-- MIB file created 01-Mar-2006 18:08:46, by -- SMICng version 2.2.11-beta(PRO)(Solaris), January 20, 2001. Enterprise key cisco.com CISCO-UNIFIED-FIREWALL-MIB DEFINITIONS ::= BEGIN -- From file: "CISCO-UNIFIED-FIREWALL-MIB.my" -- Compile options "4 7 F H N O W 03 06 0B 0G 0N 0T" IMPORTS TruthValue, TimeStamp FROM SNMPv2-TC-v1 InetAddressType, InetAddress, InetPortNumber FROM INET-ADDRESS-MIB ciscoMgmt FROM CISCO-SMI CFWNetworkProtocol, CFWApplicationProtocol, CFWPolicy, CFWPolicyTarget, CFWPolicyTargetType, CFWUrlfVendorId, CFWUrlServerStatus FROM CISCO-FIREWALL-TC dot1dTpFdbPort, dot1dTpFdbStatus FROM BRIDGE-MIB Gauge, Counter FROM RFC1155-SMI OBJECT-TYPE FROM RFC-1212 TRAP-TYPE FROM RFC-1215; ciscoUnifiedFirewallMIB OBJECT IDENTIFIER ::= { ciscoMgmt 491 } -- MODULE-IDENTITY -- LastUpdated -- 200509220000Z -- OrgName -- Cisco Systems -- ContactInfo -- Cisco Systems -- Customer Service -- -- Postal: 170 W Tasman Drive -- San Jose, CA 95134 -- USA -- -- Tel: +1 800 553-NETS -- E-mail: cs-firewalls@cisco.com -- Descr -- Overview of Cisco Firewall MIB -- ============================== -- This MIB Module models status and performance -- statistics pertaining to the common features supported -- by Cisco firewall implementations. For each firewall -- feature, capability (if applicable) and statistics are -- defined. Supporting the configuration of firewall -- features is outside the scope of this MIB. -- -- Following are the major firewall features: -- -- 1) 'Stateful Packet Filtering' -- Creating and maintaining the state of authorized -- traffic flows dynamically to permit only -- flows authorized by the policy is a mandatory -- function of a firewall. -- This MIB instruments the activity and memory -- usage by this function. -- -- 2) 'Application Inspection' -- This refers to the function of inspecting the -- headers of layer 3 and layer 4 protocols and -- creating dynamic entries in the connection -- table for traffic flows spawned by an already -- established traffic flow. -- -- This MIB reflects the protocols that are being -- inspected. -- -- 3) 'URL Filtering' -- This refers to the function of facilitating -- or restricting URL access requests through -- the firewall by consulting either local policy -- or that configured on a dedicated URL filtering -- server. -- -- This MIB instruments the URL filtering activity, -- the status and activity of distinct URL filtering -- servers configured on the firewall and the -- impact of the performance of the URL filtering -- servers on the latency and throughput of the -- firewall. -- -- 4) 'Proxy Authentication' -- This refers to the function of authenticating -- and/or authorizing users on behalf of servers -- on the secure side of the firewall. This operation -- could affect the throughput of the firewall. -- -- The MIB objects pertaining to Proxy Authentication -- will be defined in a subsequent revision of this -- MIB. -- -- -- 5) 'Transparent Mode Operation' -- A firewall could operate as a bridge and yet -- filter traffic based on layer 3-layer 7 control -- and payload information. Operating in this mode -- makes it easy to implement a firewall without -- fragmenting existing subnets. Another advantage -- of this mode of operation is enhanced security. -- -- This MIB instruments the status, activity, -- and performance of the firewall in this mode. -- Please note that to fully manage a firewall -- operating in this mode, the firewall must also -- support the bridge MIB (BRIDGE-MIB). -- -- -- 6) 'Advanced Application Inspection and Control' -- This function is also termed 'Application -- Firewall' and pertains to inspecting payload and -- headers of application traffic to make sure the -- traffic flows conform to the configured security -- policy. -- -- Monitoring this function entails identifying the -- security alerts generated by this function and -- measuring the impact on firewall performance by -- this task. Application Firewall will be -- instrumented in a separate MIB dedicated for the -- function. -- -- 7) 'Failover' or 'Redundancy' -- Redundancy configuration is essential for business -- critical firewalls. -- -- Instrumenting this function entails reflecting -- the configuration of redundancy and identifying -- failover events. -- -- The MIB objects pertaining to Proxy Authentication -- will be defined in a subsequent revision of this -- MIB. -- -- -- The management information for each firewall feature -- is defined in a distinct module compliance unit. The -- compliance units corresponding to basic features of -- firewalls are defined as mandatory. -- -- Acronyms -- ======== -- Following are definitions of some terms used in this -- module. Please refer to the module conformance for a -- glossary of feature-specific terms. -- -- `Firewall' -- A firewall is a set of related programs, -- implemented on a host or a network device, that -- protects the resources of a private network from -- users from other networks. Common firewalling -- functions include stateful packet filtering, -- proxy authentication of users on behalf of -- applications on the secure side of the firewall, -- URL access control, inspection of payload of -- traffic streams to determine security threats. -- -- `Layer2 Firewall' or 'Transparent Firewall' -- A firewall device that operates as a bridge -- while performing firewalling function. -- -- `Connection' -- The record in the firewall of a traffic strean -- that has been authorized to flow through the -- firewall. -- -- `Half Open Connection' -- For a connection oriented protocol: a connection -- that has not reached the established on both the -- sides of the connection. -- For a connection-less protocol: the connection -- corresponding to a traffic stream where traffic -- flow has occurred (since the establishment of the -- connection entry) only on one direction. -- -- `Embryonic Connection' -- The connection entry corresponding to an -- application layer protocol in which the signaling -- channel has been established while the setup of -- the data channel is underway. -- -- `Policy' -- An element of firewall configuration that -- identifies the access rights to a resource by a -- traffic source. An example of a policy is an -- Access Control Rule. -- -- `Policy Target' -- An entity to which a policy is applied so that -- the action corresponding to the policy is taken -- only on traffic streams associated with the -- entity. An example of a policy target is an -- interface. -- -- `URL Filtering Server' -- A server which is employed by the firewall to -- enforce URL access policies. -- -- `Protocol Data Unit' or PDU -- An instance of the unit of information using which -- a protocol operates is called the Protocol Data -- Unit or the PDU of the protocol. -- -- `Deep Packet Inspection' -- The task of examining the contents of the payloads -- of one or more layer 7 application protocols -- with a view to enforcing the local security -- policies termed 'Deep Packet Inspection'. -- -- `Advanced Application Inspection and Control' -- An entity that performs deep packet inspection -- of layer 7 application protocol data units is -- termed an 'Application Firewall'. -- RevDate -- 200509220000Z -- RevDescr -- Initial version of this module. ciscoUnifiedFirewallMIBNotifs OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIB 0 } ciscoUnifiedFirewallMIBObjects OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIB 1 } ciscoUnifiedFirewallMIBConform OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIB 2 } cuFwConnectionGrp OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBObjects 1 } cuFwApplInspectionGrp OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBObjects 2 } cuFwUrlFilterGrp OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBObjects 3 } cuFwFailoverGrp OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBObjects 4 } cuFwAaicGrp OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBObjects 5 } cuFwL2FwGrp OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBObjects 6 } cuFwNotifCntlGrp OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBObjects 7 } cuFwConnectionGlobals OBJECT IDENTIFIER ::= { cuFwConnectionGrp 1 } cuFwConnectionResources OBJECT IDENTIFIER ::= { cuFwConnectionGrp 2 } cuFwConnectionReportSettings OBJECT IDENTIFIER ::= { cuFwConnectionGrp 3 } cuFwConnectionSummaryTables OBJECT IDENTIFIER ::= { cuFwConnectionGrp 4 } cufwUrlFilterGlobals OBJECT IDENTIFIER ::= { cuFwUrlFilterGrp 1 } cufwUrlFilterResourceUsage OBJECT IDENTIFIER ::= { cuFwUrlFilterGrp 2 } cufwUrlFilterServers OBJECT IDENTIFIER ::= { cuFwUrlFilterGrp 3 } cufwAaicGlobals OBJECT IDENTIFIER ::= { cuFwAaicGrp 1 } cufwAaicProtocolStats OBJECT IDENTIFIER ::= { cuFwAaicGrp 2 } cufwAaicHttpProtocolStats OBJECT IDENTIFIER ::= { cufwAaicProtocolStats 1 } cufwL2FwGlobals OBJECT IDENTIFIER ::= { cuFwL2FwGrp 1 } ciscoUniFirewallMIBCompliances OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBConform 1 } ciscoUniFirewallMIBGroups OBJECT IDENTIFIER ::= { ciscoUnifiedFirewallMIBConform 2 } cufwConnGlobalNumAttempted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION " Connection