SNMP monitoring of the IPS blade

[SP4]

I'm trying to develop monitoring for our new Check Point firewalls and the OID for the IPS blade seems missing. sk90860 describes many OIDs for many software blades, and this question suggests using  .1.3.6.1.4.1.2620.1.53 but that's not present when I try to snmpwalk it. Are there any other possibilities for monitoring the IPS blade using SNMP?

[Chris_Atkinson]

Which model firewall and version/build/JHF is it currently installed with?

[SP4]

Quantum Force 9700 security gateways with a few VSX firewalls running R82 jumbo hotfix take 39

[Lesley]

Ahhh VSX, then check this one out: https://support.checkpoint.com/results/sk/sk183374

[PhoneBoy]

Creating a custom OID with the exact information you're looking to monitor.
It's queryable through the API/CLI: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-ips-status~v2%20 
Follow the steps in the Advanced SNMP configuration - Extend SNMP with shell script section of: https://support.checkpoint.com/results/sk/sk90860 

That's basically what I said in that previous thread you linked.

[SP4]

Thank you, I'll suggest this as a possible solution

[Tal_Paz-Fridman]

Adding to what PhoneBoy wrote you might also want to use Gaia API to query the relevant counters in CPView for IPS (although there is more information for other blades)

https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#cli/show-statistics-info~v1.8%20

https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#cli/show-statistics-view-info~v1.8%20 

[Lesley]

Stolen screenshot from other checkmates topic (timothy)

[SP4 · Accepted solution]

After testing again, it turns out that .1.3.6.1.4.1.2620.1.53 is indeed present and working as intended.

I'm not sure what went wrong previously, I guess there was an error in the syntax for snmpwalk I was using combined with an old version of the MIB file. Thanks to everyone for responding

[the_rock]

Thanks for the update!