@cryptotaxi247 / netdata-1 / commits / 567275e0d

go.d/snmp: add IPSec/VPN monitoring profiles for FortiGate, Juniper, MikroTik, Check Point (#21926)

Co-authored-by: ilyam8 <ilya@netdata.cloud>

Costa Tsaousis committed Mar 10, 2026 at 20:38 UTC 567275e0d44b41e17bfc45a3ef77ef818215f642
9 files changed +640 -3
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_checkpoint-vpn.yaml new
+225
@@ -0,0 +1,225 @@
1 +# Check Point VPN monitoring (CHECKPOINT-MIB)
2 +# Covers IKE/IPSec global stats, tunnel state, and permanent tunnel state
3 +
4 +metrics:
5 + # IKE global scalars
6 + - MIB: CHECKPOINT-MIB
7 + symbol:
8 + OID: 1.3.6.1.4.1.2620.1.2.9.1.1.0
9 + name: cpvIKECurrSAs
10 + chart_meta:
11 + description: Number of current IKE Security Associations
12 + family: 'Network/VPN/IPSec/IKE/SA/Active'
13 + unit: "{sa}"
14 + - MIB: CHECKPOINT-MIB
15 + symbol:
16 + OID: 1.3.6.1.4.1.2620.1.2.9.2.1.0
17 + name: cpvIKETotalFailuresInit
18 + chart_meta:
19 + description: Total IKE negotiation failures as initiator
20 + family: 'Network/VPN/IPSec/IKE/Failure/Initiator'
21 + unit: "{failure}/s"
22 + - MIB: CHECKPOINT-MIB
23 + symbol:
24 + OID: 1.3.6.1.4.1.2620.1.2.9.2.3.0
25 + name: cpvIKETotalFailuresResp
26 + chart_meta:
27 + description: Total IKE negotiation failures as responder
28 + family: 'Network/VPN/IPSec/IKE/Failure/Responder'
29 + unit: "{failure}/s"
30 +
31 + # IPSec SA scalars
32 + - MIB: CHECKPOINT-MIB
33 + symbol:
34 + OID: 1.3.6.1.4.1.2620.1.2.5.2.1.0
35 + name: cpvCurrEspSAsIn
36 + chart_meta:
37 + description: Number of current inbound ESP Security Associations
38 + family: 'Network/VPN/IPSec/SA/Active/In'
39 + unit: "{sa}"
40 + - MIB: CHECKPOINT-MIB
41 + symbol:
42 + OID: 1.3.6.1.4.1.2620.1.2.5.2.3.0
43 + name: cpvCurrEspSAsOut
44 + chart_meta:
45 + description: Number of current outbound ESP Security Associations
46 + family: 'Network/VPN/IPSec/SA/Active/Out'
47 + unit: "{sa}"
48 +
49 + # IPSec error scalars
50 + - MIB: CHECKPOINT-MIB
51 + symbol:
52 + OID: 1.3.6.1.4.1.2620.1.2.5.3.1.0
53 + name: cpvSaDecrErr
54 + chart_meta:
55 + description: Total SA decryption errors
56 + family: 'Network/VPN/IPSec/SA/Error/Decrypt'
57 + unit: "{error}/s"
58 + - MIB: CHECKPOINT-MIB
59 + symbol:
60 + OID: 1.3.6.1.4.1.2620.1.2.5.3.2.0
61 + name: cpvSaAuthErr
62 + chart_meta:
63 + description: Total SA authentication errors
64 + family: 'Network/VPN/IPSec/SA/Error/Auth'
65 + unit: "{error}/s"
66 + - MIB: CHECKPOINT-MIB
67 + symbol:
68 + OID: 1.3.6.1.4.1.2620.1.2.5.3.3.0
69 + name: cpvSaReplayErr
70 + chart_meta:
71 + description: Total SA replay errors
72 + family: 'Network/VPN/IPSec/SA/Error/Replay'
73 + unit: "{error}/s"
74 +
75 + # IPSec traffic scalars
76 + - MIB: CHECKPOINT-MIB
77 + symbol:
78 + OID: 1.3.6.1.4.1.2620.1.2.5.4.5.0
79 + name: cpvIpsecEspEncPkts
80 + chart_meta:
81 + description: Total ESP encrypted packets
82 + family: 'Network/VPN/IPSec/Traffic/Packet/Out'
83 + unit: "{packet}/s"
84 + - MIB: CHECKPOINT-MIB
85 + symbol:
