HH3C-IPSEC-MONITOR-MIB

All MIBs › HH3C-IPSEC-MONITOR-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2004-10-26

Category: Domain: Security, VPN and Security, Vendor: H3C/HH3C

Description: Monitors IPsec security associations, tunnel status, and encrypted traffic statistics on H3C VPN platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-IPSEC-MONITOR-MIB?

HH3C-IPSEC-MONITOR-MIB is an H3C (Huawei-3Com) enterprise MIB for monitoring IPsec VPN tunnels, within the network security/VPN management area on H3C routers, switches, and firewalls. Per its module description, it is designed to retrieve statistical information about IPsec tunnels, for either a specific tunnel or all tunnels on the device. Its monitoring emphasis is squarely on software/service status rather than physical hardware: tunnel state (up/down), security-association status, and encrypted/decrypted traffic counters let an administrator detect a failed or renegotiating VPN tunnel, or unusually low/zero traffic indicating a stalled connection. It likely complements H3C's own IKE/ISAKMP management MIBs, which would cover key-exchange/negotiation detail underlying the tunnels this MIB reports on. Typical deployment is H3C VPN gateways, routers, and firewalls in enterprise site-to-site or remote-access IPsec VPN deployments. Engineers can download the HH3C-IPSEC-MONITOR-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-IPSEC-MONITOR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C (Huawei-3Com) routers
H3C VPN gateways/firewalls

Monitoring Examples

No specific object or table names were included in the available source excerpt, so exact objects cannot be confirmed; based on the module description, this MIB would expose a per-tunnel table with a tunnel status/state object and encrypted/decrypted packet or byte counters, queryable for one tunnel or aggregated across all tunnels. An administrator monitoring a site-to-site VPN would poll per-tunnel status to catch a tunnel that dropped to a down or negotiating state, and check traffic counters to confirm the tunnel is actually carrying the expected volume of encrypted traffic.

What Can Be Monitored

per-tunnel IPsec status (up/down/negotiating)
encrypted/decrypted traffic statistics per tunnel
aggregate IPsec tunnel count
security association state

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From RFC1213-MIB

ifIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using hh3cIPSecTunTotalRefreshes OID:

Select an H3C router/VPN gateway/firewall (IPsec tunnel statistics) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hh3cIPSecTunTotalRefreshes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The total number of security association refreshing performed. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cIPSecMonitor	1.3.6.1.4.1.25506.2.7			The MIB is designed to get statistic information of IPSec tunnels. With this MIB, we can get information of a certain tunnel or all tunnels.
hh3cIPSecObjects	1.3.6.1.4.1.25506.2.7.1
hh3cIPSecTunnelTable	1.3.6.1.4.1.25506.2.7.1.1		not-accessible	The IPSec Phase-2 Tunnel Table. There is one entry in this table for each active IPSec Phase-2 Tunnel.
hh3cIPSecTunnelEntry	1.3.6.1.4.1.25506.2.7.1.1.1		not-accessible	Information about hh3cIPSecTunnelTable.
I32 hh3cIPSecTunIfIndex	1.3.6.1.4.1.25506.2.7.1.1.1.1	Integer32	not-accessible	The interface index( the ifIndex of ifTable ).
I32 hh3cIPSecTunEntryIndex	1.3.6.1.4.1.25506.2.7.1.1.1.2	Integer32	not-accessible	The index of IPSec policy applied in the interface.
I32 hh3cIPSecTunIndex	1.3.6.1.4.1.25506.2.7.1.1.1.3	Integer32	not-accessible	The index of IPSec Phase-2 Tunnel Table. The value of the index is a number which begins at one and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647.
I32 hh3cIPSecTunIKETunnelIndex	1.3.6.1.4.1.25506.2.7.1.1.1.4	Integer32	read-only	The index of the associated IPSec Phase-1 IKE Tunnel (IKETunIndex in the IKETunnelTable). 2147483647 is defined as invalid value.
IP hh3cIPSecTunLocalAddr	1.3.6.1.4.1.25506.2.7.1.1.1.5	IpAddress	read-only	The IP address of the local peer for the IPSec Phase-2 Tunnel. 0.0.0.0 is defined as invalid value.
IP hh3cIPSecTunRemoteAddr	1.3.6.1.4.1.25506.2.7.1.1.1.6	IpAddress	read-only	The IP address of the remote peer for the IPSec Phase-2 Tunnel. 0.0.0.0 is defined as invalid value.
HH3 hh3cIPSecTunKeyType	1.3.6.1.4.1.25506.2.7.1.1.1.7	Hh3cIPSecNegoType	read-only	The key negotiate mode used by the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecTunEncapMode	1.3.6.1.4.1.25506.2.7.1.1.1.8	Hh3cEncapMode	read-only	The encapsulation mode used by the IPSec Phase-2 Tunnel.
INT hh3cIPSecTunInitiator	1.3.6.1.4.1.25506.2.7.1.1.1.9	INTEGER	read-only	The initiator of this IPSec tunnel. Value none is used for manual IPsec tunnel, for there is no initiator or responder in this method.
G32 hh3cIPSecTunLifeSize	1.3.6.1.4.1.25506.2.7.1.1.1.10	Gauge32	read-only	The negotiated LifeSize of the IPSec Phase-2 Tunnel in kilobytes. 0 is defined as invalid value.
I32 hh3cIPSecTunLifeTime	1.3.6.1.4.1.25506.2.7.1.1.1.11	Integer32	read-only	The negotiated LifeTime of the IPSec Phase-2 Tunnel in seconds. 2147483647 is defined as invalid value.
I32 hh3cIPSecTunRemainTime	1.3.6.1.4.1.25506.2.7.1.1.1.12	Integer32	read-only	The remain time of SA in seconds. 2147483647 is defined as invalid value.
I32 hh3cIPSecTunActiveTime	1.3.6.1.4.1.25506.2.7.1.1.1.13	Integer32	read-only	The duration the IPSec Phase-2 Tunnel has been active in hundredths of seconds. 2147483647 is defined as invalid value.
G32 hh3cIPSecTunRemainSize	1.3.6.1.4.1.25506.2.7.1.1.1.14	Gauge32	read-only	The remain LifeSize of SA in kilobytes. 0 is defined as invalid value.
C32 hh3cIPSecTunTotalRefreshesEx	1.3.6.1.4.1.25506.2.7.1.1.1.15	Counter32	read-only	The total number of security association refreshing performed.
G32 hh3cIPSecTunCurrentSaInstances	1.3.6.1.4.1.25506.2.7.1.1.1.16	Gauge32	read-only	The number of security associations which are currently active or expiring.
