CISCO-UNIFIED-FIREWALL-MIB

Organization:

Cisco Systems

Module:

CISCO-UNIFIED-FIREWALL-MIB

Version:

2005-09-22

File:

CISCO-UNIFIED-FIREWALL-MIB.yang

Abstract:

Overview of Cisco Firewall MIB ============================== This MIB Module models status and performance statistics pertainin...

Contact:

Cisco Systems
Customer Service

Postal: 170 W Tasman Drive
San Jose, CA 95134
USA

Tel: +1 800 553-NETS
E-mail: cs-firewalls@cisco.com

Check for an additional details:

YANG Catalog

Description:

Overview of Cisco Firewall MIB
==============================
This MIB Module models status and performance
statistics pertaining to the common features supported
by Cisco firewall implementations. For each firewall
feature, capability (if applicable) and statistics are
defined. Supporting the configuration of firewall
features is outside the scope of this MIB.

Following are the major firewall features:

1) 'Stateful Packet Filtering'
Creating and maintaining the state of authorized
traffic flows dynamically to permit only
flows authorized by the policy is a mandatory
function of a firewall.
This MIB instruments the activity and memory
usage by this function.

2) 'Application Inspection'
This refers to the function of inspecting the
headers of layer 3 and layer 4 protocols and
creating dynamic entries in the connection
table for traffic flows spawned by an already
established traffic flow.

This MIB reflects the protocols that are being
inspected.

3) 'URL Filtering'
This refers to the function of facilitating
or restricting URL access requests through
the firewall by consulting either local policy
or that configured on a dedicated URL filtering
server.

This MIB instruments the URL filtering activity,
the status and activity of distinct URL filtering
servers configured on the firewall and the
impact of the performance of the URL filtering
servers on the latency and throughput of the
firewall.

4) 'Proxy Authentication'
This refers to the function of authenticating
and/or authorizing users on behalf of servers
on the secure side of the firewall. This operation
could affect the throughput of the firewall.

The MIB objects pertaining to Proxy Authentication
will be defined in a subsequent revision of this
MIB.


5) 'Transparent Mode Operation'
A firewall could operate as a bridge and yet
filter traffic based on layer 3-layer 7 control
and payload information. Operating in this mode
makes it easy to implement a firewall without
fragmenting existing subnets. Another advantage
of this mode of operation is enhanced security.

This MIB instruments the status, activity,
and performance of the firewall in this mode.
Please note that to fully manage a firewall
operating in this mode, the firewall must also
support the bridge MIB (BRIDGE-MIB).


6) 'Advanced Application Inspection and Control'
This function is also termed 'Application
Firewall' and pertains to inspecting payload and
headers of application traffic to make sure the
traffic flows conform to the configured security
policy.

Monitoring this function entails identifying the
security alerts generated by this function and
measuring the impact on firewall performance by
this task. Application Firewall will be
instrumented in a separate MIB dedicated for the
function.

7) 'Failover' or 'Redundancy'
Redundancy configuration is essential for business
critical firewalls.

Instrumenting this function entails reflecting
the configuration of redundancy and identifying
failover events.

The MIB objects pertaining to Proxy Authentication
will be defined in a subsequent revision of this
MIB.


The management information for each firewall feature
is defined in a distinct module compliance unit. The
compliance units corresponding to basic features of
firewalls are defined as mandatory.

Acronyms
========
Following are definitions of some terms used in this
module. Please refer to the module conformance for a
glossary of feature-specific terms.

`Firewall'
A firewall is a set of related programs,
implemented on a host or a network device, that
protects the resources of a private network from
users from other networks. Common firewalling
functions include stateful packet filtering,
proxy authentication of users on behalf of
applications on the secure side of the firewall,
URL access control, inspection of payload of
traffic streams to determine security threats.

`Layer2 Firewall' or 'Transparent Firewall'
A firewall device that operates as a bridge
while performing firewalling function.

`Connection'
The record in the firewall of a traffic strean
that has been authorized to flow through the
firewall.

`Half Open Connection'
For a connection oriented protocol: a connection
that has not reached the established on both the
sides of the connection.
For a connection-less protocol: the connection
corresponding to a traffic stream where traffic
flow has occurred (since the establishment of the
connection entry) only on one direction.

`Embryonic Connection'
The connection entry corresponding to an
application layer protocol in which the signaling
channel has been established while the setup of
the data channel is underway.

`Policy'
An element of firewall configuration that
identifies the access rights to a resource by a
traffic source. An example of a policy is an
Access Control Rule.

`Policy Target'
An entity to which a policy is applied so that
the action corresponding to the policy is taken
only on traffic streams associated with the
entity. An example of a policy target is an
interface.

`URL Filtering Server'
A server which is employed by the firewall to
enforce URL access policies.

`Protocol Data Unit' or PDU
An instance of the unit of information using which
a protocol operates is called the Protocol Data
Unit or the PDU of the protocol.

`Deep Packet Inspection'
The task of examining the contents of the payloads
of one or more layer 7 application protocols
with a view to enforcing the local security
policies termed 'Deep Packet Inspection'.

`Advanced Application Inspection and Control'
An entity that performs deep packet inspection
of layer 7 application protocol data units is
termed an 'Application Firewall'.