I am requesting a slight improvement change in SNMP for Sophos UTM Home edition.

Can the sysObjectID be changed to the Sophos sysObjectID?

Currently its set on the generic Linux one: 1.3.6.1.4.1.8072.3.2.10

I think the Sophos one starts with: .1.3.6.1.4.1.9789

I monitor my home net and it would be nice if discovery recognizes my Sophos UTM as a firewall instead of a Linux EndNode.

Also is it possible to add SNMP to the AP firmware for discovery purposes and simple traffic queries? SNMP query credentials could be either added to the same SNMP config or add a new one under 'Wireless Protection'. I have an AP30 and AP10 in my house that have no discovery feature nor query capability other than ping and DNS.

When querying any of our UTM devices running 9.509-3 for iso.org.dod.internet.mgmt.mib-2.system.sysServices _1.3.6.1.2.1.1.7.0_ we receive the error "No Such Instance currently exists at this OID"

This is causing an issue with some network management applications that use the value of sysServices to determine which OSI layers the device supports

At a minimum, the value would need to be "4" to identify the UTM is rulling as a route mode firewall.

# Test on device with unmodified snmpd.conf
snmpget -v 3 -l authPriv -u USER -a SHA -A {Password} -x AES -X {Password} X.X.X.X SNMPv2-MIB::sysServices.0
SNMPv2-MIB::sysServices.0 = No Such Instance currently exists at this OID

# Test on device with modified snmpd.conf
snmpget -v 3 -l authPriv -u USER -a SHA -A {Password} -x AES -X {Password} Z.Z.Z.Z SNMPv2-MIB::sysServices.0
SNMPv2-MIB::sysServices.0 = INTEGER: 4

http://www.net-snmp.org/docs/mibs/SNMPv2-MIB.txt
sysServices OBJECT-TYPE
SYNTAX INTEGER (0..127)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A value which indicates the set of services that this
entity may potentially offer. The value is a sum.

This sum initially takes the value zero. Then, for
each layer, L, in the range 1 through 7, that this node
performs transactions for, 2 raised to (L - 1) is added
to the sum. For example, a node which performs only
routing functions would have a value of 4 (2^(3-1)).
In contrast, a node which is a host offering application
services would have a value of 72 (2^(4-1) + 2^(7-1)).
Note that in the context of the Internet suite of
protocols, values should be calculated accordingly:

layer functionality
1 physical (e.g., repeaters)
2 datalink/subnetwork (e.g., bridges)
3 internet (e.g., supports the IP)
4 end-to-end (e.g., supports the TCP)
7 applications (e.g., supports the SMTP)

For systems including OSI protocols, layers 5 and 6
may also be counted."

Hi-- I'm using Zabbix to monitor my environment-- including Sophos UTM where possible.

One thing I don't seem to see is a way to monitor the status of ipsec site-to-site vpns using snmp traps. I can get either a [WARN-726] (a site is down) or a [INFO-726] (a site came up)... but I don't seem to get info on WHICH tunnel.

Since I currently have 35 site-to-site vpns running through this thing "the vpn is down" isn't a very helpful alert.

By contrast, if I have email alerts for the same event turned on, I get something like:

VPN connection '###name of site removed###' [IPsec] using Site-to-Site is up again.