86 + OID: 1.3.6.1.4.1.2620.1.2.5.4.6.0
87 + name: cpvIpsecEspDecPkts
88 + chart_meta:
89 + description: Total ESP decrypted packets
90 + family: 'Network/VPN/IPSec/Traffic/Packet/In'
91 + unit: "{packet}/s"
92 + - MIB: CHECKPOINT-MIB
93 + symbol:
94 + OID: 1.3.6.1.4.1.2620.1.2.5.4.19.0
95 + name: cpvIpsecEspEncBytes
96 + chart_meta:
97 + description: Total ESP encrypted bytes
98 + family: 'Network/VPN/IPSec/Traffic/Throughput/Out'
99 + unit: "By/s"
100 + - MIB: CHECKPOINT-MIB
101 + symbol:
102 + OID: 1.3.6.1.4.1.2620.1.2.5.4.20.0
103 + name: cpvIpsecEspDecBytes
104 + chart_meta:
105 + description: Total ESP decrypted bytes
106 + family: 'Network/VPN/IPSec/Traffic/Throughput/In'
107 + unit: "By/s"
108 +
109 + # VPN tunnel state table
110 + - MIB: CHECKPOINT-MIB
111 + table:
112 + OID: 1.3.6.1.4.1.2620.500.9002
113 + name: tunnelTable
114 + symbols:
115 + - OID: 1.3.6.1.4.1.2620.500.9002.1.3
116 + name: tunnelState
117 + chart_meta:
118 + description: Current state of the VPN tunnel
119 + family: 'Network/VPN/IPSec/Tunnel/Status'
120 + unit: "{status}"
121 + mapping:
122 + 3: active
123 + 4: destroy
124 + 129: idle
125 + 130: phase1
126 + 131: down
127 + 132: init
128 + - OID: 1.3.6.1.4.1.2620.500.9002.1.9
129 + name: tunnelProbState
130 + chart_meta:
131 + description: DPD probe state of the VPN tunnel
132 + family: 'Network/VPN/IPSec/Tunnel/ProbeStatus'
133 + unit: "{status}"
134 + mapping:
135 + 0: unknown
136 + 1: alive
137 + 2: dead
138 + metric_tags:
139 + - tag: tunnel_peer_name
140 + symbol:
141 + OID: 1.3.6.1.4.1.2620.500.9002.1.2
142 + name: tunnelPeerObjName
143 + - tag: _tunnel_community
144 + symbol:
145 + OID: 1.3.6.1.4.1.2620.500.9002.1.4
146 + name: tunnelCommunity
147 + - tag: _tunnel_interface
148 + symbol:
149 + OID: 1.3.6.1.4.1.2620.500.9002.1.6
150 + name: tunnelInterface
151 + - tag: _tunnel_source_ip
152 + symbol:
153 + OID: 1.3.6.1.4.1.2620.500.9002.1.7
154 + name: tunnelSourceIP
155 + - tag: _tunnel_link_priority
156 + symbol:
157 + OID: 1.3.6.1.4.1.2620.500.9002.1.8
158 + name: tunnelLinkPriority
159 + - tag: _tunnel_peer_type
160 + symbol:
161 + OID: 1.3.6.1.4.1.2620.500.9002.1.10
162 + name: tunnelPeerType
163 + - tag: _tunnel_type
164 + symbol:
165 + OID: 1.3.6.1.4.1.2620.500.9002.1.11
166 + name: tunnelType
167 +
168 + # Permanent VPN tunnel state table
169 + - MIB: CHECKPOINT-MIB
170 + table:
171 + OID: 1.3.6.1.4.1.2620.500.9003
172 + name: permanentTunnelTable
173 + symbols:
174 + - OID: 1.3.6.1.4.1.2620.500.9003.1.3
175 + name: permanentTunnelState
176 + chart_meta:
177 + description: Current state of the permanent VPN tunnel
178 + family: 'Network/VPN/IPSec/PermanentTunnel/Status'
179 + unit: "{status}"
180 + mapping:
181 + 3: active
182 + 4: destroy
183 + 129: idle
184 + 130: phase1
185 + 131: down
186 + 132: init
187 + - OID: 1.3.6.1.4.1.2620.500.9003.1.9
188 + name: permanentTunnelProbState
189 + chart_meta:
190 + description: DPD probe state of the permanent VPN tunnel
191 + family: 'Network/VPN/IPSec/PermanentTunnel/ProbeStatus'