Statistics Aggregation Connection 1 +-----------+ ------------->| |-------> Global Connection Summary Connection 2 | | ------------->| | Connection 3 | | ------------->| First |------------> ConnSummary | Level | (i.e, L-3/4 Protocol Connection 4 |Aggregation| Connection Summary) ------------->| | . | | . | |---------------> PolicyConnSummary Connection N | | (i.e, L-3/4 Policy Target based ------------->| | Protocol Connection Summary) +-----------+ +-----------+ L-3/4 Protocol | | Connection Summary | | ------------------>| |---------> AppConnSummary | | (i.e, L-7 Protocol | Second | Connection Summary) |---Level---| L-3/4 Policy Target |Aggregation| based Protocol | | Connection Summary | | ------------------>| |---------------> PolicyAppConnSummary | | (i.e, L-7 Policy Target based | | Protocol Connection Summary) +-----------+ Specifically, the object 'cufwConnGlobalNumAttempted' models the number of connections which are attempted to be set up through the firewall. This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 1 } cufwConnGlobalNumSetupsAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection setup attempts that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwConnGlobalNumPolicyDeclined' and 'cufwConnGlobalNumResDeclined'. This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 2 } cufwConnGlobalNumPolicyDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections which were attempted to be setup but which were declined due to reasons of security policy. This includes the connections that failed authentication. This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 3 } cufwConnGlobalNumResDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections which were attempted to be setup but which were declined due to non-availability of required resources. This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 4 } cufwConnGlobalNumHalfOpen OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections which are in the process of being setup but which have not yet reached the established state in the connection table." ::= { cuFwConnectionGlobals 5 } cufwConnGlobalNumActive OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections which are currently active." ::= { cuFwConnectionGlobals 6 } cufwConnGlobalNumExpired OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections which were active but which were since normally terminated. This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 7 } cufwConnGlobalNumAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections which were active but which were aborted by the firewall due to reasons of policy or resource rationing. This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 8 } cufwConnGlobalNumEmbryonic OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of embryonic application layer connections (that is, connections in which the signaling channel has been established while the data channel is awaiting setup). This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 9 } cufwConnGlobalConnSetupRate1 OBJECT-TYPE SYNTAX Gauge -- Units -- Connections per second ACCESS read-only STATUS mandatory DESCRIPTION "The averaged number of connections which the firewall establishing per second, averaged over the last 60 seconds." ::= { cuFwConnectionGlobals 10 } cufwConnGlobalConnSetupRate5 OBJECT-TYPE SYNTAX Gauge -- Units -- Connections per second ACCESS read-only STATUS mandatory DESCRIPTION "The averaged number of connections which the firewall establishing per second, averaged over the last 300 seconds." ::= { cuFwConnectionGlobals 11 } cufwConnGlobalNumRemoteAccess OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of active connections which correspond to remote access applications. Specifically, the protocol for which the connection is established must be one of PPP, PPTP, L2TP or remote access IPsec (IPsec connections employing extended authentication). This value is accumulated from the last reboot of the firewall." ::= { cuFwConnectionGlobals 12 } cufwConnResMemoryUsage OBJECT-TYPE SYNTAX Gauge -- Units -- KBytes ACCESS read-only STATUS mandatory DESCRIPTION "The amount of memory occupied by all structures required to maintain the state of all connections which are either being established or are active." ::= { cuFwConnectionResources 1 } cufwConnResActiveConnMemoryUsage OBJECT-TYPE SYNTAX Gauge -- Units -- KBytes ACCESS read-only STATUS mandatory DESCRIPTION "The amount of memory occupied by all structures required to maintain the state of all active connections." ::= { cuFwConnectionResources 2 } cufwConnResHOConnMemoryUsage OBJECT-TYPE SYNTAX Gauge -- Units -- KBytes ACCESS read-only STATUS mandatory DESCRIPTION "The amount of memory occupied by all structures required to maintain the state of all half open connections." ::= { cuFwConnectionResources 3 } cufwConnResEmbrConnMemoryUsage OBJECT-TYPE SYNTAX Gauge -- Units -- KBytes ACCESS read-only STATUS mandatory DESCRIPTION "The amount of memory occupied by all structures required to maintain the state of all embryonic connections." ::= { cuFwConnectionResources 4 } cufwConnReptAppStats OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION "Setting this object to 'true' enables the MIB to report connection activity statistics pertaining to application protocols. If this object is set to 'false', the agent should stop updating the objects defined in this module pertaining to application protocols. Application monitoring could be a resource intensive operation. It is expected that the administrators would use this control to disable application monitoring when the performance of the firewall is degrading." DEFVAL { false } ::= { cuFwConnectionReportSettings 1 } cufwConnReptAppStatsLastChanged OBJECT-TYPE SYNTAX TimeStamp -- Rsyntax TimeTicks ACCESS read-only STATUS mandatory DESCRIPTION "The time at which the value of cufwConnReptAppStats was last changed." ::= { cuFwConnectionReportSettings 2 } cufwConnSummaryTable OBJECT-TYPE SYNTAX SEQUENCE OF CufwConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table summarizes the connection activity on the firewall per layer3-layer 4 protocol instance. Each entry in the table lists the connection summary of a distinct network protocol. For instance, the conceptual row corresponding to the index cufwConnProtocol = fwpTcp yields the summary of TCP connection activity on the firewall since its reboot." ::= { cuFwConnectionSummaryTables 1 } cufwConnSummaryEntry OBJECT-TYPE SYNTAX CufwConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Each entry contains the summary of connection activity for a layer3-layer4 network protocol." INDEX { cufwConnProtocol } ::= { cufwConnSummaryTable 1 } CufwConnSummaryEntry ::= SEQUENCE { cufwConnProtocol CFWNetworkProtocol, cufwConnNumAttempted Counter, cufwConnNumSetupsAborted Counter, cufwConnNumPolicyDeclined Counter, cufwConnNumResDeclined Counter, cufwConnNumHalfOpen Gauge, cufwConnNumActive Gauge, cufwConnNumAborted Counter, cufwConnSetupRate1 Gauge, cufwConnSetupRate5 Gauge } cufwConnProtocol OBJECT-TYPE SYNTAX CFWNetworkProtocol -- Rsyntax INTEGER { -- none(1), -- other(2), -- ip(3), -- icmp(4), -- gre(5), -- udp(6), -- tcp(7) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The (L3-L4) protocol for which this conceptual row summarizes the connection activity on the managed entity." ::= { cufwConnSummaryEntry 1 } cufwConnNumAttempted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall." ::= { cufwConnSummaryEntry 2 } cufwConnNumSetupsAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection setup attempts, corresponding to the protocol denoted by 'cufwConnProtocol', that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwConnNumPolicyDeclined' and 'cufwConnNumResDeclined'. This value is accumulated from the last reboot of the firewall." ::= { cufwConnSummaryEntry 3 } cufwConnNumPolicyDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall." ::= { cufwConnSummaryEntry 4 } cufwConnNumResDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall." ::= { cufwConnSummaryEntry 5 } cufwConnNumHalfOpen OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwConnProtocol'." ::= { cufwConnSummaryEntry 6 } cufwConnNumActive OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently active, corresponding to the protocol denoted by 'cufwConnProtocol'." ::= { cufwConnSummaryEntry 7 } cufwConnNumAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that were abnormally terminated after successful establishment, corresponding to the protocol denoted by 'cufwConnProtocol'. This value is accumulated from the last reboot of the firewall." ::= { cufwConnSummaryEntry 8 } cufwConnSetupRate1 OBJECT-TYPE SYNTAX Gauge -- Units -- Connections Per Second ACCESS read-only STATUS mandatory DESCRIPTION "The connection setup rate averaged over the last 60 seconds corresponding to the protocol denoted by 'cufwConnProtocol'." ::= { cufwConnSummaryEntry 9 } cufwConnSetupRate5 OBJECT-TYPE SYNTAX Gauge -- Units -- Connections Per Second ACCESS read-only STATUS mandatory DESCRIPTION "The connection setup rate averaged over the last 300 seconds