HH3 hh3cIPSecTunInSaEncryptAlgo	1.3.6.1.4.1.25506.2.7.1.1.1.17	Hh3cEncryptAlgo	read-only	The encryption algorithm used by the inbound security association of the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecTunInSaAhAuthAlgo	1.3.6.1.4.1.25506.2.7.1.1.1.18	Hh3cAuthAlgo	read-only	The authentication algorithm used by the inbound authentication header (AH) security association of the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecTunInSaEspAuthAlgo	1.3.6.1.4.1.25506.2.7.1.1.1.19	Hh3cAuthAlgo	read-only	The authentication algorithm used by the inbound encapsulation security protocol(ESP) security association of the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecTunDiffHellmanGrp	1.3.6.1.4.1.25506.2.7.1.1.1.20	Hh3cDiffHellmanGrp	read-only	The Diffie Hellman Group used by the security association of the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecTunOutSaEncryptAlgo	1.3.6.1.4.1.25506.2.7.1.1.1.21	Hh3cEncryptAlgo	read-only	The encryption algorithm used by the outbound security association of the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecTunOutSaAhAuthAlgo	1.3.6.1.4.1.25506.2.7.1.1.1.22	Hh3cAuthAlgo	read-only	The authentication algorithm used by the outbound authentication header (AH) security association of the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecTunOutSaEspAuthAlgo	1.3.6.1.4.1.25506.2.7.1.1.1.23	Hh3cAuthAlgo	read-only	The authentication algorithm used by the outbound encapsulation security protocol(ESP) security association of the IPSec Phase-2 Tunnel.
STR hh3cIPSecTunPolicyName	1.3.6.1.4.1.25506.2.7.1.1.1.24	DisplayString	read-only	The policy name used by this IPSec tunnel.
I32 hh3cIPSecTunPolicyNum	1.3.6.1.4.1.25506.2.7.1.1.1.25	Integer32	read-only	The sequence number of policy used by this IPSec tunnel.
INT hh3cIPSecTunStatus	1.3.6.1.4.1.25506.2.7.1.1.1.26	INTEGER	read-only	The status of the IPSec Tunnel.
hh3cIPSecTunnelStatTable	1.3.6.1.4.1.25506.2.7.1.2		not-accessible	The IPSec Phase-2 Tunnel Statistics Table.
hh3cIPSecTunnelStatEntry	1.3.6.1.4.1.25506.2.7.1.2.1		not-accessible	Information about hh3cIPSecTunnelStatTable.
C64 hh3cIPSecTunInOctets	1.3.6.1.4.1.25506.2.7.1.2.1.1	Counter64	read-only	The total number of octets received by this IPSec Phase-2 Tunnel. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 hh3cIPSecTunInDecompOctets	1.3.6.1.4.1.25506.2.7.1.2.1.2	Counter64	read-only	The total number of decompressed octets received by this IPSec Phase-2 Tunnel. This value is accumulated AFTER the packet is decompressed.
C64 hh3cIPSecTunInPkts	1.3.6.1.4.1.25506.2.7.1.2.1.3	Counter64	read-only	The total number of packets received by this IPSec Phase-2 Tunnel.
C64 hh3cIPSecTunInDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.4	Counter64	read-only	The total number of packets dropped during receiving process by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunInReplayDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.5	Counter32	read-only	The total number of packets dropped during receiving process due to Anti-Replay process by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunInAuthFails	1.3.6.1.4.1.25506.2.7.1.2.1.6	Counter32	read-only	The total number of inbound authentication's which ended in failure by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunInDecryptFails	1.3.6.1.4.1.25506.2.7.1.2.1.7	Counter32	read-only	The total number of inbound decryption's which ended in failure by this IPSec Phase-2 Tunnel.
C64 hh3cIPSecTunOutOctets	1.3.6.1.4.1.25506.2.7.1.2.1.8	Counter64	read-only	The total number of octets sent by this IPSec Phase-2 Tunnel. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 hh3cIPSecTunOutUncompOctets	1.3.6.1.4.1.25506.2.7.1.2.1.9	Counter64	read-only	The total number of uncompressed octets sent by this IPSec Phase-2 Tunnel.This value is accumulated BEFORE the packet is compressed.
