-- These MIBs were created on 08/02/2000
--
-- Copyright (c) 1999 - 2000 by NetScreen Technologies, Inc.
-- All rights reserved.
--
--  Add global-report manager specific trap
--  Last modified date: 09/28/2001
-- 

NETSCREEN-TRAP-MIB DEFINITIONS ::= BEGIN
IMPORTS
    enterprises FROM RFC1155-SMI
    DisplayString FROM RFC1213-MIB
    netscreen, netscreenTrapInfo FROM NETSCREEN-SMI;
    
netscreenTrapType OBJECT-TYPE 
	SYNTAX  INTEGER {
		user-auth-fail(3),    -- User Authentication Fail
		winnuke(4), 		-- Winnuke pak
		syn-attack(5), 	-- Syn attack
		tear-drop(6),		-- tear-drop attack
		ping-death(7), 	-- Ping of Death attack
		ip-spoofing(8),	-- IP spoofing attack
		ip-src-route(9),	-- IP source routing attack
		land(10),		-- land attack
		icmp-flood(11),	-- ICMP flooding attack
		udp-flood(12),	-- UDP flooding attack	
	
		illegal-cms-svr(13),	-- Illegal server IP to connect to CMS port		
		url-block-srv(14),	-- URL blocking server connection alarm
		high-availibility(15),-- HA alarm
	 
		port-scan(16),	-- Port Scan attack
		addr-sweep(17),	-- address sweep attack
		policy-deny(18),	-- Deny by policy attack
				  
		device-dead(19),	-- device not working
		low-memory(20),	-- memory low
				  
		dns-srv-down(21),	-- DNS server unreachable
		generic-HW-fail(22),	-- Fan, Power Supply failure
		lb-srv-down(23),	-- Load balance server unreachable
		log-full(24),		-- log buffer overflow
		x509(25),		-- X509 related	
		vpn-ike(26),		-- VPN and IKE related
		admin(27),		-- admin realted
		sme(28),		-- Illegal src ip to connect to sme port
		dhcp(29),		-- DHCP related 
		cpu-usage-high(30),	-- CPU usage is high
		IP-conflict(31),			-- Interface IP conflict 
		attact-malicious-url(32),	-- Microsoft IIS server vulnerability 
		session-threshold(33),		-- session threshold is exceeded 
		ssh-alarm(34),				-- SSH related alarms 
		vpn-tunnel-up(40),	-- VPN tunnel from down to up	
		vpn-tunnel-down(41),	-- VPN tunnel from up to down	
		vpn-replay-attack(42),		-- VPN replay detected 
		allocated-session-threshold(51),	-- allocated session exceed threshold
		nsrp-rto-up(60),      -- NSRP rto self unit status change from up to down     
		nsrp-rto-down(61),      -- NSRP rto self unit status change from down to up     
		nsrp-trackip-success(62),     -- NSRP track ip successed      
		nsrp-trackip-failed(63),      -- NSRP track ip failed 
		nsrp-trackip-failover(64),    -- NSRP track ip fail over
		nsrp-inconsistent-configuration(65),	-- NSRP inconsistent configuration between master and backup
		nsrp-vsd-init(70),    -- NSRP vsd  group status change to elect
		nsrp-vsd-master(71),  -- NSRP vsd  group status change to master
		nsrp-vsd-pbackup(72), -- NSRP vsd  group status change to primary backup
		nsrp-vsd-backup(73),  -- NSRP vsd  group status change to backup
		nsrp-vsd-ineligible(74),       -- NSRP vsd  group status change to ineligible
		nsrp-vsd-inoperable(75),	-- NSRP VSD group status change to inoperable
		nsrp-vsd-req-hearbeat-2nd(76),	-- NSRP VSD request heartbeat from 2nd HA path 
		nsrp-vsd-reply-2nd(77),		-- NSRP VSD reply to 2nd path request 
		nsrp-rto-duplicated(78),	-- NSRP duplicated RTO group found 
		