192 + unit: "{status}"
193 + mapping:
194 + 0: unknown
195 + 1: alive
196 + 2: dead
197 + metric_tags:
198 + - tag: tunnel_peer_name
199 + symbol:
200 + OID: 1.3.6.1.4.1.2620.500.9003.1.2
201 + name: permanentTunnelPeerObjName
202 + - tag: _tunnel_community
203 + symbol:
204 + OID: 1.3.6.1.4.1.2620.500.9003.1.4
205 + name: permanentTunnelCommunity
206 + - tag: _tunnel_interface
207 + symbol:
208 + OID: 1.3.6.1.4.1.2620.500.9003.1.6
209 + name: permanentTunnelInterface
210 + - tag: _tunnel_source_ip
211 + symbol:
212 + OID: 1.3.6.1.4.1.2620.500.9003.1.7
213 + name: permanentTunnelSourceIP
214 + - tag: _tunnel_link_priority
215 + symbol:
216 + OID: 1.3.6.1.4.1.2620.500.9003.1.8
217 + name: permanentTunnelLinkPriority
218 + - tag: _tunnel_peer_type
219 + symbol:
220 + OID: 1.3.6.1.4.1.2620.500.9003.1.10
221 + name: permanentTunnelPeerType
222 + - tag: _tunnel_type
223 + symbol:
224 + OID: 1.3.6.1.4.1.2620.500.9003.1.11
225 + name: permanentTunnelType
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_fortinet-fortigate-vpn-tunnel.yaml
+88 -3
@@ -1,4 +1,5 @@
1 metrics:
2 + # IPSec Phase 2 tunnel table
3 - MIB: FORTINET-FORTIGATE-MIB
4 table:
5 OID: 1.3.6.1.4.1.12356.101.12.2.2
@@ -8,27 +9,111 @@ metrics:
9 name: fgVpnTunEntInOctets
10 chart_meta:
11 description: Number of bytes received on tunnel
11 - family: 'Network/VPN/Tunnel/Traffic/In'
12 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Traffic/In'
13 unit: "bit/s"
14 scale_factor: 8
15 - OID: 1.3.6.1.4.1.12356.101.12.2.2.1.19
16 name: fgVpnTunEntOutOctets
17 chart_meta:
18 description: Number of bytes sent out on tunnel
18 - family: 'Network/VPN/Tunnel/Traffic/Out'
19 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Traffic/Out'
20 unit: "bit/s"
21 scale_factor: 8
22 - OID: 1.3.6.1.4.1.12356.101.12.2.2.1.20
23 name: fgVpnTunEntStatus
24 chart_meta:
25 description: Current status of tunnel (up or down)
25 - family: 'Network/VPN/Tunnel/Status'
26 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Status'
27 unit: "{status}"
28 mapping:
29 1: down
30 2: up
31 + - OID: 1.3.6.1.4.1.12356.101.12.2.2.1.15
32 + name: fgVpnTunEntLifeSecs
33 + chart_meta:
34 + description: Remaining lifetime of this tunnel in seconds
35 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Lifetime'
36 + unit: "s"
37 + - OID: 1.3.6.1.4.1.12356.101.12.2.2.1.16
38 + name: fgVpnTunEntLifeBytes
39 + chart_meta:
40 + description: Remaining lifetime of this tunnel in bytes
41 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Lifetime/Bytes'
42 + unit: "By"
43 metric_tags:
44 - tag: vpn_tunnel_name
45 symbol:
46 OID: 1.3.6.1.4.1.12356.101.12.2.2.1.2
47 name: fgVpnTunEntPhase1Name
48 + - tag: phase_2_name
49 + symbol:
50 + OID: 1.3.6.1.4.1.12356.101.12.2.2.1.3
51 + name: fgVpnTunEntPhase2Name
52 + - tag: _remote_gateway_ip
53 + symbol:
54 + OID: 1.3.6.1.4.1.12356.101.12.2.2.1.4
55 + name: fgVpnTunEntRemGwyIp
56 + - tag: _local_gateway_ip
57 + symbol:
58 + OID: 1.3.6.1.4.1.12356.101.12.2.2.1.6