C64 hh3cIPSecTunOutPkts	1.3.6.1.4.1.25506.2.7.1.2.1.10	Counter64	read-only	The total number of packets sent by this IPSec Phase-2 Tunnel.
C64 hh3cIPSecTunOutDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.11	Counter64	read-only	The total number of packets dropped during sending process by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunOutEncryptFails	1.3.6.1.4.1.25506.2.7.1.2.1.12	Counter32	read-only	The total number of outbound encryption's which ended in failure by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunNoMemoryDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.13	Counter32	read-only	The total number of packets dropped due to no enough memory by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunQueueFullDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.14	Counter32	read-only	The total number of packets dropped due to queue full by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunInvalidLenDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.15	Counter32	read-only	The total number of packets dropped due to invalid length packet by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunTooLongDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.16	Counter32	read-only	The total number of packets dropped due to too long packet by this IPSec Phase-2 Tunnel.
C32 hh3cIPSecTunInvalidSaDropPkts	1.3.6.1.4.1.25506.2.7.1.2.1.17	Counter32	read-only	The total number of packets dropped due to invalid SA by this IPSec Phase-2 Tunnel.
hh3cIPSecSaTable	1.3.6.1.4.1.25506.2.7.1.3		not-accessible	The IPSec Phase-2 Security Protection Index Table. This table contains an entry for each active and expiring security association.
hh3cIPSecSaEntry	1.3.6.1.4.1.25506.2.7.1.3.1		not-accessible	Information about hh3cIPSecSaTable.
I32 hh3cIPSecSaIndex	1.3.6.1.4.1.25506.2.7.1.3.1.1	Integer32	not-accessible	The number of the Sa associated with the Phase-2 Tunnel Table. The value of this index is a number which begins at one and is incremented with each Sa associated with an IPSec Phase-2 Tunnel. The value of this object will wrap at 2,147,483,647.
INT hh3cIPSecSaDirection	1.3.6.1.4.1.25506.2.7.1.3.1.2	INTEGER	read-only	The direction of the SA.
U32 hh3cIPSecSaValue	1.3.6.1.4.1.25506.2.7.1.3.1.3	Unsigned32	read-only	The value of the SPI.
HH3 hh3cIPSecSaProtocol	1.3.6.1.4.1.25506.2.7.1.3.1.4	Hh3cSaProtocol	read-only	The security protocol of the SA.
HH3 hh3cIPSecSaEncryptAlgo	1.3.6.1.4.1.25506.2.7.1.3.1.5	Hh3cEncryptAlgo	read-only	The encryption algorithm used by the security association of the IPSec Phase-2 Tunnel.
HH3 hh3cIPSecSaAuthAlgo	1.3.6.1.4.1.25506.2.7.1.3.1.6	Hh3cAuthAlgo	read-only	The authentication algorithm used by the SA.
INT hh3cIPSecSaStatus	1.3.6.1.4.1.25506.2.7.1.3.1.7	INTEGER	read-only	The status of the SA.
hh3cIPSecTrafficTable	1.3.6.1.4.1.25506.2.7.1.4		not-accessible	The IPSec Phase-2 Tunnel Traffic Table.
hh3cIPSecTrafficEntry	1.3.6.1.4.1.25506.2.7.1.4.1		not-accessible	Information about hh3cIPSecTrafficTable.
HH3 hh3cIPSecTrafficLocalType	1.3.6.1.4.1.25506.2.7.1.4.1.1	Hh3cTrafficType	read-only	The type of local peer. Possible values are: a single IP address, or an IP address range, or an IP subnet.
IP hh3cIPSecTrafficLocalAddr1	1.3.6.1.4.1.25506.2.7.1.4.1.2	IpAddress	read-only	The first specification of local peer's IP address. If the local peer type is single IP address, then this is the value of the IP address. If the local peer type is IP subnet, then this is the value of the subnet. If the local peer type is IP address range, then this is the value of beginning IP address of the range.
