A3COM-HUAWEI-IPSEC-MONITOR-MIB

All MIBs › A3COM-HUAWEI-IPSEC-MONITOR-MIB

Organization: Huawei-3COM Technologies Co., Ltd.

Last Updated: 2004-10-26

Category: VPN and Security, Vendor: H3C/HH3C

Description: Tracks IPsec security associations along with tunnel statistics and encryption/authentication parameters on H3C equipment.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is A3COM-HUAWEI-IPSEC-MONITOR-MIB?

A3COM-HUAWEI-IPSEC-MONITOR-MIB is an H3C/3Com private MIB dedicated to monitoring IPsec VPN tunnels, providing statistics for either a specific tunnel or all tunnels configured on a device. No sample runtime objects were available for this module, but its module description confirms it is a statistics/monitoring-focused MIB rather than a configuration MIB, so it primarily exposes per-tunnel packet, byte, and status counters plus security-association parameters. Its central monitoring use is software/service status: verifying that IPsec tunnels remain established and are actively passing encrypted traffic, and identifying tunnels that have failed negotiation or gone idle. It logically depends on the device's underlying IPsec/IKE configuration objects (typically in a companion IPsec configuration MIB) since this module only covers the monitoring/statistics side. It is deployed on H3C/3Com routers and security gateways terminating site-to-site or remote-access IPsec VPNs. Engineers can download the A3COM-HUAWEI-IPSEC-MONITOR-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in A3COM-HUAWEI-IPSEC-MONITOR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C/3Com routers and VPN security gateways

Monitoring Examples

No sample objects were provided for this module; in general, this type of MIB would be polled to retrieve per-tunnel encrypted/decrypted packet and byte counters and current SA/tunnel status, which would reveal a tunnel that has dropped from an established to a down state or one passing zero traffic despite being marked up.

What Can Be Monitored

IPsec tunnel operational status
per-tunnel encrypted/decrypted packet counters
per-tunnel byte counters
security association state

Imported Objects

From A3COM-HUAWEI-OID-MIB

h3cCommon

OBJECT-IDENTITY

From RFC1213-MIB

ifIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using h3cIPSecGlobalInOctets OID:

Select an H3C/3Com VPN gateway as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type h3cIPSecGlobalInOctets into the Find box to locate it in the OID tree, then select it and click OK. The total number of octets received by all current and previous IPSec Phase-2 Tunnels. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
NTF h3cIPSecAuthFailFailure	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.4			This notification is generated when the IPSec phase-2 authentication failure occurs.
H3C h3cIPSecAuthFailureTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.5	H3cTrapStatus	read-write	Indicates whether h3cIPSecAuthFailFailure traps should be generated.
h3cIPSecCompliance	1.3.6.1.4.1.43.45.1.10.2.7.2.1.1
h3cIPSecCompliances	1.3.6.1.4.1.43.45.1.10.2.7.2.1
h3cIPSecConformance	1.3.6.1.4.1.43.45.1.10.2.7.2
NTF h3cIPSecDecryFailFailure	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.6			This notification is generated when the IPSec phase-2 tunnel has a decrypting failure.
H3C h3cIPSecDecryFailureTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.7	H3cTrapStatus	read-write	Indicates whether h3cIPSecDecryFailFailure traps should be generated.
NTF h3cIPSecEncryFailFailure	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.5			This notification is generated when the IPSec phase-2 tunnel has an encrypting failure.
H3C h3cIPSecEncryFailureTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.6	H3cTrapStatus	read-write	Indicates whether h3cIPSecEncryFailFailure traps should be generated.
G32 h3cIPSecGlobalActiveSas	1.3.6.1.4.1.43.45.1.10.2.7.1.5.2	Gauge32	read-only	The total number of currently active or expiring IPSec Phase-2 SA.
G32 h3cIPSecGlobalActiveTunnels	1.3.6.1.4.1.43.45.1.10.2.7.1.5.1	Gauge32	read-only	The total number of currently active IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInAuthFails	1.3.6.1.4.1.43.45.1.10.2.7.1.5.8	Counter32	read-only	The total number of inbound authentication's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalInDecompOctets	1.3.6.1.4.1.43.45.1.10.2.7.1.5.4	Counter64	read-only	The total number of decompressed octets received by all current and previous IPSec Phase-2 Tunnels. This value is accumulated AFTER the packet is decompressed.
C32 h3cIPSecGlobalInDecryptFails	1.3.6.1.4.1.43.45.1.10.2.7.1.5.9	Counter32	read-only	The total number of inbound decryption's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalInDrops	1.3.6.1.4.1.43.45.1.10.2.7.1.5.6	Counter64	read-only	The total number of packets dropped during receiving process by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalInOctetsEx	1.3.6.1.4.1.43.45.1.10.2.7.1.5.3	Counter64	read-only	The total number of octets received by all current and previous IPSec Phase-2 Tunnels. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 h3cIPSecGlobalInPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.5	Counter64	read-only	The total number of packets received by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInReplayDrops	1.3.6.1.4.1.43.45.1.10.2.7.1.5.7	Counter32	read-only	The total number of packets dropped during receiving process due to Anti-Replay process by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInvalidLenDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.18	Counter32	read-only	The total number of packets dropped due to invalid packet length by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInvalidSaDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.20	Counter32	read-only	The total number of packets dropped due to invalid SA by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalNoFindSaDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.16	Counter32	read-only	The total number of packets dropped due to not find SA by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalNoMemoryDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.15	Counter32	read-only	The total number of packets dropped due to no enough memory by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalOutDrops	1.3.6.1.4.1.43.45.1.10.2.7.1.5.13	Counter64	read-only	The total number of packets dropped during sending process by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalOutEncryptFails	1.3.6.1.4.1.43.45.1.10.2.7.1.5.14	Counter32	read-only	The total number of outbound encryption's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalOutOctets	1.3.6.1.4.1.43.45.1.10.2.7.1.5.10	Counter64	read-only	The total number of octets sent by all current and previous IPSec Phase-2 Tunnels. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 h3cIPSecGlobalOutPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.12	Counter64	read-only	The total number of packets sent by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalOutUncompOctets	1.3.6.1.4.1.43.45.1.10.2.7.1.5.11	Counter64	read-only	The total number of uncompressed octets sent by all current and previous IPSec Phase-2 Tunnels. This value is accumulated BEFORE the packet is compressed.
C32 h3cIPSecGlobalQueueFullDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.17	Counter32	read-only	The total number of packets dropped due to queue full by all current and previous IPSec Phase-2 Tunnels.
h3cIPSecGlobalStats	1.3.6.1.4.1.43.45.1.10.2.7.1.5
h3cIPSecGlobalStatsGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.5			The group contains all of the IPSec tunnel's statistic information.
C32 h3cIPSecGlobalTooLongDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.5.19	Counter32	read-only	The total number of packets dropped due to too long packet by all current and previous IPSec Phase-2 Tunnels.
h3cIPSecGroups	1.3.6.1.4.1.43.45.1.10.2.7.2.2
NTF h3cIPSecInvalidSaFailure	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.7			This notification is generated when the IPSec phase-2 invalid SA failure occurs.
H3C h3cIPSecInvalidSaTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.8	H3cTrapStatus	read-write	Indicates whether h3cIPSec Invalid Sa Failure traps should be generated.