59 + name: fgVpnTunEntLocGwyIp
60 + - tag: vdom
61 + symbol:
62 + OID: 1.3.6.1.4.1.12356.101.12.2.2.1.21
63 + name: fgVpnTunEntVdom
64 +
65 + # SSL VPN per-VDOM statistics
66 + - MIB: FORTINET-FORTIGATE-MIB
67 + table:
68 + OID: 1.3.6.1.4.1.12356.101.12.2.3
69 + name: fgVpnSslStatsTable
70 + symbols:
71 + - OID: 1.3.6.1.4.1.12356.101.12.2.3.1.1
72 + name: fgVpnSslState
73 + chart_meta:
74 + description: Whether SSL VPN is enabled on this VDOM
75 + family: 'Network/VPN/RemoteAccess/Status'
76 + unit: "{status}"
77 + mapping:
78 + 1: disabled
79 + 2: enabled
80 + - OID: 1.3.6.1.4.1.12356.101.12.2.3.1.2
81 + name: fgVpnSslStatsLoginUsers
82 + chart_meta:
83 + description: Number of current logged-in SSL VPN users
84 + family: 'Network/VPN/RemoteAccess/User/Active'
85 + unit: "{user}"
86 + - OID: 1.3.6.1.4.1.12356.101.12.2.3.1.3
87 + name: fgVpnSslStatsMaxUsers
88 + chart_meta:
89 + description: Maximum number of SSL VPN users allowed
90 + family: 'Network/VPN/RemoteAccess/User/Maximum'
91 + unit: "{user}"
92 + - OID: 1.3.6.1.4.1.12356.101.12.2.3.1.4
93 + name: fgVpnSslStatsActiveWebSessions
94 + chart_meta:
95 + description: Number of active SSL VPN web sessions
96 + family: 'Network/VPN/RemoteAccess/Session/Web/Active'
97 + unit: "{session}"
98 + - OID: 1.3.6.1.4.1.12356.101.12.2.3.1.5
99 + name: fgVpnSslStatsMaxWebSessions
100 + chart_meta:
101 + description: Maximum number of SSL VPN web sessions allowed
102 + family: 'Network/VPN/RemoteAccess/Session/Web/Maximum'
103 + unit: "{session}"
104 + - OID: 1.3.6.1.4.1.12356.101.12.2.3.1.6
105 + name: fgVpnSslStatsActiveTunnels
106 + chart_meta:
107 + description: Number of active SSL VPN tunnels
108 + family: 'Network/VPN/RemoteAccess/Session/Tunnel/Active'
109 + unit: "{tunnel}"
110 + - OID: 1.3.6.1.4.1.12356.101.12.2.3.1.7
111 + name: fgVpnSslStatsMaxTunnels
112 + chart_meta:
113 + description: Maximum number of SSL VPN tunnels allowed
114 + family: 'Network/VPN/RemoteAccess/Session/Tunnel/Maximum'
115 + unit: "{tunnel}"
116 + metric_tags:
117 + # fgVpnSslStatsTable is indexed by VDOM index
118 + - tag: vdom_index
119 + index: 1
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_juniper-ipsec-flow-monitor.yaml new
+225
@@ -0,0 +1,225 @@
1 +# Juniper IPSec Flow Monitor (JUNIPER-IPSEC-FLOW-MON-MIB)
2 +# Covers SRX firewalls and MX routers with IPSec capability
3 +# MIB root: 1.3.6.1.4.1.2636.3.52
4 +
5 +metrics:
6 + # Global scalars
7 + - MIB: JUNIPER-IPSEC-FLOW-MON-MIB
8 + symbol:
9 + OID: 1.3.6.1.4.1.2636.3.52.1.1.1.0
10 + name: jnxIkeNumOfTunnels
11 + chart_meta:
12 + description: Total number of active IKE Phase 1 tunnels
13 + family: 'Network/VPN/IPSec/Phase1/Tunnel/Active'
14 + unit: "{tunnel}"
15 + - MIB: JUNIPER-IPSEC-FLOW-MON-MIB
16 + symbol:
17 + OID: 1.3.6.1.4.1.2636.3.52.1.2.1.0
18 + name: jnxIpSecNumOfTunnels
19 + chart_meta:
20 + description: Total number of active IPSec Phase 2 tunnels
21 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Active'
22 + unit: "{tunnel}"
23 +
