-- MIB file created 26-Jan-2006 14:04:34, by -- SMICng version 2.2.11-beta(PRO)(Solaris), January 20, 2001. Enterprise key cisco.com CISCO-FIREWALL-MIB DEFINITIONS ::= BEGIN -- From file: "CISCO-FIREWALL-MIB.my" -- Compile options "4 7 F H N O W 03 06 0B 0G 0N 0T" IMPORTS DateAndTime, RowPointer FROM SNMPv2-TC-v1 SnmpAdminString FROM SNMP-FRAMEWORK-MIB InterfaceIndexOrZero FROM IF-MIB ciscoMgmt FROM CISCO-SMI Counter, Gauge, IpAddress FROM RFC1155-SMI OBJECT-TYPE FROM RFC-1212 TRAP-TYPE FROM RFC-1215; ciscoFirewallMIB OBJECT IDENTIFIER ::= { ciscoMgmt 147 } -- MODULE-IDENTITY -- LastUpdated -- 200512060000Z -- OrgName -- Cisco Systems, Inc. -- ContactInfo -- Cisco Systems -- Customer Service -- -- Postal: 170 W Tasman Drive -- San Jose, CA 95134 -- USA -- -- Tel: +1 800 553-NETS -- -- E-mail: cs-pix@cisco.com -- cs-iosfw@cisco.com -- Descr -- MIB module for monitoring Cisco Firewalls. -- RevDate -- 200512060000Z -- RevDescr -- Added the copyright statement and updated the imports -- such that Unsigned32 is imported from SNMPv2-SMI instead -- of CISCO-TC. Added a new NOTIFICATION-GROUP -- ciscoFirewallMIBNotificationGroupRev1 to include all the -- notifications defined in the MIB. Obsoleted the -- OBJECT-GROUP ciscoFirewallMIBNotificationGroup. Deprecated -- the MODULE-COMPLIANCE ciscoFirewallMIBCompliance and added -- a new MODULE-COMPLIANCE ciscoFirewallMIBComplianceRev1. -- RevDate -- 9904291200Z -- RevDescr -- Initial version of this MIB module. ciscoFirewallMIBObjects OBJECT IDENTIFIER ::= { ciscoFirewallMIB 1 } cfwEvents OBJECT IDENTIFIER ::= { ciscoFirewallMIBObjects 1 } cfwBasicEvents OBJECT IDENTIFIER ::= { cfwEvents 1 } cfwNetEvents OBJECT IDENTIFIER ::= { cfwEvents 2 } cfwSystem OBJECT IDENTIFIER ::= { ciscoFirewallMIBObjects 2 } cfwStatus OBJECT IDENTIFIER ::= { cfwSystem 1 } cfwStatistics OBJECT IDENTIFIER ::= { cfwSystem 2 } ciscoFirewallMIBNotificationPrefix OBJECT IDENTIFIER ::= { ciscoFirewallMIB 2 } ciscoFirewallMIBNotifications OBJECT IDENTIFIER ::= { ciscoFirewallMIBNotificationPrefix 0 } ciscoFirewallMIBConformance OBJECT IDENTIFIER ::= { ciscoFirewallMIB 3 } ciscoFirewallMIBCompliances OBJECT IDENTIFIER ::= { ciscoFirewallMIBConformance 1 } ciscoFirewallMIBGroups OBJECT IDENTIFIER ::= { ciscoFirewallMIBConformance 2 } ResourceStatistics ::= INTEGER { highUse(1), highLoad(2), maximum(3), minimum(4), low(5), high(6), average(7), free(8), inUse(9) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to identify various statistics -- that are related to the resources on a firewall. -- -- highUse : The highest load the resource has had for a -- time period. The time period will be -- implementation dependent. -- highLoad : The highest load the resource has had since -- startup. -- maximum : The maximum amount of the resource that is -- available. -- minimum : The minimum amount of the resource that is -- available. -- low : The lowest amount of the resource that has been -- available since startup. -- high : The highest amount of the resource that has been -- available since startup. -- average : The average amount of the resource that has been -- available since startup. -- free : The amount of the resource that is currently -- available since startup. -- inUse : The amount of the resource that is currently -- in use, eg. CPU usage, memory usage. Hardware ::= INTEGER { memory(1), disk(2), power(3), netInterface(4), cpu(5), primaryUnit(6), secondaryUnit(7), other(8) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various hardware -- resouces that can be monitored by the firewall. -- -- memory - identifies memory. -- disk - identifies disk. -- power - identifies power. -- netInterface - identifies a network interface. -- tape - identifies a tape drive. -- controller - identifies hardware controller. -- cpu - identifies CPU. -- primaryUnit - identifies the primary unit of the two -- identical firewalls configured redundancy. -- secondaryUnit - identifies the secondary unit of the two -- identical firewalls configured redundancy. -- other - identifies other hardware. Services ::= INTEGER { otherFWService(1), fileXferFtp(2), fileXferTftp(3), fileXferFtps(4), loginTelnet(5), loginRlogin(6), loginTelnets(7), remoteExecSunRPC(8), remoteExecMSRPC(9), remoteExecRsh(10), remoteExecXserver(11), webHttp(12), webHttps(13), mailSmtp(14), multimediaStreamworks(15), multimediaH323(16), multimediaNetShow(17), multimediaVDOLive(18), multimediaRealAV(19), multimediaRTSP(20), dbOracle(21), dbMSsql(22), contInspProgLang(23), contInspUrl(24), directoryNis(25), directoryDns(26), directoryNetbiosns(27), directoryNetbiosdgm(28), directoryNetbiosssn(29), directoryWins(30), qryWhois(31), qryFinger(32), qryIdent(33), fsNfsStatus(34), fsNfs(35), fsCifs(36), protoIcmp(37), protoTcp(38), protoUdp(39), protoIp(40), protoSnmp(41) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various