corresponding to the protocol denoted by 'cufwConnProtocol'." ::= { cufwConnSummaryEntry 10 } cufwAppConnSummaryTable OBJECT-TYPE SYNTAX SEQUENCE OF CufwAppConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table lists the summary of firewall connections pertaining to Layer 7 protocols, catalogued by distinct application protocols. Each entry in the table lists the connection summary corresponding to a distinct application protocol. For instance, to obtain the connection summary for SMTP on the firewall since the last reboot of the device, use the conceptual row corresponding to cufwAppConnProtocol = fwApSmtp" ::= { cuFwConnectionSummaryTables 2 } cufwAppConnSummaryEntry OBJECT-TYPE SYNTAX CufwAppConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Each entry contains the summary of connection activity for a distinct layer 7 protocol identified by the index element 'cufwAppConnProtocol'." INDEX { cufwAppConnProtocol } ::= { cufwAppConnSummaryTable 1 } CufwAppConnSummaryEntry ::= SEQUENCE { cufwAppConnProtocol CFWApplicationProtocol, cufwAppConnNumAttempted Counter, cufwAppConnNumSetupsAborted Counter, cufwAppConnNumPolicyDeclined Counter, cufwAppConnNumResDeclined Counter, cufwAppConnNumHalfOpen Gauge, cufwAppConnNumActive Gauge, cufwAppConnNumAborted Counter, cufwAppConnSetupRate1 Gauge, cufwAppConnSetupRate5 Gauge } cufwAppConnProtocol OBJECT-TYPE SYNTAX CFWApplicationProtocol -- Rsyntax INTEGER { -- none(1), -- other(2), -- ftp(3), -- telnet(4), -- smtp(5), -- http(6), -- tacacs(7), -- dns(8), -- sqlnet(9), -- https(10), -- tftp(11), -- gopher(12), -- finger(13), -- kerberos(14), -- pop2(15), -- pop3(16), -- sunRpc(17), -- msRpc(18), -- nntp(19), -- snmp(20), -- imap(21), -- ldap(22), -- exec(23), -- login(24), -- shell(25), -- msSql(26), -- sybaseSql(27), -- nfs(28), -- lotusnote(29), -- h323(30), -- cuseeme(31), -- realmedia(32), -- netshow(33), -- streamworks(34), -- vdolive(35), -- sap(36), -- sip(37), -- mgcp(38), -- rtsp(39), -- skinny(40), -- gtpV0(41), -- gtpV1(42), -- echo(43), -- discard(44), -- daytime(45), -- netstat(46), -- ssh(47), -- time(48), -- tacacsDs(49), -- bootps(50), -- bootpc(51), -- dnsix(52), -- rtelnet(53), -- ident(54), -- sqlServ(55), -- ntp(56), -- pwdgen(57), -- ciscoFna(58), -- ciscoTna(59), -- ciscoSys(60), -- netbiosNs(61), -- netbiosDgm(62), -- netbiosSsn(63), -- sqlSrv(64), -- snmpTrap(65), -- rsvd(66), -- send(67), -- xdmcp(68), -- bgp(69), -- irc(70), -- qmtp(71), -- ipx(72), -- dbase(73), -- imap3(74), -- rsvpTunnel(75), -- hpCollector(76), -- hpManagedNode(77), -- hpAlarmMgr(78), -- microsoftDs(79), -- creativeServer(80), -- creativePartnr(81), -- appleQtc(82), -- igmpV3Lite(83), -- isakmp(84), -- biff(85), -- who(86), -- syslog(87), -- router(88), -- ncp(89), -- timed(90), -- ircServ(91), -- uucp(92), -- syslogConn(93), -- sshell(94), -- ldaps(95), -- dhcpFailover(96), -- msexchRouting(97), -- entrustSvcs(98), -- entrustSvcHandler(99), -- ciscoTdp(100), -- webster(101), -- gdoi(102), -- iscsi(103), -- cddbp(104), -- ftps(105), -- telnets(106), -- imaps(107), -- ircs(108), -- pop3s(109), -- socks(110), -- kazaa(111), -- msSqlM(112), -- msSna(113), -- wins(114), -- ica(115), -- orasrv(116), -- rdbDbsDisp(117), -- vqp(118), -- icabrowser(119), -- kermit(120), -- rsvpEncap(121), -- l2tp(122), -- pptp(123), -- h323Gatestat(124), -- rWinsock(125), -- radius(126), -- hsrp(127), -- net8Cman(128), -- oracleEmVp(129), -- oracleNames(130), -- oracle(131), -- ciscoSvcs(132), -- ciscoNetMgmt(133), -- stun(134), -- trRsrb(135), -- ddnsV3(136), -- aceSvr(137), -- giop(138), -- ttc(139), -- ipass(140), -- clp(141), -- citrixImaClient(142), -- sms(143), -- citrix(144), -- realSecure(145), -- lotusMtap(146), -- cifs(147), -- msDotnetster(148), -- tarantella(149), -- fcipPort(150), -- ssp(151), -- iscsiTarget(152), -- mySql(153), -- msClusterNet(154), -- ldapAdmin(155), -- ieee80211Iapp(156), -- oemAgent(157), -- rtcPmPort(158), -- dbControlAgent(159), -- ipsecMsft(160), -- sipTls(161), -- aim(162), -- pcAnyWhereData(163), -- pcAnyWhereStat(164), -- x11(165), -- ircu(166), -- n2h2Server(167), -- h323CallSigAlt(168), -- yahooMsgr(169), -- msnMsgr(170) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The layer7 protocol for which this conceptual row summarizes the connection activity for this firewall." ::= { cufwAppConnSummaryEntry 1 } cufwAppConnNumAttempted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwAppConnSummaryEntry 2 } cufwAppConnNumSetupsAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection setup attempts, corresponding to the protocol denoted by 'cufwAppConnProtocol', that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwAppConnNumPolicyDeclined' and 'cufwAppConnNumResDeclined'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwAppConnSummaryEntry 3 } cufwAppConnNumPolicyDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwAppConnSummaryEntry 4 } cufwAppConnNumResDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwAppConnSummaryEntry 5 } cufwAppConnNumHalfOpen OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwAppConnProtocol'." ::= { cufwAppConnSummaryEntry 6 } cufwAppConnNumActive OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently active, corresponding to the protocol denoted by 'cufwAppConnProtocol'." ::= { cufwAppConnSummaryEntry 7 } cufwAppConnNumAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that were terminated by the firewall successful establishment, corresponding to the protocol denoted by 'cufwAppConnProtocol'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwAppConnSummaryEntry 8 } cufwAppConnSetupRate1 OBJECT-TYPE SYNTAX Gauge -- Units -- Connections Per Second ACCESS read-only STATUS mandatory DESCRIPTION "The connection setup rate averaged over the last 60 seconds corresponding to the protocol denoted by 'cufwAppConnProtocol'." ::= { cufwAppConnSummaryEntry 9 } cufwAppConnSetupRate5 OBJECT-TYPE SYNTAX Gauge -- Units -- Connections Per Second ACCESS read-only STATUS mandatory DESCRIPTION "The connection setup rate averaged over the last 300 seconds corresponding to the protocol denoted by 'cufwAppConnProtocol'." ::= { cufwAppConnSummaryEntry 10 } cufwPolicyConnSummaryTable OBJECT-TYPE SYNTAX SEQUENCE OF CufwPolicyConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table lists the summary of firewall connections for layer3-layer 4 protocols catalogued on a per policy basis. Each entry in the table lists the connection summary of a distinct network protocol, configured on the specified policy on the firewall, and pertaining to a specified target to which the policy is currently applied. If a policy is bound to a target, it would have one or more entries in this table. If the policy is detached from the target, all entries corresponding to the association between the policy and the target are elminated from this table. Although the information is indexed by policy targets as well, one may aggregate the connection summary for a specific policy across all the target to which the policy is currently applied by setting cufwConnPolicyTargetType = 'targetAll'" ::= { cuFwConnectionSummaryTables 3 } cufwPolicyConnSummaryEntry OBJECT-TYPE SYNTAX CufwPolicyConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Each entry contains the summary of connection activity for a specific protocol in a specific policy applied to the specified policy target." INDEX { cufwPolConnPolicy, cufwPolConnPolicyTargetType, cufwPolConnPolicyTarget, cufwPolConnProtocol } ::= { cufwPolicyConnSummaryTable 1 } CufwPolicyConnSummaryEntry ::= SEQUENCE { cufwPolConnPolicy CFWPolicy, cufwPolConnPolicyTargetType CFWPolicyTargetType, cufwPolConnPolicyTarget CFWPolicyTarget, cufwPolConnProtocol CFWNetworkProtocol, cufwPolConnNumAttempted Counter, cufwPolConnNumSetupsAborted Counter, cufwPolConnNumPolicyDeclined Counter, cufwPolConnNumResDeclined Counter, cufwPolConnNumHalfOpen Gauge, cufwPolConnNumActive Gauge, cufwPolConnNumAborted Counter } cufwPolConnPolicy OBJECT-TYPE SYNTAX CFWPolicy -- Rsyntax OCTET STRING(SIZE(0..128)) ACCESS not-accessible STATUS mandatory DESCRIPTION "The identity of the firewall policy for which this conceptual row contains the connection activity summary." ::= { cufwPolicyConnSummaryEntry 1 } cufwPolConnPolicyTargetType OBJECT-TYPE SYNTAX CFWPolicyTargetType -- Rsyntax INTEGER { -- all(1), -- other(2), -- interface(3), -- zone(4), -- zonepair(5), -- user(6), -- usergroup(7), -- context(8) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The type of the entity to which the firewall policy 'cufwPolConnPolicy' has been applied. This could be an interface type (most commonly), the type of another object or a group of objects defined in the firewall configuration. When this object is set to 'targetALL', the value of index object cufwConnPolicyTarget is ignored." ::= { cufwPolicyConnSummaryEntry 2 } cufwPolConnPolicyTarget OBJECT-TYPE SYNTAX CFWPolicyTarget(SIZE(0..128)) -- Rsyntax OCTET STRING(SIZE(0..128)) ACCESS not-accessible STATUS mandatory DESCRIPTION "The identity of the entity to which the firewall policy 'cufwPolConnPolicy' is applied. This could be an interface