H3C-IPSEC-MONITOR-MIB

All MIBs › H3C-IPSEC-MONITOR-MIB

Organization: Huawei-3COM Technologies Co., Ltd.

Last Updated: 2004-10-26

Category: VPN and Security, Vendor: H3C/HH3C

Description: H3C MIB for IPsec VPN monitoring including security associations, tunnel status, and traffic statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is H3C-IPSEC-MONITOR-MIB?

This H3C vendor MIB provides read-only monitoring of IPsec VPN tunnels on H3C routers and security gateways, focused on retrieving statistics for individual tunnels or all active tunnels. It exposes security association (SA) status and traffic statistics for IPsec tunnels, letting an operator see which tunnels are up and how much traffic they're carrying. Its monitoring emphasis is on the software/protocol status of VPN connectivity, detecting tunnels that have gone down, SAs that failed to negotiate, or unusual traffic volume/error counts on a given tunnel that could indicate a network or configuration issue. IPsec MIB monitoring generally builds on IETF IPsec MIB concepts even though this is an H3C-specific implementation. It is deployed on H3C routers, firewalls, or VPN gateways terminating site-to-site or remote-access IPsec VPN tunnels. Network engineers evaluating or troubleshooting this functionality can download the H3C-IPSEC-MONITOR-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in H3C-IPSEC-MONITOR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C routers, firewalls, and VPN gateways

Monitoring Examples

An administrator would poll per-tunnel SA status objects to confirm a specific IPsec tunnel between two sites remains established, and check tunnel-level byte/packet counters to verify traffic is actually flowing rather than the tunnel being up but idle. A tunnel repeatedly showing SA renegotiation without stabilizing would indicate a phase 2 mismatch or a peer configuration problem. Aggregating statistics across all tunnels would help identify which site link is consuming disproportionate VPN bandwidth.

What Can Be Monitored

IPsec tunnel status
security association (SA) state
per-tunnel traffic statistics
tunnel error/renegotiation counts

Imported Objects

From HUAWEI-3COM-OID-MIB

h3cCommon

OBJECT-IDENTITY

From RFC1213-MIB

ifIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using h3cIPSecGlobalInOctets OID:

Select an H3C router, firewall, or VPN gateway as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type h3cIPSecGlobalInOctets into the Find box to locate it in the OID tree, then select it and click OK. The total number of octets received by all current and previous IPSec Phase-2 Tunnels. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cIPSecMonitor	1.3.6.1.4.1.2011.10.2.7			The MIB is designed to get statistic information of IPSec tunnels. With this MIB, we can get information of a certain tunnel or all tunnels.
h3cIPSecObjects	1.3.6.1.4.1.2011.10.2.7.1
h3cIPSecTunnelTable	1.3.6.1.4.1.2011.10.2.7.1.1		not-accessible	The IPSec Phase-2 Tunnel Table. There is one entry in this table for each active IPSec Phase-2 Tunnel.
h3cIPSecTunnelEntry	1.3.6.1.4.1.2011.10.2.7.1.1.1		not-accessible	Information about h3cIPSecTunnelTable.
I32 h3cIPSecTunIfIndex	1.3.6.1.4.1.2011.10.2.7.1.1.1.1	Integer32	not-accessible	The interface index( the ifIndex of ifTable ).
I32 h3cIPSecTunEntryIndex	1.3.6.1.4.1.2011.10.2.7.1.1.1.2	Integer32	not-accessible	The index of IPSec policy applied in the interface.
I32 h3cIPSecTunIndex	1.3.6.1.4.1.2011.10.2.7.1.1.1.3	Integer32	not-accessible	The index of IPSec Phase-2 Tunnel Table. The value of the index is a number which begins at one and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647.
I32 h3cIPSecTunIKETunnelIndex	1.3.6.1.4.1.2011.10.2.7.1.1.1.4	Integer32	read-only	The index of the associated IPSec Phase-1 IKE Tunnel (IKETunIndex in the IKETunnelTable). 2147483647 is defined as invalid value.
IP h3cIPSecTunLocalAddr	1.3.6.1.4.1.2011.10.2.7.1.1.1.5	IpAddress	read-only	The IP address of the local peer for the IPSec Phase-2 Tunnel. 0.0.0.0 is defined as invalid value.
IP h3cIPSecTunRemoteAddr	1.3.6.1.4.1.2011.10.2.7.1.1.1.6	IpAddress	read-only	The IP address of the remote peer for the IPSec Phase-2 Tunnel. 0.0.0.0 is defined as invalid value.
H3C h3cIPSecTunKeyType	1.3.6.1.4.1.2011.10.2.7.1.1.1.7	H3cIPSecNegoType	read-only	The key negotiate mode used by the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunEncapMode	1.3.6.1.4.1.2011.10.2.7.1.1.1.8	H3cEncapMode	read-only	The encapsulation mode used by the IPSec Phase-2 Tunnel.
INT h3cIPSecTunInitiator	1.3.6.1.4.1.2011.10.2.7.1.1.1.9	INTEGER	read-only	The initiator of this IPSec tunnel. Value none is used for manual IPsec tunnel, for there is no initiator or responder in this method.
G32 h3cIPSecTunLifeSize	1.3.6.1.4.1.2011.10.2.7.1.1.1.10	Gauge32	read-only	The negotiated LifeSize of the IPSec Phase-2 Tunnel in kilobytes. 0 is defined as invalid value.
I32 h3cIPSecTunLifeTime	1.3.6.1.4.1.2011.10.2.7.1.1.1.11	Integer32	read-only	The negotiated LifeTime of the IPSec Phase-2 Tunnel in seconds. 2147483647 is defined as invalid value.
I32 h3cIPSecTunRemainTime	1.3.6.1.4.1.2011.10.2.7.1.1.1.12	Integer32	read-only	The remain time of SA in seconds. 2147483647 is defined as invalid value.
I32 h3cIPSecTunActiveTime	1.3.6.1.4.1.2011.10.2.7.1.1.1.13	Integer32	read-only	The duration the IPSec Phase-2 Tunnel has been active in hundredths of seconds. 2147483647 is defined as invalid value.
G32 h3cIPSecTunRemainSize	1.3.6.1.4.1.2011.10.2.7.1.1.1.14	Gauge32	read-only	The remain LifeSize of SA in kilobytes. 0 is defined as invalid value.
C32 h3cIPSecTunTotalRefreshes	1.3.6.1.4.1.2011.10.2.7.1.1.1.15	Counter32	read-only	The total number of security association refreshing performed.
G32 h3cIPSecTunCurrentSaInstances	1.3.6.1.4.1.2011.10.2.7.1.1.1.16	Gauge32	read-only	The number of security associations which are currently active or expiring.
