HH3C-OBJP-MIB

All MIBs › HH3C-OBJP-MIB

Organization: Hangzhou H3C Technologies Co., Ltd.

Last Updated: 2014-03-10

Category: Vendor: H3C/HH3C

Description: HH3C MIB for object policy (OBJP) management defining reusable address and service policy objects.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-OBJP-MIB?

HH3C-OBJP-MIB is an H3C MIB for object-policy (OBJP) management, a security-policy framework that groups devices into named zones and defines zone-pair rules (e.g., firewall/ACL-style rules) governing traffic between them. It exposes a running-information table reporting the source and destination zones of each configured zone pair, along with per-rule match-packet counters and the timestamp of the last rule match. Its monitoring focus is squarely on security-policy enforcement status: an administrator can confirm which zone-pair rules are actively matching traffic and when they last fired, which helps validate policy correctness and detect unexpected traffic being blocked or permitted. It is a device-specific policy framework layered on top of general IP addressing/zone concepts rather than an extension of a specific standard MIB. It is typically deployed on H3C security gateways and firewalls that use zone-based policy management, and administrators can download the HH3C-OBJP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-OBJP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C security gateway
H3C firewall

Monitoring Examples

An admin would poll hh3cObjpZonePairRunningInfoTable, keyed by hh3cObjpZonePairSrcZone/hh3cObjpZonePairDstZone/hh3cObjpZonePairRuleID, to check hh3cObjpZonePairMatchPacketCount and hh3cObjpZonePairLastMatchTime for a given zone-pair rule. A rule whose match count stays at zero over time would reveal that traffic expected to hit that policy rule isn't actually reaching it, indicating a routing or zone-assignment misconfiguration. Comparing IPv4 versus IPv6 behavior is possible via hh3cObjpZonePairIPVersion on each entry.

What Can Be Monitored

zone-pair rule match packet counts
last rule match time
source/destination zone assignment
IP version per policy rule

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

How to Use in IPNetwork Monitor

Example using hh3cObjpZonePairMatchPacketCount OID:

Select an H3C security gateway/firewall (zone-pair object-policy management) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hh3cObjpZonePairMatchPacketCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of packets matching the rule. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cObjp	1.3.6.1.4.1.25506.2.155			Object-policy management information base for managing devices that support object policy.
hh3cObjpZonePairObjects	1.3.6.1.4.1.25506.2.155.1
hh3cObjpZonePairRunningInfoTable	1.3.6.1.4.1.25506.2.155.1.1		not-accessible	Object policy of zone pair running information base.
hh3cObjpZonePairRunningInfoEntry	1.3.6.1.4.1.25506.2.155.1.1.1		not-accessible	Object policy of zone pair running information entry.
OCT hh3cObjpZonePairSrcZone	1.3.6.1.4.1.25506.2.155.1.1.1.1	OCTET STRING	not-accessible	Name of the source security zone.
OCT hh3cObjpZonePairDstZone	1.3.6.1.4.1.25506.2.155.1.1.1.2	OCTET STRING	not-accessible	Name of the destination security zone.
INT hh3cObjpZonePairIPVersion	1.3.6.1.4.1.25506.2.155.1.1.1.3	INTEGER	not-accessible	IP protocol version.
U32 hh3cObjpZonePairRuleID	1.3.6.1.4.1.25506.2.155.1.1.1.4	Unsigned32	not-accessible	Rule ID of object policy.
C64 hh3cObjpZonePairMatchPacketCountEx	1.3.6.1.4.1.25506.2.155.1.1.1.5	Counter64	read-only	Number of packets matching the rule.
U32 hh3cObjpZonePairLastMatchTime	1.3.6.1.4.1.25506.2.155.1.1.1.6	Unsigned32	read-only	Interval in seconds between the last match and 1970/1/1 00:00:00.

RFC description

H3C object policy zone pair configuration and running information for firewalls.

Start monitoring H3C security gateway/firewall (zone-pair object-policy management) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-OBJP-MIB