object (most commonly), another object or group of objects defined in the firewall configuration." ::= { cufwPolicyConnSummaryEntry 3 } cufwPolConnProtocol OBJECT-TYPE SYNTAX CFWNetworkProtocol -- Rsyntax INTEGER { -- none(1), -- other(2), -- ip(3), -- icmp(4), -- gre(5), -- udp(6), -- tcp(7) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The (L3-L4) protocol corresponding to which this conceptual row summarizes the connection activity on the firewall." ::= { cufwPolicyConnSummaryEntry 4 } cufwPolConnNumAttempted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'." ::= { cufwPolicyConnSummaryEntry 5 } cufwPolConnNumSetupsAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection setup attempts, corresponding to the protocol denoted by 'cufwPolConnProtocol', associated with the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget', that were aborted before the connection could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwPolConnNumPolicyDeclined' and 'cufwPolConnNumResDeclined'." ::= { cufwPolicyConnSummaryEntry 6 } cufwPolConnNumPolicyDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'." ::= { cufwPolicyConnSummaryEntry 7 } cufwPolConnNumResDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'." ::= { cufwPolicyConnSummaryEntry 8 } cufwPolConnNumHalfOpen OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'." ::= { cufwPolicyConnSummaryEntry 9 } cufwPolConnNumActive OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently active, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'." ::= { cufwPolicyConnSummaryEntry 10 } cufwPolConnNumAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that were abnormally terminated after successful establishment, corresponding to the protocol denoted by 'cufwPolConnProtocol', in the policy 'cufwPolConnPolicy' applied to the entity identified by 'cufwPolConnPolicyTarget'." ::= { cufwPolicyConnSummaryEntry 11 } cufwPolicyAppConnSummaryTable OBJECT-TYPE SYNTAX SEQUENCE OF CufwPolicyAppConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table lists the summary of firewall connections pertaining to Layer 7 protocols, catalogued on a per policy basis Each entry in the table lists the connection summary of a distinct application protocol, configured on the specified policy on the firewall, and pertaining to a specified target to which the policy has been applied. If a policy is bound to a target, it would have one or more entries in this table. If the policy is detached from the target, all entries corresponding to the association between the policy and the target are elminated from this table. Although the information is indexed by policy targets as well, one may aggregate the connection summary for a specific policy across all the target to which the policy is currently applied by setting cufwAppConnPolicyTargetType = 'targetALL'" ::= { cuFwConnectionSummaryTables 4 } cufwPolicyAppConnSummaryEntry OBJECT-TYPE SYNTAX CufwPolicyAppConnSummaryEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Each entry contains the summary of connection activity for a specific layer 7 protocol in a specific policy applied to the specified policy target." INDEX { cufwPolAppConnPolicy, cufwPolAppConnPolicyTargetType, cufwPolAppConnPolicyTarget, cufwPolAppConnProtocol } ::= { cufwPolicyAppConnSummaryTable 1 } CufwPolicyAppConnSummaryEntry ::= SEQUENCE { cufwPolAppConnPolicy CFWPolicy, cufwPolAppConnPolicyTargetType CFWPolicyTargetType, cufwPolAppConnPolicyTarget CFWPolicyTarget, cufwPolAppConnProtocol CFWApplicationProtocol, cufwPolAppConnNumAttempted Counter, cufwPolAppConnNumSetupsAborted Counter, cufwPolAppConnNumPolicyDeclined Counter, cufwPolAppConnNumResDeclined Counter, cufwPolAppConnNumHalfOpen Gauge, cufwPolAppConnNumActive Gauge, cufwPolAppConnNumAborted Counter } cufwPolAppConnPolicy OBJECT-TYPE SYNTAX CFWPolicy -- Rsyntax OCTET STRING(SIZE(0..128)) ACCESS not-accessible STATUS mandatory DESCRIPTION "The identity of the firewall policy for which this conceptual row contains the connection activity summary." ::= { cufwPolicyAppConnSummaryEntry 1 } cufwPolAppConnPolicyTargetType OBJECT-TYPE SYNTAX CFWPolicyTargetType -- Rsyntax INTEGER { -- all(1), -- other(2), -- interface(3), -- zone(4), -- zonepair(5), -- user(6), -- usergroup(7), -- context(8) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The type of the entity to which the firewall policy 'cufwPolAppConnPolicy' has been applied. This could be an interface type (most commonly), the type of another object or a group of objects defined in the firewall configuration. When this object is set to 'targetALL', the value of index object cufwAppConnPolicyTarget is ignored." ::= { cufwPolicyAppConnSummaryEntry 2 } cufwPolAppConnPolicyTarget OBJECT-TYPE SYNTAX CFWPolicyTarget(SIZE(0..128)) -- Rsyntax OCTET STRING(SIZE(0..128)) ACCESS not-accessible STATUS mandatory DESCRIPTION "The identity of the entity to which the firewall policy 'cufwPolAppProtocol' refers. This could be an interface object (most commonly), another object or group of objects defined in the firewall configuration." ::= { cufwPolicyAppConnSummaryEntry 3 } cufwPolAppConnProtocol OBJECT-TYPE SYNTAX CFWApplicationProtocol -- Rsyntax INTEGER { -- none(1), -- other(2), -- ftp(3), -- telnet(4), -- smtp(5), -- http(6), -- tacacs(7), -- dns(8), -- sqlnet(9), -- https(10), -- tftp(11), -- gopher(12), -- finger(13), -- kerberos(14), -- pop2(15), -- pop3(16), -- sunRpc(17), -- msRpc(18), -- nntp(19), -- snmp(20), -- imap(21), -- ldap(22), -- exec(23), -- login(24), -- shell(25), -- msSql(26), -- sybaseSql(27), -- nfs(28), -- lotusnote(29), -- h323(30), -- cuseeme(31), -- realmedia(32), -- netshow(33), -- streamworks(34), -- vdolive(35), -- sap(36), -- sip(37), -- mgcp(38), -- rtsp(39), -- skinny(40), -- gtpV0(41), -- gtpV1(42), -- echo(43), -- discard(44), -- daytime(45), -- netstat(46), -- ssh(47), -- time(48), -- tacacsDs(49), -- bootps(50), -- bootpc(51), -- dnsix(52), -- rtelnet(53), -- ident(54), -- sqlServ(55), -- ntp(56), -- pwdgen(57), -- ciscoFna(58), -- ciscoTna(59), -- ciscoSys(60), -- netbiosNs(61), -- netbiosDgm(62), -- netbiosSsn(63), -- sqlSrv(64), -- snmpTrap(65), -- rsvd(66), -- send(67), -- xdmcp(68), -- bgp(69), -- irc(70), -- qmtp(71), -- ipx(72), -- dbase(73), -- imap3(74), -- rsvpTunnel(75), -- hpCollector(76), -- hpManagedNode(77), -- hpAlarmMgr(78), -- microsoftDs(79), -- creativeServer(80), -- creativePartnr(81), -- appleQtc(82), -- igmpV3Lite(83), -- isakmp(84), -- biff(85), -- who(86), -- syslog(87), -- router(88), -- ncp(89), -- timed(90), -- ircServ(91), -- uucp(92), -- syslogConn(93), -- sshell(94), -- ldaps(95), -- dhcpFailover(96), -- msexchRouting(97), -- entrustSvcs(98), -- entrustSvcHandler(99), -- ciscoTdp(100), -- webster(101), -- gdoi(102), -- iscsi(103), -- cddbp(104), -- ftps(105), -- telnets(106), -- imaps(107), -- ircs(108), -- pop3s(109), -- socks(110), -- kazaa(111), -- msSqlM(112), -- msSna(113), -- wins(114), -- ica(115), -- orasrv(116), -- rdbDbsDisp(117), -- vqp(118), -- icabrowser(119), -- kermit(120), -- rsvpEncap(121), -- l2tp(122), -- pptp(123), -- h323Gatestat(124), -- rWinsock(125), -- radius(126), -- hsrp(127), -- net8Cman(128), -- oracleEmVp(129), -- oracleNames(130), -- oracle(131), -- ciscoSvcs(132), -- ciscoNetMgmt(133), -- stun(134), -- trRsrb(135), -- ddnsV3(136), -- aceSvr(137), -- giop(138), -- ttc(139), -- ipass(140), -- clp(141), -- citrixImaClient(142), -- sms(143), -- citrix(144), -- realSecure(145), -- lotusMtap(146), -- cifs(147), -- msDotnetster(148), -- tarantella(149), -- fcipPort(150), -- ssp(151), -- iscsiTarget(152), -- mySql(153), -- msClusterNet(154), -- ldapAdmin(155), -- ieee80211Iapp(156), -- oemAgent(157), -- rtcPmPort(158), -- dbControlAgent(159), -- ipsecMsft(160), -- sipTls(161), -- aim(162), -- pcAnyWhereData(163), -- pcAnyWhereStat(164), -- x11(165), -- ircu(166), -- n2h2Server(167), -- h323CallSigAlt(168), -- yahooMsgr(169), -- msnMsgr(170) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The layer7 protocol for which this conceptual row summarizes the connection activity for this firewall." ::= { cufwPolicyAppConnSummaryEntry 4 } cufwPolAppConnNumAttempted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections attempted since the last reboot of the firewall, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwPolicyAppConnSummaryEntry 5 } cufwPolAppConnNumSetupsAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection setup attempts, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', associated with the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget', that were aborted before the connections could proceed to completion. The counter includes setup attempts aborted by the firewall as well as those aborted by the initiator and/or the responder(s) of/to the connection setup attempt. Consequently, this value subsumes the values of objects 'cufwPolAppConnNumPolicyDeclined' and 'cufwPolAppConnNumResDeclined'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwPolicyAppConnSummaryEntry 6 } cufwPolAppConnNumPolicyDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to security