H3C h3cIPSecTunInSaEncryptAlgo	1.3.6.1.4.1.2011.10.2.7.1.1.1.17	H3cEncryptAlgo	read-only	The encryption algorithm used by the inbound security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunInSaAhAuthAlgo	1.3.6.1.4.1.2011.10.2.7.1.1.1.18	H3cAuthAlgo	read-only	The authentication algorithm used by the inbound authentication header (AH) security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunInSaEspAuthAlgo	1.3.6.1.4.1.2011.10.2.7.1.1.1.19	H3cAuthAlgo	read-only	The authentication algorithm used by the inbound encapsulation security protocol(ESP) security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunDiffHellmanGrp	1.3.6.1.4.1.2011.10.2.7.1.1.1.20	H3cDiffHellmanGrp	read-only	The Diffie Hellman Group used by the security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunOutSaEncryptAlgo	1.3.6.1.4.1.2011.10.2.7.1.1.1.21	H3cEncryptAlgo	read-only	The encryption algorithm used by the outbound security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunOutSaAhAuthAlgo	1.3.6.1.4.1.2011.10.2.7.1.1.1.22	H3cAuthAlgo	read-only	The authentication algorithm used by the outbound authentication header (AH) security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecTunOutSaEspAuthAlgo	1.3.6.1.4.1.2011.10.2.7.1.1.1.23	H3cAuthAlgo	read-only	The authentication algorithm used by the outbound encapsulation security protocol(ESP) security association of the IPSec Phase-2 Tunnel.
STR h3cIPSecTunPolicyName	1.3.6.1.4.1.2011.10.2.7.1.1.1.24	DisplayString	read-only	The policy name used by this IPSec tunnel.
I32 h3cIPSecTunPolicyNum	1.3.6.1.4.1.2011.10.2.7.1.1.1.25	Integer32	read-only	The sequence number of policy used by this IPSec tunnel.
INT h3cIPSecTunStatus	1.3.6.1.4.1.2011.10.2.7.1.1.1.26	INTEGER	read-only	The status of the IPSec Tunnel.
h3cIPSecTunnelStatTable	1.3.6.1.4.1.2011.10.2.7.1.2		not-accessible	The IPSec Phase-2 Tunnel Statistics Table.
h3cIPSecTunnelStatEntry	1.3.6.1.4.1.2011.10.2.7.1.2.1		not-accessible	Information about h3cIPSecTunnelStatTable.
C64 h3cIPSecTunInOctets	1.3.6.1.4.1.2011.10.2.7.1.2.1.1	Counter64	read-only	The total number of octets received by this IPSec Phase-2 Tunnel. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 h3cIPSecTunInDecompOctets	1.3.6.1.4.1.2011.10.2.7.1.2.1.2	Counter64	read-only	The total number of decompressed octets received by this IPSec Phase-2 Tunnel. This value is accumulated AFTER the packet is decompressed.
C64 h3cIPSecTunInPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.3	Counter64	read-only	The total number of packets received by this IPSec Phase-2 Tunnel.
C64 h3cIPSecTunInDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.4	Counter64	read-only	The total number of packets dropped during receiving process by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInReplayDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.5	Counter32	read-only	The total number of packets dropped during receiving process due to Anti-Replay process by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInAuthFails	1.3.6.1.4.1.2011.10.2.7.1.2.1.6	Counter32	read-only	The total number of inbound authentication's which ended in failure by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInDecryptFails	1.3.6.1.4.1.2011.10.2.7.1.2.1.7	Counter32	read-only	The total number of inbound decryption's which ended in failure by this IPSec Phase-2 Tunnel.
C64 h3cIPSecTunOutOctets	1.3.6.1.4.1.2011.10.2.7.1.2.1.8	Counter64	read-only	The total number of octets sent by this IPSec Phase-2 Tunnel. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 h3cIPSecTunOutUncompOctets	1.3.6.1.4.1.2011.10.2.7.1.2.1.9	Counter64	read-only	The total number of uncompressed octets sent by this IPSec Phase-2 Tunnel.This value is accumulated BEFORE the packet is compressed.