services -- that are monitored by the firewall. -- -- otherFWService - a service that does not fit into any -- other category. -- fileXferFtp - identifies FTP, File Transfer Protocol. -- fileXferTftp - identifies TFTP, Trivial File -- Transfer Protocol -- fileXferFtps - identifies FTP, File Transfer -- Protocol running over Secure Sockets Layer. -- loginTelnet - identifies telnet -- loginRlogin - identifies rlogin. -- loginTelnets - identifies telnet over -- Secure Sockets Layer(SSL). -- remoteExecSunRPC - identifies Sun Remote -- Procedure Call Protocol. -- remoteExecMSRPC - identifies Microsoft Remote -- Procedure Call Protocol. -- remoteExecRsh - identifies the remote shell. -- remoteExecXserver - identifies the Xwindows server. -- webHttp - identifies Hyper Text Transfer Protocol. -- webHttps - identifies the secure HTTP protocol. -- mailSmtp - identifies SMTP, Simple Mail Transfer Protocol. -- mailSmtps - identifies SMTP, Simple Mail Transfer Protocol -- running over Secure Sockets Layer (SSL). -- multimediaStreamworks - identifies streamworks. -- multimediaH323 - identifies H323. -- multimediaNetShow - identifies NetShow. -- multimediaVDOLive - identifies vDOLive. -- multimediaRealAV - identifies RealAV. -- multimediaRTSP - identifies Real Time Streaming Protocol -- dbOracle - identifies Oracle's SQL*Net. -- dbMSsql - identifies MicroSoft SQL. -- contInspProgLang - identifies a payload as a programming -- language such as Java or ActiveX. -- contInspUrl - identifies a payload as a URL. -- directoryNis - identifies NIS, Network Information Service. -- directoryDns - identifies DNS, Domain Name Service. -- directoryNetbiosns - identifies NetBIOSNS - NetBIOS Name Service. -- directoryNetbiosdgm - identifies NetBIOSNS - NetBIOS -- datagram Service. -- directoryNetbiosssn - identifies NetBIOSNS - NetBIOS -- Session Service. -- directoryWins - identifies Windows Internet Naming -- Service (WINS). -- qryWhois - identifies WhoIs service. -- qryFinger - identifies finger. -- qryIdent - identifies Ident. -- fsNfsStatus - identifies Network File System (NFS) Status. -- fsNfs - identifies Network File System (NFS). -- fsCifs - identifies CIFS, Common Internet -- File Service. -- protoIcmp - identifies ICMP, Internet Control Message Protocol. -- protoTcp - identifies TCP, Transmission Control Protocol. -- protoUdp - identifies UDP, User Datagram Protocol. -- protoIp - identifies IP, Internet Protocol. -- protoSnmp - identifies SNMP, Simple Network Management Protocol. HardwareStatus ::= INTEGER { other(1), up(2), down(3), error(4), overTemp(5), busy(6), noMedia(7), backup(8), active(9), standby(10) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various events -- that are related to the resources on a firewall. -- other : Generic resource event. -- up : The resource is in service. -- down : The resource is not in service. -- error : There has been an error for this resource. -- overTemp : The resource is overheating. -- busy : The resource is busy. -- noMedia : A device doesn't have its needed media. -- backup : Processing has switched to the backup. -- active : This is the active unit. -- standby : This is the standby unit. SecurityEvent ::= INTEGER { other(1), none(2), dos(3), recon(4), pakFwd(5), addrSpoof(6), svcSpoof(7), thirdParty(8), complete(9), invalPak(10), illegCom(11), policy(12) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various -- security-related events and statistics on a firewall. -- -- other : Generic attack event. -- none : No attack is occurring, an informational -- event. -- dos : A denial of service attack has been detected. -- recon : A pattern of reconnaissance activity has been -- detected. -- pakFwd : A packet forwarding attack has been detected. -- addrSpoof : A spoofed address has been detected. -- svcSpoof : A spoofed service (eg., DNS) has been detected. -- thirdParty : This site is being used as a third-party for -- an attack on another network. For example, the -- 'smurf' attack or email spamming. -- complete : An attack has terminated -- invlPak : An invalid packet with attack characteristics -- has been detected. -- illegCmd : An illegal command has been found. -- policy : An attempt has reen made to violate a security -- policy. ContentInspectionEvent ::= INTEGER { other(1), okay(2), error(3), found(4), clean(5), reject(6), saved(7) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- Content inspection events, these events report that -- something was found in the application payload. The -- details entry in the