24 + # IKE / Phase 1 tunnel table
25 + - MIB: JUNIPER-IPSEC-FLOW-MON-MIB
26 + table:
27 + OID: 1.3.6.1.4.1.2636.3.52.1.1.2
28 + name: jnxIkeTunnelMonTable
29 + symbols:
30 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.6
31 + name: jnxIkeTunMonState
32 + chart_meta:
33 + description: Current state of the IKE Phase 1 tunnel
34 + family: 'Network/VPN/IPSec/Phase1/Tunnel/Status'
35 + unit: "{status}"
36 + mapping:
37 + 1: up
38 + 2: down
39 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.20
40 + name: jnxIkeTunMonLifeTime
41 + chart_meta:
42 + description: Remaining lifetime of the IKE Phase 1 tunnel
43 + family: 'Network/VPN/IPSec/Phase1/Tunnel/Lifetime'
44 + unit: "s"
45 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.21
46 + name: jnxIkeTunMonActiveTime
47 + chart_meta:
48 + description: Time this IKE Phase 1 tunnel has been active
49 + family: 'Network/VPN/IPSec/Phase1/Tunnel/ActiveTime'
50 + unit: "s"
51 + # TimeTicks in hundredths of seconds
52 + scale_factor: 0.01
53 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.22
54 + name: jnxIkeTunMonInOctets
55 + chart_meta:
56 + description: Number of bytes received on this IKE Phase 1 tunnel
57 + family: 'Network/VPN/IPSec/Phase1/Tunnel/Traffic/In'
58 + unit: "By/s"
59 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.23
60 + name: jnxIkeTunMonInPkts
61 + chart_meta:
62 + description: Number of packets received on this IKE Phase 1 tunnel
63 + family: 'Network/VPN/IPSec/Phase1/Tunnel/Packet/In'
64 + unit: "{packet}/s"
65 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.24
66 + name: jnxIkeTunMonOutOctets
67 + chart_meta:
68 + description: Number of bytes sent on this IKE Phase 1 tunnel
69 + family: 'Network/VPN/IPSec/Phase1/Tunnel/Traffic/Out'
70 + unit: "By/s"
71 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.25
72 + name: jnxIkeTunMonOutPkts
73 + chart_meta:
74 + description: Number of packets sent on this IKE Phase 1 tunnel
75 + family: 'Network/VPN/IPSec/Phase1/Tunnel/Packet/Out'
76 + unit: "{packet}/s"
77 + - OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.27
78 + name: jnxIkeTunMonDPDDownCount
79 + chart_meta:
80 + description: Number of DPD (Dead Peer Detection) down events on this tunnel
81 + family: 'Network/VPN/IPSec/Phase1/Tunnel/DPD/Down'
82 + unit: "{event}/s"
83 + metric_tags:
84 + - tag: ike_tunnel_index
85 + index: 1
86 + - tag: _peer_remote_address
87 + symbol:
88 + OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.2
89 + name: jnxIkeTunMonRemoteAddr
90 + format: ip_address
91 + - tag: _peer_local_address
92 + symbol:
93 + OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.4
94 + name: jnxIkeTunMonLocalAddr
95 + format: ip_address
96 + - tag: _remote_identity
97 + symbol:
98 + OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.14
99 + name: jnxIkeTunMonRemoteIdent
100 + - tag: _gateway_name
101 + symbol:
102 + OID: 1.3.6.1.4.1.2636.3.52.1.1.2.1.43
103 + name: jnxIkeTunMonRemoteGwName
104 +
105 + # IPSec / Phase 2 tunnel table