C64 h3cIPSecTunOutPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.10	Counter64	read-only	The total number of packets sent by this IPSec Phase-2 Tunnel.
C64 h3cIPSecTunOutDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.11	Counter64	read-only	The total number of packets dropped during sending process by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunOutEncryptFails	1.3.6.1.4.1.2011.10.2.7.1.2.1.12	Counter32	read-only	The total number of outbound encryption's which ended in failure by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunNoMemoryDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.13	Counter32	read-only	The total number of packets dropped due to no enough memory by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunQueueFullDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.14	Counter32	read-only	The total number of packets dropped due to queue full by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInvalidLenDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.15	Counter32	read-only	The total number of packets dropped due to invalid length packet by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunTooLongDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.16	Counter32	read-only	The total number of packets dropped due to too long packet by this IPSec Phase-2 Tunnel.
C32 h3cIPSecTunInvalidSaDropPkts	1.3.6.1.4.1.2011.10.2.7.1.2.1.17	Counter32	read-only	The total number of packets dropped due to invalid SA by this IPSec Phase-2 Tunnel.
h3cIPSecSaTable	1.3.6.1.4.1.2011.10.2.7.1.3		not-accessible	The IPSec Phase-2 Security Protection Index Table. This table contains an entry for each active and expiring security association.
h3cIPSecSaEntry	1.3.6.1.4.1.2011.10.2.7.1.3.1		not-accessible	Information about h3cIPSecSaTable.
I32 h3cIPSecSaIndex	1.3.6.1.4.1.2011.10.2.7.1.3.1.1	Integer32	not-accessible	The number of the Sa associated with the Phase-2 Tunnel Table. The value of this index is a number which begins at one and is incremented with each Sa associated with an IPSec Phase-2 Tunnel. The value of this object will wrap at 2,147,483,647.
INT h3cIPSecSaDirection	1.3.6.1.4.1.2011.10.2.7.1.3.1.2	INTEGER	read-only	The direction of the SA.
U32 h3cIPSecSaValue	1.3.6.1.4.1.2011.10.2.7.1.3.1.3	Unsigned32	read-only	The value of the SPI.
H3C h3cIPSecSaProtocol	1.3.6.1.4.1.2011.10.2.7.1.3.1.4	H3cSaProtocol	read-only	The security protocol of the SA.
H3C h3cIPSecSaEncryptAlgo	1.3.6.1.4.1.2011.10.2.7.1.3.1.5	H3cEncryptAlgo	read-only	The encryption algorithm used by the security association of the IPSec Phase-2 Tunnel.
H3C h3cIPSecSaAuthAlgo	1.3.6.1.4.1.2011.10.2.7.1.3.1.6	H3cAuthAlgo	read-only	The authentication algorithm used by the SA.
INT h3cIPSecSaStatus	1.3.6.1.4.1.2011.10.2.7.1.3.1.7	INTEGER	read-only	The status of the SA.
h3cIPSecTrafficTable	1.3.6.1.4.1.2011.10.2.7.1.4		not-accessible	The IPSec Phase-2 Tunnel Traffic Table.
h3cIPSecTrafficEntry	1.3.6.1.4.1.2011.10.2.7.1.4.1		not-accessible	Information about h3cIPSecTrafficTable.
H3C h3cIPSecTrafficLocalType	1.3.6.1.4.1.2011.10.2.7.1.4.1.1	H3cTrafficType	read-only	The type of local peer. Possible values are: a single IP address, or an IP address range, or an IP subnet.
IP h3cIPSecTrafficLocalAddr1	1.3.6.1.4.1.2011.10.2.7.1.4.1.2	IpAddress	read-only	The first specification of local peer's IP address. If the local peer type is single IP address, then this is the value of the IP address. If the local peer type is IP subnet, then this is the value of the subnet. If the local peer type is IP address range, then this is the value of beginning IP address of the range.
IP h3cIPSecTrafficLocalAddr2	1.3.6.1.4.1.2011.10.2.7.1.4.1.3	IpAddress	read-only	The second specification of local peer's IP address. If the local peer type is single IP address, then this is the value of the IP address. If the local peer type is IP subnet, then this is the value of the subnet mask. If the local peer type is IP address range, then this is the value of ending IP address of the range.
I32 h3cIPSecTrafficLocalProtocol	1.3.6.1.4.1.2011.10.2.7.1.4.1.4	Integer32	read-only	The protocol number of the local peer's traffic.
I32 h3cIPSecTrafficLocalPort	1.3.6.1.4.1.2011.10.2.7.1.4.1.5	Integer32	read-only	The port number of the local peer's traffic.
H3C h3cIPSecTrafficRemoteType	1.3.6.1.4.1.2011.10.2.7.1.4.1.6	H3cTrafficType	read-only	The type of remote peer. Possible values are: a single IP address, or an IP address range, or an IP subnet.
IP h3cIPSecTrafficRemoteAddr1	1.3.6.1.4.1.2011.10.2.7.1.4.1.7	IpAddress	read-only	The first specification of remote peer's IP address. If the remote peer type is single IP address, then this is the value of the IP address. If the remote peer type is IP subnet, then this is the value of the subnet. If the remote peer type is IP address range, then this is the value of beginning IP address of the range.
IP h3cIPSecTrafficRemoteAddr2	1.3.6.1.4.1.2011.10.2.7.1.4.1.8	IpAddress	read-only	Single IP address, then this is the value of the IP address. If the remote peer type is IP subnet, then this is the value of the subnet mask. If the remote peer type is IP address range, then this is the value of ending IP address of the range.
I32 h3cIPSecTrafficRemoteProtocol	1.3.6.1.4.1.2011.10.2.7.1.4.1.9	Integer32	read-only	The protocol number of the remote peer's traffic.
I32 h3cIPSecTrafficRemotePort	1.3.6.1.4.1.2011.10.2.7.1.4.1.10	Integer32	read-only	The port number of the remote peer's traffic.
h3cIPSecGlobalStats	1.3.6.1.4.1.2011.10.2.7.1.5
G32 h3cIPSecGlobalActiveTunnels	1.3.6.1.4.1.2011.10.2.7.1.5.1	Gauge32	read-only	The total number of currently active IPSec Phase-2 Tunnels.
G32 h3cIPSecGlobalActiveSas	1.3.6.1.4.1.2011.10.2.7.1.5.2	Gauge32	read-only	The total number of currently active or expiring IPSec Phase-2 SA.
C64 h3cIPSecGlobalInOctetsEx	1.3.6.1.4.1.2011.10.2.7.1.5.3	Counter64	read-only	The total number of octets received by all current and previous IPSec Phase-2 Tunnels. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 h3cIPSecGlobalInDecompOctets	1.3.6.1.4.1.2011.10.2.7.1.5.4	Counter64	read-only	The total number of decompressed octets received by all current and previous IPSec Phase-2 Tunnels. This value is accumulated AFTER the packet is decompressed.
C64 h3cIPSecGlobalInPkts	1.3.6.1.4.1.2011.10.2.7.1.5.5	Counter64	read-only	The total number of packets received by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalInDrops	1.3.6.1.4.1.2011.10.2.7.1.5.6	Counter64	read-only	The total number of packets dropped during receiving process by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInReplayDrops	1.3.6.1.4.1.2011.10.2.7.1.5.7	Counter32	read-only	The total number of packets dropped during receiving process due to Anti-Replay process by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInAuthFails	1.3.6.1.4.1.2011.10.2.7.1.5.8	Counter32	read-only	The total number of inbound authentication's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInDecryptFails	1.3.6.1.4.1.2011.10.2.7.1.5.9	Counter32	read-only	The total number of inbound decryption's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalOutOctets	1.3.6.1.4.1.2011.10.2.7.1.5.10	Counter64	read-only	The total number of octets sent by all current and previous IPSec Phase-2 Tunnels. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 h3cIPSecGlobalOutUncompOctets	1.3.6.1.4.1.2011.10.2.7.1.5.11	Counter64	read-only	The total number of uncompressed octets sent by all current and previous IPSec Phase-2 Tunnels. This value is accumulated BEFORE the packet is compressed.
C64 h3cIPSecGlobalOutPkts	1.3.6.1.4.1.2011.10.2.7.1.5.12	Counter64	read-only	The total number of packets sent by all current and previous IPSec Phase-2 Tunnels.
C64 h3cIPSecGlobalOutDrops	1.3.6.1.4.1.2011.10.2.7.1.5.13	Counter64	read-only	The total number of packets dropped during sending process by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalOutEncryptFails	1.3.6.1.4.1.2011.10.2.7.1.5.14	Counter32	read-only	The total number of outbound encryption's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalNoMemoryDropPkts	1.3.6.1.4.1.2011.10.2.7.1.5.15	Counter32	read-only	The total number of packets dropped due to no enough memory by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalNoFindSaDropPkts	1.3.6.1.4.1.2011.10.2.7.1.5.16	Counter32	read-only	The total number of packets dropped due to not find SA by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalQueueFullDropPkts	1.3.6.1.4.1.2011.10.2.7.1.5.17	Counter32	read-only	The total number of packets dropped due to queue full by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInvalidLenDropPkts	1.3.6.1.4.1.2011.10.2.7.1.5.18	Counter32	read-only	The total number of packets dropped due to invalid packet length by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalTooLongDropPkts	1.3.6.1.4.1.2011.10.2.7.1.5.19	Counter32	read-only	The total number of packets dropped due to too long packet by all current and previous IPSec Phase-2 Tunnels.
C32 h3cIPSecGlobalInvalidSaDropPkts	1.3.6.1.4.1.2011.10.2.7.1.5.20	Counter32	read-only	The total number of packets dropped due to invalid SA by all current and previous IPSec Phase-2 Tunnels.
h3cIPSecTrapObject	1.3.6.1.4.1.2011.10.2.7.1.6
STR h3cIPSecPolicyName	1.3.6.1.4.1.2011.10.2.7.1.6.1	DisplayString	accessible-for-notify	The IPSec policy name with a trap.
I32 h3cIPSecPolicySeqNum	1.3.6.1.4.1.2011.10.2.7.1.6.2	Integer32	accessible-for-notify	The IPSec policy sequence number with a trap.
I32 h3cIPSecPolicySize	1.3.6.1.4.1.2011.10.2.7.1.6.3	Integer32	accessible-for-notify	The number of IPSec policies with a trap.
I32 h3cIPSecSpiValue	1.3.6.1.4.1.2011.10.2.7.1.6.4	Integer32	accessible-for-notify	The SPI value associated with a trap.
h3cIPSecTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7
H3C h3cIPSecTrapGlobalCntl	1.3.6.1.4.1.2011.10.2.7.1.7.1	H3cTrapStatus	read-write	Indicates whether all IPSec traps should be generated.
H3C h3cIPSecTunnelStartTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.2	H3cTrapStatus	read-write	Indicates whether h3cIPSecTunnelStart traps should be generated.
H3C h3cIPSecTunnelStopTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.3	H3cTrapStatus	read-write	Indicates whether h3cIPSecTunnelStop traps should be generated.
H3C h3cIPSecNoSaTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.4	H3cTrapStatus	read-write	Indicates whether h3cIPSecNoSaFailure traps should be generated.
H3C h3cIPSecAuthFailureTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.5	H3cTrapStatus	read-write	Indicates whether h3cIPSecAuthFailFailure traps should be generated.
H3C h3cIPSecEncryFailureTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.6	H3cTrapStatus	read-write	Indicates whether h3cIPSecEncryFailFailure traps should be generated.
H3C h3cIPSecDecryFailureTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.7	H3cTrapStatus	read-write	Indicates whether h3cIPSecDecryFailFailure traps should be generated.
H3C h3cIPSecInvalidSaTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.8	H3cTrapStatus	read-write	Indicates whether h3cIPSec Invalid Sa Failure traps should be generated.