IP hh3cIPSecTrafficLocalAddr2	1.3.6.1.4.1.25506.2.7.1.4.1.3	IpAddress	read-only	The second specification of local peer's IP address. If the local peer type is single IP address, then this is the value of the IP address. If the local peer type is IP subnet, then this is the value of the subnet mask. If the local peer type is IP address range, then this is the value of ending IP address of the range.
I32 hh3cIPSecTrafficLocalProtocol	1.3.6.1.4.1.25506.2.7.1.4.1.4	Integer32	read-only	The protocol number of the local peer's traffic.
I32 hh3cIPSecTrafficLocalPort	1.3.6.1.4.1.25506.2.7.1.4.1.5	Integer32	read-only	The port number of the local peer's traffic.
HH3 hh3cIPSecTrafficRemoteType	1.3.6.1.4.1.25506.2.7.1.4.1.6	Hh3cTrafficType	read-only	The type of remote peer. Possible values are: a single IP address, or an IP address range, or an IP subnet.
IP hh3cIPSecTrafficRemoteAddr1	1.3.6.1.4.1.25506.2.7.1.4.1.7	IpAddress	read-only	The first specification of remote peer's IP address. If the remote peer type is single IP address, then this is the value of the IP address. If the remote peer type is IP subnet, then this is the value of the subnet. If the remote peer type is IP address range, then this is the value of beginning IP address of the range.
IP hh3cIPSecTrafficRemoteAddr2	1.3.6.1.4.1.25506.2.7.1.4.1.8	IpAddress	read-only	Single IP address, then this is the value of the IP address. If the remote peer type is IP subnet, then this is the value of the subnet mask. If the remote peer type is IP address range, then this is the value of ending IP address of the range.
I32 hh3cIPSecTrafficRemoteProtocol	1.3.6.1.4.1.25506.2.7.1.4.1.9	Integer32	read-only	The protocol number of the remote peer's traffic.
I32 hh3cIPSecTrafficRemotePort	1.3.6.1.4.1.25506.2.7.1.4.1.10	Integer32	read-only	The port number of the remote peer's traffic.
hh3cIPSecGlobalStats	1.3.6.1.4.1.25506.2.7.1.5
G32 hh3cIPSecGlobalActiveTunnels	1.3.6.1.4.1.25506.2.7.1.5.1	Gauge32	read-only	The total number of currently active IPSec Phase-2 Tunnels.
G32 hh3cIPSecGlobalActiveSas	1.3.6.1.4.1.25506.2.7.1.5.2	Gauge32	read-only	The total number of currently active or expiring IPSec Phase-2 SA.
C64 hh3cIPSecGlobalInOctets	1.3.6.1.4.1.25506.2.7.1.5.3	Counter64	read-only	The total number of octets received by all current and previous IPSec Phase-2 Tunnels. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 hh3cIPSecGlobalInDecompOctets	1.3.6.1.4.1.25506.2.7.1.5.4	Counter64	read-only	The total number of decompressed octets received by all current and previous IPSec Phase-2 Tunnels. This value is accumulated AFTER the packet is decompressed.
C64 hh3cIPSecGlobalInPkts	1.3.6.1.4.1.25506.2.7.1.5.5	Counter64	read-only	The total number of packets received by all current and previous IPSec Phase-2 Tunnels.
C64 hh3cIPSecGlobalInDrops	1.3.6.1.4.1.25506.2.7.1.5.6	Counter64	read-only	The total number of packets dropped during receiving process by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalInReplayDrops	1.3.6.1.4.1.25506.2.7.1.5.7	Counter32	read-only	The total number of packets dropped during receiving process due to Anti-Replay process by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalInAuthFails	1.3.6.1.4.1.25506.2.7.1.5.8	Counter32	read-only	The total number of inbound authentication's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalInDecryptFails	1.3.6.1.4.1.25506.2.7.1.5.9	Counter32	read-only	The total number of inbound decryption's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C64 hh3cIPSecGlobalOutOctets	1.3.6.1.4.1.25506.2.7.1.5.10	Counter64	read-only	The total number of octets sent by all current and previous IPSec Phase-2 Tunnels. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 hh3cIPSecGlobalOutUncompOctets	1.3.6.1.4.1.25506.2.7.1.5.11	Counter64	read-only	The total number of uncompressed octets sent by all current and previous IPSec Phase-2 Tunnels. This value is accumulated BEFORE the packet is compressed.