106 + - MIB: JUNIPER-IPSEC-FLOW-MON-MIB
107 + table:
108 + OID: 1.3.6.1.4.1.2636.3.52.1.2.2
109 + name: jnxIpSecTunnelMonTable
110 + symbols:
111 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.10
112 + name: jnxIpSecTunMonOutEncryptedBytes
113 + chart_meta:
114 + description: Number of encrypted bytes sent on this IPSec Phase 2 tunnel
115 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Traffic/Out'
116 + unit: "By/s"
117 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.11
118 + name: jnxIpSecTunMonOutEncryptedPkts
119 + chart_meta:
120 + description: Number of encrypted packets sent on this IPSec Phase 2 tunnel
121 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Packet/Out'
122 + unit: "{packet}/s"
123 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.12
124 + name: jnxIpSecTunMonInDecryptedBytes
125 + chart_meta:
126 + description: Number of decrypted bytes received on this IPSec Phase 2 tunnel
127 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Traffic/In'
128 + unit: "By/s"
129 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.13
130 + name: jnxIpSecTunMonInDecryptedPkts
131 + chart_meta:
132 + description: Number of decrypted packets received on this IPSec Phase 2 tunnel
133 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Packet/In'
134 + unit: "{packet}/s"
135 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.18
136 + name: jnxIpSecTunMonReplayDropPkts
137 + chart_meta:
138 + description: Number of packets dropped due to anti-replay check failure
139 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Drop/Replay'
140 + unit: "{drop}/s"
141 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.20
142 + name: jnxIpSecTunMonEspAuthFails
143 + chart_meta:
144 + description: Number of ESP authentication failures on this tunnel
145 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Error/AuthFail'
146 + unit: "{failure}/s"
147 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.21
148 + name: jnxIpSecTunMonDecryptFails
149 + chart_meta:
150 + description: Number of decryption failures on this tunnel
151 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Error/DecryptFail'
152 + unit: "{failure}/s"
153 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.26
154 + name: jnxIpSecTunMonDroppedPkts
155 + chart_meta:
156 + description: Total number of packets dropped on this IPSec Phase 2 tunnel
157 + family: 'Network/VPN/IPSec/Phase2/Tunnel/Drop/Total'
158 + unit: "{drop}/s"
159 + metric_tags:
160 + - tag: ipsec_tunnel_index
161 + index: 1
162 + - tag: _peer_remote_address
163 + symbol:
164 + OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.2
165 + name: jnxIpSecTunMonRemoteGwAddr
166 + format: ip_address
167 + - tag: _peer_local_address
168 + symbol:
169 + OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.5
170 + name: jnxIpSecTunMonLocalAddr
171 + format: ip_address
172 + - tag: _local_proxy_id
173 + symbol:
174 + OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.6
