
|
of a particular size."
|
||
|
|
INDEX {
|
||
|
|
cfwBufferStatSize,
|
||
|
|
cfwBufferStatType
|
||
|
|
}
|
||
|
|
::= { cfwBufferStatsTable 1 }
|
||
|
|
|
||
|
|
CfwBufferStatsEntry ::= SEQUENCE {
|
||
|
|
cfwBufferStatSize Unsigned32,
|
||
|
|
cfwBufferStatType ResourceStatistics,
|
||
|
|
cfwBufferStatInformation SnmpAdminString,
|
||
|
|
cfwBufferStatValue Gauge32
|
||
|
|
}
|
||
|
|
|
||
|
|
cfwBufferStatSize OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This object contains the size of the set of buffers
|
||
|
|
for which this row contains the statistics given by
|
||
|
|
cfwBufferStatType."
|
||
|
|
::= { cfwBufferStatsEntry 1 }
|
||
|
|
|
||
|
|
cfwBufferStatType OBJECT-TYPE
|
||
|
|
SYNTAX ResourceStatistics
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This object identifies the type of statistic given by
|
||
|
|
this row for the particular set of buffers identified by
|
||
|
|
cfwBufferStatSize."
|
||
|
|
::= { cfwBufferStatsEntry 2 }
|
||
|
|
|
||
|
|
cfwBufferStatInformation OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A detailed textual description of the statistic
|
||
|
|
identified by cfwBufferStatType."
|
||
|
|
::= { cfwBufferStatsEntry 3 }
|
||
|
|
|
||
|
|
cfwBufferStatValue OBJECT-TYPE
|
||
|
|
SYNTAX Gauge32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The value of the buffer statistic."
|
||
|
|
::= { cfwBufferStatsEntry 4 }
|
||
|
|
|
||
|
|
|
||
|
|
-- The Firewall Connection Statistics Table
|
||
|
|
--
|
||
|
|
-- This table can be used to provide the statistics for firewall
|
||
|
|
-- connection events or services. These "connections" can be
|
||
|
|
-- connections in a loose sense of the word - a UDP transaction
|
||
|
|
-- would qualify as a connection if the firewall maintains
|
||
|
|
-- state information to monitor the packets traversing the firewall
|
||
|
|
-- for this "connection". A uni-directional UDP "connection" could be
|
||
|
|
-- described as being "half-open" by a value of 'halfOpen' in
|
||
|
|
-- cfwConnectionStatType.
|
||
|
|
--
|
||
|
|
-- This table contains multiple rows for each service to which the
|
||
|
|
-- statistic applies.
|
||
|
|
|
||
|
|
cfwConnectionStatTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF CfwConnectionStatEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table of firewall statistic instances."
|
||
|
|
::= { cfwStatistics 2 }
|
||
|
|
|
||
|
|
cfwConnectionStatEntry OBJECT-TYPE
|
||
|
|
SYNTAX CfwConnectionStatEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An entry in the table, containing information about a
|
||
|
|
firewall statistic."
|
||
|
|
INDEX {
|
||
|
|
cfwConnectionStatService,
|
||
|
|
cfwConnectionStatType
|
||
|
|
}
|
||
|
|
::= { cfwConnectionStatTable 1 }
|
||
|
|
|
||
|
|
CfwConnectionStatEntry ::= SEQUENCE {
|
||
|
|
cfwConnectionStatService Services,
|
||
|
|
cfwConnectionStatType ConnectionStat,
|
||
|
|
cfwConnectionStatDescription SnmpAdminString,
|
||
|
|
cfwConnectionStatCount Counter32,
|
||
|
|
cfwConnectionStatValue Gauge32
|
||
|
|
}
|
||
|
|
|
||
|
|
cfwConnectionStatService OBJECT-TYPE
|
||
|
|
SYNTAX Services
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The identification of the type of connection providing
|
||
|
|
statistics."
|
||
|
|
::= { cfwConnectionStatEntry 1 }
|
||
|
|
|
||
|
|
cfwConnectionStatType OBJECT-TYPE
|
||
|
|
SYNTAX ConnectionStat
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The state of the connections that this row contains
|
||
|
|
statistics for."
|
||
|
|
::= { cfwConnectionStatEntry 2 }
|
||
|
|
|
||
|
|
cfwConnectionStatDescription OBJECT-TYPE
|
||
|
|
SYNTAX SnmpAdminString
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A detailed textual description of this statistic."