C64 hh3cIPSecGlobalOutPkts	1.3.6.1.4.1.25506.2.7.1.5.12	Counter64	read-only	The total number of packets sent by all current and previous IPSec Phase-2 Tunnels.
C64 hh3cIPSecGlobalOutDrops	1.3.6.1.4.1.25506.2.7.1.5.13	Counter64	read-only	The total number of packets dropped during sending process by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalOutEncryptFails	1.3.6.1.4.1.25506.2.7.1.5.14	Counter32	read-only	The total number of outbound encryption's which ended in failure by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalNoMemoryDropPkts	1.3.6.1.4.1.25506.2.7.1.5.15	Counter32	read-only	The total number of packets dropped due to no enough memory by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalNoFindSaDropPkts	1.3.6.1.4.1.25506.2.7.1.5.16	Counter32	read-only	The total number of packets dropped due to not find SA by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalQueueFullDropPkts	1.3.6.1.4.1.25506.2.7.1.5.17	Counter32	read-only	The total number of packets dropped due to queue full by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalInvalidLenDropPkts	1.3.6.1.4.1.25506.2.7.1.5.18	Counter32	read-only	The total number of packets dropped due to invalid packet length by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalTooLongDropPkts	1.3.6.1.4.1.25506.2.7.1.5.19	Counter32	read-only	The total number of packets dropped due to too long packet by all current and previous IPSec Phase-2 Tunnels.
C32 hh3cIPSecGlobalInvalidSaDropPkts	1.3.6.1.4.1.25506.2.7.1.5.20	Counter32	read-only	The total number of packets dropped due to invalid SA by all current and previous IPSec Phase-2 Tunnels.
hh3cIPSecTrapObject	1.3.6.1.4.1.25506.2.7.1.6
STR hh3cIPSecPolicyName	1.3.6.1.4.1.25506.2.7.1.6.1	DisplayString	accessible-for-notify	The IPSec policy name with a trap.
I32 hh3cIPSecPolicySeqNum	1.3.6.1.4.1.25506.2.7.1.6.2	Integer32	accessible-for-notify	The IPSec policy sequence number with a trap.
I32 hh3cIPSecPolicySize	1.3.6.1.4.1.25506.2.7.1.6.3	Integer32	accessible-for-notify	The number of IPSec policies with a trap.
I32 hh3cIPSecSpiValue	1.3.6.1.4.1.25506.2.7.1.6.4	Integer32	accessible-for-notify	The SPI value associated with a trap.
hh3cIPSecTrapCntl	1.3.6.1.4.1.25506.2.7.1.7
HH3 hh3cIPSecTrapGlobalCntl	1.3.6.1.4.1.25506.2.7.1.7.1	Hh3cTrapStatus	read-write	Indicates whether all IPSec traps should be generated.
HH3 hh3cIPSecTunnelStartTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.2	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecTunnelStart traps should be generated.
HH3 hh3cIPSecTunnelStopTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.3	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecTunnelStop traps should be generated.
HH3 hh3cIPSecNoSaTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.4	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecNoSaFailure traps should be generated.
HH3 hh3cIPSecAuthFailureTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.5	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecAuthFailFailure traps should be generated.
HH3 hh3cIPSecEncryFailureTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.6	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecEncryFailFailure traps should be generated.
HH3 hh3cIPSecDecryFailureTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.7	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecDecryFailFailure traps should be generated.
HH3 hh3cIPSecInvalidSaTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.8	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSec Invalid Sa Failure traps should be generated.