policy, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwPolicyAppConnSummaryEntry 7 } cufwPolAppConnNumResDeclined OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connection attempts that were declined due to resource unavailability, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'. This value is accumulated from the last reboot of the firewall subject to the control exercised by cufwConnReptAppStats." ::= { cufwPolicyAppConnSummaryEntry 8 } cufwPolAppConnNumHalfOpen OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently in the process of being established, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'." ::= { cufwPolicyAppConnSummaryEntry 9 } cufwPolAppConnNumActive OBJECT-TYPE SYNTAX Gauge -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that are currently active, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'." ::= { cufwPolicyAppConnSummaryEntry 10 } cufwPolAppConnNumAborted OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections that were abnormally terminated after successful establishment, corresponding to the protocol denoted by 'cufwPolAppConnProtocol', in the policy 'cufwPolAppConnPolicy' applied to the entity identified by 'cufwPolAppConnPolicyTarget'." ::= { cufwPolicyAppConnSummaryEntry 11 } cufwAIAuditTrailEnabled OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION "The value identifies if audit trail in application inspection has been globally enabled or disabled." ::= { cuFwApplInspectionGrp 1 } cufwAIAlertEnabled OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION "The value identifies if application inspection alerts have been globally enabled or disabled." ::= { cuFwApplInspectionGrp 2 } cufwInspectionTable OBJECT-TYPE SYNTAX SEQUENCE OF CufwInspectionEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table identifies if an application protocol has been configured for inspection and if so, the name of the firewall policy or the inspection configuration that configures the specified protocol for inspection. The table also identifies if the specified protocol is actively being inspected. This table may be used by an administrator to quickly identify if a protocol is being subjected to application inspection by the managed firewall." ::= { cuFwApplInspectionGrp 3 } cufwInspectionEntry OBJECT-TYPE SYNTAX CufwInspectionEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Each entry contains the configuration of a specific application inspection element." INDEX { cufwInspectionPolicyName, cufwInspectionProtocol } ::= { cufwInspectionTable 1 } CufwInspectionEntry ::= SEQUENCE { cufwInspectionPolicyName CFWPolicy, cufwInspectionProtocol CFWApplicationProtocol, cufwInspectionStatus TruthValue } cufwInspectionPolicyName OBJECT-TYPE SYNTAX CFWPolicy(SIZE(0..128)) -- Rsyntax OCTET STRING(SIZE(0..128)) ACCESS not-accessible STATUS mandatory DESCRIPTION "The name of the policy that configures the device inspect the protocol specified by 'cufwInspectionProtocol'." ::= { cufwInspectionEntry 1 } cufwInspectionProtocol OBJECT-TYPE SYNTAX CFWApplicationProtocol -- Rsyntax INTEGER { -- none(1), -- other(2), -- ftp(3), -- telnet(4), -- smtp(5), -- http(6), -- tacacs(7), -- dns(8), -- sqlnet(9), -- https(10), -- tftp(11), -- gopher(12), -- finger(13), -- kerberos(14), -- pop2(15), -- pop3(16), -- sunRpc(17), -- msRpc(18), -- nntp(19), -- snmp(20), -- imap(21), -- ldap(22), -- exec(23), -- login(24), -- shell(25), -- msSql(26), -- sybaseSql(27), -- nfs(28), -- lotusnote(29), -- h323(30), -- cuseeme(31), -- realmedia(32), -- netshow(33), -- streamworks(34), -- vdolive(35), -- sap(36), -- sip(37), -- mgcp(38), -- rtsp(39), -- skinny(40), -- gtpV0(41), -- gtpV1(42), -- echo(43), -- discard(44), -- daytime(45), -- netstat(46), -- ssh(47), -- time(48), -- tacacsDs(49), -- bootps(50), -- bootpc(51), -- dnsix(52), -- rtelnet(53), -- ident(54), -- sqlServ(55), -- ntp(56), -- pwdgen(57), -- ciscoFna(58), -- ciscoTna(59), -- ciscoSys(60), -- netbiosNs(61), -- netbiosDgm(62), -- netbiosSsn(63), -- sqlSrv(64), -- snmpTrap(65), -- rsvd(66), -- send(67), -- xdmcp(68), -- bgp(69), -- irc(70), -- qmtp(71), -- ipx(72), -- dbase(73), -- imap3(74), -- rsvpTunnel(75), -- hpCollector(76), -- hpManagedNode(77), -- hpAlarmMgr(78), -- microsoftDs(79), -- creativeServer(80), -- creativePartnr(81), -- appleQtc(82), -- igmpV3Lite(83), -- isakmp(84), -- biff(85), -- who(86), -- syslog(87), -- router(88), -- ncp(89), -- timed(90), -- ircServ(91), -- uucp(92), -- syslogConn(93), -- sshell(94), -- ldaps(95), -- dhcpFailover(96), -- msexchRouting(97), -- entrustSvcs(98), -- entrustSvcHandler(99), -- ciscoTdp(100), -- webster(101), -- gdoi(102), -- iscsi(103), -- cddbp(104), -- ftps(105), -- telnets(106), -- imaps(107), -- ircs(108), -- pop3s(109), -- socks(110), -- kazaa(111), -- msSqlM(112), -- msSna(113), -- wins(114), -- ica(115), -- orasrv(116), -- rdbDbsDisp(117), -- vqp(118), -- icabrowser(119), -- kermit(120), -- rsvpEncap(121), -- l2tp(122), -- pptp(123), -- h323Gatestat(124), -- rWinsock(125), -- radius(126), -- hsrp(127), -- net8Cman(128), -- oracleEmVp(129), -- oracleNames(130), -- oracle(131), -- ciscoSvcs(132), -- ciscoNetMgmt(133), -- stun(134), -- trRsrb(135), -- ddnsV3(136), -- aceSvr(137), -- giop(138), -- ttc(139), -- ipass(140), -- clp(141), -- citrixImaClient(142), -- sms(143), -- citrix(144), -- realSecure(145), -- lotusMtap(146), -- cifs(147), -- msDotnetster(148), -- tarantella(149), -- fcipPort(150), -- ssp(151), -- iscsiTarget(152), -- mySql(153), -- msClusterNet(154), -- ldapAdmin(155), -- ieee80211Iapp(156), -- oemAgent(157), -- rtcPmPort(158), -- dbControlAgent(159), -- ipsecMsft(160), -- sipTls(161), -- aim(162), -- pcAnyWhereData(163), -- pcAnyWhereStat(164), -- x11(165), -- ircu(166), -- n2h2Server(167), -- h323CallSigAlt(168), -- yahooMsgr(169), -- msnMsgr(170) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The application protocol that is configured for inspection." ::= { cufwInspectionEntry 2 } cufwInspectionStatus OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-only STATUS mandatory DESCRIPTION "This MIB object identifies if the directive to inspect the protocol specified by 'cufwInspectionProtocol' by the policy corresponding to this conceptual row is enabled or disabled." ::= { cufwInspectionEntry 3 } cufwUrlfFunctionEnabled OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION " URL Filtering Operation _________ 2.2 Request | | |---------->| Server | | | | _________ __|_ |_________| | |<--(5. Response )---| | 3. Response | | | | |<-------------| | Client |---(1. Request )--->|FW | |_________| |____|<--------------| | 4. URLF Resp ____|______ | | | |------------>|URLF Server| 2.1 URLF Req |___________| 1) Client sends a Request containing a URL to the Server 2.1) FW extracts the URL from the Request and sends it to URL Filtering Server (or Verifies the URL locally) 2.2) FW also forwards the original Request from the Client to the Server 3) Any Responses from the Server received before receiving a response from URLF Server are cached by the FW 4) URLF Response indicates whether the URL access should be allowed or denied 5) If the URLF Response allows the URL, FW forwards the URL Access responses from the Server to the Client 6) If the URLF Response indicates that the URL access should be denied, FW drops all the cached URL responses and forces the connection between the Client and the Server to be terminated Specifically, the object cufwUrlfFunctionEnabled indicates if the URL filtering function is enabled. When this MIB object contains the value 'false', the firewall device will not perform URL filtering function, even if it contains configuration pertaining to other aspects of URL filtering." ::= { cufwUrlFilterGlobals 1 } cufwUrlfRequestsNumProcessed OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests processed by this firewall. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 2 } cufwUrlfRequestsProcRate1 OBJECT-TYPE SYNTAX Gauge -- Units -- Requests per second ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests processed per seconds by this firewall averaged over the last 60 seconds." ::= { cufwUrlFilterGlobals 3 } cufwUrlfRequestsProcRate5 OBJECT-TYPE SYNTAX Gauge -- Units -- Requests per second ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests processed per second by this firewall averaged over the last 300 seconds." ::= { cufwUrlFilterGlobals 4 } cufwUrlfRequestsNumAllowed OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests allowed by this firewall, due to a directive from a URL filtering server or a static policy configured on the firewall. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 5 } cufwUrlfRequestsNumDenied OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests declined by this firewall, due to a directive from a URL filtering server, a static policy configured on the firewall, due to resource constraints or any other reason. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 6 } cufwUrlfRequestsDeniedRate1 OBJECT-TYPE SYNTAX Gauge -- Units -- Requests per second ACCESS read-only STATUS mandatory DESCRIPTION "The rate at which URL access requests were denied by this firewall, due to a directive from a URL filtering server, a static policy configured on the firewall, due to resource constraints or any other reason, averaged over the last 60 seconds." ::= { cufwUrlFilterGlobals 7 } cufwUrlfRequestsDeniedRate5 OBJECT-TYPE SYNTAX Gauge -- Units -- Requests Per Second ACCESS read-only STATUS mandatory DESCRIPTION "The rate at which URL access requests were denied by this firewall, due to a directive from a URL filtering server, a static policy configured on the firewall, due to resource constraints or any other reason, averaged over the last 300 seconds." ::= { cufwUrlFilterGlobals 8 } cufwUrlfRequestsNumCacheAllowed OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests allowed by the firewall because of a cached entry holding the result from a previous URL access request that was handled either by a URLF Server or exclusive domain configuration. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 9 } cufwUrlfRequestsNumCacheDenied OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests denied by the firewall because of a cached entry holding the result from a previous URL access request that was handled either by a URLF Server or exclusive domain configuration. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 10 } cufwUrlfAllowModeReqNumAllowed OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests that were allowed by the firewall when the URL filtering server was not available. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 11 } cufwUrlfAllowModeReqNumDenied OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests that were declined by the firewall when the URL filtering server was not available. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 12 } cufwUrlfRequestsNumResDropped OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of incoming URL access requests that were dropped by the firewall because of resource constraints. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 13 } cufwUrlfRequestsResDropRate1 OBJECT-TYPE SYNTAX Gauge -- Units -- Requests Per Second ACCESS read-only STATUS mandatory DESCRIPTION "The rate at which incoming URL access requests were dropped by the firewall because of resource constraints, averaged over the last 60 seconds." ::= { cufwUrlFilterGlobals 14 } cufwUrlfRequestsResDropRate5 OBJECT-TYPE SYNTAX Gauge -- Units -- Requests Per Second ACCESS read-only STATUS mandatory DESCRIPTION "The rate at which incoming URL access requests were dropped by the firewall because of resource constraints, averaged over the last 300 seconds." ::= { cufwUrlFilterGlobals 15 } cufwUrlfNumServerTimeouts OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of times the firewall failed to receive a response from the configured URL filtering servers for a request to authorize a URL access request. This is equal to the number of times a firewall removed a URL access request from the queue of pending requests because no response was received from the URL filtering server(s). This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 16 } cufwUrlfNumServerRetries OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access authorization requests re-sent by the firewall to the URL Filtering Servers because a response was not received within the configured time interval. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 17 } cufwUrlfResponsesNumLate OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Responses ACCESS read-only STATUS mandatory DESCRIPTION "The number of responses from URL filtering servers which were received after the original URL access request was removed from the queue of pending requests. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 18 } cufwUrlfUrlAccRespsNumResDropped OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Responses ACCESS read-only STATUS mandatory DESCRIPTION "The number of transport packets constituting responses to URL access requests that were dropped by the firewall due to resource constraints waiting for a response from the filtering server. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlFilterGlobals 19 } cufwUrlfResTotalRequestCacheSize OBJECT-TYPE SYNTAX Gauge -- Units -- KBytes ACCESS read-only STATUS mandatory DESCRIPTION "The amount of memory occupied by all the caches used in the firewall to cache pending URL access requests." ::= { cufwUrlFilterResourceUsage 1 } cufwUrlfResTotalRespCacheSize OBJECT-TYPE SYNTAX Gauge -- Units -- KBytes ACCESS read-only STATUS mandatory DESCRIPTION "The amount of memory occupied by all the caches used in the firewall to cache responses for URL requests received from servers while awaiting a response from URL filter server." ::= { cufwUrlFilterResourceUsage 2 } cufwUrlfServerTable OBJECT-TYPE SYNTAX SEQUENCE OF CufwUrlfServerEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table lists the URL filtering servers configured on the managed device and their performance statistics. This table is not meant as a device to configure URL filtering servers." ::= { cufwUrlFilterServers 1 } cufwUrlfServerEntry OBJECT-TYPE SYNTAX CufwUrlfServerEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Each entry contains the configuration of a specific URL filtering server." INDEX { cufwUrlfServerAddrType, cufwUrlfServerAddress, cufwUrlfServerPort } ::= { cufwUrlfServerTable 1 } CufwUrlfServerEntry ::= SEQUENCE { cufwUrlfServerAddrType InetAddressType, cufwUrlfServerAddress InetAddress, cufwUrlfServerPort InetPortNumber, cufwUrlfServerVendor CFWUrlfVendorId, cufwUrlfServerStatus CFWUrlServerStatus, cufwUrlfServerReqsNumProcessed Counter, cufwUrlfServerReqsNumAllowed Counter, cufwUrlfServerReqsNumDenied Counter, cufwUrlfServerNumTimeouts Counter, cufwUrlfServerNumRetries Counter, cufwUrlfServerRespsNumReceived Counter, cufwUrlfServerRespsNumLate Counter, cufwUrlfServerAvgRespTime1 Gauge, cufwUrlfServerAvgRespTime5 Gauge } cufwUrlfServerAddrType OBJECT-TYPE SYNTAX InetAddressType -- Rsyntax INTEGER { -- ?? enum value of zero may cause problems -- unknown(0), -- ipv4(1), -- ipv6(2), -- ipv4z(3), -- ipv6z(4), -- dns(16) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "The type of the IP address of the URL filtering server." ::= { cufwUrlfServerEntry 1 } cufwUrlfServerAddress OBJECT-TYPE SYNTAX InetAddress -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS not-accessible STATUS mandatory DESCRIPTION "The value of the IP address of the URL filtering server." ::= { cufwUrlfServerEntry 2 } cufwUrlfServerPort OBJECT-TYPE SYNTAX InetPortNumber -- Rsyntax Gauge(0..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "The value of the port at which the URL filtering server listens for incoming requests." ::= { cufwUrlfServerEntry 3 } cufwUrlfServerVendor OBJECT-TYPE SYNTAX CFWUrlfVendorId -- Rsyntax INTEGER { -- other(1), -- websense(2), -- n2h2(3) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The vendor type of the URL filtering server." ::= { cufwUrlfServerEntry 4 } cufwUrlfServerStatus OBJECT-TYPE SYNTAX CFWUrlServerStatus -- Rsyntax INTEGER { -- online(1), -- offline(2), -- indeterminate(3) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The status of the URL filtering server corresponding to this conceptual row." ::= { cufwUrlfServerEntry 5 } cufwUrlfServerReqsNumProcessed OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests forwarded by the managed firewall device to the URL filtering server corresponding to this conceptual row. This value is counted from the last reboot of the managed device." ::= { cufwUrlfServerEntry 6 } cufwUrlfServerReqsNumAllowed OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests allowed by the URL filtering server corresponding to this conceptual row. This counter does not include late responses. This value is counted from the last reboot of the managed device." ::= { cufwUrlfServerEntry 7 } cufwUrlfServerReqsNumDenied OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access requests denied by the URL filtering server corresponding to this conceptual row. This counter does not include late responses. This value is counted from the last reboot of the managed device." ::= { cufwUrlfServerEntry 8 } cufwUrlfServerNumTimeouts OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of times the firewall failed to receive a response from the URL filtering server corresponding to this conceptual row, for a request to authorize a URL access request. This is equal to the number of times a firewall removed a URL access request from the queue of pending requests because no response was received from the URL filtering server. This value is accumulated from the last reboot of the firewall." ::= { cufwUrlfServerEntry 9 } cufwUrlfServerNumRetries OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access authorization requests re-sent by the firewall to the URL Filtering Server corresponding to this conceptual row, because a response was not received within the configured time interval from the server. This value is counted from the last reboot of the managed device." ::= { cufwUrlfServerEntry 10 } cufwUrlfServerRespsNumReceived OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access responses received by the firewall from the URL filtering server corresponding to this conceptual row. This counter does not include late responses. This value is counted from the last reboot of the managed device." ::= { cufwUrlfServerEntry 11 } cufwUrlfServerRespsNumLate OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of URL access responses received by the managed firewall from the URL filtering server corresponding to this conceptual row after the original URL access request was removed from the queue of pending requests. This value is counted from the last reboot of the managed device." ::= { cufwUrlfServerEntry 12 } cufwUrlfServerAvgRespTime1 OBJECT-TYPE SYNTAX Gauge -- Units -- seconds ACCESS read-only STATUS mandatory DESCRIPTION "The average round-trip response time of the URL filtering server computed over the last 60 seconds. A value of zero indicates that there was insufficient data to compute this value over the last time interval." ::= { cufwUrlfServerEntry 13 } cufwUrlfServerAvgRespTime5 OBJECT-TYPE SYNTAX Gauge -- Units -- seconds ACCESS read-only STATUS mandatory DESCRIPTION "The average round-trip response time of the URL filtering server computed over the last 300 seconds. A value of zero indicates that there was insufficient data to compute this value over the last time interval." ::= { cufwUrlfServerEntry 14 } cufwAaicGlobalNumBadProtocolOps OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "'Protocol Operation' is the application protocol specific operation that the PDU is intended to perform. An example of 'protocol operation' is the HELO command of SMTP protocol. This MIB object records the number of application protocol data units that contained a protocol operation which was disallowed by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of application traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicGlobals 1 } cufwAaicGlobalNumBadPDUSize OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "This MIB object records the number of application protocol data units (PDU) that had either an invalid header size or an invalid payload size, as determined by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of application traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicGlobals 2 } cufwAaicGlobalNumBadPortRange OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "Number of application protocol units that attempted to advertise illegal port ranges for secondary connections. An example of such an occurrence would be a passive FTP connection, where the server advertises a disallowed port range for data connection. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of application traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicGlobals 3 } cufwAaicHttpNumBadProtocolOps OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- HTTP Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "The number of PDUs corresponding to HTTP protocol which were detected to be containing HTTP protocol methods which are disallowed by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicHttpProtocolStats 1 } cufwAaicHttpNumBadPDUSize OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- HTTP Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "The number of PDUs corresponding to HTTP protocol that had either an invalid header size or an invalid payload size, as determined by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicHttpProtocolStats 2 } cufwAaicHttpNumTunneledConns OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- Connections ACCESS read-only STATUS mandatory DESCRIPTION "The number of connections corresponding to HTTP protocol which were detected to be tunneling other application traffic streams. An instance of this would be InstantMessenger traffic running on HTTP. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicHttpProtocolStats 3 } cufwAaicHttpNumLargeURIs OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- HTTP Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "The number of PDUs corresponding to HTTP protocol which were detected to be containing a URI of size not permitted by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicHttpProtocolStats 4 } cufwAaicHttpNumBadContent OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- HTTP Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "The number of PDUs corresponding to HTTP protocol which were detected to be containing content whose type disallowed by the local security policy. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicHttpProtocolStats 5 } cufwAaicHttpNumMismatchContent OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- HTTP Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "The number of PDUs corresponding to HTTP protocol which were detected to be containing content whose type was different from the content type specified in the header of the PDU. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicHttpProtocolStats 6 } cufwAaicHttpNumDoubleEncodedPkts OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- HTTP Protocol Data Units ACCESS read-only STATUS mandatory DESCRIPTION "The number of PDUs corresponding to HTTP protocol which were detected to be containing double encoding. Double encoding is a mechanism to obfuscate content in which a encoded data is re-encoded so as to evade deep packet inspections. For this MIB to be implemented, the managed firewall must be implementing deep packet inspection of HTTP traffic payloads. This value is accumulated from the last reboot of the firewall." ::= { cufwAaicHttpProtocolStats 7 } cufwL2GlobalEnableStealthMode OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-only STATUS mandatory DESCRIPTION "The value indicates if the firewall is operating in transparent (layer 2) mode or not. When operating in transparent mode, the firewall operates as a bridge while performing firewalling functions." ::= { cufwL2FwGlobals 1 } cufwL2GlobalArpCacheSize OBJECT-TYPE SYNTAX INTEGER(1..2147483647) -- Units -- ARP entries ACCESS read-only STATUS mandatory DESCRIPTION "The value indicates the configured maximum size of the ARP cache used for management traffic." ::= { cufwL2FwGlobals 2 } cufwL2GlobalEnableArpInspection OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION "The value indicates if ARP inspection, which is a security feature, is enabled globally on the managed firewall." ::= { cufwL2FwGlobals 3 } cufwL2GlobalNumArpRequests OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- ARP Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of ARP requests issued by the transparent firewall to resolve a destination IP address. This counter is accumulated since the last reboot of the firewall." ::= { cufwL2FwGlobals 5 } cufwL2GlobalNumIcmpRequests OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- ICMP Traceroute Requests ACCESS read-only STATUS mandatory DESCRIPTION "The number of ICMP traceroute requests issued by the transparent firewall to resolve a destination IP address. This counter is accumulated since the last reboot of the firewall." ::= { cufwL2FwGlobals 6 } cufwL2GlobalNumFloods OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of times the firewall floods a frame to be forwarded to the egress interfaces because the destination MAC address is missing in the bridge table. This counter is accumulated since the last reboot of the firewall." ::= { cufwL2FwGlobals 7 } cufwL2GlobalNumDrops OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of times the firewall dropped an incoming frame because the destination MAC address is missing in the bridge table. This counter is accumulated since the last reboot of the firewall." ::= { cufwL2FwGlobals 8 } cufwL2GlobalArpOverflowRate5 OBJECT-TYPE SYNTAX Gauge ACCESS read-only STATUS mandatory DESCRIPTION "The number of times an existing entry from the ARP cache had to be ejected in order to insert a new entry in the last 300 seconds. This counter is accumulated since the last reboot of the firewall." ::= { cufwL2FwGlobals 9 } cufwL2GlobalNumBadArpResponses OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- ARP Responses ACCESS read-only STATUS mandatory DESCRIPTION "The number of malformed ARP responses received by the firewall in trying to resolve the MAC address of the destination IP address in an incoming frame. This counter is accumulated since the last reboot of the firewall." ::= { cufwL2FwGlobals 10 } cufwL2GlobalNumSpoofedArpResps OBJECT-TYPE SYNTAX --?? syntax is not convertable to SMIv1 Counter -- Units -- ARP Responses ACCESS read-only STATUS mandatory DESCRIPTION "The number of spoofed ARP responses received by the firewall. Such an event would occur when the firewall encounters an ARP response mapping an IP address to a different MAC Address from the one present in the local ARP cache. This counter is accumulated since the last reboot of the firewall." ::= { cufwL2FwGlobals 11 } cufwCntlUrlfServerStatusChange OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION "This object defines the administrative state of sending the SNMP