HH3C-NDEC-MIB

All MIBs › HH3C-NDEC-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2004-09-15

Category: Technology: SDN/OpenFlow, Vendor: H3C/HH3C

Description: Manages Network Device Edge Controller (NDEC) functions for SD-WAN and edge device orchestration on H3C platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-NDEC-MIB?

HH3C-NDEC-MIB is an H3C MIB for managing Network Device Edge Controller (NDEC) functionality, used in SD-WAN and edge-device orchestration, with a notable focus on IPsec Security Association (SA) parameters between edge devices. It exposes SA list tables containing peer IP address, protocol, SPI, encryption/authentication algorithms, and SA lifetime (in kilobytes and seconds), along with negotiation-mode settings. Its monitoring role centers on confirming secure tunnel/session health between SD-WAN edge nodes, checking that IPsec SAs are established with the correct algorithms and haven't expired, a software/security-configuration status concern rather than physical hardware monitoring. It depends conceptually on standard IPsec/IKE concepts (SPI, SA lifetime) similar to those found in IETF IPsec-related MIBs, even though this is H3C's own SD-WAN-oriented implementation. It is typically deployed on H3C SD-WAN edge routers/controllers establishing encrypted overlay tunnels across an NDEC-managed fabric. Engineers can download the HH3C-NDEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-NDEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C SD-WAN edge router
H3C NDEC controller

Monitoring Examples

An admin would poll hh3chipsNDECSAListTable, keyed by hh3chipsSPI, to check hh3chipsPeerIpAddr, hh3chipsEncAlgorithm, hh3chipsAuthAlgorithm, and remaining hh3chipsSaLifeSecond/hh3chipsSaLifeKBytes for each active IPsec SA between SD-WAN edge nodes. An SA nearing its lifetime limit without renegotiation, or a mismatch in hh3chipsNegotiateSaMode between peers, would reveal an impending or active tunnel-drop condition. The hh3chipsTraps group would notify the operator when an SA is established or torn down.

What Can Be Monitored

IPsec SA peer address
SA encryption/authentication algorithm
SA lifetime remaining
SA negotiation mode
SA establishment/teardown events

Imported Objects

From HH3C-OID-MIB

hh3cmlsr

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TruthValue

How to Use in IPNetwork Monitor

Example using hh3chipsInPac OID:

Select an H3C SD-WAN edge router/NDEC controller (IPsec SA between edge devices) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hh3chipsInPac into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the total packets of the NDEC recieved. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
T/F hh3chikeClearSA	1.3.6.1.4.1.25506.8.36.2.2.1.6	TruthValue	read-write	Clear this IKE SA or not.
I32 hh3chikeConnId	1.3.6.1.4.1.25506.8.36.2.2.1.1	Integer32	read-only	The identifier of IKE SA connection.
INT hh3chikeDoi	1.3.6.1.4.1.25506.8.36.2.2.1.5	INTEGER	read-only	The domain of this IKE SA
STR hh3chikeFlag	1.3.6.1.4.1.25506.8.36.2.2.1.3	DisplayString	read-only	The status of this IKE SA.
IP hh3chikePeerIpAddr	1.3.6.1.4.1.25506.8.36.2.2.1.2	IpAddress	read-only	The peer IP address of this IKE SA.
INT hh3chikePhase	1.3.6.1.4.1.25506.8.36.2.2.1.4	INTEGER	read-only	The phase of this IKE SA.
hh3chikeSAEntry	1.3.6.1.4.1.25506.8.36.2.2.1		not-accessible	Each entry contains the attributes associated with a single IKE SA entity.
hh3chikeSATable	1.3.6.1.4.1.25506.8.36.2.2		not-accessible	The table containing IKE SA entities configured on NDEC by the operator.
INT hh3chipsAH	1.3.6.1.4.1.25506.8.36.2.5.1.4	INTEGER	read-only	Algorithm of AH protocol.
INT hh3chipsAuthAlgorithm	1.3.6.1.4.1.25506.8.36.2.1.1.5	INTEGER	read-only	The authentication algorithm of this SA entry.
T/F hh3chipsByCard	1.3.6.1.4.1.25506.8.36.2.1.1.9	TruthValue	read-only	The flag of this SA on NDEC or not.
STR hh3chipsCardCPLDVer	1.3.6.1.4.1.25506.8.36.2.6.1.10	DisplayString	read-only	CPLD version of the NDEC.
STR hh3chipsCardHardVer	1.3.6.1.4.1.25506.8.36.2.6.1.8	DisplayString	read-only	Hardware version of the NDEC.
INT hh3chipsCardOperate	1.3.6.1.4.1.25506.8.36.2.6.1.11	INTEGER	read-write	The version of the NDEC's CPLD. cardClearStatic(1): clear the statistics of the card cardReset(2): rest the card cardSynTime(3): synchoronize the clock of the card cardSysLogOn(4):turn on the log of the card cardSysLogOff(5):turn off the log of the card cardSysLogClear(6):clear the log of the card
INT hh3chipsCardSlot	1.3.6.1.4.1.25506.8.36.2.6.1.1	INTEGER	read-only	Slot number of NDEC .
STR hh3chipsCardSoftVer	1.3.6.1.4.1.25506.8.36.2.6.1.9	DisplayString	read-only	Software version of the NDEC.
INT hh3chipsCardStatus	1.3.6.1.4.1.25506.8.36.2.6.1.7	INTEGER	read-only	State of the NDEC.
C32 hh3chipsDropPac	1.3.6.1.4.1.25506.8.36.2.6.1.6	Counter32	read-only	Total packets of the NDEC dropped .
G32 hh3chipsDropPacInUnitTime	1.3.6.1.4.1.25506.8.36.2.6.1.12	Gauge32	read-only	Dropped packets in unit interval.
INT hh3chipsEespEn	1.3.6.1.4.1.25506.8.36.2.5.1.5	INTEGER	read-only	Encryption algorithm of ESP protocol.
INT hh3chipsEncAlgorithm	1.3.6.1.4.1.25506.8.36.2.1.1.4	INTEGER	read-only	The encrypt algorithm of this SA entry.
INT hh3chipsEspAu	1.3.6.1.4.1.25506.8.36.2.5.1.6	INTEGER	read-only	Authentication algorithm of ESP protocol.
G32 hh3chipsExpBytes	1.3.6.1.4.1.25506.8.36.2.1.1.11	Gauge32	read-only	This object specifies the lifetime in bytes of the tunnels generated using this policy specification.
G32 hh3chipsExpTimeout	1.3.6.1.4.1.25506.8.36.2.1.1.13	Gauge32	read-only	This object specifies the lifetime in seconds of the tunnels generated using this policy specification.
STR hh3chipsIfNameUsed	1.3.6.1.4.1.25506.8.36.2.4.1.10	DisplayString	read-only	This object indicates the name of the interface which uses this IPSec policy entry.
hh3chipsIKEPolicyEntry	1.3.6.1.4.1.25506.8.36.2.3.1		not-accessible	Each entry includes the properties of a ISAKMP Policy entry.
hh3chipsIKEPolicyTable	1.3.6.1.4.1.25506.8.36.2.3		not-accessible	List of all ISAKMP policy entries.
STR hh3chipsInAhHexKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.15	DisplayString	read-only	This object indicates the inbound AH authentication key IPSec SAs generated using this IPSec policy entry. The AH authentication key is in hex.
G32 hh3chipsInAHSPI	1.3.6.1.4.1.25506.8.36.2.4.1.11	Gauge32	read-only	This object indicates the inbound AH SPI IPSec SAs generated using this IPSec policy entry.
STR hh3chipsInAhStringKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.18	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hh3chipsInByte	1.3.6.1.4.1.25506.8.36.2.6.1.4	Counter32	read-only	Total bytes of the NDEC sent.
STR hh3chipsInEspAuthenHexKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.17	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The ESP authentication key is hex.