event can report on what was -- found (eg., virus, company private info., etc), what it -- was found in (eg., html, win32 executable, e-mail), and -- what was done with it (eg., the quarantine location). -- -- other : A content inspection event. Used to indicate -- that some content inspection has occurred that -- is not covered by the other content inspection -- enumerations. -- okay : The check of the content was okay, nothing 'bad' -- was found. -- error : There was an error while checking the content. -- found : Something was found that the content inspection -- engine has determined merits attention. -- clean : The content inspection engine has found something -- that violates the security policy and has -- neutralized the content in the data flow. -- reject : The content inspection engine has found something -- that violates the security policy and has discarded -- the content. -- saved : The content inspection engine has found something -- that violates the security policy and has stored -- it in a quarentine storage area. ConnectionEvent ::= INTEGER { other(1), accept(2), error(3), drop(4), close(5), timeout(6), refused(7), reset(8), noResp(9) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various events -- and statistics that are related to the connections that -- occur on a firewall. -- -- other : A generic connection event. -- accept : A connection has been acccepted. -- error : An error has occurred for a connection. -- drop : The connection has been dropped. -- close : A connection has been closed. -- timeout : A connection has been timed out. -- refused : A connection has been refused. -- reset : A connection has been reset. -- noResp : A connection has received no response. ConnectionStat ::= INTEGER { other(1), totalOpen(2), currentOpen(3), currentClosing(4), currentHalfOpen(5), currentInUse(6), high(7) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various -- connections statistics. -- -- other : A generic connection event. -- totalOpen : Total open connections since reboot. -- currentOpen : The number of connections currently open. -- currentClosing : The number of connections currently closing. -- currentHalfOpen : The number of connections currently half-open. -- currentInUse : The number of connections currently in use. -- high : The highest number of connections in use at -- any one time since system startup. AccessEvent ::= INTEGER { other(1), grant(2), deny(3), denyMult(4), error(5) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various events -- and statistics that are related to the access control on a -- firewall. -- -- other : Miscellaneous access event. -- grant : A service has allowed access based on all -- of its access checks. -- deny : a client was denied use of a service. -- denyMult : A client was denied use of a service -- multiple times. -- error : An error has ocurred during the access -- control process. AuthenticationEvent ::= INTEGER { other(1), succ(2), error(3), fail(4), succPriv(5), failPriv(6), failMult(7) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- This textual convention is used to describe various events -- and statistics that are related to authorization. -- -- other : Miscellaneous authentication event. -- succ : A client successfuly authenticated. -- error : Error while authenticating. -- fail : A client failed an authenticating. -- succPriv : A client accessed a service with special -- privileges. -- failPriv : A client failed to access a service with -- special privileges. -- failMult : Multiple failed authentication attempts by -- a client. GenericEvent ::= INTEGER { abnormal(1), okay(2), error(3) } -- TEXTUAL-CONVENTION -- Status -- mandatory -- Descr -- Generic Events - events for which there is no more specific -- enumeration -- abnormal : An abnormal event has occurred that is neither -- 'okay' nor an 'error'. -- okay : A normal event occurred or the system has changed -- from an abnormal state to a normal state -- error : An error event occurred cfwBasicEventsTableLastRow OBJECT-TYPE SYNTAX Gauge ACCESS read-only STATUS mandatory DESCRIPTION "The index value of the most recently created row in the cfwBasicEventsTable. This number starts at 1 and increase by one with each new log entry. When this number wraps, all events are deleted." ::= { cfwBasicEvents 1 } cfwBasicEventsTable OBJECT-TYPE SYNTAX SEQUENCE OF CfwBasicEventsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Table of basic data for firewall events. The agent may choose to delete the instances of cfwBasicEventsEntry as required because of lack of memory. The oldest Events will be selected first for deletion." ::= { cfwBasicEvents 2 } cfwBasicEventsEntry OBJECT-TYPE SYNTAX CfwBasicEventsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "An entry in the table, containing general information about an event. This table will always be sparse, i.e., each row will instanciate only a subet of the columnar objects." INDEX { cfwBasicEventIndex } ::= { cfwBasicEventsTable 1 } CfwBasicEventsEntry ::= SEQUENCE { cfwBasicEventIndex Gauge, cfwBasicEventTime DateAndTime, cfwBasicSecurityEventType SecurityEvent, cfwBasicContentInspEventType ContentInspectionEvent, cfwBasicConnectionEventType ConnectionEvent, cfwBasicAccessEventType AccessEvent, cfwBasicAuthenticationEventType AuthenticationEvent, cfwBasicGenericEventType GenericEvent, cfwBasicEventDescription SnmpAdminString, cfwBasicEventDetailsTableRow RowPointer } cfwBasicEventIndex OBJECT-TYPE SYNTAX Gauge ACCESS not-accessible STATUS mandatory DESCRIPTION "An index that uniquely identifies an entry in the log table. These indices are assigned beginning with 1 and increase by one with each new event logged." ::= { cfwBasicEventsEntry 1 } cfwBasicEventTime OBJECT-TYPE SYNTAX DateAndTime -- Rsyntax OCTET STRING(SIZE(8|11)) ACCESS read-only STATUS mandatory DESCRIPTION "The time that the event occurred." ::= { cfwBasicEventsEntry 2 } cfwBasicSecurityEventType OBJECT-TYPE SYNTAX SecurityEvent -- Rsyntax INTEGER { -- other(1), -- none(2), -- dos(3), -- recon(4), -- pakFwd(5), -- addrSpoof(6), -- svcSpoof(7), -- thirdParty(8), -- complete(9), -- invalPak(10), -- illegCom(11), -- policy(12) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The type of security-related event that this row contains. If the event is not security-related this object will not be instantiated." ::= { cfwBasicEventsEntry 3 } cfwBasicContentInspEventType OBJECT-TYPE SYNTAX ContentInspectionEvent -- Rsyntax INTEGER { -- other(1), -- okay(2), -- error(3), -- found(4), -- clean(5), -- reject(6), -- saved(7) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The type of content inspection-related event that this row contains. If the event is not content inspection-related this object will not be instantiated." ::= { cfwBasicEventsEntry 4 } cfwBasicConnectionEventType OBJECT-TYPE SYNTAX ConnectionEvent -- Rsyntax INTEGER { -- other(1), -- accept(2), -- error(3), -- drop(4), -- close(5), -- timeout(6), -- refused(7), -- reset(8), -- noResp(9) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The type of connection-related event that this row contains. If the event is not connection-related this object will not be instantiated." ::= { cfwBasicEventsEntry 5 } cfwBasicAccessEventType OBJECT-TYPE SYNTAX AccessEvent -- Rsyntax INTEGER { -- other(1), -- grant(2), -- deny(3), -- denyMult(4), -- error(5) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The type of access-related event that this row contains. If the event is not access-related this object will not be instantiated." ::= { cfwBasicEventsEntry 6 } cfwBasicAuthenticationEventType OBJECT-TYPE SYNTAX AuthenticationEvent -- Rsyntax INTEGER { -- other(1), -- succ(2), -- error(3), -- fail(4), -- succPriv(5), -- failPriv(6), -- failMult(7) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The type of authentication-related event that this row contains. If the event is not authentication-related this object will not be instantiated." ::= { cfwBasicEventsEntry 7 } cfwBasicGenericEventType OBJECT-TYPE SYNTAX GenericEvent -- Rsyntax INTEGER { -- abnormal(1), -- okay(2), -- error(3) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The type of generic event that this row contains. If the event does not fall into one of the other categories this object will be populated. Otherwise, this object will not be instantiated." ::= { cfwBasicEventsEntry 8 } cfwBasicEventDescription OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "A description of the event. The value of the object may be a zero-length string." ::= { cfwBasicEventsEntry 9 } cfwBasicEventDetailsTableRow OBJECT-TYPE SYNTAX RowPointer -- Rsyntax OBJECT IDENTIFIER ACCESS read-only STATUS mandatory DESCRIPTION "A pointer to a row in the table containing details about this event. Generally, the table will be the cfwNetEventsTable but a Cisco-defined table may also appear here. If there there is no more detailed information for this event the value of this object will have the value {0 0}." ::= { cfwBasicEventsEntry 10 } cfwNetEventsTableLastRow OBJECT-TYPE SYNTAX Gauge ACCESS read-only STATUS mandatory DESCRIPTION "The index value of the last row in the cfwNetEventsTable. This number starts at 1 and increase by one with each new log entry. When this number wraps, all events are deleted." ::= { cfwNetEvents 1 } cfwNetEventsTable OBJECT-TYPE SYNTAX SEQUENCE OF CfwNetEventsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Table of detailed data for network events. The agent may choose to delete the instances of cfwBasicEventsEntry as required because of lack of memory. It is an implementation-specific matter as to when this deletion may occur. It is recommended that the oldest log instances are deleted first." ::= { cfwNetEvents 2 } cfwNetEventsEntry OBJECT-TYPE SYNTAX CfwNetEventsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "An entry in the table, containing detailed information about an event. Note that this table may be sparse. If Network Address Translation is not enabled cfwNetEventInsideSrcIpAddress and cfwNetEventInsideDstIpAddress will not be instantiated in the row. If Port Address Translation is not enabled cfwNetEventInsideSrcIpPort and cfwNetEventInsideDstIpPort will not be instantiated in the row. Entries are added to this table at the same time that events are added to the cfwBasicEventsTable. These two tables may be configured to be different sizes so there may not be a one-to-one correspondence between rows in the two tables." INDEX { cfwNetEventIndex } ::= { cfwNetEventsTable 1 } CfwNetEventsEntry ::= SEQUENCE { cfwNetEventIndex Gauge, cfwNetEventInterface InterfaceIndexOrZero, cfwNetEventSrcIpAddress IpAddress, cfwNetEventInsideSrcIpAddress IpAddress, cfwNetEventDstIpAddress IpAddress, cfwNetEventInsideDstIpAddress IpAddress, cfwNetEventSrcIpPort INTEGER, cfwNetEventInsideSrcIpPort INTEGER, cfwNetEventDstIpPort INTEGER, cfwNetEventInsideDstIpPort INTEGER, cfwNetEventService Services, cfwNetEventServiceInformation SnmpAdminString, cfwNetEventIdentity SnmpAdminString, cfwNetEventDescription SnmpAdminString } cfwNetEventIndex OBJECT-TYPE SYNTAX Gauge ACCESS not-accessible STATUS mandatory DESCRIPTION "An index that uniquely identifies an entry in the log table. These indices are assigned beginning with one and increase by one with each new log entry. When this number wraps, all events are deleted in order to allow the NMS to differentiate between old and new events." ::= { cfwNetEventsEntry 1 } cfwNetEventInterface OBJECT-TYPE SYNTAX InterfaceIndexOrZero -- Rsyntax INTEGER(0..2147483647) ACCESS read-only STATUS mandatory DESCRIPTION "The interface most closely associated with this event. For example, for an event that relates to the receipt of a packet, this object identifies the interface on which the packet was received. If there are multiple interfaces associated with an event, the interface most closely associated with the cause of the event will be used. For example, for an event for the setup of a TCP connection, the interface on the initiator's side of the connection would be preferred. If there is no associated interface, then this object has the value zero." ::= { cfwNetEventsEntry 2 } cfwNetEventSrcIpAddress OBJECT-TYPE SYNTAX IpAddress ACCESS read-only STATUS mandatory DESCRIPTION "Source IP address in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different source addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 3 } cfwNetEventInsideSrcIpAddress OBJECT-TYPE SYNTAX IpAddress ACCESS read-only STATUS mandatory DESCRIPTION "Source IP address after Network Address Translation has been applied. If NAT has not been applied to the source address in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different source addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 4 } cfwNetEventDstIpAddress OBJECT-TYPE SYNTAX IpAddress ACCESS read-only STATUS mandatory DESCRIPTION "Destination IP address in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different destination addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 5 } cfwNetEventInsideDstIpAddress OBJECT-TYPE SYNTAX IpAddress ACCESS read-only STATUS mandatory DESCRIPTION "Destination IP address after Network Address Translation has been applied. If NAT has not been applied to the destination address in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different destination addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 6 } cfwNetEventSrcIpPort OBJECT-TYPE SYNTAX INTEGER(0..65535) ACCESS read-only STATUS mandatory DESCRIPTION "Source UDP/TCP port in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different source ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 7 } cfwNetEventInsideSrcIpPort OBJECT-TYPE SYNTAX INTEGER(0..65535) ACCESS read-only STATUS mandatory DESCRIPTION "Source UDP/TCP port after Port Address Translation has been applied. If PAT has not been applied to the source port in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different source ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 8 } cfwNetEventDstIpPort OBJECT-TYPE SYNTAX