175 + name: jnxIpSecTunMonLocalProxyId
176 + - tag: _remote_proxy_id
177 + symbol:
178 + OID: 1.3.6.1.4.1.2636.3.52.1.2.2.1.7
179 + name: jnxIpSecTunMonRemoteProxyId
180 +
181 + # IPSec SA detail table
182 + - MIB: JUNIPER-IPSEC-FLOW-MON-MIB
183 + table:
184 + OID: 1.3.6.1.4.1.2636.3.52.1.2.3
185 + name: jnxIpSecSaMonTable
186 + symbols:
187 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.3.1.14
188 + name: jnxIpSecSaMonState
189 + chart_meta:
190 + description: Status of this IPSec Security Association
191 + family: 'Network/VPN/IPSec/Phase2/SA/Status'
192 + unit: "{status}"
193 + mapping:
194 + 0: unknown
195 + 1: active
196 + 2: expiring
197 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.3.1.8
198 + name: jnxIpSecSaMonLifeTime
199 + chart_meta:
200 + description: Remaining lifetime of this IPSec Security Association
201 + family: 'Network/VPN/IPSec/Phase2/SA/Lifetime'
202 + unit: "s"
203 + - OID: 1.3.6.1.4.1.2636.3.52.1.2.3.1.9
204 + name: jnxIpSecSaMonActiveTime
205 + chart_meta:
206 + description: Time this IPSec Security Association has been active
207 + family: 'Network/VPN/IPSec/Phase2/SA/ActiveTime'
208 + unit: "s"
209 + # TimeTicks in hundredths of seconds
210 + scale_factor: 0.01
211 + metric_tags:
212 + - tag: sa_index
213 + index: 1
214 + - tag: _sa_encap_mode
215 + symbol:
216 + OID: 1.3.6.1.4.1.2636.3.52.1.2.3.1.6
217 + name: jnxIpSecSaMonEncapMode
218 + - tag: _encrypt_algo
219 + symbol:
220 + OID: 1.3.6.1.4.1.2636.3.52.1.2.3.1.12
221 + name: jnxIpSecSaMonEncryptAlgo
222 + - tag: _auth_algo
223 + symbol:
224 + OID: 1.3.6.1.4.1.2636.3.52.1.2.3.1.13
225 + name: jnxIpSecSaMonAuthAlgo
src/go/plugin/go.d/config/go.d/snmp.profiles/default/_mikrotik-ipsec.yaml new
+88
@@ -0,0 +1,88 @@
1 +# MikroTik IPSec IKE SA monitoring (MIKROTIK-MIB)
2 +# MIB root: 1.3.6.1.4.1.14988.1.1.20
3 +
4 +metrics:
5 + # Global scalar
6 + - MIB: MIKROTIK-MIB
7 + symbol:
8 + OID: 1.3.6.1.4.1.14988.1.1.20.1.0
9 + name: mtxrIkeSACount
10 + chart_meta:
11 + description: Number of active IKE Security Associations
12 + family: 'Network/VPN/IPSec/IKE/SA/Active'
13 + unit: "{sa}"
14 +
15 + # IKE SA table
16 + - MIB: MIKROTIK-MIB
17 + table:
18 + OID: 1.3.6.1.4.1.14988.1.1.20.2
19 + name: mtxrIkeSATable
20 + symbols:
21 + - OID: 1.3.6.1.4.1.14988.1.1.20.2.1.7
22 + name: mtxrIkeSAState
23 + chart_meta:
24 + description: Current state of the IKE Security Association
25 + family: 'Network/VPN/IPSec/IKE/SA/Status'
26 + unit: "{status}"
27 + mapping:
28 + 1: exchange
29 + 2: established
30 + 3: expired
31 + 4: eap
32 + - OID: 1.3.6.1.4.1.14988.1.1.20.2.1.8
33 + name: mtxrIkeSAUptime
34 + chart_meta:
35 + description: How long this IKE SA has been active
36 + family: 'Network/VPN/IPSec/IKE/SA/Uptime'
37 + unit: "s"
38 + # TimeTicks in hundredths of seconds
39 + scale_factor: 0.01
40 + - OID: 1.3.6.1.4.1.14988.1.1.20.2.1.11
41 + name: mtxrIkeSAPh2Count
42 + chart_meta:
43 + description: Number of Phase 2 child SAs for this IKE SA
44 + family: 'Network/VPN/IPSec/IKE/SA/Phase2Count'
