Interface counters may return incorrect value via SNMP while using 32 bit OIDs
16231
Created On 01/26/21 16:33 PM - Last Modified 06/08/23 08:57 AM
Symptom
If SNMP monitoring tools were configured to collect interface counters from PANx devices using 32-bit OIDs, the readings may return incorrect values if the firewalls are with PanOS version 8.1.0 or later.
Environment
- Firewall PAN-OS version 8.1 or later
Cause
Starting with PanOS 8.1.0, some improvements have been made related to interface counters. We are now using 64-bit counters instead of 32-bit counters and we use IETF's MIBs with 64-bit OIDs to monitor them via SNMP.
Resolution
64-bit IETF OIDs should be used to monitor interface counters. For instance, the OID 1.3.6.1.2.1.31.1.1.1.10 should be used instead of 1.3.6.1.2.1.2.2.1.16 to get 64-bit value for "ifOutOctets".
Necessary info about SNMP MIBs can be found on the link below:
https://docs.paloaltonetworks.com/resources/snmp-mib-files
Additional Information
Related IETF RFC can be found on the link below.
https://tools.ietf.org/html/rfc2863