INTEGER(0..65535) ACCESS read-only STATUS mandatory DESCRIPTION "Destination UDP/TCP port in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different destination ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 9 } cfwNetEventInsideDstIpPort OBJECT-TYPE SYNTAX INTEGER(0..65535) ACCESS read-only STATUS mandatory DESCRIPTION "Destination UDP/TCP port after Port Address Translation has been applied. If PAT has not been applied to the Destination port in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different destination ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event." ::= { cfwNetEventsEntry 10 } cfwNetEventService OBJECT-TYPE SYNTAX Services -- Rsyntax INTEGER { -- otherFWService(1), -- fileXferFtp(2), -- fileXferTftp(3), -- fileXferFtps(4), -- loginTelnet(5), -- loginRlogin(6), -- loginTelnets(7), -- remoteExecSunRPC(8), -- remoteExecMSRPC(9), -- remoteExecRsh(10), -- remoteExecXserver(11), -- webHttp(12), -- webHttps(13), -- mailSmtp(14), -- multimediaStreamworks(15), -- multimediaH323(16), -- multimediaNetShow(17), -- multimediaVDOLive(18), -- multimediaRealAV(19), -- multimediaRTSP(20), -- dbOracle(21), -- dbMSsql(22), -- contInspProgLang(23), -- contInspUrl(24), -- directoryNis(25), -- directoryDns(26), -- directoryNetbiosns(27), -- directoryNetbiosdgm(28), -- directoryNetbiosssn(29), -- directoryWins(30), -- qryWhois(31), -- qryFinger(32), -- qryIdent(33), -- fsNfsStatus(34), -- fsNfs(35), -- fsCifs(36), -- protoIcmp(37), -- protoTcp(38), -- protoUdp(39), -- protoIp(40), -- protoSnmp(41) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The identification of the type of service involved with this event." ::= { cfwNetEventsEntry 11 } cfwNetEventServiceInformation OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "Specific service information. This can be used to describe the particular service indentified by cfwNetEventService and can reflect whether the service is a local service or a gateway service. For example, if the value for cfwNetEventService is loginTelnet then the string provided might be 'local telnet'." ::= { cfwNetEventsEntry 12 } cfwNetEventIdentity OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "This object will contain a description of the entity that caused the event. The entity could be a userid, username, processid or other identifier for the entity using the service. If there is no such information then this object will contain a zero-length string." ::= { cfwNetEventsEntry 13 } cfwNetEventDescription OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "A detailed description of the event." ::= { cfwNetEventsEntry 14 } cfwHardwareStatusTable OBJECT-TYPE SYNTAX SEQUENCE OF CfwHardwareStatusEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Table of firewall cfwHardwareStatusEntry entries." ::= { cfwStatus 1 } cfwHardwareStatusEntry OBJECT-TYPE SYNTAX CfwHardwareStatusEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "An entry in the table, containing status information about a resource." INDEX { cfwHardwareType } ::= { cfwHardwareStatusTable 1 } CfwHardwareStatusEntry ::= SEQUENCE { cfwHardwareType Hardware, cfwHardwareInformation SnmpAdminString, cfwHardwareStatusValue HardwareStatus, cfwHardwareStatusDetail SnmpAdminString } cfwHardwareType OBJECT-TYPE SYNTAX Hardware -- Rsyntax INTEGER { -- memory(1), -- disk(2), -- power(3), -- netInterface(4), -- cpu(5), -- primaryUnit(6), -- secondaryUnit(7), -- other(8) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The hardware type for which this row provides status information." ::= { cfwHardwareStatusEntry 1 } cfwHardwareInformation OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "A detailed textual description of the resource identified by cfwHardwareType." ::= { cfwHardwareStatusEntry 2 } cfwHardwareStatusValue OBJECT-TYPE SYNTAX HardwareStatus -- Rsyntax INTEGER { -- other(1), -- up(2), -- down(3), -- error(4), -- overTemp(5), -- busy(6), -- noMedia(7), -- backup(8), -- active(9), -- standby(10) -- } ACCESS read-only STATUS mandatory DESCRIPTION "This object contains the current status of the resource." ::= { cfwHardwareStatusEntry 3 } cfwHardwareStatusDetail OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "A detailed textual description of the current status of the resource which may provide a more specific description than cfwHardwareStatusValue." ::= { cfwHardwareStatusEntry 4 } cfwBufferStatsTable OBJECT-TYPE SYNTAX SEQUENCE OF CfwBufferStatsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A table conatining status information about a firewall's buffers." ::= { cfwStatistics 1 } cfwBufferStatsEntry OBJECT-TYPE SYNTAX CfwBufferStatsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "An entry in the table, containing status information about a particular statistic for the set of buffers of a particular size." INDEX { cfwBufferStatSize, cfwBufferStatType } ::= { cfwBufferStatsTable 1 } CfwBufferStatsEntry ::= SEQUENCE { cfwBufferStatSize Gauge, cfwBufferStatType ResourceStatistics, cfwBufferStatInformation SnmpAdminString, cfwBufferStatValue Gauge } cfwBufferStatSize OBJECT-TYPE SYNTAX Gauge ACCESS not-accessible STATUS mandatory DESCRIPTION "This object contains the size of the set of buffers for which this row contains the statistics given by cfwBufferStatType." ::= { cfwBufferStatsEntry 1 } cfwBufferStatType OBJECT-TYPE SYNTAX ResourceStatistics -- Rsyntax INTEGER { -- highUse(1), -- highLoad(2), -- maximum(3), -- minimum(4), -- low(5), -- high(6), -- average(7), -- free(8), -- inUse(9) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object identifies the type of statistic given by this row for the particular set of buffers identified by cfwBufferStatSize." ::= { cfwBufferStatsEntry 2 } cfwBufferStatInformation OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "A detailed textual description of the statistic identified by cfwBufferStatType." ::= { cfwBufferStatsEntry 3 } cfwBufferStatValue OBJECT-TYPE SYNTAX Gauge ACCESS read-only STATUS mandatory DESCRIPTION "The value of the buffer statistic." ::= { cfwBufferStatsEntry 4 } cfwConnectionStatTable OBJECT-TYPE SYNTAX SEQUENCE OF CfwConnectionStatEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Table of firewall statistic instances." ::= { cfwStatistics 2 } cfwConnectionStatEntry OBJECT-TYPE SYNTAX CfwConnectionStatEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "An entry in the table, containing information about a firewall statistic." INDEX { cfwConnectionStatService, cfwConnectionStatType } ::= { cfwConnectionStatTable 1 } CfwConnectionStatEntry ::= SEQUENCE { cfwConnectionStatService Services, cfwConnectionStatType ConnectionStat, cfwConnectionStatDescription SnmpAdminString, cfwConnectionStatCount Counter, cfwConnectionStatValue Gauge } cfwConnectionStatService OBJECT-TYPE SYNTAX Services -- Rsyntax INTEGER { -- otherFWService(1), -- fileXferFtp(2), -- fileXferTftp(3), -- fileXferFtps(4), -- loginTelnet(5), -- loginRlogin(6), -- loginTelnets(7), -- remoteExecSunRPC(8), -- remoteExecMSRPC(9), -- remoteExecRsh(10), -- remoteExecXserver(11), -- webHttp(12), -- webHttps(13), -- mailSmtp(14), -- multimediaStreamworks(15), -- multimediaH323(16), -- multimediaNetShow(17), -- multimediaVDOLive(18), -- multimediaRealAV(19), -- multimediaRTSP(20), -- dbOracle(21), -- dbMSsql(22), -- contInspProgLang(23), -- contInspUrl(24), -- directoryNis(25), -- directoryDns(26), -- directoryNetbiosns(27), -- directoryNetbiosdgm(28), -- directoryNetbiosssn(29), -- directoryWins(30), -- qryWhois(31), -- qryFinger(32), -- qryIdent(33), -- fsNfsStatus(34), -- fsNfs(35), -- fsCifs(36), -- protoIcmp(37), -- protoTcp(38), -- protoUdp(39), -- protoIp(40), -- protoSnmp(41) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The identification of the type of connection providing statistics." ::= { cfwConnectionStatEntry 1 } cfwConnectionStatType OBJECT-TYPE SYNTAX ConnectionStat -- Rsyntax INTEGER { -- other(1), -- totalOpen(2), -- currentOpen(3), -- currentClosing(4), -- currentHalfOpen(5), -- currentInUse(6), -- high(7) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The state of the connections that this row contains statistics for." ::= { cfwConnectionStatEntry 2 } cfwConnectionStatDescription OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "A detailed textual description of this statistic." ::= { cfwConnectionStatEntry 3 } cfwConnectionStatCount OBJECT-TYPE SYNTAX Counter ACCESS read-only STATUS mandatory DESCRIPTION "This is an integer that contains the value of the resource statistic. If a type of 'gauge' is more appropriate this object will be omitted resulting in a sparse table." ::= { cfwConnectionStatEntry 4 } cfwConnectionStatValue OBJECT-TYPE SYNTAX Gauge ACCESS read-only STATUS mandatory DESCRIPTION "This is an integer that contains the value of the resource statistic. If a type of 'counter' is more appropriate this object will be omitted resulting in a sparse table." ::= { cfwConnectionStatEntry 5 } cfwSecurityNotification TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoFirewallMIBNotificationPrefix VARIABLES { cfwBasicEventTime, cfwBasicSecurityEventType, cfwBasicEventDescription, cfwBasicEventDetailsTableRow } -- Status -- mandatory DESCRIPTION "This notification is used for events involving security events. The included objects provide more detailed information about the event." ::= 2 cfwContentInspectNotification TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoFirewallMIBNotificationPrefix VARIABLES { cfwBasicEventTime, cfwBasicContentInspEventType, cfwBasicEventDescription, cfwBasicEventDetailsTableRow } -- Status -- mandatory DESCRIPTION "This notification is used to notify the NMS of content inspection events. The included objects provide more detailed information about the event." ::= 3 cfwConnNotification TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoFirewallMIBNotificationPrefix VARIABLES { cfwBasicEventTime, cfwBasicConnectionEventType, cfwBasicEventDescription, cfwBasicEventDetailsTableRow } -- Status -- mandatory DESCRIPTION "This notification is used to notify the NMS of connection-oriented events. The included objects provide more detailed information about the event." ::= 4 cfwAccessNotification TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoFirewallMIBNotificationPrefix VARIABLES { cfwBasicEventTime, cfwBasicAccessEventType, cfwBasicEventDescription, cfwBasicEventDetailsTableRow } -- Status -- mandatory DESCRIPTION "This notification is used to notify the NMS of access events. The included objects provide more detailed information about the event." ::= 5 cfwAuthNotification TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoFirewallMIBNotificationPrefix VARIABLES { cfwBasicEventTime, cfwBasicAuthenticationEventType, cfwBasicEventDescription, cfwBasicEventDetailsTableRow } -- Status -- mandatory DESCRIPTION "This notification is used to notify the NMS of authentication events. The included objects provide more detailed information about the event." ::= 6 cfwGenericNotification TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoFirewallMIBNotificationPrefix VARIABLES { cfwBasicEventTime, cfwBasicGenericEventType, cfwBasicEventDescription, cfwBasicEventDetailsTableRow } -- Status -- mandatory DESCRIPTION "This notification is used to notify the NMS of events that do not fall into the other categories. The included objects provide more detailed information about the event." ::= 7 ciscoFirewallMIBEventsGroup OBJECT IDENTIFIER ::= { ciscoFirewallMIBGroups 1 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- Firewall events -- objects -- cfwBasicEventsTableLastRow, cfwBasicEventTime, -- cfwBasicSecurityEventType, cfwBasicContentInspEventType, -- cfwBasicConnectionEventType, cfwBasicAccessEventType, -- cfwBasicAuthenticationEventType, cfwBasicGenericEventType, -- cfwBasicEventDescription, cfwBasicEventDetailsTableRow, -- cfwNetEventsTableLastRow, cfwNetEventInterface, -- cfwNetEventSrcIpAddress, cfwNetEventInsideSrcIpAddress, -- cfwNetEventDstIpAddress, cfwNetEventInsideDstIpAddress, -- cfwNetEventSrcIpPort, cfwNetEventInsideSrcIpPort, -- cfwNetEventDstIpPort, cfwNetEventInsideDstIpPort, -- cfwNetEventService, cfwNetEventServiceInformation, -- cfwNetEventIdentity, cfwNetEventDescription ciscoFirewallMIBStatisticsGroup OBJECT IDENTIFIER ::= { ciscoFirewallMIBGroups 2 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- Firewall statistics -- objects -- cfwHardwareInformation, cfwHardwareStatusValue, -- cfwHardwareStatusDetail, cfwBufferStatInformation, -- cfwBufferStatValue, cfwConnectionStatDescription, -- cfwConnectionStatCount, cfwConnectionStatValue ciscoFirewallMIBNotificationGroup OBJECT IDENTIFIER ::= { ciscoFirewallMIBGroups 3 } -- OBJECT-GROUP -- Status -- obsolete -- Descr -- Firewall Notifications -- objects -- cfwBasicEventTime, cfwBasicSecurityEventType, -- cfwBasicContentInspEventType, cfwBasicConnectionEventType, -- cfwBasicAccessEventType, cfwBasicAuthenticationEventType, -- cfwBasicGenericEventType, cfwBasicEventDescription, -- cfwBasicEventDetailsTableRow ciscoFirewallMIBNotificationGroupRev1 OBJECT IDENTIFIER ::= { ciscoFirewallMIBGroups 4 } -- NOTIFICATION-GROUP -- Status -- mandatory -- Descr -- Firewall Notifications -- notifications -- cfwSecurityNotification, cfwContentInspectNotification, -- cfwConnNotification, cfwAccessNotification, -- cfwAuthNotification, cfwGenericNotification ciscoFirewallMIBCompliance OBJECT IDENTIFIER ::= { ciscoFirewallMIBCompliances 1 } -- MODULE-COMPLIANCE -- Status -- deprecated -- Descr -- The compliance statement for entities which implement -- the Cisco FirewallMIB. -- Module -- >>current<< -- MandGroup -- ciscoFirewallMIBStatisticsGroup ciscoFirewallMIBComplianceRev1 OBJECT IDENTIFIER ::= { ciscoFirewallMIBCompliances 2 } -- MODULE-COMPLIANCE -- Status -- mandatory -- Descr -- The compliance statement for entities which implement -- the Cisco FirewallMIB. -- Module -- >>current<< -- MandGroup -- ciscoFirewallMIBStatisticsGroup -- OptGroup -- ciscoFirewallMIBEventsGroup -- OptGroup -- ciscoFirewallMIBNotificationGroupRev1 END