notification to signal the election of a new primary URL filtering server by this firewall. Such a change could occur either as a result of the current primary server becoming unavailable or as a result of explicit management action in nominating a filtering server the primary server." DEFVAL { false } ::= { cuFwNotifCntlGrp 1 } cufwCntlL2StaticMacAddressMoved OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION "This object defines the administrative state of sending the SNMP notification to signal the move of a statically configured MAC address to a new port. Such a change could occur either as a result of physical move of the device with the MAC Address to the new port or due to MAC address spoofing." DEFVAL { true } ::= { cuFwNotifCntlGrp 2 } ciscoUFwUrlfServerStateChange TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoUnifiedFirewallMIB VARIABLES { cufwUrlfServerStatus } -- Status -- mandatory DESCRIPTION "This notification is generated when the firewall elects a new primary URL filtering server from the existing set of configured servers. Such a change could occur either as a result of the current primary server becoming unavailable or as a result of explicit management action in nominating a filtering server the primary server. The notification is issued just before the change occurs. Consequently, the varbinds identify the attributes corresponding to the old primary server. This notification is issued if and only if the object 'cufwCntlUrlfServerStatusChange' has been set to 'true'." ::= 1 ciscoUFwL2StaticMacAddressMoved TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoUnifiedFirewallMIB VARIABLES { dot1dTpFdbPort, dot1dTpFdbStatus } -- Status -- mandatory DESCRIPTION "This notification is generated when the firewall detects the move of a static MAC address to a new port. Such a change could occur either as a result of physical move of the device with the MAC Address to the new port, due to management action of relocating the MAC address at the new location or due to MAC address spoofing. The varbinds identify the new location (port) of the MAC Address and its status at the new location. This notification is issued if and only if the object 'cufwCntlL2StaticMacAddressMoved' has been set to 'true'." ::= 2 ciscoFwConnectionGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 1 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument the firewall stateful connection activity. -- objects -- cufwConnGlobalNumAttempted, cufwConnGlobalNumSetupsAborted, -- cufwConnGlobalNumPolicyDeclined, cufwConnGlobalNumResDeclined, -- cufwConnGlobalNumHalfOpen, cufwConnGlobalNumActive, -- cufwConnGlobalNumAborted, cufwConnGlobalNumExpired, -- cufwConnGlobalNumEmbryonic, cufwConnGlobalConnSetupRate1, -- cufwConnGlobalConnSetupRate5, cufwConnGlobalNumRemoteAccess, -- cufwConnNumAttempted, cufwConnNumSetupsAborted, -- cufwConnNumPolicyDeclined, cufwConnNumResDeclined, -- cufwConnNumHalfOpen, cufwConnNumActive, cufwConnNumAborted, -- cufwConnSetupRate1, cufwConnSetupRate5, -- cufwAppConnNumAttempted, cufwAppConnNumSetupsAborted, -- cufwAppConnNumPolicyDeclined, cufwAppConnNumResDeclined, -- cufwAppConnNumHalfOpen, cufwAppConnNumActive, -- cufwAppConnNumAborted, cufwAppConnSetupRate1, -- cufwAppConnSetupRate5 ciscoFwConnResourceUsageGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 2 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument the resource usage of the stateful packet -- filtering feature of the managed firewall. -- objects -- cufwConnResMemoryUsage, cufwConnResActiveConnMemoryUsage, -- cufwConnResHOConnMemoryUsage, cufwConnResEmbrConnMemoryUsage ciscoFwPolicyConnectionGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 3 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument policy based summary of firewall connection -- activity. -- objects -- cufwPolConnNumAttempted, cufwPolConnNumSetupsAborted, -- cufwPolConnNumPolicyDeclined, cufwPolConnNumResDeclined, -- cufwPolConnNumHalfOpen, cufwPolConnNumActive, -- cufwPolConnNumAborted, cufwPolAppConnNumAttempted, -- cufwPolAppConnNumSetupsAborted, -- cufwPolAppConnNumPolicyDeclined, cufwPolAppConnNumResDeclined, -- cufwPolAppConnNumHalfOpen, cufwPolAppConnNumActive, -- cufwPolAppConnNumAborted ciscoFwApplInspectionGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 4 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument the firewall Application Inspection -- function. -- objects -- cufwAIAuditTrailEnabled, cufwAIAlertEnabled, -- cufwInspectionStatus ciscoFwUrlFilterGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 5 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument the firewall URL filtering function. -- objects -- cufwUrlfFunctionEnabled, cufwUrlfRequestsNumProcessed, -- cufwUrlfRequestsProcRate1, cufwUrlfRequestsProcRate5, -- cufwUrlfRequestsNumAllowed, cufwUrlfRequestsNumDenied, -- cufwUrlfRequestsDeniedRate1, cufwUrlfRequestsDeniedRate5, -- cufwUrlfRequestsNumCacheAllowed, -- cufwUrlfRequestsNumCacheDenied, -- cufwUrlfAllowModeReqNumAllowed, cufwUrlfAllowModeReqNumDenied, -- cufwUrlfRequestsNumResDropped, cufwUrlfRequestsResDropRate1, -- cufwUrlfRequestsResDropRate5, cufwUrlfNumServerTimeouts, -- cufwUrlfNumServerRetries, cufwUrlfResponsesNumLate, -- cufwUrlfUrlAccRespsNumResDropped, cufwUrlfServerVendor, -- cufwUrlfServerStatus, cufwUrlfServerReqsNumProcessed, -- cufwUrlfServerReqsNumAllowed, cufwUrlfServerReqsNumDenied, -- cufwUrlfServerNumTimeouts, cufwUrlfServerNumRetries, -- cufwUrlfServerRespsNumReceived, cufwUrlfServerRespsNumLate, -- cufwUrlfServerAvgRespTime1, cufwUrlfServerAvgRespTime5, -- cufwCntlUrlfServerStatusChange ciscoFwUrlFilterResourceGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 6 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument the resource usage of the URL filtering -- feature of the managed firewall. -- objects -- cufwUrlfResTotalRequestCacheSize, -- cufwUrlfResTotalRespCacheSize ciscoFwTransparentFwGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 7 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument the transparent mode (or layer 2) operation -- of a firewall. -- objects -- cufwL2GlobalEnableStealthMode, cufwL2GlobalArpCacheSize, -- cufwL2GlobalEnableArpInspection, cufwL2GlobalNumArpRequests, -- cufwL2GlobalNumIcmpRequests, cufwL2GlobalNumFloods, -- cufwL2GlobalNumDrops, cufwL2GlobalArpOverflowRate5, -- cufwL2GlobalNumBadArpResponses, -- cufwL2GlobalNumSpoofedArpResps, -- cufwCntlL2StaticMacAddressMoved ciscoFwBasicAaicGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 10 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects required to -- instrument the basic elements of Advanced Application -- Inspection and Control (AAIC). -- objects -- cufwAaicGlobalNumBadProtocolOps, cufwAaicGlobalNumBadPDUSize, -- cufwAaicGlobalNumBadPortRange ciscoFwAaicHttpGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 11 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group defines statistics pertaining to deep -- packet inspection of HTTP payloads. -- -- A firewall that implements this group must implement -- the group 'ciscoFwBasicAaicGroup'. -- objects -- cufwAaicHttpNumBadProtocolOps, cufwAaicHttpNumBadPDUSize, -- cufwAaicHttpNumTunneledConns, cufwAaicHttpNumLargeURIs, -- cufwAaicHttpNumBadContent, cufwAaicHttpNumMismatchContent, -- cufwAaicHttpNumDoubleEncodedPkts ciscoFwMibReportingControlGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 12 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This group contains the MIB objects that allow -- the administrator to control the granularity of -- objects reported by the agent. -- objects -- cufwConnReptAppStats, cufwConnReptAppStatsLastChanged ciscoFwNotificationsGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 8 } -- NOTIFICATION-GROUP -- Status -- mandatory -- Descr -- This group contains notifications defined -- in the Cisco Firewall MIB pertaining to -- basic firewall operations. -- -- Presently, the list include a notification -- pertaining to URL filtering alone. -- notifications -- ciscoUFwUrlfServerStateChange ciscoFwTransparentNotifGroup OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBGroups 9 } -- NOTIFICATION-GROUP -- Status -- mandatory -- Descr -- This group contains the notifications that signal -- security critical events pertaining to the -- transparent mode operation of the firewall. -- notifications -- ciscoUFwL2StaticMacAddressMoved ciscoUniFirewallMIBCompliance OBJECT IDENTIFIER ::= { ciscoUniFirewallMIBCompliances 1 } -- MODULE-COMPLIANCE -- Status -- mandatory -- Descr -- The compliance statement for SNMP entities -- the Cisco Firewall MIB. -- Module -- >>current<< -- MandGroup -- ciscoFwConnectionGroup -- MandGroup -- ciscoFwMibReportingControlGroup -- OptGroup -- ciscoFwApplInspectionGroup -- OptGroup -- ciscoFwConnResourceUsageGroup -- OptGroup -- ciscoFwPolicyConnectionGroup -- OptGroup -- ciscoFwUrlFilterGroup -- OptGroup -- ciscoFwUrlFilterResourceGroup -- OptGroup -- ciscoFwTransparentFwGroup -- OptGroup -- ciscoFwTransparentNotifGroup -- OptGroup -- ciscoFwBasicAaicGroup -- OptGroup -- ciscoFwAaicHttpGroup END