A3COM-HUAWEI-WAPI-MIB

All MIBs › A3COM-HUAWEI-WAPI-MIB

Organization: H3C Technologies Co., Ltd.

Last Updated: 2010-12-01

Category: Vendor: H3C/HH3C, Wireless and WLAN

Description: Manages WLAN Authentication and Privacy Infrastructure (WAPI), the Chinese wireless security standard, on H3C/3Com wireless access points and controllers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is A3COM-HUAWEI-WAPI-MIB?

A3COM-HUAWEI-WAPI-MIB is an H3C/3Com private MIB extending WLAN management to cover WAPI (WLAN Authentication and Privacy Infrastructure), the Chinese national wireless security standard used as an alternative to WPA/WPA2 on domestic wireless deployments. It exposes configuration and running-state objects for the WAPI feature along with trap information objects identifying the client MAC address, access point ID, radio ID, and BSSID involved in a WAPI event. Its monitoring emphasis is on software/security-service status: administrators use the trap data to detect WAPI authentication events or failures tied to a specific AP, radio, and client, supporting security incident investigation on the wireless network. It is an extension of the vendor's core WLAN AP/AC MIB family and depends on the underlying WAPI protocol standard rather than a separate IETF MIB. It is deployed on H3C/3Com wireless access points and controllers operating in markets requiring WAPI compliance. Engineers can download the A3COM-HUAWEI-WAPI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in A3COM-HUAWEI-WAPI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C/3Com wireless access points and controllers (WAPI-capable)

Monitoring Examples

An administrator subscribes to traps carrying h3cwapiTrapInfo objects and inspects h3cwapiTrapInfoMacAddr, h3cwapiTrapInfoAPId, h3cwapiTrapInfoRadioId, and h3cwapiTrapInfoBSSId to pinpoint which client, access point, radio, and BSS were involved in a WAPI authentication event. A cluster of trap events referencing the same h3cwapiTrapInfoAPId would suggest a WAPI misconfiguration or attack concentrated on a single access point.

What Can Be Monitored

WAPI authentication events
client MAC involved in WAPI event
access point and radio identifiers
BSSID of WAPI event

Imported Objects

From A3COM-HUAWEI-OID-MIB

h3cCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From RFC1213-MIB

ifDescr
ifIndex

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TruthValue

How to Use in IPNetwork Monitor

Example using h3cwapiStatsWAISignatureErrors OID:

Select an H3C/3Com wireless controller or access point as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type h3cwapiStatsWAISignatureErrors into the Find box to locate it in the OID tree, then select it and click OK. This counter increases when the received packet of WAI signature is wrong. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cwapiMIB	1.3.6.1.4.1.43.45.1.10.2.77			A3COM-HUAWEI-WAPI-MIB is an extension of MIB in WAPI protocol. This MIB contains objects to manage configuration and monitor running state for WAPI feature.
h3cwapiMIBObjects	1.3.6.1.4.1.43.45.1.10.2.77.1
T/F h3cwapiModeEnabled	1.3.6.1.4.1.43.45.1.10.2.77.1.1	TruthValue	read-write	When this object is set to TRUE, it shall indicate that WAPI is enabled. Otherwise, it shall indicate that WAPI is disabled.
IPt h3cwapiASIPAddressType	1.3.6.1.4.1.43.45.1.10.2.77.1.2	InetAddressType	read-write	This object is used to set global IP addresses type (IPv4 or IPv6) of AS.
IP h3cwapiASIPAddress	1.3.6.1.4.1.43.45.1.10.2.77.1.3	InetAddress	read-write	This object is used to set the global IP address of AS.
T/F h3cwapiCertificateInstalled	1.3.6.1.4.1.43.45.1.10.2.77.1.4	TruthValue	read-only	This object indicates whether the entity has installed certificate. When the value is TURE, it shall indicate that the entity has installed certificate. Otherwise, it shall indicate that the entity hasn't installed certificate.
h3cwapiMIBStatsObjects	1.3.6.1.4.1.43.45.1.10.2.77.2
C32 h3cwapiStatsWAISignatureErrorsEx	1.3.6.1.4.1.43.45.1.10.2.77.2.1	Counter32	read-only	This counter increases when the received packet of WAI signature is wrong.
C32 h3cwapiStatsWAIHMACErrors	1.3.6.1.4.1.43.45.1.10.2.77.2.2	Counter32	read-only	This counter increases when the received packet of WAI message authentication key checking error occurs.
C32 h3cwapiStatsWAIAuthRsltFailures	1.3.6.1.4.1.43.45.1.10.2.77.2.3	Counter32	read-only	This counter increases when the WAI authentication result is unsuccessful.
C32 h3cwapiStatsWAIDiscardCounters	1.3.6.1.4.1.43.45.1.10.2.77.2.4	Counter32	read-only	This counter increases when the received packet of WAI are discarded.
C32 h3cwapiStatsWAITimeoutCounters	1.3.6.1.4.1.43.45.1.10.2.77.2.5	Counter32	read-only	This counter increases when the packet of WAI overtime are detected.
C32 h3cwapiStatsWAIFormatErrors	1.3.6.1.4.1.43.45.1.10.2.77.2.6	Counter32	read-only	This counter increases when the WAI packet of WAI format error is detected.
C32 h3cwapiStatsWAICtfHskFailures	1.3.6.1.4.1.43.45.1.10.2.77.2.7	Counter32	read-only	This counter increases when the WAI certificate authenticates unsuccessfully.
C32 h3cwapiStatsWAIUniHskFailures	1.3.6.1.4.1.43.45.1.10.2.77.2.8	Counter32	read-only	This counter increases when the WAI unicast cipher key negotiates unsuccessfully.
C32 h3cwapiStatsWAIMulHskFailures	1.3.6.1.4.1.43.45.1.10.2.77.2.9	Counter32	read-only	This counter increases when the WAI multicast cipher key announces unsuccessfully.
h3cwapiMIBTableObjects	1.3.6.1.4.1.43.45.1.10.2.77.3
h3cwapiConfigTable	1.3.6.1.4.1.43.45.1.10.2.77.3.1		not-accessible	The table containing WAPI configuration objects.
h3cwapiConfigEntry	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1		not-accessible	An entry in the h3cwapiConfigTable.
IPt h3cwapiConfigASIPAddressType	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.1	InetAddressType	read-write	This object is used to set IP addresses type of AS.
IP h3cwapiConfigASIPAddress	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.2	InetAddress	read-write	This object is used to set the IP address of AS.
INT h3cwapiConfigAuthMethod	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.3	INTEGER	read-write	This object selects a mechanism for WAPI authentication method. The default is certificate.
INT h3cwapiConfigAuthMode	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.4	INTEGER	read-write	This object selects a mechanism for WAPI authentication mode. When the value is standard, it shall indicate that the entity acts accord with the official definition. Otherwise, it shall indicate that the entity finishs authentication by means of RADIUS. The default is standard.
OCT h3cwapiConfigISPDomain	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.5	OCTET STRING	read-write	The ISP domain name.
OCT h3cwapiConfigCertificateDomain	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.6	OCTET STRING	read-write	The PKI domain name.
OCT h3cwapiConfigASName	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.7	OCTET STRING	read-write	The name of AS.
