Still issues with SNMP - SFOS v18 MR1

Hi Patrik Nordlund 

Thank you for reaching out to the Community!

Please collect the following details from your firewall for further investigation. 

• Packet capture on port 161 or 162:
  • Follow this KBA for more info: Sophos XG Firewall: How to capture packets and download the Packet Capture
  • Use this command to capture packets: tcpdump filedump 'port 161 or 162 -s0

• Snapshot of the top command from the Advanced Shell.

• Snapshot of the UI/System Graph.

Thanks,

Hi,

Ok I have done that, how would you like me to send it to you?

/patrik

Hi Patrik Nordlund 

PM me the screenshots and the packet capture.

Thanks,

Hi,

Ok, done it now, was some issue with Firefox and attaching files so that is why it did not work for me before

, have you had a chance to look at the files?

I have another questions regarding snmp and v18 as well, are different XG-models responding on different OIDs?

The first example is from an XG230 and now I have started to look at a XG135 but that does not seem to respond to all the same OIDs as the 230's? In fact it seems to respond to very few OIDs.

Hello Patrik Nordlund 

I have checked the PCAP and found that the OID requested is not the same as the OID in the MIB file. 

OID 1.3.6.1.4.1.2604.5.1.2.5.1.0 -> Memory Capacity

OID 1.3.6.1.4.1.2604.5.1.2.5.2.0 -> Memory % used. 

As per PCAP this is requested 

get-response 1.3.6.1.4.1.2435.2.3.9.4.2.1.5.5.6.0 1.3.6.1.4.1.2435.2.3.9.4.2.1.5.5.8.0 1.3.6.1.2.1.43.16.5.1.2.1.1 1.3.6.1.2.1.43.10.2.1.2.1.1

Please check the OID value using the OID file.

You can use any MIB free tools to decode the MIB file. 

The MIB file is different for V18 and V17.5 not different models.

5226.SOPHOS-XG-MIB (2).zip

Not sure why the pcap would show those OIDs but there are several snmp-request coming from our monitoring system.

Anyway, if I look at the specific oid using Paessler SNMP Tester it shows memory usage 100%

Hello Patrik Nordlund 

Thanks for the update, 

Now I want three outputs along with the PCAP. 

1) Snapshot of the memory graph

2) output of commands in the advance shell > SSH > Choose option 5 then choose 3.

atop

cat /proc/meminfo

free

3) PCAP of the communication on V2. V3 is encrypted,

You may run these commands on Linux machine.

- > memory Capacity

snmpget -v2c -c <Communitystring> <ip address > 1.3.6.1.4.1.2604.5.1.2.5.1.0

> Memory % usage
snmpget -v2c -c <Communitystring> <IPaddress> 1.3.6.1.4.1.2604.5.1.2.5.2.0

Sample 

snmpget -v2c -c Communitystring 192.168.50.147 1.3.6.1.4.1.2604.5.1.2.5.2.0

iso.3.6.1.4.1.2604.5.1.2.5.2.0 = Gauge32: 65

snmpget -v2c -c Communitystring 192.168.50.147 1.3.6.1.4.1.2604.5.1.2.5.1.0

iso.3.6.1.4.1.2604.5.1.2.5.1.0 = Gauge32: 3943

Tested on V18 Mr1-1

Hello Patrik Nordlund 

Thanks for the update, 

Now I want three outputs along with the PCAP. 

1) Snapshot of the memory graph

2) output of commands in the advance shell > SSH > Choose option 5 then choose 3.

atop

cat /proc/meminfo

free

3) PCAP of the communication on V2. V3 is encrypted,

You may run these commands on Linux machine.

- > memory Capacity

snmpget -v2c -c <Communitystring> <ip address > 1.3.6.1.4.1.2604.5.1.2.5.1.0

> Memory % usage
snmpget -v2c -c <Communitystring> <IPaddress> 1.3.6.1.4.1.2604.5.1.2.5.2.0

Sample 

snmpget -v2c -c Communitystring 192.168.50.147 1.3.6.1.4.1.2604.5.1.2.5.2.0

iso.3.6.1.4.1.2604.5.1.2.5.2.0 = Gauge32: 65

snmpget -v2c -c Communitystring 192.168.50.147 1.3.6.1.4.1.2604.5.1.2.5.1.0

iso.3.6.1.4.1.2604.5.1.2.5.1.0 = Gauge32: 3943

Tested on V18 Mr1-1

Hello

We have checked and found there is an issue with the memory calculation in V18. 

The issue will be sorted out in V18 MR4.

JIRA ID: NC-61313

Hello,

Thank you for the update, any news regarding the licensing details?

/patrik

Hello

What about the cpu percentage missing in the V18 mib ?

Thanks

Good afternoon. You can give me the disk oid and swap sfos 18 information. I need it