could it implemented, that the utm can be monitored by snmp - in all variants of working, activated modules by snmp or api.

it is in this century not possible to monitoring deeper details of the utm. basically, there are any point s reachable - but it makes not the needings of an working utm with reds, vpns and else without any deeper investigations.

Of course, be a partnership with paessler, like it was made by other software creators.
So, it could be set as a given sensor in the PRTG gui, supported from Sophos / Paessler - it will spare many hours of work.

I am requesting a slight improvement change in SNMP for Sophos UTM Home edition.

Can the sysObjectID be changed to the Sophos sysObjectID?

Currently its set on the generic Linux one: 1.3.6.1.4.1.8072.3.2.10

I think the Sophos one starts with: .1.3.6.1.4.1.9789

I monitor my home net and it would be nice if discovery recognizes my Sophos UTM as a firewall instead of a Linux EndNode.

Also is it possible to add SNMP to the AP firmware for discovery purposes and simple traffic queries? SNMP query credentials could be either added to the same SNMP config or add a new one under 'Wireless Protection'. I have an AP30 and AP10 in my house that have no discovery feature nor query capability other than ping and DNS.

When querying any of our UTM devices running 9.509-3 for iso.org.dod.internet.mgmt.mib-2.system.sysServices 1.3.6.1.2.1.1.7.0 we receive the error "No Such Instance currently exists at this OID"

This is causing an issue with some network management applications that use the value of sysServices to determine which OSI layers the device supports

At a minimum, the value would need to be "4" to identify the UTM is rulling as a route mode firewall.

Test on device with unmodified snmpd.conf

snmpget -v 3 -l authPriv -u USER -a SHA -A {Password} -x AES -X {Password} X.X.X.X SNMPv2-MIB::sysServices.0
SNMPv2-MIB::sysServices.0 = No Such Instance currently exists at this OID

Test on device with modified snmpd.conf

snmpget -v 3 -l authPriv -u USER -a SHA -A {Password} -x AES -X {Password} Z.Z.Z.Z SNMPv2-MIB::sysServices.0
SNMPv2-MIB::sysServices.0 = INTEGER: 4

http://www.net-snmp.org/docs/mibs/SNMPv2-MIB.txt
sysServices OBJECT-TYPE

SYNTAX      INTEGER (0..127)

MAX-ACCESS  read-only

STATUS      current

DESCRIPTION

        "A value which indicates the set of services that this

        entity may potentially offer.  The value is a sum.


        This sum initially takes the value zero. Then, for

        each layer, L, in the range 1 through 7, that this node

        performs transactions for, 2 raised to (L - 1) is added

        to the sum.  For example, a node which performs only

        routing functions would have a value of 4 (2^(3-1)).

        In contrast, a node which is a host offering application

        services would have a value of 72 (2^(4-1) + 2^(7-1)).

        Note that in the context of the Internet suite of

        protocols, values should be calculated accordingly:

             layer      functionality

               1        physical (e.g., repeaters)

               2        datalink/subnetwork (e.g., bridges)

               3        internet (e.g., supports the IP)

               4        end-to-end  (e.g., supports the TCP)

               7        applications (e.g., supports the SMTP)

        For systems including OSI protocols, layers 5 and 6

        may also be counted."

Hi-- I'm using Zabbix to monitor my environment-- including Sophos UTM where possible.

One thing I don't seem to see is a way to monitor the status of ipsec site-to-site vpns using snmp traps. I can get either a [WARN-726] (a site is down) or a [INFO-726] (a site came up)... but I don't seem to get info on WHICH tunnel.

Since I currently have 35 site-to-site vpns running through this thing "the vpn is down" isn't a very helpful alert.

By contrast, if I have email alerts for the same event turned on, I get something like:

VPN connection '###name of site removed###' [IPsec] using Site-to-Site is up again.