|
||
|
|
::= { cfwConnectionStatEntry 3 }
|
||
|
|
|
||
|
|
cfwConnectionStatCount OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This is an integer that contains the value of the
|
||
|
|
resource statistic. If a type of 'gauge' is more
|
||
|
|
appropriate this object will be omitted resulting
|
||
|
|
in a sparse table."
|
||
|
|
::= { cfwConnectionStatEntry 4 }
|
||
|
|
|
||
|
|
cfwConnectionStatValue OBJECT-TYPE
|
||
|
|
SYNTAX Gauge32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This is an integer that contains the value of the
|
||
|
|
resource statistic. If a type of 'counter' is more
|
||
|
|
appropriate this object will be omitted resulting
|
||
|
|
in a sparse table."
|
||
|
|
::= { cfwConnectionStatEntry 5 }
|
||
|
|
|
||
|
|
cfwConnectionPerSecond OBJECT-TYPE
|
||
|
|
SYNTAX Gauge32
|
||
|
|
UNITS "Connections per second"
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The current cps rate on the firewall."
|
||
|
|
::= { cfwStatistics 3 }
|
||
|
|
|
||
|
|
cfwConnectionPerSecondPeak OBJECT-TYPE
|
||
|
|
SYNTAX Gauge32
|
||
|
|
UNITS "Connections per second"
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The peak cps rate hit on the firewall."
|
||
|
|
::= { cfwStatistics 4 }
|
||
|
|
|
||
|
|
-- Notifications
|
||
|
|
|
||
|
|
ciscoFirewallMIBNotificationPrefix OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIB 2 }
|
||
|
|
|
||
|
|
ciscoFirewallMIBNotifications OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIBNotificationPrefix 0 }
|
||
|
|
|
||
|
|
|
||
|
|
cfwSecurityNotification NOTIFICATION-TYPE
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicSecurityEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This notification is used for events involving security
|
||
|
|
events. The included objects provide more detailed
|
||
|
|
information about the event."
|
||
|
|
::= { ciscoFirewallMIBNotifications 2 }
|
||
|
|
|
||
|
|
cfwContentInspectNotification NOTIFICATION-TYPE
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicContentInspEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This notification is used to notify the NMS of content
|
||
|
|
inspection events. The included objects provide more
|
||
|
|
detailed information about the event."
|
||
|
|
::= { ciscoFirewallMIBNotifications 3 }
|
||
|
|
|
||
|
|
cfwConnNotification NOTIFICATION-TYPE
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicConnectionEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This notification is used to notify the NMS of
|
||
|
|
connection-oriented events. The included objects provide
|
||
|
|
more detailed information about the event."
|
||
|
|
::= { ciscoFirewallMIBNotifications 4 }
|
||
|
|
|
||
|
|
cfwAccessNotification NOTIFICATION-TYPE
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicAccessEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This notification is used to notify the NMS of access
|
||
|
|
events. The included objects provide more detailed
|
||
|
|
information about the event."
|
||
|
|
::= { ciscoFirewallMIBNotifications 5 }
|
||
|
|
|
||
|
|
cfwAuthNotification NOTIFICATION-TYPE
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicAuthenticationEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This notification is used to notify the NMS of
|
||
|
|
authentication events. The included objects provide
|
||
|
|
more detailed information about the event."
|
||
|
|
::= { ciscoFirewallMIBNotifications 6 }
|
||
|
|
|
||
|
|
cfwGenericNotification NOTIFICATION-TYPE
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicGenericEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"This notification is used to notify the NMS of events
|
||
|
|
that do not fall into the other categories. The included
|
||
|
|
objects provide more detailed information about the event."
|
||
|
|
::= { ciscoFirewallMIBNotifications 7 }
|
||
|
|
-- Conformance
|
||
|
|
|
||
|
|
ciscoFirewallMIBConformance OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIB 3 }
|
||
|
|
|
||
|
|
ciscoFirewallMIBCompliances OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIBConformance 1 }
|
||
|
|
|
||
|
|
ciscoFirewallMIBGroups OBJECT IDENTIFIER
|
||
|
|
::= { ciscoFirewallMIBConformance 2 }
|
||
|
|
|
||
|
|
|
||
|
|
-- Conformance
|
||
|
|
|
||
|
|
ciscoFirewallMIBCompliance MODULE-COMPLIANCE
|
||
|
|
STATUS deprecated
|
||
|
|
DESCRIPTION
|
||
|
|
"The compliance statement for entities which implement
|
||
|
|
the Cisco FirewallMIB."
