A3COM-HUAWEI-NDEC-MIB

All MIBs › A3COM-HUAWEI-NDEC-MIB

Organization: HUAWEI Technologies Co., Ltd.

Last Updated: 2004-09-15

Category: VPN and Security, Vendor: H3C/HH3C

Description: Manages network data encryption on H3C/3Com devices, providing configuration and status for encrypted communication sessions and encryption policy application.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is A3COM-HUAWEI-NDEC-MIB?

A3COM-HUAWEI-NDEC-MIB is a joint H3C/3Com (Huawei-3Com, "A3COM") enterprise MIB that manages Network Data Encryption (NDEC) hardware/software modules used to encrypt communication sessions on H3C/3Com routing and security platforms. It exposes a security-association table describing encrypted session parameters -- peer and local IP addresses, protocol, SPI, encryption and authentication algorithms, and SA lifetime in kilobytes or seconds -- along with card-level association (hipsByCard) and negotiation-mode settings. Administrators use it to monitor the software/hardware state of the encryption engine -- verifying active security associations, confirming which encryption card is handling a given SA, checking whether SA lifetimes are approaching expiry, and receiving traps (hipsTraps) on encryption-related events -- which reveals whether encrypted tunnels are healthy or about to renegotiate/expire. It is a self-contained vendor security MIB but is conceptually related to standard IPsec/IKE constructs (SPI, SA lifetime) defined in IETF security standards. It is typically deployed on H3C/3Com routers or security appliances providing hardware-accelerated network data encryption. Network engineers evaluating or troubleshooting this functionality can download the A3COM-HUAWEI-NDEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in A3COM-HUAWEI-NDEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C/3Com router or security appliance with NDEC encryption card

Monitoring Examples

An operator would walk hipsNDECSAListTable/hipsNDECSAListEntry to see active security associations, checking hipsPeerIpAddr, hipsLocalIpAddr, and hipsSPI to identify a specific encrypted session, and hipsEncAlgorithm/hipsAuthAlgorithm to confirm the negotiated algorithms match policy. Monitoring hipsSaLifeKBytes and hipsSaLifeSecond together shows how close an SA is to expiring by volume or time, which would explain an imminent renegotiation. If hipsByCard shows an SA pinned to a specific encryption card, an admin could correlate encryption throughput issues with that card, and hipsTraps would flag encryption failures or negotiation errors as they occur.

What Can Be Monitored

active security association details (peer/local IP, SPI)
encryption/authentication algorithm in use
SA lifetime (KB/seconds) remaining
encryption card assignment
NDEC fault/event traps

Imported Objects

From A3COM-HUAWEI-OID-MIB

mlsr	OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TruthValue

How to Use in IPNetwork Monitor

Example using hipsInPac OID:

Select an H3C/3Com security routers/appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hipsInPac into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the total packets of the NDEC recieved. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
T/F hikeClearSA	1.3.6.1.4.1.43.45.1.2.33.2.2.1.6	TruthValue	read-write	Clear this IKE SA or not.
I32 hikeConnId	1.3.6.1.4.1.43.45.1.2.33.2.2.1.1	Integer32	read-only	The identifier of IKE SA connection.
INT hikeDoi	1.3.6.1.4.1.43.45.1.2.33.2.2.1.5	INTEGER	read-only	The domain of this IKE SA
STR hikeFlag	1.3.6.1.4.1.43.45.1.2.33.2.2.1.3	DisplayString	read-only	The status of this IKE SA.
IP hikePeerIpAddr	1.3.6.1.4.1.43.45.1.2.33.2.2.1.2	IpAddress	read-only	The peer IP address of this IKE SA.
INT hikePhase	1.3.6.1.4.1.43.45.1.2.33.2.2.1.4	INTEGER	read-only	The phase of this IKE SA.
hikeSAEntry	1.3.6.1.4.1.43.45.1.2.33.2.2.1		not-accessible	Each entry contains the attributes associated with a single IKE SA entity.
hikeSATable	1.3.6.1.4.1.43.45.1.2.33.2.2		not-accessible	The table containing IKE SA entities configured on NDEC by the operator.
INT hipsAH	1.3.6.1.4.1.43.45.1.2.33.2.5.1.4	INTEGER	read-only	Algorithm of AH protocol.
INT hipsAuthAlgorithm	1.3.6.1.4.1.43.45.1.2.33.2.1.1.5	INTEGER	read-only	The authentication algorithm of this SA entry.
T/F hipsByCard	1.3.6.1.4.1.43.45.1.2.33.2.1.1.9	TruthValue	read-only	The flag of this SA on NDEC or not.
STR hipsCardCPLDVer	1.3.6.1.4.1.43.45.1.2.33.2.6.1.10	DisplayString	read-only	CPLD version of the NDEC.
STR hipsCardHardVer	1.3.6.1.4.1.43.45.1.2.33.2.6.1.8	DisplayString	read-only	Hardware version of the NDEC.
INT hipsCardOperate	1.3.6.1.4.1.43.45.1.2.33.2.6.1.11	INTEGER	read-write	The version of the NDEC's CPLD. cardClearStatic(1): clear the statistics of the card cardReset(2): rest the card cardSynTime(3): synchoronize the clock of the card cardSysLogOn(4):turn on the log of the card cardSysLogOff(5):turn off the log of the card cardSysLogClear(6):clear the log of the card
INT hipsCardSlot	1.3.6.1.4.1.43.45.1.2.33.2.6.1.1	INTEGER	read-only	Slot number of NDEC .
STR hipsCardSoftVer	1.3.6.1.4.1.43.45.1.2.33.2.6.1.9	DisplayString	read-only	Software version of the NDEC.
INT hipsCardStatus	1.3.6.1.4.1.43.45.1.2.33.2.6.1.7	INTEGER	read-only	State of the NDEC.
C32 hipsDropPac	1.3.6.1.4.1.43.45.1.2.33.2.6.1.6	Counter32	read-only	Total packets of the NDEC dropped .
G32 hipsDropPacInUnitTime	1.3.6.1.4.1.43.45.1.2.33.2.6.1.12	Gauge32	read-only	Dropped packets in unit interval.
INT hipsEespEn	1.3.6.1.4.1.43.45.1.2.33.2.5.1.5	INTEGER	read-only	Encryption algorithm of ESP protocol.
INT hipsEncAlgorithm	1.3.6.1.4.1.43.45.1.2.33.2.1.1.4	INTEGER	read-only	The encrypt algorithm of this SA entry.
INT hipsEspAu	1.3.6.1.4.1.43.45.1.2.33.2.5.1.6	INTEGER	read-only	Authentication algorithm of ESP protocol.
G32 hipsExpBytes	1.3.6.1.4.1.43.45.1.2.33.2.1.1.11	Gauge32	read-only	This object specifies the lifetime in bytes of the tunnels generated using this policy specification.
G32 hipsExpTimeout	1.3.6.1.4.1.43.45.1.2.33.2.1.1.13	Gauge32	read-only	This object specifies the lifetime in seconds of the tunnels generated using this policy specification.
STR hipsIfNameUsed	1.3.6.1.4.1.43.45.1.2.33.2.4.1.10	DisplayString	read-only	This object indicates the name of the interface which uses this IPSec policy entry.
hipsIKEPolicyEntry	1.3.6.1.4.1.43.45.1.2.33.2.3.1		not-accessible	Each entry includes the properties of a ISAKMP Policy entry.
hipsIKEPolicyTable	1.3.6.1.4.1.43.45.1.2.33.2.3		not-accessible	List of all ISAKMP policy entries.
STR hipsInAhHexKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.15	DisplayString	read-only	This object indicates the inbound AH authentication key IPSec SAs generated using this IPSec policy entry. The AH authentication key is in hex.
G32 hipsInAHSPI	1.3.6.1.4.1.43.45.1.2.33.2.4.1.11	Gauge32	read-only	This object indicates the inbound AH SPI IPSec SAs generated using this IPSec policy entry.
STR hipsInAhStringKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.18	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hipsInByte	1.3.6.1.4.1.43.45.1.2.33.2.6.1.4	Counter32	read-only	Total bytes of the NDEC sent.
STR hipsInEspAuthenHexKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.17	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The ESP authentication key is hex.