h3cIPSecMonitor	1.3.6.1.4.1.43.45.1.10.2.7			The MIB is designed to get statistic information of IPSec tunnels. With this MIB, we can get information of a certain tunnel or all tunnels.
NTF h3cIPSecNoSaFailure	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.3			This notification is generated when an IPSec Phase-2 non-existent SA error occurs.
H3C h3cIPSecNoSaTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.4	H3cTrapStatus	read-write	Indicates whether h3cIPSecNoSaFailure traps should be generated.
h3cIPSecNotifications	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1
h3cIPSecObjects	1.3.6.1.4.1.43.45.1.10.2.7.1
NTF h3cIPSecPolicyAdd	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.8			This notification is generated when an IPSec policy is added.
H3C h3cIPSecPolicyAddTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.9	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyAdd traps should be generated.
NTF h3cIPSecPolicyAttach	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.10			This notification is generated when an IPSec policy is attached with one interface.
H3C h3cIPSecPolicyAttachTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.11	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyAttach traps should be generated.
NTF h3cIPSecPolicyDel	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.9			This notification is generated when an IPSec policy is deleted.
H3C h3cIPSecPolicyDelTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.10	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyDel traps should be generated.
NTF h3cIPSecPolicyDetach	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.11			This notification is generated when an IPSec policy is detached with one interface.
H3C h3cIPSecPolicyDetachTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.12	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyDetach traps should be generated.
STR h3cIPSecPolicyName	1.3.6.1.4.1.43.45.1.10.2.7.1.6.1	DisplayString	accessible-for-notify	The IPSec policy name with a trap.
I32 h3cIPSecPolicySeqNum	1.3.6.1.4.1.43.45.1.10.2.7.1.6.2	Integer32	accessible-for-notify	The IPSec policy sequence number with a trap.
I32 h3cIPSecPolicySize	1.3.6.1.4.1.43.45.1.10.2.7.1.6.3	Integer32	accessible-for-notify	The number of IPSec policies with a trap.
H3C h3cIPSecSaAuthAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1.6	H3cAuthAlgo	read-only	The authentication algorithm used by the SA.
INT h3cIPSecSaDirection	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1.2	INTEGER	read-only	The direction of the SA.
H3C h3cIPSecSaEncryptAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1.5	H3cEncryptAlgo	read-only	The encryption algorithm used by the security association of the IPSec Phase-2 Tunnel.
h3cIPSecSaEntry	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1		not-accessible	Information about h3cIPSecSaTable.
h3cIPSecSaGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.3			The group contains the SA's property information.
I32 h3cIPSecSaIndex	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1.1	Integer32	not-accessible	The number of the Sa associated with the Phase-2 Tunnel Table. The value of this index is a number which begins at one and is incremented with each Sa associated with an IPSec Phase-2 Tunnel. The value of this object will wrap at 2,147,483,647.
H3C h3cIPSecSaProtocol	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1.4	H3cSaProtocol	read-only	The security protocol of the SA.
INT h3cIPSecSaStatus	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1.7	INTEGER	read-only	The status of the SA.
h3cIPSecSaTable	1.3.6.1.4.1.43.45.1.10.2.7.1.3		not-accessible	The IPSec Phase-2 Security Protection Index Table. This table contains an entry for each active and expiring security association.
U32 h3cIPSecSaValue	1.3.6.1.4.1.43.45.1.10.2.7.1.3.1.3	Unsigned32	read-only	The value of the SPI.
I32 h3cIPSecSpiValue	1.3.6.1.4.1.43.45.1.10.2.7.1.6.4	Integer32	accessible-for-notify	The SPI value associated with a trap.
h3cIPSecTrafficEntry	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1		not-accessible	Information about h3cIPSecTrafficTable.
IP h3cIPSecTrafficLocalAddr1	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.2	IpAddress	read-only	The first specification of local peer's IP address. If the local peer type is single IP address, then this is the value of the IP address. If the local peer type is IP subnet, then this is the value of the subnet. If the local peer type is IP address range, then this is the value of beginning IP address of the range.
IP h3cIPSecTrafficLocalAddr2	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.3	IpAddress	read-only	The second specification of local peer's IP address. If the local peer type is single IP address, then this is the value of the IP address. If the local peer type is IP subnet, then this is the value of the subnet mask. If the local peer type is IP address range, then this is the value of ending IP address of the range.
I32 h3cIPSecTrafficLocalPort	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.5	Integer32	read-only	The port number of the local peer's traffic.
I32 h3cIPSecTrafficLocalProtocol	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.4	Integer32	read-only	The protocol number of the local peer's traffic.
H3C h3cIPSecTrafficLocalType	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.1	H3cTrafficType	read-only	The type of local peer. Possible values are: a single IP address, or an IP address range, or an IP subnet.
IP h3cIPSecTrafficRemoteAddr1	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.7	IpAddress	read-only	The first specification of remote peer's IP address. If the remote peer type is single IP address, then this is the value of the IP address. If the remote peer type is IP subnet, then this is the value of the subnet. If the remote peer type is IP address range, then this is the value of beginning IP address of the range.
IP h3cIPSecTrafficRemoteAddr2	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.8	IpAddress	read-only	Single IP address, then this is the value of the IP address. If the remote peer type is IP subnet, then this is the value of the subnet mask. If the remote peer type is IP address range, then this is the value of ending IP address of the range.
I32 h3cIPSecTrafficRemotePort	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.10	Integer32	read-only	The port number of the remote peer's traffic.
I32 h3cIPSecTrafficRemoteProtocol	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.9	Integer32	read-only	The protocol number of the remote peer's traffic.
H3C h3cIPSecTrafficRemoteType	1.3.6.1.4.1.43.45.1.10.2.7.1.4.1.6	H3cTrafficType	read-only	The type of remote peer. Possible values are: a single IP address, or an IP address range, or an IP subnet.
h3cIPSecTrafficTable	1.3.6.1.4.1.43.45.1.10.2.7.1.4		not-accessible	The IPSec Phase-2 Tunnel Traffic Table.
h3cIPSecTrafficTableGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.4			The group contains the property information of the data flow protected by IPSec tunnel.
h3cIPSecTrap	1.3.6.1.4.1.43.45.1.10.2.7.1.8
h3cIPSecTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7
h3cIPSecTrapCntlGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.7			The group contains all of trap switches of IPSec tunnels.
H3C h3cIPSecTrapGlobalCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.1	H3cTrapStatus	read-write	Indicates whether all IPSec traps should be generated.
h3cIPSecTrapGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.8			The group contains all of trap of IPSec tunnels.
h3cIPSecTrapObject	1.3.6.1.4.1.43.45.1.10.2.7.1.6
h3cIPSecTrapObjectGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.6			The group contains all of trap objects of IPSec tunnels.
I32 h3cIPSecTunActiveTime	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.13	Integer32	read-only	The duration the IPSec Phase-2 Tunnel has been active in hundredths of seconds. 2147483647 is defined as invalid value.
G32 h3cIPSecTunCurrentSaInstances	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.16	Gauge32	read-only	The number of security associations which are currently active or expiring.
H3C h3cIPSecTunDiffHellmanGrp	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.20	H3cDiffHellmanGrp	read-only	The Diffie Hellman Group used by the security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunEncapMode	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.8	H3cEncapMode	read-only	The encapsulation mode used by the IPSec Phase-2 Tunnel.
I32 h3cIPSecTunEntryIndex	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.2	Integer32	not-accessible	The index of IPSec policy applied in the interface.
I32 h3cIPSecTunIfIndex	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.1	Integer32	not-accessible	The interface index( the ifIndex of ifTable ).
I32 h3cIPSecTunIKETunnelIndex	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.4	Integer32	read-only	The index of the associated IPSec Phase-1 IKE Tunnel (IKETunIndex in the IKETunnelTable). 2147483647 is defined as invalid value.
C32 h3cIPSecTunInAuthFails	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.6	Counter32	read-only	The total number of inbound authentication's which ended in failure by this IPSec Phase-2 Tunnel.
C64 h3cIPSecTunInDecompOctets	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.2	Counter64	read-only	The total number of decompressed octets received by this IPSec Phase-2 Tunnel. This value is accumulated AFTER the packet is decompressed.
C32 h3cIPSecTunInDecryptFails	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.7	Counter32	read-only	The total number of inbound decryption's which ended in failure by this IPSec Phase-2 Tunnel.
I32 h3cIPSecTunIndex	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.3	Integer32	not-accessible	The index of IPSec Phase-2 Tunnel Table. The value of the index is a number which begins at one and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647.
C64 h3cIPSecTunInDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.4	Counter64	read-only	The total number of packets dropped during receiving process by this IPSec Phase-2 Tunnel.
INT h3cIPSecTunInitiator	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.9	INTEGER	read-only	The initiator of this IPSec tunnel. Value none is used for manual IPsec tunnel, for there is no initiator or responder in this method.
C64 h3cIPSecTunInOctets	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.1	Counter64	read-only	The total number of octets received by this IPSec Phase-2 Tunnel. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 h3cIPSecTunInPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.3	Counter64	read-only	The total number of packets received by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInReplayDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.5	Counter32	read-only	The total number of packets dropped during receiving process due to Anti-Replay process by this IPSec Phase-2 Tunnel.
H3C h3cIPSecTunInSaAhAuthAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.18	H3cAuthAlgo	read-only	The authentication algorithm used by the inbound authentication header (AH) security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunInSaEncryptAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.17	H3cEncryptAlgo	read-only	The encryption algorithm used by the inbound security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunInSaEspAuthAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.19	H3cAuthAlgo	read-only	The authentication algorithm used by the inbound encapsulation security protocol(ESP) security association of the IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInvalidLenDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.15	Counter32	read-only	The total number of packets dropped due to invalid length packet by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInvalidSaDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.17	Counter32	read-only	The total number of packets dropped due to invalid SA by this IPSec Phase-2 Tunnel.
