SNMP OID to monitor subinterfaces?

[dvas0004]

Hi All

We are currently trying to monitor Layer 3 sub-interface bandwidth via SNMP. I've been checking the enterprise MIBs for palo alto, and there doesnt seem to be any such OID. Does anyone have an idea what OID to use, if even possible, to monitor a subinterface, for example, ethernet1/12.12?

Many Thanks All!

Regards

David Vassallo

[sbrenner · Accepted solution]

It isn't currently possible to collect SNMP stats on a sub-interface. I would open up a feature request with your local Palo Alto Networks SE.

-Scott

[dvas0004]

Thanks for the answer Scott!

[Moorthy]

Is this still not supported?

[ericgearhart]

The real answer to this is to use PA's API to query subinterfaces (and IPSec tunnels work too!)

See this doc and my comments:

Integrating Zabbix and PA subinterfaces via API

[Moorthy]

Ok, thank you. So this says it's still not supported. Can I have the FR ID?

[dh016d]

This is an extreme necro post, but don't care, wanted to share. 
It is now possible to gather sub interface stats via SNMP OID. This was tested with v11.1.

You can SNMP walk the interfaces, and sub interfaces will show

```
snmpwalk -c $SNMP_PUBLIC -v2c 10.200.2.58 1.3.6.1.2.1.31.1.1.1.1
```
Basically for interface ae.9999 you see something like this iso.3.6.1.2.1.31.1.1.1.1.500019999

So 50001 is the prefix for the sub interface. 
Then you can snmpget with these oids

```
name_oid="1.3.6.1.2.1.31.1.1.1.1.500019999"
alias_oid="1.3.6.1.2.1.31.1.1.1.18.500019999"
admin_oid="1.3.6.1.2.1.2.2.1.7.500019999"
oper_oid="1.3.6.1.2.1.2.2.1.8.500019999"
mtu_oid="1.3.6.1.2.1.2.2.1.4.500019999"
speed_oid="1.3.6.1.2.1.31.1.1.1.15.500019999"
in_oct_oid="1.3.6.1.2.1.31.1.1.1.6.500019999"
out_oct_oid="1.3.6.1.2.1.31.1.1.1.10.500019999"
in_ucast_oid="1.3.6.1.2.1.31.1.1.1.7.500019999"
out_ucast_oid="1.3.6.1.2.1.31.1.1.1.11.500019999"
in_disc_oid="1.3.6.1.2.1.2.2.1.13.500019999"
out_disc_oid="1.3.6.1.2.1.2.2.1.19.500019999"
in_err_oid="1.3.6.1.2.1.2.2.1.14.500019999"
out_err_oid="1.3.6.1.2.1.2.2.1.20.500019999"
```

Wanted to share because this is the only post I saw about this and times have changed... over 10 years later 🙂