45 + unit: "{sa}"
46 + - OID: 1.3.6.1.4.1.14988.1.1.20.2.1.20
47 + name: mtxrIkeSATxBytes
48 + chart_meta:
49 + description: Number of bytes transmitted through this IKE SA
50 + family: 'Network/VPN/IPSec/IKE/SA/Traffic/Out'
51 + unit: "By/s"
52 + - OID: 1.3.6.1.4.1.14988.1.1.20.2.1.21
53 + name: mtxrIkeSARxBytes
54 + chart_meta:
55 + description: Number of bytes received through this IKE SA
56 + family: 'Network/VPN/IPSec/IKE/SA/Traffic/In'
57 + unit: "By/s"
58 + - OID: 1.3.6.1.4.1.14988.1.1.20.2.1.22
59 + name: mtxrIkeSATxPackets
60 + chart_meta:
61 + description: Number of packets transmitted through this IKE SA
62 + family: 'Network/VPN/IPSec/IKE/SA/Packet/Out'
63 + unit: "{packet}/s"
64 + - OID: 1.3.6.1.4.1.14988.1.1.20.2.1.23
65 + name: mtxrIkeSARxPackets
66 + chart_meta:
67 + description: Number of packets received through this IKE SA
68 + family: 'Network/VPN/IPSec/IKE/SA/Packet/In'
69 + unit: "{packet}/s"
70 + metric_tags:
71 + - tag: ike_sa_index
72 + index: 1
73 + - tag: _ike_version
74 + symbol:
75 + OID: 1.3.6.1.4.1.14988.1.1.20.2.1.6
76 + name: mtxrIkeSAIKEVersion
77 + - tag: _peer_identity
78 + symbol:
79 + OID: 1.3.6.1.4.1.14988.1.1.20.2.1.10
80 + name: mtxrIkeSARemoteIdentity
81 + - tag: _local_address
82 + symbol:
83 + OID: 1.3.6.1.4.1.14988.1.1.20.2.1.13
84 + name: mtxrIkeSALocalAddress
85 + - tag: _peer_address
86 + symbol:
87 + OID: 1.3.6.1.4.1.14988.1.1.20.2.1.16
88 + name: mtxrIkeSARemoteAddress
src/go/plugin/go.d/config/go.d/snmp.profiles/default/checkpoint.yaml
+1
@@ -11,6 +11,7 @@ extends:
11 - _std-tcp-mib.yaml
12 - _std-udp-mib.yaml
13 - _std-ip-mib.yaml
14 + - _checkpoint-vpn.yaml
15
16 selector:
17 - sysobjectid:
src/go/plugin/go.d/config/go.d/snmp.profiles/default/fortinet-fortigate.yaml
+10
@@ -68,6 +68,16 @@ metadata:
68 # https://github.com/DanielleHuisman/observium-community-edition/blob/main/mibs/fortinet/FORTINET-FORTIGATE-MIB
69
70 metrics:
71 + ### VPN
72 + - MIB: FORTINET-FORTIGATE-MIB
73 + symbol:
74 + OID: 1.3.6.1.4.1.12356.101.12.1.1.0
75 + name: fgVpnTunnelUpCount
76 + chart_meta:
77 + description: Total number of active IPSec VPN tunnels
78 + family: 'Network/VPN/IPSec/Tunnel/Active'
79 + unit: "{tunnel}"
80 +
81 ### CPU
82 - MIB: FORTINET-FORTIGATE-MIB
83 symbol:
src/go/plugin/go.d/config/go.d/snmp.profiles/default/juniper-mx.yaml
+1
@@ -14,6 +14,7 @@ extends:
14 - _juniper-virtualchassis.yaml
15 - _juniper-firewall.yaml
16 - _juniper-junos-generic.yaml
17 + - _juniper-ipsec-flow-monitor.yaml
18 - _juniper.yaml
19
20 metadata:
src/go/plugin/go.d/config/go.d/snmp.profiles/default/juniper-srx.yaml
+1
@@ -16,6 +16,7 @@ extends:
16 - _juniper-scu.yaml
17 - _juniper-dcu.yaml
18 - _juniper-junos-generic.yaml
19 + - _juniper-ipsec-flow-monitor.yaml
20 - _juniper.yaml
21
22 metadata:
src/go/plugin/go.d/config/go.d/snmp.profiles/default/mikrotik-router.yaml
+1
@@ -1,6 +1,7 @@
1 extends:
2 - _system-base.yaml
3 - _std-if-mib.yaml
4 + - _mikrotik-ipsec.yaml
5
6 selector:
7 - sysobjectid: