---
type: Device Guide
title: "SNMP Monitoring for Firewalls: Throughput, Sessions & Health"
description: "Monitor firewalls over SNMP — throughput and health via standard MIBs; session counts and HA state via vendor MIBs (Palo Alto, Fortinet, pfSense)."
resource: "https://snmp-monitoring.info/devices/firewall/"
tags: [devices]
timestamp: 2026-07-11T00:00:00Z
---

# SNMP Monitoring for Firewalls: Throughput, Sessions & Health

Monitor firewalls over SNMP — throughput and health via standard MIBs; session counts and HA state via vendor MIBs (Palo Alto, Fortinet, pfSense).

## Related concepts

- Up: [SNMP by Device Type: Servers, Network Gear, UPS & More](/devices/index.md)

## Frequently asked questions

### How do I monitor a firewall with SNMP?

Enable SNMP on the firewall (vendor UI or CLI) with a random read-only community or SNMPv3 user, restricted to your manager's IP. Poll standard MIBs for interface throughput (IF-MIB) and CPU/memory (HOST-RESOURCES where present), and the vendor MIB for firewall-specific metrics like session counts and HA state. Alert on session-table saturation, throughput, HA failover, and CPU.

### What OID is the firewall session count?

It's vendor-specific — there's no standard OID for active sessions. Fortinet exposes it in the FORTINET-FORTIGATE-MIB (1.3.6.1.4.1.12356), Palo Alto under 1.3.6.1.4.1.25461, and pfSense through BSD/UCD-based objects. Load your vendor's MIB and look up the session-count leaf for your platform rather than assuming an OID; the exact object varies by vendor and model.

### Which MIB do Fortinet and Palo Alto use for SNMP?

Fortinet uses the FORTINET-FORTIGATE-MIB under enterprise 1.3.6.1.4.1.12356, and Palo Alto uses its enterprise tree at 1.3.6.1.4.1.25461. Both expose vendor-specific data like sessions, HA state, and throughput there, while interfaces and basic resources come from the standard IF-MIB and HOST-RESOURCES-MIB. Check each vendor's MIB documentation for the specific leaves.

### Can SNMP show firewall HA failover?

Yes, through the vendor MIB. HA (high-availability) state — which unit is active or passive — is exposed as vendor-specific objects, so you can poll it and alert on a change that indicates a failover. It's not in the standard MIBs, so you'll find it in the FORTINET-FORTIGATE-MIB, Palo Alto's MIB, or your platform's equivalent; verify the exact OID against the vendor documentation.

## Source

Concept generated from https://snmp-monitoring.info/devices/firewall/ — the SNMP Monitoring vendor-neutral knowledge base. Content is limited to what that page states (no external claims added here).