STR hipsInEspCipherHexKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.16	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The ESP authentication key is hex.
G32 hipsInESPSPI	1.3.6.1.4.1.43.45.1.2.33.2.4.1.12	Gauge32	read-only	This object indicates the inbound ESP SPI IPSec SAs generated using this IPSec policy entry.
STR hipsInEspStringKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.19	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hipsInPacEx	1.3.6.1.4.1.43.45.1.2.33.2.6.1.2	Counter32	read-only	Total packets of the NDEC recieved.
INT hipsIsakmpPolAuth	1.3.6.1.4.1.43.45.1.2.33.2.3.1.4	INTEGER	read-only	The specified peer authentication method. The local entity would authenticate the peer using the method specified by this object when this policy entity is selected to negotiate with a peer.
INT hipsIsakmpPolEncr	1.3.6.1.4.1.43.45.1.2.33.2.3.1.2	INTEGER	read-only	The specified encryption transform. It is used by Internet Key Exchange(IKE) tunnels to protect the ISAKMP PDUs.
INT hipsIsakmpPolGroup	1.3.6.1.4.1.43.45.1.2.33.2.3.1.5	INTEGER	read-only	This object is used to specify the Oakley group which is used for Diffie Hellman exchange in the Main Mode. The local entity selects the group specified by this object to perform Diffie Hellman exchange with the peer when this policy item is chosen to negotiate the Main Mode with an IKE peer.
INT hipsIsakmpPolHash	1.3.6.1.4.1.43.45.1.2.33.2.3.1.3	INTEGER	read-only	The specified hash transform. It is used by Internet Key Exchange(IKE) tunnels to protect the ISAKMP PDUs.
G32 hipsIsakmpPolLifetime	1.3.6.1.4.1.43.45.1.2.33.2.3.1.6	Gauge32	read-only	This object indicates the lifetime of the IKE tunnels in seconds.
I32 hipsIsakmpPolPriority	1.3.6.1.4.1.43.45.1.2.33.2.3.1.1	Integer32	read-only	ISAKMP Policy entry's priority.
T/F hipsIsCardTransform	1.3.6.1.4.1.43.45.1.2.33.2.5.1.7	TruthValue	read-only	This object indicates the flag of the NDEC is used for IPSec SAs generated using this IPSec policy entry.
IP hipsLocalIpAddr	1.3.6.1.4.1.43.45.1.2.33.2.1.1.6	IpAddress	read-only	The local IP address of this SA entry.
INT hipsNDECBackup	1.3.6.1.4.1.43.45.1.2.33.2.7.2	INTEGER	read-write	The flag that NDEC using backup. The value 1 represents using backup The value 0 represents not using backup
INT hipsNDECConnections	1.3.6.1.4.1.43.45.1.2.33.2.7.1	INTEGER	read-only	Total connections of the system at this time.
NTF hipsNDECFlowTrap	1.3.6.1.4.1.43.45.1.2.33.2.8.3			This trap is generated when a NDEC card is overloaded.
hipsNDECInfoEntry	1.3.6.1.4.1.43.45.1.2.33.2.6.1		not-accessible	Properties of each NDEC.
hipsNDECInfoTable	1.3.6.1.4.1.43.45.1.2.33.2.6		not-accessible	Table of NDEC set.
hipsNDECLeaf	1.3.6.1.4.1.43.45.1.2.33.2.7
NTF hipsNDECNormalResetTrap	1.3.6.1.4.1.43.45.1.2.33.2.8.1			This trap is generated when the NDEC card is reset.
hipsNDECSAListEntry	1.3.6.1.4.1.43.45.1.2.33.2.1.1		not-accessible	Each entry contains the attributes associated with a single NDEC'S SA entry.
hipsNDECSAListTable	1.3.6.1.4.1.43.45.1.2.33.2.1		not-accessible	The table containing the list of all SA entries configured on NDEC by the operator.
NTF hipsNDECStateChangeTrap	1.3.6.1.4.1.43.45.1.2.33.2.8.2			This trap is generated when the NDEC card's state changes.
INT hipsNegotiateSaMode	1.3.6.1.4.1.43.45.1.2.33.2.1.1.10	INTEGER	read-only	The type of key used by the IPSec Phase-2 Tunnel.
STR hipsOutAhHexKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.20	DisplayString	read-only	This object indicates the outbound AH authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
G32 hipsOutAHSPI	1.3.6.1.4.1.43.45.1.2.33.2.4.1.13	Gauge32	read-only	This object indicates the outbound AH SPI IPSec SAs generated using this IPSec policy entry.
STR hipsOutAhStringKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.23	DisplayString	read-only	This object indicates the outbound AH authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hipsOutByte	1.3.6.1.4.1.43.45.1.2.33.2.6.1.5	Counter32	read-only	Total bytes of the NDEC sent.
STR hipsOutEspAuthenHexKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.22	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
STR hipsOutEspCipherHexKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.21	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
