HH3C-DOMAIN-MIB

All MIBs › HH3C-DOMAIN-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2009-08-05

Category: RADIUS and AAA, Vendor: H3C/HH3C

Description: Manages authentication domains (ISP domains) on H3C devices, associating AAA schemes with user access policies.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-DOMAIN-MIB?

HH3C-DOMAIN-MIB is an H3C enterprise MIB for managing ISP/authentication domains, which group AAA (authentication, authorization, accounting) scheme assignments and access policies for different classes of users on H3C routers and switches. It exposes domain-level configuration data: domain names, associated AAA scheme bindings (RADIUS/HWTACACS/local), and policy parameters applied to users in that domain. Its primary value is confirming software/service configuration state, verifying that a domain exists, is active, and is correctly bound to the intended authentication scheme, rather than exposing hardware sensors; a missing or misconfigured domain entry can explain why a class of users fails to authenticate. It works in conjunction with vendor AAA/RADIUS MIBs since domains reference those underlying schemes. Typical deployment is on H3C access/aggregation devices such as BRAS platforms or enterprise switches performing 802.1X or PPP user authentication. Engineers can download the HH3C-DOMAIN-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-DOMAIN-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C router/switch/BRAS with AAA

Monitoring Examples

No object names were sampled for this MIB, so specific identifiers can't be cited, but consistent with "managing domain" it would expose a table of configured ISP domains and their bound AAA scheme references. An admin would check that a domain used by a subscriber group maps to the correct RADIUS/HWTACACS scheme, and a missing domain entry would explain a spike in authentication failures for that user segment.

What Can Be Monitored

configured domain list
domain-to-AAA-scheme binding
domain active/enabled status

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using hh3cDomainState OID:

Select an H3C router/switch/BRAS with AAA (ISP domain-based AAA scheme binding) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hh3cDomainState into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The state of the domain, which reflects whether the domain is active. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value is anything other than 'active', since that indicates the condition this object reports has changed to one worth investigating. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cDomain	1.3.6.1.4.1.25506.2.46			The MIB module is used for managing domain.
hh3cDomainControl	1.3.6.1.4.1.25506.2.46.1
OCT hh3cDomainDefault	1.3.6.1.4.1.25506.2.46.1.1	OCTET STRING	read-write	Specifies default domain on the equipment. Default value is 'system'.
hh3cDomainTables	1.3.6.1.4.1.25506.2.46.2
hh3cDomainInfoTable	1.3.6.1.4.1.25506.2.46.2.1		not-accessible	The (conceptual) table listing the domains.
hh3cDomainInfoEntry	1.3.6.1.4.1.25506.2.46.2.1.1		not-accessible	An entry (conceptual row) representing a domain.
OCT hh3cDomainName	1.3.6.1.4.1.25506.2.46.2.1.1.1	OCTET STRING	not-accessible	An index uniquely identifies a domain.
INT hh3cDomainStateEx	1.3.6.1.4.1.25506.2.46.2.1.1.2	INTEGER	read-create	The state of the domain, which reflects whether the domain is active. Default value is active.
I32 hh3cDomainMaxAccessNum	1.3.6.1.4.1.25506.2.46.2.1.1.3	Integer32	read-create	The maximum number which the domain allows to access. If the value is set to 0, the access limit will be disabled.
INT hh3cDomainVlanAssignMode	1.3.6.1.4.1.25506.2.46.2.1.1.4	INTEGER	read-create	The vlan assignment mode. The mode SHOULD be the same as the mode of corresponding server. 1 (integer) - Integer Vlan assignment mode. 2 (string) - String Vlan assignment mode. 3 (vlanlist) - VLAN-List Vlan assignment mode. The default value is integer.
T/F hh3cDomainIdleCutEnable	1.3.6.1.4.1.25506.2.46.2.1.1.5	TruthValue	read-create	The idle cut control. Setting this attribute to true, the connection will be cut when the flow is less than hh3cDomainIdleCutMinFlow and lasts hh3cDomainIdleCutMaxTime. Default value is false.
I32 hh3cDomainIdleCutMaxTime	1.3.6.1.4.1.25506.2.46.2.1.1.6	Integer32	read-create	The maximal time of idle-cut. The unit is minute. If the value of hh3cDomainIdleCutEnable is false, the value of hh3cDomainIdleCutMaxTime is meaningless.
I32 hh3cDomainIdleCutMinFlow	1.3.6.1.4.1.25506.2.46.2.1.1.7	Integer32	read-create	The minimal flow of idle-cut. The unit is byte. If the value of hh3cDomainIdleCutEnable is false, the value of hh3cDomainIdleCutMinFlow is meaningless.
T/F hh3cDomainMessengerEnable	1.3.6.1.4.1.25506.2.46.2.1.1.8	TruthValue	read-create	The messenger service control. If set hh3cDomainMessengerEnable to true, hh3cDomainMessengerLimitTime and hh3cDomainMessengerSpanTime must be set to valid values. Default value is false.
I32 hh3cDomainMessengerLimitTime	1.3.6.1.4.1.25506.2.46.2.1.1.9	Integer32	read-create	The messenger service limit time. The unit is minute. If the value of hh3cDomainMessengerEnable is false, the value of hh3cDomainMessengerLimitTime is meaningless.
I32 hh3cDomainMessengerSpanTime	1.3.6.1.4.1.25506.2.46.2.1.1.10	Integer32	read-create	The messenger service span time. The unit is minute. It must be a multiple of 5. If the value of hh3cDomainMessengerEnable is false, the value of hh3cDomainMessengerSpanTime is meaningless.
T/F hh3cDomainSelfServiceEnable	1.3.6.1.4.1.25506.2.46.2.1.1.11	TruthValue	read-create	The self service control. If set hh3cDomainSelfServiceEnable to true, hh3cDomainSelfServiceURL must be set to a valid value. Default value is FALSE.
OCT hh3cDomainSelfServiceURL	1.3.6.1.4.1.25506.2.46.2.1.1.12	OCTET STRING	read-create	Self-service URL(Uniform Resource Locator) of the domain.
INT hh3cDomainAccFailureAction	1.3.6.1.4.1.25506.2.46.2.1.1.13	INTEGER	read-create	Defines the action that authentication should be taken if authentication succeeds but the associated accounting start fails. 1 (ignore) - treat as authentication success; ignore accounting start failure. 2 (reject) - treat as authentication failed if corresponding accounting start fails. Default value is reject.
ROW hh3cDomainRowStatus	1.3.6.1.4.1.25506.2.46.2.1.1.14	RowStatus	read-create	This object is responsible for managing the creation, deletion and modification of rows, which supports active status and CreateAndGo, Destroy operation. To destroy an existent row, the domain of the row MUST NOT be used by user.
I32 hh3cDomainCurrentAccessNum	1.3.6.1.4.1.25506.2.46.2.1.1.15	Integer32	read-only	The current access number of the domain.
hh3cDomainSchemeTable	1.3.6.1.4.1.25506.2.46.2.2		not-accessible	The (conceptual) table listing schemes of all domains.
hh3cDomainSchemeEntry	1.3.6.1.4.1.25506.2.46.2.2.1		not-accessible	An entry (conceptual row) representing an IP pool of a domain
I32 hh3cDomainSchemeIndex	1.3.6.1.4.1.25506.2.46.2.2.1.1	Integer32	not-accessible	The scheme index of domain, which is an identifier of a domain scheme.
HH3 hh3cDomainSchemeMode	1.3.6.1.4.1.25506.2.46.2.2.1.2	Hh3cModeOfDomainScheme	read-create	The scheme mode of the domain. Setting hh3cDomainSchemeMode to none(1) indicates the domain has none scheme. Setting hh3cDomainSchemeMode to local(2) indicates the domain will use local-server as a scheme. Setting hh3cDomainSchemeMode to radius(3) or tacacs(4) indicates the domain will use radius or tacacs scheme. If set hh3cDomainSchemeMode to radius(3) or tacacs(4), hh3cDomainAuthSchemeName and hh3cDomainAcctSchemeName must be set to valid values. And if hh3cDomainSchemeMode is set to none(1) or local(2), the value of hh3cDomainAuthSchemeName and hh3cDomainAcctSchemeName will be ignored.
OCT hh3cDomainAuthSchemeName	1.3.6.1.4.1.25506.2.46.2.2.1.3	OCTET STRING	read-create	The authentication scheme name of domain. If hh3cDomainSchemeMode is set to radius or tacacs, the hh3cDomainAuthSchemeName must be configured with a valid value.
OCT hh3cDomainAcctSchemeName	1.3.6.1.4.1.25506.2.46.2.2.1.4	OCTET STRING	read-create	The accounting scheme name of the domain. If hh3cDomainSchemeMode is set to radius or tacacs, the hh3cDomainAcctSchemeName must be configured with a valid value.
ROW hh3cDomainSchemeRowStatus	1.3.6.1.4.1.25506.2.46.2.2.1.5	RowStatus	read-create	This object is responsible for managing the creation, deletion and modification of rows, which supports active status and createAndGo, destroy operation. To create a new row, hh3cDomainSchemeMode must be specified. To destroy an existent row, the scheme of the row MUST NOT be used by user.
HH3 hh3cDomainSchemeAAAType	1.3.6.1.4.1.25506.2.46.2.2.1.6	Hh3cAAATypeDomainScheme	read-create	Service Type of the server.
OCT hh3cDomainSchemeAAAName	1.3.6.1.4.1.25506.2.46.2.2.1.7	OCTET STRING	read-create	The scheme name of the domain, whether the scheme represents accounting, authentication or authorization references the object hh3cDomainSchemeAAAType. The value of the object must be valid if the value of hh3cDomainSchemeMode is radius or tacacs, the value of the object will be ignored if the value of hh3cDomainSchemeMode is none or local. If the domain has no scheme, there will be a null string. If this object is supported, the objects hh3cDomainAuthSchemeName and hh3cDomainAcctSchemeName will be ignored.
HH3 hh3cDomainSchemeAccessMode	1.3.6.1.4.1.25506.2.46.2.2.1.8	Hh3cAccessModeofDomainScheme	read-create	The access mode of the domain scheme.
hh3cDomainIpPoolTable	1.3.6.1.4.1.25506.2.46.2.3		not-accessible	The (conceptual) table listing IP pools of all domains.
hh3cDomainIpPoolEntry	1.3.6.1.4.1.25506.2.46.2.3.1		not-accessible	An entry (conceptual row) representing an IP pool of a domain.
I32 hh3cDomainIpPoolNum	1.3.6.1.4.1.25506.2.46.2.3.1.1	Integer32	not-accessible	The number of IP pool, which is an identifier of an IP pool.
IPt hh3cDomainIpPoolLowIpAddrType	1.3.6.1.4.1.25506.2.46.2.3.1.2	InetAddressType	read-create	The low IP addresses type (IPv4 or IPv6) of IP pool.
IP hh3cDomainIpPoolLowIpAddr	1.3.6.1.4.1.25506.2.46.2.3.1.3	InetAddress	read-create	The low IP address of IP pool.
I32 hh3cDomainIpPoolLen	1.3.6.1.4.1.25506.2.46.2.3.1.4	Integer32	read-create	The length of IP pool. Default value is 1.
ROW hh3cDomainIpPoolRowStatus	1.3.6.1.4.1.25506.2.46.2.3.1.5	RowStatus	read-create	This object is responsible for managing the creation, deletion and modification of rows, which supports active status and CreateAndGo, Destroy operation. To create a new row, hh3cDomainIpPoolNum and hh3cDomainIpPoolLowIpAddr must be specified. To destroy an existent row, the IP pool of this row MUST NOT be used by user.

RFC description

Vendor-private MIB for H3C domain (user/administrative domain) configuration and management; used on H3C network equipment.

Start monitoring H3C router/switch/BRAS with AAA (ISP domain-based AAA scheme binding) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-DOMAIN-MIB