H3C h3cIPSecTunKeyType	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.7	H3cIPSecNegoType	read-only	The key negotiate mode used by the IPSec Phase-2 Tunnel.
G32 h3cIPSecTunLifeSize	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.10	Gauge32	read-only	The negotiated LifeSize of the IPSec Phase-2 Tunnel in kilobytes. 0 is defined as invalid value.
I32 h3cIPSecTunLifeTime	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.11	Integer32	read-only	The negotiated LifeTime of the IPSec Phase-2 Tunnel in seconds. 2147483647 is defined as invalid value.
IP h3cIPSecTunLocalAddr	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.5	IpAddress	read-only	The IP address of the local peer for the IPSec Phase-2 Tunnel. 0.0.0.0 is defined as invalid value.
h3cIPSecTunnelEntry	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1		not-accessible	Information about h3cIPSecTunnelTable.
NTF h3cIPSecTunnelStart	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.1			This notification is generated when an IPSec Phase-2 Tunnel is created.
H3C h3cIPSecTunnelStartTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.2	H3cTrapStatus	read-write	Indicates whether h3cIPSecTunnelStart traps should be generated.
h3cIPSecTunnelStatEntry	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1		not-accessible	Information about h3cIPSecTunnelStatTable.
h3cIPSecTunnelStatGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.2			The group contains the IPSec tunnel's statistic information.
h3cIPSecTunnelStatTable	1.3.6.1.4.1.43.45.1.10.2.7.1.2		not-accessible	The IPSec Phase-2 Tunnel Statistics Table.
NTF h3cIPSecTunnelStop	1.3.6.1.4.1.43.45.1.10.2.7.1.8.1.2			This notification is generated when an IPSec Phase-2 Tunnel is deleted.
H3C h3cIPSecTunnelStopTrapCntl	1.3.6.1.4.1.43.45.1.10.2.7.1.7.3	H3cTrapStatus	read-write	Indicates whether h3cIPSecTunnelStop traps should be generated.
h3cIPSecTunnelTable	1.3.6.1.4.1.43.45.1.10.2.7.1.1		not-accessible	The IPSec Phase-2 Tunnel Table. There is one entry in this table for each active IPSec Phase-2 Tunnel.
h3cIPSecTunnelTableGroup	1.3.6.1.4.1.43.45.1.10.2.7.2.2.1			The group contains the IPSec tunnel's property information.
C32 h3cIPSecTunNoMemoryDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.13	Counter32	read-only	The total number of packets dropped due to no enough memory by this IPSec Phase-2 Tunnel.
C64 h3cIPSecTunOutDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.11	Counter64	read-only	The total number of packets dropped during sending process by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunOutEncryptFails	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.12	Counter32	read-only	The total number of outbound encryption's which ended in failure by this IPSec Phase-2 Tunnel.
C64 h3cIPSecTunOutOctets	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.8	Counter64	read-only	The total number of octets sent by this IPSec Phase-2 Tunnel. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 h3cIPSecTunOutPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.10	Counter64	read-only	The total number of packets sent by this IPSec Phase-2 Tunnel.
H3C h3cIPSecTunOutSaAhAuthAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.22	H3cAuthAlgo	read-only	The authentication algorithm used by the outbound authentication header (AH) security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunOutSaEncryptAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.21	H3cEncryptAlgo	read-only	The encryption algorithm used by the outbound security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunOutSaEspAuthAlgo	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.23	H3cAuthAlgo	read-only	The authentication algorithm used by the outbound encapsulation security protocol(ESP) security association of the IPSec Phase-2 Tunnel.
C64 h3cIPSecTunOutUncompOctets	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.9	Counter64	read-only	The total number of uncompressed octets sent by this IPSec Phase-2 Tunnel.This value is accumulated BEFORE the packet is compressed.
STR h3cIPSecTunPolicyName	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.24	DisplayString	read-only	The policy name used by this IPSec tunnel.
I32 h3cIPSecTunPolicyNum	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.25	Integer32	read-only	The sequence number of policy used by this IPSec tunnel.
C32 h3cIPSecTunQueueFullDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.14	Counter32	read-only	The total number of packets dropped due to queue full by this IPSec Phase-2 Tunnel.
G32 h3cIPSecTunRemainSize	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.14	Gauge32	read-only	The remain LifeSize of SA in kilobytes. 0 is defined as invalid value.
I32 h3cIPSecTunRemainTime	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.12	Integer32	read-only	The remain time of SA in seconds. 2147483647 is defined as invalid value.
IP h3cIPSecTunRemoteAddr	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.6	IpAddress	read-only	The IP address of the remote peer for the IPSec Phase-2 Tunnel. 0.0.0.0 is defined as invalid value.
INT h3cIPSecTunStatus	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.26	INTEGER	read-only	The status of the IPSec Tunnel.
C32 h3cIPSecTunTooLongDropPkts	1.3.6.1.4.1.43.45.1.10.2.7.1.2.1.16	Counter32	read-only	The total number of packets dropped due to too long packet by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunTotalRefreshes	1.3.6.1.4.1.43.45.1.10.2.7.1.1.1.15	Counter32	read-only	The total number of security association refreshing performed.

RFC description

Monitors IPsec security associations, tunnel statistics, and encryption/authentication parameters on H3C devices.

Start monitoring H3C/3Com VPN gateways with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download A3COM-HUAWEI-IPSEC-MONITOR-MIB