G32 hipsOutESPSPI	1.3.6.1.4.1.43.45.1.2.33.2.4.1.14	Gauge32	read-only	This object indicates the outbound ESP SPI IPSec SAs generated using this IPSec policy entry.
STR hipsOutEspStringKeyString	1.3.6.1.4.1.43.45.1.2.33.2.4.1.24	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hipsOutPac	1.3.6.1.4.1.43.45.1.2.33.2.6.1.3	Counter32	read-only	Total packets of the NDEC sent.
IP hipsPeerIpAddr	1.3.6.1.4.1.43.45.1.2.33.2.1.1.1	IpAddress	read-only	The peer IP address of this SA entry.
INT hipsProtocol	1.3.6.1.4.1.43.45.1.2.33.2.1.1.2	INTEGER	read-only	The Protocol of this SA entry.
G32 hipsSaLifeKBytes	1.3.6.1.4.1.43.45.1.2.33.2.1.1.7	Gauge32	read-only	The lifetime of this SA entry in bytes.
G32 hipsSaLifeSecond	1.3.6.1.4.1.43.45.1.2.33.2.1.1.8	Gauge32	read-only	The lifetime of this SA entry in seconds.
G32 hipsSoftBytes	1.3.6.1.4.1.43.45.1.2.33.2.1.1.12	Gauge32	read-only	This object specifies the lifetime in bytes of the tunnels generated using this policy specification.
G32 hipsSoftTimeout	1.3.6.1.4.1.43.45.1.2.33.2.1.1.14	Gauge32	read-only	This object specifies the lifetime in seconds of the tunnels generated using this policy specification.
G32 hipsSPI	1.3.6.1.4.1.43.45.1.2.33.2.1.1.3	Gauge32	read-only	The SPI of this SA entry.
hipsStaticCryptomapEntry	1.3.6.1.4.1.43.45.1.2.33.2.4.1		not-accessible	Each entry contains properites of a single static cryptomap entry. The members of dynamic cryptomap sets, which may be linked with the parent static cryptomap set, are not included in this table.
G32 hipsStaticCryptomapLifesize	1.3.6.1.4.1.43.45.1.2.33.2.4.1.8	Gauge32	read-only	This object identifies the lifesize of the IPSec SAs generated using this IPSec policy entry. Lifesize means maximum traffic in bytes that may be carried.
G32 hipsStaticCryptomapLifetime	1.3.6.1.4.1.43.45.1.2.33.2.4.1.7	Gauge32	read-only	This object indicates the lifetime of the IPSec SA which is created using this IPSec policy entry.
IP hipsStaticCryptomapLocalIpAddr	1.3.6.1.4.1.43.45.1.2.33.2.4.1.9	IpAddress	read-only	The value of this object is the local IP address of the IPSec SAs generated using this IPSec policy entry.
INT hipsStaticCryptomapMatchAddr	1.3.6.1.4.1.43.45.1.2.33.2.4.1.4	INTEGER	read-only	The access list number entered by the operatoir while creating this cryptomap.
STR hipsStaticCryptomapName	1.3.6.1.4.1.43.45.1.2.33.2.4.1.1	DisplayString	read-only	The name of the cryptomap entry in the cryptomap set. This is the first index component of this table.
INT hipsStaticCryptomapNegMode	1.3.6.1.4.1.43.45.1.2.33.2.4.1.3	INTEGER	read-only	Type of the cryptomap entry. This object may be an ISAKMP cryptomap or manual.
IP hipsStaticCryptomapPeerIpAddr	1.3.6.1.4.1.43.45.1.2.33.2.4.1.5	IpAddress	read-only	The IP address of the current peer. Traffic protected by this cryptomap is protected by a tunnel terminating at the device whose IP address is the value of this object.
I32 hipsStaticCryptomapSN	1.3.6.1.4.1.43.45.1.2.33.2.4.1.2	Integer32	read-only	The sequence number of the cryptomap entry in the cryptomap set. This is the second index component of this table.
hipsStaticCryptomapTable	1.3.6.1.4.1.43.45.1.2.33.2.4		not-accessible	The table includes the list of the member cryptomaps of the cryptomap sets which are set on the specific entity.
STR hipsStaticCryptomapTransforName	1.3.6.1.4.1.43.45.1.2.33.2.4.1.6	DisplayString	read-only	The transform associated with this cryptomap entry.
INT hipsTransformMode	1.3.6.1.4.1.43.45.1.2.33.2.5.1.2	INTEGER	read-only	Mode of the transform entry.
STR hipsTransformName	1.3.6.1.4.1.43.45.1.2.33.2.5.1.1	DisplayString	read-only	Name of the transform entry.
hipsTransformNameSetEntry	1.3.6.1.4.1.43.45.1.2.33.2.5.1		not-accessible	Each entry refers to properties of a transform.
hipsTransformNameSetTable	1.3.6.1.4.1.43.45.1.2.33.2.5		not-accessible	Transform set table.
INT hipsTransformProtocol	1.3.6.1.4.1.43.45.1.2.33.2.5.1.3	INTEGER	read-only	Transform protocol.
hipsTraps	1.3.6.1.4.1.43.45.1.2.33.2.8
huaweiNDEC	1.3.6.1.4.1.43.45.1.2.33.2			This MIB contains objects to manage the NDEC device.

RFC description

Manages NDEC (Network Data Encryption Controller) devices with IPsec security associations, IKE policies, and cryptographic algorithm configurations.

Start monitoring H3C/3Com security routers/appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download A3COM-HUAWEI-NDEC-MIB