		dc-fail-reconnect-mc(79), -- DC fails to re-connect to MC 
		mc-fail-reconnect-db(80), -- MC fails to re-connect to Db 
		dc-fail-init(81), -- DC fails to initialize 
		mc-fail-init(82), -- MC fails to initialize 
		unknown-connect-attempt-dc(83), -- Unknown device trying to connect to a DC 
		dc-reinit(84), -- DC has been reinitialized/restarted (similar meaning as the cold start trap generated by the device)
		mc-reinit(85), -- MC has been restarted
		dc-fail-auth(86), -- DC fails to authenticate to a device
		dc-mc-version-unmatch(87), -- DC / MC are not running the same version
		dc-log-full(88), -- DC's traffic log files are full
		device-connect-dc(89),   -- NetScreen device connected to Global PRO 
		device-disconnect-dc(90),   -- NetScreen device dis-connected from Global PRO 
		
		ids-component(400),			-- block java/active-x component
		ids-icmp-flood(401),		-- icmp flood attack
		ids-udp-flood(402),			-- udp flood attack
		ids-winnuke(403),			-- winnuke attack
		ids-port-scan(404),			-- port scan attack
		ids-addr-sweep(405),		-- address sweep attack
		ids-tear-drop(406),			-- tear drop attack
		ids-syn(407),				-- syn flood attack
		ids-ip-spoofing(408),		-- ip spoofing attack 
		ids-ping-death(409),		-- ping of death attack
		ids-ip-source-route(410),	-- filter ip packet with source route option
		ids-land(411),				-- land attack
		syn-frag-attack(412), -- screen syn fragment attack
		tcp-without-flag(413),  -- screen tcp packet without flag attack
		unknow-ip-packet(414), -- screen unknown ip packet  
		bad-ip-option(415), -- screen	bad ip option
		icmp-fragment(435), -- screen icmp fragment packet
		too-large-icmp(436),-- screen too large icmp packet 
		tcp-syn-fin(437),   -- screen tcp flag syn-fin set
		tcp-fin-no-ack(438),	-- screen tcp fin without ack
		ids-tcp-syn-ack-ack(439),	-- avoid replying to syns after excessive 3 way TCP handshakes from same 
									-- src ip but not proceeding with user auth. (not replying to username/password)..
		ids-ip-block-frag(440),		-- ip fragment
		link-statechange(1000)   -- link state change	              
	}
	ACCESS  not-accessible
	STATUS  mandatory
	DESCRIPTION
		"The integer value of the raised alarm type.
		Note that the type should be interpreted within a specific trap"
	::= { netscreenTrapInfo 1 }

netscreenTrapDesc OBJECT-TYPE 
	SYNTAX  DisplayString (SIZE (0..255))
	ACCESS  not-accessible
	STATUS  mandatory
	DESCRIPTION
		"The textual description of the alarm"
	::= { netscreenTrapInfo 3 }

netscreenTrapHw TRAP-TYPE
	ENTERPRISE netscreen
	VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
	DESCRIPTION
		"This trap indicates that some kind of hardware problem has occured."
	::= 100

netscreenTrapFw TRAP-TYPE
	ENTERPRISE netscreen
	VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
	DESCRIPTION
                "This trap indicates that some kind of firewall functions has been triggered."
             ::= 200

netscreenTrapSw TRAP-TYPE
             ENTERPRISE netscreen
             VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
             DESCRIPTION
                "This trap indicates that some kind of software problem has occured."
             ::= 300

netscreenTrapTrf TRAP-TYPE
             ENTERPRISE netscreen
             VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
             DESCRIPTION
                "This trap indicates that some kind of traffic conditions has been triggered."
             ::= 400

netscreenTrapVpn TRAP-TYPE
             ENTERPRISE netscreen
             VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
             DESCRIPTION
                "This trap indicates that VPN tunnel status has occured."
             ::= 500

netscreenTrapNsrp TRAP-TYPE
             ENTERPRISE netscreen
             VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
             DESCRIPTION
                "This trap indicates that NSRP status has occured."
             ::= 600
	     
netscreenTrapGPRO TRAP-TYPE
             ENTERPRISE netscreen
             VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
             DESCRIPTION
                "This trap indicates that some kind of Global PRO problems has occurred."
             ::= 700

netscreenTrapDrp TRAP-TYPE
             ENTERPRISE netscreen
             VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
             DESCRIPTION
                "This trap indicates that Drp status has occured."
             ::= 800

netscreenTrapIFFailover TRAP-TYPE
             ENTERPRISE netscreen
             VARIABLES  { netscreenTrapType, netscreenTrapDesc  }
             DESCRIPTION
                "This trap indicates that interface fail over status has occured."
             ::= 900
END