H3C h3cIPSecPolicyAddTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.9	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyAdd traps should be generated.
H3C h3cIPSecPolicyDelTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.10	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyDel traps should be generated.
H3C h3cIPSecPolicyAttachTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.11	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyAttach traps should be generated.
H3C h3cIPSecPolicyDetachTrapCntl	1.3.6.1.4.1.2011.10.2.7.1.7.12	H3cTrapStatus	read-write	Indicates whether h3cIPSecPolicyDetach traps should be generated.
h3cIPSecTrap	1.3.6.1.4.1.2011.10.2.7.1.8
h3cIPSecNotifications	1.3.6.1.4.1.2011.10.2.7.1.8.1
NTF h3cIPSecTunnelStart	1.3.6.1.4.1.2011.10.2.7.1.8.1.1			This notification is generated when an IPSec Phase-2 Tunnel is created.
NTF h3cIPSecTunnelStop	1.3.6.1.4.1.2011.10.2.7.1.8.1.2			This notification is generated when an IPSec Phase-2 Tunnel is deleted.
NTF h3cIPSecNoSaFailure	1.3.6.1.4.1.2011.10.2.7.1.8.1.3			This notification is generated when an IPSec Phase-2 non-existent SA error occurs.
NTF h3cIPSecAuthFailFailure	1.3.6.1.4.1.2011.10.2.7.1.8.1.4			This notification is generated when the IPSec phase-2 authentication failure occurs.
NTF h3cIPSecEncryFailFailure	1.3.6.1.4.1.2011.10.2.7.1.8.1.5			This notification is generated when the IPSec phase-2 tunnel has an encrypting failure.
NTF h3cIPSecDecryFailFailure	1.3.6.1.4.1.2011.10.2.7.1.8.1.6			This notification is generated when the IPSec phase-2 tunnel has a decrypting failure.
NTF h3cIPSecInvalidSaFailure	1.3.6.1.4.1.2011.10.2.7.1.8.1.7			This notification is generated when the IPSec phase-2 invalid SA failure occurs.
NTF h3cIPSecPolicyAdd	1.3.6.1.4.1.2011.10.2.7.1.8.1.8			This notification is generated when an IPSec policy is added.
NTF h3cIPSecPolicyDel	1.3.6.1.4.1.2011.10.2.7.1.8.1.9			This notification is generated when an IPSec policy is deleted.
NTF h3cIPSecPolicyAttach	1.3.6.1.4.1.2011.10.2.7.1.8.1.10			This notification is generated when an IPSec policy is attached with one interface.
NTF h3cIPSecPolicyDetach	1.3.6.1.4.1.2011.10.2.7.1.8.1.11			This notification is generated when an IPSec policy is detached with one interface.
h3cIPSecConformance	1.3.6.1.4.1.2011.10.2.7.2
h3cIPSecCompliances	1.3.6.1.4.1.2011.10.2.7.2.1
h3cIPSecCompliance	1.3.6.1.4.1.2011.10.2.7.2.1.1
h3cIPSecGroups	1.3.6.1.4.1.2011.10.2.7.2.2
h3cIPSecTunnelTableGroup	1.3.6.1.4.1.2011.10.2.7.2.2.1			The group contains the IPSec tunnel's property information.
h3cIPSecTunnelStatGroup	1.3.6.1.4.1.2011.10.2.7.2.2.2			The group contains the IPSec tunnel's statistic information.
h3cIPSecSaGroup	1.3.6.1.4.1.2011.10.2.7.2.2.3			The group contains the SA's property information.
h3cIPSecTrafficTableGroup	1.3.6.1.4.1.2011.10.2.7.2.2.4			The group contains the property information of the data flow protected by IPSec tunnel.
h3cIPSecGlobalStatsGroup	1.3.6.1.4.1.2011.10.2.7.2.2.5			The group contains all of the IPSec tunnel's statistic information.
h3cIPSecTrapObjectGroup	1.3.6.1.4.1.2011.10.2.7.2.2.6			The group contains all of trap objects of IPSec tunnels.
h3cIPSecTrapCntlGroup	1.3.6.1.4.1.2011.10.2.7.2.2.7			The group contains all of trap switches of IPSec tunnels.
h3cIPSecTrapGroup	1.3.6.1.4.1.2011.10.2.7.2.2.8			The group contains all of trap of IPSec tunnels.

RFC description

IPSec tunnel statistics including encryption, authentication, and Diffie-Hellman negotiation monitoring.

Start monitoring H3C routers, firewalls, and VPN gateways with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download H3C-IPSEC-MONITOR-MIB