topic Re: What is SNMP OID for CP FW number of new connections? in General Topics

What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Sat, 07 Mar 2020 12:37:19 GMT

What is SNMP OID for CP FW number of new connections?

Re: What is SNMP OID for CP FW number of new connections?

Chris_Atkinson — Sat, 07 Mar 2020 12:44:17 GMT

Please review sk90860 section 2-D for more information.

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Sat, 07 Mar 2020 12:52:20 GMT

Is it .1.3.6.1.4.1.2620.1.1.25.22 ? But OID Description: " Connections rate since last start of Check Point services. ". I feel uncertain.

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Sat, 07 Mar 2020 13:11:11 GMT

[Expert@PNS-CP4607-02:0]# snmpwalk -v 2c -c vpn123 localhost .1.3.6.1.4.1.2620.1.1.25.22
SNMPv2-SMI::enterprises.2620.1.1.25.22 = No Such Instance currently exists at this OID

What is wrong with it?

Re: What is SNMP OID for CP FW number of new connections?

Chris_Atkinson — Sun, 08 Mar 2020 11:39:52 GMT

Try dropping the leading '.' and appending .0 to the end.

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Sat, 07 Mar 2020 15:35:26 GMT

[Expert@PNS-CP4607-02:0]# snmpwalk -v 2c -c vpn123 localhost .1.3.6.1.4.1.2620.1.1.25.22.0
SNMPv2-SMI::enterprises.2620.1.1.25.22.0 = No Such Instance currently exists at this OID

Re: What is SNMP OID for CP FW number of new connections?

Chris_Atkinson — Sat, 07 Mar 2020 15:44:35 GMT

To confirm is this a standard security gateway or are you running VSX and what version?

Do the other OIDs in 2-D return integer values...

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Sun, 08 Mar 2020 11:25:18 GMT

[Expert@PNS-CP4607-02:0]# fw ver
This is Check Point's software version R77.30 - Build 001

Simple distributed deploy GW but not VSX.

Re: What is SNMP OID for CP FW number of new connections?

Chris_Atkinson — Sun, 08 Mar 2020 11:47:43 GMT

Jumbo Take 351 GA and is your snmp monitoring generally working or does restarting the service help?

[Expert@HostName]# service snmpd status

[Expert@HostName]# service snmpd start

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Sun, 08 Mar 2020 12:19:20 GMT

Restart service is useless and I don't want to install hotfix.
Can I [Expert@HostName]# service snmpd stop
and download latest mib file https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=53467 replace $CPDIR/lib/snmp/chkpnt.mib in GW, then
[Expert@HostName]# service snmpd start

Re: What is SNMP OID for CP FW number of new connections?

Chris_Atkinson — Sun, 08 Mar 2020 12:23:16 GMT

Given the limited details provided...

If anything it might be related to the NET-SNMP package version, updates available via TAC.

Re: What is SNMP OID for CP FW number of new connections?

HristoGrigorov — Sun, 08 Mar 2020 15:54:47 GMT

Is this OID returning anything for you: .1.3.6.1.4.1.2620.1.1.26.11.6 ?

Re: What is SNMP OID for CP FW number of new connections?

John_Fleming — Mon, 09 Mar 2020 20:27:11 GMT

NOTE: only valid for non SMB firewalls.

Is cpsnmpd running? I think this is the process snmpd hands off to for checkpoint related oids.

If its not running do the following

cpconfig

chose option for checkpoint snmp extensions

exit

WARNING: This will do a cpstop / cpstart meaing all services will reload and including firewall policy.

Re: What is SNMP OID for CP FW number of new connections?

Pedro_Espindola — Mon, 09 Mar 2020 19:52:38 GMT

As Hristo said, 1.3.6.1.4.1.2620.1.1.26.11.6.0 is the correct one. Works on enterprise appliances.

For SMB appliances, you have to use delta of 1.3.6.1.4.1.2620.1.1.25.3.0.

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Tue, 10 Mar 2020 04:01:40 GMT

[Expert@PNS-CP4607-02:0]# service snmpd status
snmpd (pid 11013) is running...

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Tue, 10 Mar 2020 04:03:52 GMT

[Expert@PNS-CP4607-02:0]# snmpwalk -v 2c -c vpn123 localhost 1.3.6.1.4.1.2620.1.1.26.11.6.0
SNMPv2-SMI::enterprises.2620.1.1.26.11.6.0 = Counter32: 2
[Expert@PNS-CP4607-02:0]# snmpwalk -v 2c -c vpn123 localhost 1.3.6.1.4.1.2620.1.1.26.11.6.0
SNMPv2-SMI::enterprises.2620.1.1.26.11.6.0 = Counter32: 2
[Expert@PNS-CP4607-02:0]# snmpwalk -v 2c -c vpn123 localhost 1.3.6.1.4.1.2620.1.1.26.11.6.0
SNMPv2-SMI::enterprises.2620.1.1.26.11.6.0 = Counter32: 1
[Expert@PNS-CP4607-02:0]# snmpwalk -v 2c -c vpn123 localhost 1.3.6.1.4.1.2620.1.1.26.11.6.0
SNMPv2-SMI::enterprises.2620.1.1.26.11.6.0 = Counter32: 1
It seem correct. How do you find it?

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Tue, 10 Mar 2020 04:04:17 GMT

It seem correct. How do you find it?

Re: What is SNMP OID for CP FW number of new connections?

HristoGrigorov — Tue, 10 Mar 2020 04:24:42 GMT

I found it using this simple command:

# cat CHECKPOINT-MIB | grep -i conn | grep -i rate

It returns:

fwConnectionsStatConnectionRate OBJECT-TYPE
"connection rate (per second) passing through the FireWall-1 Module"
"Writing logs localy, To log servers(0), Local configured (1) Local due to connectivity(2) Local due to high rate(3)"

Paste fwConnectionsStatConnectionRate in Google and the first result is the OID 😀

Re: What is SNMP OID for CP FW number of new connections?

Herschel_Liang — Tue, 10 Mar 2020 04:33:49 GMT

Get! 0.0

Re: What is SNMP OID for CP FW number of new connections?

Pedro_Espindola — Tue, 10 Mar 2020 17:35:26 GMT

Some tools to explore the mibs:

ManageEngine MIB Browser:

https://www.manageengine.com/products/mibbrowser-free-tool/

Paessler MIB Importer:

https://www.paessler.com/tools/mibimporter

There are OIDs that are not in the mibs, but it helps.