|
||
|
|
MODULE -- this module
|
||
|
|
MANDATORY-GROUPS { ciscoFirewallMIBStatisticsGroup }
|
||
|
|
::= { ciscoFirewallMIBCompliances 1 }
|
||
|
|
|
||
|
|
ciscoFirewallMIBComplianceRev1 MODULE-COMPLIANCE
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The compliance statement for entities which implement
|
||
|
|
the Cisco FirewallMIB."
|
||
|
|
MODULE -- this module
|
||
|
|
MANDATORY-GROUPS { ciscoFirewallMIBStatisticsGroup }
|
||
|
|
|
||
|
|
GROUP ciscoFirewallMIBEventsGroup
|
||
|
|
DESCRIPTION
|
||
|
|
"Implementation of these objects is not required."
|
||
|
|
|
||
|
|
GROUP ciscoFirewallMIBNotificationGroupRev1
|
||
|
|
DESCRIPTION
|
||
|
|
"Implementation of these notifications is not required."
|
||
|
|
::= { ciscoFirewallMIBCompliances 2 }
|
||
|
|
|
||
|
|
-- Units of Conformance
|
||
|
|
|
||
|
|
ciscoFirewallMIBEventsGroup OBJECT-GROUP
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventsTableLastRow,
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicSecurityEventType,
|
||
|
|
cfwBasicContentInspEventType,
|
||
|
|
cfwBasicConnectionEventType,
|
||
|
|
cfwBasicAccessEventType,
|
||
|
|
cfwBasicAuthenticationEventType,
|
||
|
|
cfwBasicGenericEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow,
|
||
|
|
cfwNetEventsTableLastRow,
|
||
|
|
cfwNetEventInterface,
|
||
|
|
cfwNetEventSrcIpAddress,
|
||
|
|
cfwNetEventInsideSrcIpAddress,
|
||
|
|
cfwNetEventDstIpAddress,
|
||
|
|
cfwNetEventInsideDstIpAddress,
|
||
|
|
cfwNetEventSrcIpPort,
|
||
|
|
cfwNetEventInsideSrcIpPort,
|
||
|
|
cfwNetEventDstIpPort,
|
||
|
|
cfwNetEventInsideDstIpPort,
|
||
|
|
cfwNetEventService,
|
||
|
|
cfwNetEventServiceInformation,
|
||
|
|
cfwNetEventIdentity,
|
||
|
|
cfwNetEventDescription
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Firewall events"
|
||
|
|
::= { ciscoFirewallMIBGroups 1 }
|
||
|
|
|
||
|
|
ciscoFirewallMIBStatisticsGroup OBJECT-GROUP
|
||
|
|
OBJECTS {
|
||
|
|
cfwHardwareInformation,
|
||
|
|
cfwHardwareStatusValue,
|
||
|
|
cfwHardwareStatusDetail,
|
||
|
|
cfwBufferStatInformation,
|
||
|
|
cfwBufferStatValue,
|
||
|
|
cfwConnectionStatDescription,
|
||
|
|
cfwConnectionStatCount,
|
||
|
|
cfwConnectionStatValue
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Firewall statistics"
|
||
|
|
::= { ciscoFirewallMIBGroups 2 }
|
||
|
|
|
||
|
|
ciscoFirewallMIBNotificationGroup OBJECT-GROUP
|
||
|
|
OBJECTS {
|
||
|
|
cfwBasicEventTime,
|
||
|
|
cfwBasicSecurityEventType,
|
||
|
|
cfwBasicContentInspEventType,
|
||
|
|
cfwBasicConnectionEventType,
|
||
|
|
cfwBasicAccessEventType,
|
||
|
|
cfwBasicAuthenticationEventType,
|
||
|
|
cfwBasicGenericEventType,
|
||
|
|
cfwBasicEventDescription,
|
||
|
|
cfwBasicEventDetailsTableRow
|
||
|
|
}
|
||
|
|
STATUS obsolete
|
||
|
|
DESCRIPTION
|
||
|
|
"Firewall Notifications"
|
||
|
|
::= { ciscoFirewallMIBGroups 3 }
|
||
|
|
|
||
|
|
ciscoFirewallMIBNotificationGroupRev1 NOTIFICATION-GROUP
|
||
|
|
NOTIFICATIONS {
|
||
|
|
cfwSecurityNotification,
|
||
|
|
cfwContentInspectNotification,
|
||
|
|
cfwConnNotification,
|
||
|
|
cfwAccessNotification,
|
||
|
|
cfwAuthNotification,
|
||
|
|
cfwGenericNotification
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Firewall Notifications"
|
||
|
|
::= { ciscoFirewallMIBGroups 4 }
|
||
|
|
|
||
|
|
END
|
||
|
|
|
||
|
|
|