topic Re: SNMP MIBS for IPS Blade in Firewall and Security Management

SNMP MIBS for IPS Blade

9eae3dd1-bcda-4 — Thu, 25 Jun 2020 20:12:07 GMT

sk90860 Section VI-3 documents SNMP OIDs for many of the blades, but the IPS Blade is missing. Is this an oversight or is there a reason why IPS was excluded?

Re: SNMP MIBS for IPS Blade

PhoneBoy — Fri, 26 Jun 2020 00:16:28 GMT

What precise information about IPS are you expecting to see over SNMP?

Re: SNMP MIBS for IPS Blade

9eae3dd1-bcda-4 — Fri, 26 Jun 2020 12:49:13 GMT

I'd expect to see similar information as you'd see for the other blades, let's use Anti-Bot as an example. What I'd really like to accomplish is to be able to alert when my IPS updates fail for some reason, so Update Status is most appropriate (failed,up-to-date,new,degrade,unknown).

Would be great to be able to pull something like Installation Date/Version that can be compared to see if they are more than a week out of date for instance.

Re: SNMP MIBS for IPS Blade

PhoneBoy — Fri, 26 Jun 2020 15:48:33 GMT

Up until fairly recently, IPS signatures had to be pushed from the management.
They still are in many configurations.
Might be better off querying this using REST API.
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-ips-status~v1.6
If you want to use SNMP you might have to create a custom MIB tied to the relevant CLI commands.

Re: SNMP MIBS for IPS Blade

9eae3dd1-bcda-4 — Tue, 30 Jun 2020 13:37:17 GMT

Custom SNMP or REST API sound like two possible solutions that can be tested. But going back to my original question, I'm guessing my answer is there is no SNMP MIBs for IPS as there is for the other blades such as Anti-Bot, Anti-Spam, Anti-Virus, App Control, etc.

Re: SNMP MIBS for IPS Blade

PhoneBoy — Wed, 01 Jul 2020 05:11:02 GMT

If you're not finding them in the MIB, then they don't exist 🙂

Re: SNMP MIBS for IPS Blade

Timothy_Hall — Wed, 26 Apr 2023 01:25:39 GMT

Just to follow up on this old thread it appears there are some queryable SNMP OIDs present for the IPS blade now, at least in R81.20. They may have been added in an earlier code release, but this is the first time I've noticed them:

Edit: Looking back through the MIB files it appears these were added in version R81.