STR hh3chipsInEspCipherHexKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.16	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The ESP authentication key is hex.
G32 hh3chipsInESPSPI	1.3.6.1.4.1.25506.8.36.2.4.1.12	Gauge32	read-only	This object indicates the inbound ESP SPI IPSec SAs generated using this IPSec policy entry.
STR hh3chipsInEspStringKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.19	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hh3chipsInPacEx	1.3.6.1.4.1.25506.8.36.2.6.1.2	Counter32	read-only	Total packets of the NDEC recieved.
INT hh3chipsIsakmpPolAuth	1.3.6.1.4.1.25506.8.36.2.3.1.4	INTEGER	read-only	The specified peer authentication method. The local entity would authenticate the peer using the method specified by this object when this policy entity is selected to negotiate with a peer.
INT hh3chipsIsakmpPolEncr	1.3.6.1.4.1.25506.8.36.2.3.1.2	INTEGER	read-only	The specified encryption transform. It is used by Internet Key Exchange(IKE) tunnels to protect the ISAKMP PDUs.
INT hh3chipsIsakmpPolGroup	1.3.6.1.4.1.25506.8.36.2.3.1.5	INTEGER	read-only	This object is used to specify the Oakley group which is used for Diffie Hellman exchange in the Main Mode. The local entity selects the group specified by this object to perform Diffie Hellman exchange with the peer when this policy item is chosen to negotiate the Main Mode with an IKE peer.
INT hh3chipsIsakmpPolHash	1.3.6.1.4.1.25506.8.36.2.3.1.3	INTEGER	read-only	The specified hash transform. It is used by Internet Key Exchange(IKE) tunnels to protect the ISAKMP PDUs.
G32 hh3chipsIsakmpPolLifetime	1.3.6.1.4.1.25506.8.36.2.3.1.6	Gauge32	read-only	This object indicates the lifetime of the IKE tunnels in seconds.
I32 hh3chipsIsakmpPolPriority	1.3.6.1.4.1.25506.8.36.2.3.1.1	Integer32	read-only	ISAKMP Policy entry's priority.
T/F hh3chipsIsCardTransform	1.3.6.1.4.1.25506.8.36.2.5.1.7	TruthValue	read-only	This object indicates the flag of the NDEC is used for IPSec SAs generated using this IPSec policy entry.
IP hh3chipsLocalIpAddr	1.3.6.1.4.1.25506.8.36.2.1.1.6	IpAddress	read-only	The local IP address of this SA entry.
INT hh3chipsNDECBackup	1.3.6.1.4.1.25506.8.36.2.7.2	INTEGER	read-write	The flag that NDEC using backup. The value 1 represents using backup The value 0 represents not using backup
INT hh3chipsNDECConnections	1.3.6.1.4.1.25506.8.36.2.7.1	INTEGER	read-only	Total connections of the system at this time.
NTF hh3chipsNDECFlowTrap	1.3.6.1.4.1.25506.8.36.2.8.3			This trap is generated when a NDEC card is overloaded.
hh3chipsNDECInfoEntry	1.3.6.1.4.1.25506.8.36.2.6.1		not-accessible	Properties of each NDEC.
hh3chipsNDECInfoTable	1.3.6.1.4.1.25506.8.36.2.6		not-accessible	Table of NDEC set.
hh3chipsNDECLeaf	1.3.6.1.4.1.25506.8.36.2.7
NTF hh3chipsNDECNormalResetTrap	1.3.6.1.4.1.25506.8.36.2.8.1			This trap is generated when the NDEC card is reset.
hh3chipsNDECSAListEntry	1.3.6.1.4.1.25506.8.36.2.1.1		not-accessible	Each entry contains the attributes associated with a single NDEC'S SA entry.
hh3chipsNDECSAListTable	1.3.6.1.4.1.25506.8.36.2.1		not-accessible	The table containing the list of all SA entries configured on NDEC by the operator.
NTF hh3chipsNDECStateChangeTrap	1.3.6.1.4.1.25506.8.36.2.8.2			This trap is generated when the NDEC card's state changes.
INT hh3chipsNegotiateSaMode	1.3.6.1.4.1.25506.8.36.2.1.1.10	INTEGER	read-only	The type of key used by the IPSec Phase-2 Tunnel.
STR hh3chipsOutAhHexKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.20	DisplayString	read-only	This object indicates the outbound AH authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
G32 hh3chipsOutAHSPI	1.3.6.1.4.1.25506.8.36.2.4.1.13	Gauge32	read-only	This object indicates the outbound AH SPI IPSec SAs generated using this IPSec policy entry.
STR hh3chipsOutAhStringKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.23	DisplayString	read-only	This object indicates the outbound AH authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hh3chipsOutByte	1.3.6.1.4.1.25506.8.36.2.6.1.5	Counter32	read-only	Total bytes of the NDEC sent.
STR hh3chipsOutEspAuthenHexKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.22	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
STR hh3chipsOutEspCipherHexKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.21	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