HH3 hh3cIPSecPolicyAddTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.9	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecPolicyAdd traps should be generated.
HH3 hh3cIPSecPolicyDelTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.10	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecPolicyDel traps should be generated.
HH3 hh3cIPSecPolicyAttachTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.11	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecPolicyAttach traps should be generated.
HH3 hh3cIPSecPolicyDetachTrapCntl	1.3.6.1.4.1.25506.2.7.1.7.12	Hh3cTrapStatus	read-write	Indicates whether hh3cIPSecPolicyDetach traps should be generated.
hh3cIPSecTrap	1.3.6.1.4.1.25506.2.7.1.8
hh3cIPSecNotifications	1.3.6.1.4.1.25506.2.7.1.8.1
NTF hh3cIPSecTunnelStart	1.3.6.1.4.1.25506.2.7.1.8.1.1			This notification is generated when an IPSec Phase-2 Tunnel is created.
NTF hh3cIPSecTunnelStop	1.3.6.1.4.1.25506.2.7.1.8.1.2			This notification is generated when an IPSec Phase-2 Tunnel is deleted.
NTF hh3cIPSecNoSaFailure	1.3.6.1.4.1.25506.2.7.1.8.1.3			This notification is generated when an IPSec Phase-2 non-existent SA error occurs.
NTF hh3cIPSecAuthFailFailure	1.3.6.1.4.1.25506.2.7.1.8.1.4			This notification is generated when the IPSec phase-2 authentication failure occurs.
NTF hh3cIPSecEncryFailFailure	1.3.6.1.4.1.25506.2.7.1.8.1.5			This notification is generated when the IPSec phase-2 tunnel has an encrypting failure.
NTF hh3cIPSecDecryFailFailure	1.3.6.1.4.1.25506.2.7.1.8.1.6			This notification is generated when the IPSec phase-2 tunnel has a decrypting failure.
NTF hh3cIPSecInvalidSaFailure	1.3.6.1.4.1.25506.2.7.1.8.1.7			This notification is generated when the IPSec phase-2 invalid SA failure occurs.
NTF hh3cIPSecPolicyAdd	1.3.6.1.4.1.25506.2.7.1.8.1.8			This notification is generated when an IPSec policy is added.
NTF hh3cIPSecPolicyDel	1.3.6.1.4.1.25506.2.7.1.8.1.9			This notification is generated when an IPSec policy is deleted.
NTF hh3cIPSecPolicyAttach	1.3.6.1.4.1.25506.2.7.1.8.1.10			This notification is generated when an IPSec policy is attached with one interface.
NTF hh3cIPSecPolicyDetach	1.3.6.1.4.1.25506.2.7.1.8.1.11			This notification is generated when an IPSec policy is detached with one interface.
hh3cIPSecConformance	1.3.6.1.4.1.25506.2.7.2
hh3cIPSecCompliances	1.3.6.1.4.1.25506.2.7.2.1
hh3cIPSecCompliance	1.3.6.1.4.1.25506.2.7.2.1.1
hh3cIPSecGroups	1.3.6.1.4.1.25506.2.7.2.2
hh3cIPSecTunnelTableGroup	1.3.6.1.4.1.25506.2.7.2.2.1			The group contains the IPSec tunnel's property information.
hh3cIPSecTunnelStatGroup	1.3.6.1.4.1.25506.2.7.2.2.2			The group contains the IPSec tunnel's statistic information.
hh3cIPSecSaGroup	1.3.6.1.4.1.25506.2.7.2.2.3			The group contains the SA's property information.
hh3cIPSecTrafficTableGroup	1.3.6.1.4.1.25506.2.7.2.2.4			The group contains the property information of the data flow protected by IPSec tunnel.
hh3cIPSecGlobalStatsGroup	1.3.6.1.4.1.25506.2.7.2.2.5			The group contains all of the IPSec tunnel's statistic information.
hh3cIPSecTrapObjectGroup	1.3.6.1.4.1.25506.2.7.2.2.6			The group contains all of trap objects of IPSec tunnels.
hh3cIPSecTrapCntlGroup	1.3.6.1.4.1.25506.2.7.2.2.7			The group contains all of trap switches of IPSec tunnels.
hh3cIPSecTrapGroup	1.3.6.1.4.1.25506.2.7.2.2.8			The group contains all of trap of IPSec tunnels.

RFC description

Huawei H3C vendor-private MIB for monitoring IPSec tunnel operations and security associations.

Start monitoring H3C router/VPN gateway/firewall (IPsec tunnel statistics) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-IPSEC-MONITOR-MIB