T/F h3cwapiConfigBKRekeyEnabled	1.3.6.1.4.1.43.45.1.10.2.77.3.1.1.8	TruthValue	read-write	This object indicates whether the BK rekey function is supported. When the value is TURE, it shall indicate that the BK rekey function is supported. Otherwise, it shall indicate that the BK rekey function is not supported.
h3cwapiConfigExtTable	1.3.6.1.4.1.43.45.1.10.2.77.3.2		not-accessible	The table containing WAPI configuration objects for SSID.
h3cwapiConfigExtEntry	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1		not-accessible	An extend entry in the h3cwapiConfigExtTable.
I32 h3cwapiConfigServicePolicyID	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.1	Integer32	not-accessible	Represents the ID of each service policy.
T/F h3cwapiConfigUnicastCipherEnabled	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.2	TruthValue	read-write	This object enables or disables the unicast cipher.
U32 h3cwapiConfigUnicastCipherSize	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.3	Unsigned32	read-only	This object indicates the length in bits of the unicast cipher key. This should be 256 for SMS4, first 128 bits for encrypting, last 128 bits for integrity checking.
T/F h3cwapiConfigAuthenticationSuiteEnabled	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.4	TruthValue	read-write	This variable indicates the corresponding AKM suite is enabled or disabled.
OCT h3cwapiConfigAuthenticationSuite	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.5	OCTET STRING	read-only	The selector of an AKM suite. It consists of an OUI (the first 3 octets) and a cipher suite identifier (the last octet).
IPt h3cwapiCfgExtASIPAddressType	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.6	InetAddressType	read-write	This object is used to set IP addresses type of AS.
IP h3cwapiCfgExtASIPAddress	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.7	InetAddress	read-write	This object is used to set the IP address of AS.
OCT h3cwapiCfgExtASName	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.8	OCTET STRING	read-write	This object is used to set the name of AS.
OCT h3cwapiCfgExtCertDomain	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.9	OCTET STRING	read-write	This object is used to set the PKI domain name.
T/F h3cwapiCfgExtCertInstalled	1.3.6.1.4.1.43.45.1.10.2.77.3.2.1.10	TruthValue	read-only	This object indicates whether the entity has installed certificate. When the value is TURE, it shall indicate that the SSID has installed certificate. Otherwise, it shall indicate that the SSID hasn't installed certificate.
h3cwapiTrap	1.3.6.1.4.1.43.45.1.10.2.77.4
h3cwapiTrapPrefix	1.3.6.1.4.1.43.45.1.10.2.77.4.0
NTF h3cwapiUserwithInvalidCertificate	1.3.6.1.4.1.43.45.1.10.2.77.4.0.1			This trap is sent when a user intrudes upon network with invalid certificate.
NTF h3cwapiStationReplayAttack	1.3.6.1.4.1.43.45.1.10.2.77.4.0.2			This trap is sent when an attacker records and replays network transactions.
NTF h3cwapiTamperAttack	1.3.6.1.4.1.43.45.1.10.2.77.4.0.3			This trap is sent when an attacker monitors network traffic and maliciously changes data in transit(for example, an attacker may modify the contents of a WAI message).
NTF h3cwapiLowSafeLevelAttack	1.3.6.1.4.1.43.45.1.10.2.77.4.0.4			This trap is sent when a station associates AP(Access Point), creates packet of Unicast Key Negotiation Response with wrong WIE(WAPI Information Element) of ASUE(Authentication Supplicant Entity).
NTF h3cwapiAddressRedirectionAttack	1.3.6.1.4.1.43.45.1.10.2.77.4.0.5			This trap is sent when an attacker maliciously changes destination MAC address of WPI(WLAN Privacy Infrastructure) frame.
h3cwapiTrapInfo	1.3.6.1.4.1.43.45.1.10.2.77.4.1
MAC h3cwapiTrapInfoMacAddr	1.3.6.1.4.1.43.45.1.10.2.77.4.1.1	MacAddress	accessible-for-notify	The MAC address of the WAPI user.
I32 h3cwapiTrapInfoAPId	1.3.6.1.4.1.43.45.1.10.2.77.4.1.2	Integer32	accessible-for-notify	To uniquely identify each AP.
I32 h3cwapiTrapInfoRadioId	1.3.6.1.4.1.43.45.1.10.2.77.4.1.3	Integer32	accessible-for-notify	Represents each radio.
MAC h3cwapiTrapInfoBSSId	1.3.6.1.4.1.43.45.1.10.2.77.4.1.4	MacAddress	accessible-for-notify	As MAC Address format, it is to identify BSS.

RFC description

Huawei/H3C enterprise SNMP MIB module for managing WAPI (Wireless Authentication and Privacy Infrastructure) functionality on compatible Huawei network devices.

Start monitoring H3C/3Com wireless controllers and APs with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download A3COM-HUAWEI-WAPI-MIB