G32 hh3chipsOutESPSPI	1.3.6.1.4.1.25506.8.36.2.4.1.14	Gauge32	read-only	This object indicates the outbound ESP SPI IPSec SAs generated using this IPSec policy entry.
STR hh3chipsOutEspStringKeyString	1.3.6.1.4.1.25506.8.36.2.4.1.24	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
C32 hh3chipsOutPac	1.3.6.1.4.1.25506.8.36.2.6.1.3	Counter32	read-only	Total packets of the NDEC sent.
IP hh3chipsPeerIpAddr	1.3.6.1.4.1.25506.8.36.2.1.1.1	IpAddress	read-only	The peer IP address of this SA entry.
INT hh3chipsProtocol	1.3.6.1.4.1.25506.8.36.2.1.1.2	INTEGER	read-only	The Protocol of this SA entry.
G32 hh3chipsSaLifeKBytes	1.3.6.1.4.1.25506.8.36.2.1.1.7	Gauge32	read-only	The lifetime of this SA entry in bytes.
G32 hh3chipsSaLifeSecond	1.3.6.1.4.1.25506.8.36.2.1.1.8	Gauge32	read-only	The lifetime of this SA entry in seconds.
G32 hh3chipsSoftBytes	1.3.6.1.4.1.25506.8.36.2.1.1.12	Gauge32	read-only	This object specifies the lifetime in bytes of the tunnels generated using this policy specification.
G32 hh3chipsSoftTimeout	1.3.6.1.4.1.25506.8.36.2.1.1.14	Gauge32	read-only	This object specifies the lifetime in seconds of the tunnels generated using this policy specification.
G32 hh3chipsSPI	1.3.6.1.4.1.25506.8.36.2.1.1.3	Gauge32	read-only	The SPI of this SA entry.
hh3chipsStaticCryptomapEntry	1.3.6.1.4.1.25506.8.36.2.4.1		not-accessible	Each entry contains properites of a single static cryptomap entry. The members of dynamic cryptomap sets, which may be linked with the parent static cryptomap set, are not included in this table.
G32 hh3chipsStaticCryptomapLifesize	1.3.6.1.4.1.25506.8.36.2.4.1.8	Gauge32	read-only	This object identifies the lifesize of the IPSec SAs generated using this IPSec policy entry. Lifesize means maximum traffic in bytes that may be carried.
G32 hh3chipsStaticCryptomapLifetime	1.3.6.1.4.1.25506.8.36.2.4.1.7	Gauge32	read-only	This object indicates the lifetime of the IPSec SA which is created using this IPSec policy entry.
IP hh3chipsStaticCryptomapLocalIpAddr	1.3.6.1.4.1.25506.8.36.2.4.1.9	IpAddress	read-only	The value of this object is the local IP address of the IPSec SAs generated using this IPSec policy entry.
INT hh3chipsStaticCryptomapMatchAddr	1.3.6.1.4.1.25506.8.36.2.4.1.4	INTEGER	read-only	The access list number entered by the operatoir while creating this cryptomap.
STR hh3chipsStaticCryptomapName	1.3.6.1.4.1.25506.8.36.2.4.1.1	DisplayString	read-only	The name of the cryptomap entry in the cryptomap set. This is the first index component of this table.
INT hh3chipsStaticCryptomapNegMode	1.3.6.1.4.1.25506.8.36.2.4.1.3	INTEGER	read-only	Type of the cryptomap entry. This object may be an ISAKMP cryptomap or manual.
IP hh3chipsStaticCryptomapPeerIpAddr	1.3.6.1.4.1.25506.8.36.2.4.1.5	IpAddress	read-only	The IP address of the current peer. Traffic protected by this cryptomap is protected by a tunnel terminating at the device whose IP address is the value of this object.
I32 hh3chipsStaticCryptomapSN	1.3.6.1.4.1.25506.8.36.2.4.1.2	Integer32	read-only	The sequence number of the cryptomap entry in the cryptomap set. This is the second index component of this table.
hh3chipsStaticCryptomapTable	1.3.6.1.4.1.25506.8.36.2.4		not-accessible	The table includes the list of the member cryptomaps of the cryptomap sets which are set on the specific entity.
STR hh3chipsStaticCryptomapTransforName	1.3.6.1.4.1.25506.8.36.2.4.1.6	DisplayString	read-only	The transform associated with this cryptomap entry.
INT hh3chipsTransformMode	1.3.6.1.4.1.25506.8.36.2.5.1.2	INTEGER	read-only	Mode of the transform entry.
STR hh3chipsTransformName	1.3.6.1.4.1.25506.8.36.2.5.1.1	DisplayString	read-only	Name of the transform entry.
hh3chipsTransformNameSetEntry	1.3.6.1.4.1.25506.8.36.2.5.1		not-accessible	Each entry refers to properties of a transform.
hh3chipsTransformNameSetTable	1.3.6.1.4.1.25506.8.36.2.5		not-accessible	Transform set table.
INT hh3chipsTransformProtocol	1.3.6.1.4.1.25506.8.36.2.5.1.3	INTEGER	read-only	Transform protocol.
hh3chipsTraps	1.3.6.1.4.1.25506.8.36.2.8
hh3cNDEC	1.3.6.1.4.1.25506.8.36.2			This MIB contains objects to manage the NDEC device.

RFC description

H3C NDEC device MIB for network data encryption/security. Manages security associations, IKE policies, and cryptographic parameters.

Start monitoring H3C SD-WAN edge router/NDEC controller (IPsec SA between edge devices) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-NDEC-MIB