topic Re: SNMP OID for VPN certificate expiry? in General Topics

SNMP OID for VPN certificate expiry?

biskit — Tue, 31 Oct 2023 10:31:45 GMT

Is there a way to monitor the VPN certificate expiry date via SNMP?

I've been searching for an OID to use in my monitoring platform and haven't found one yet 🙄

For bonus points, is there a way via SNMP to monitor the expiry date of InternalCA.p12 (as per sk158096)?

Thanks,

Matt

Chris_Atkinson — Tue, 31 Oct 2023 13:22:49 GMT

Improving monitoring of certificates is planned.

In general you can otherwise extend SNMP with bash scripts (refer sk90860) to achieve in lieu of official OIDs, if SNMP options are a must.

Tal_Paz-Fridman — Tue, 31 Oct 2023 13:14:04 GMT

Here are the OIDs

stattest get 1.3.6.1.4.1.2620.1.1.101 - status_code

stattest get 1.3.6.1.4.1.2620.1.1.102 - short_description

stattest get 1.3.6.1.4.1.2620.1.1.103 - long_description

We'll add it to the SK

SmartConsole shows a warning or error icon near the Security Gateway / Cluster object about an expiring VPN certificate

Piet_vd_Maas — Fri, 23 Aug 2024 09:21:10 GMT

Is there any update of monitoring Certificates by SNMP?

PhoneBoy — Fri, 23 Aug 2024 13:07:29 GMT

Not as far as I know.
Note that in R82 we are adding additional monitoring for VPN…not sure how it will translate to SNMP.

Hugo_vd_Kooij — Thu, 10 Oct 2024 12:29:30 GMT

snmpget on OID 1.3.6.1.4.1.2620.1.1.102.0 will give you some information.

We will use it to create a ticket as soon as it is not OK. Giving us enough time to renew the certifcate in time.