All MIBs › HM2-FW-MIB
Organization: Hirschmann Automation and Control GmbH
Last Updated: 2011-09-13
Category: Vendor: Belden
Description: Hirschmann HiOS (HM2) firmware MIB for firmware version management and software update control.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is HM2-FW-MIB?
HM2-FW-MIB is a Hirschmann Automation and Control proprietary MIB (Platform2/HM2 family) providing an SNMP interface to Hirschmann's built-in firewall modules. It exposes the maximum number of dynamic and Layer 3 firewall rules supported, actions to reset statistics or flush connection-tracking tables, the default policy (permit/deny), a checksum-validation toggle, trap notifications when a rule is applied (optionally with logging), and a running count of rule matches. As a configuration/security-status MIB it lets an administrator confirm the firewall's default policy and watch rule-match counts to verify traffic is being filtered as expected. It is deployed on Hirschmann industrial switches with the built-in firewall feature. Engineers can download the HM2-FW-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in HM2-FW-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Hirschmann industrial Ethernet switches (Platform2/HM2 firewall)
Monitoring Examples
An administrator monitors hm2DynFwRuleCount for an unexpected spike, then subscribes to hm2DynFwRuleAppliedAndLoggedTrap to see exactly which rule and traffic pattern is triggering it.
What Can Be Monitored
- firewall default policy
- rule-match counts and rule-applied traps
This MIB depends on
Related MIBs
Imported Objects
From HM2-TC-MIB
| HmActionValue | |
| HmEnabledStatus | |
| HmTimeSeconds1970 | |
| hm2ConfigurationMibs | OBJECT-IDENTITY |
From IF-MIB
| InterfaceIndex |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Counter64 | |
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| DisplayString | |
| RowStatus | |
| TruthValue |
How to Use in IPNetwork Monitor
Example using hm2DynFwStatsTtPck OID:
Select a Hirschmann industrial Ethernet switch (built-in firewall module) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hm2DynFwStatsTtPck into the Find box to locate it in the OID tree, then select it and click OK. It reports the total number of packets processed by the dynamic firewall. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| hm2FwMib | 1.3.6.1.4.1.248.11.79 | SNMP interface for Hirschmann Firewall modules. Copyright (C) | ||
| hm2FwNotifications | 1.3.6.1.4.1.248.11.79.0 | |||
| NTF hm2DynFwRuleAppliedTrap | 1.3.6.1.4.1.248.11.79.0.1 | A rule of the dynamic firewall was applied. The rule is identified by the given rule index of the rule table. | ||
| NTF hm2DynFwRuleAppliedAndLoggedTrap | 1.3.6.1.4.1.248.11.79.0.2 | A rule of the dynamic firewall was applied and logged according to the current logging mechanism. The rule is identified by the given rule index of the rule table. | ||
| NTF hm2L3RuleAppliedTrap | 1.3.6.1.4.1.248.11.79.0.3 | A rule of the L3 firewall was applied. The rule is identified by the given rule index of the rule table. | ||
| NTF hm2L3RuleAppliedAndLoggedTrap | 1.3.6.1.4.1.248.11.79.0.4 | A rule of the L3 firewall was applied and logged according the current logging mechanism. The rule is identified by the given rule index of the rule table. | ||
| hm2FwObjects | 1.3.6.1.4.1.248.11.79.1 | |||
| hm2FwGeneralSettings | 1.3.6.1.4.1.248.11.79.1.1 | |||
| I32 hm2DynFwMaxRules | 1.3.6.1.4.1.248.11.79.1.1.1 | Integer32 | read-only | Maximum number of allowed rules for dynamic firewalling. |
| I32 hm2L3MaxRules | 1.3.6.1.4.1.248.11.79.1.1.2 | Integer32 | read-only | Maximum number of allowed rules for L3 firewalling. |
| HMA hm2ResetStatistics | 1.3.6.1.4.1.248.11.79.1.1.3 | HmActionValue | read-write | Setting this value to action(2) will reset the statistics of the whole firewall module. It will be set to noop(1) automatically after reset. |
| HMA hm2FlushTables | 1.3.6.1.4.1.248.11.79.1.1.4 | HmActionValue | read-write | Setting this value to action(2) will flush all connection tracking states. It will be set to noop(1) automatically after table flush. |
| INT hm2DefaultPolicy | 1.3.6.1.4.1.248.11.79.1.1.5 | INTEGER | read-write | The default policy for forwarding packets: o accept(1): Packets matching this rule are accepted and will be forwarded o drop(2): Packets matching this rule will be silently discarded o reject(3): Packets matching this rule will be dropped and the originator gets informed by an ICMP message |
| T/F hm2ConnTrackValidateCheckSum | 1.3.6.1.4.1.248.11.79.1.1.6 | TruthValue | read-write | This value describes, whether the Firewall connection tracking in the Linux kernel shall validate the protocol checksums. Disable this validation (false) improves routing throughput. |
| hm2DynFw | 1.3.6.1.4.1.248.11.79.1.2 | |||
| hm2DynFwRuleObjects | 1.3.6.1.4.1.248.11.79.1.2.1 | |||
| I32 hm2DynFwRuleCount | 1.3.6.1.4.1.248.11.79.1.2.1.1 | Integer32 | read-only | Number of current dynamic firewalls rules |
| I32 hm2DynFwIfMappingRuleCount | 1.3.6.1.4.1.248.11.79.1.2.1.2 | Integer32 | read-only | Number of current DynFw IF mapping entries. |
| T/F hm2DynFwRulePendingActions | 1.3.6.1.4.1.248.11.79.1.2.1.3 | TruthValue | read-only | This value describes, whether the DynFW rule table was modified but not yet written to the firewall implementation (set to true). After writing all modifications to the firewall, the value switches automatically back to false. |
| HMA hm2DynFwCommitPendingActions | 1.3.6.1.4.1.248.11.79.1.2.1.4 | HmActionValue | read-write | Setting this value to action(2) writes not yet committed changes to the firewall (DynFW and Interface Mapping Table). After writing all modifications, the value switches automatically back to noop(1). |
| hm2DynFwRuleTables | 1.3.6.1.4.1.248.11.79.1.2.2 | |||
| hm2DynFwRuleTable | 1.3.6.1.4.1.248.11.79.1.2.2.1 | not-accessible | The list of rules for this dynamic firewall | |
| hm2DynFwRuleEntry | 1.3.6.1.4.1.248.11.79.1.2.2.1.1 | not-accessible | Dynamic firewall rule entry. | |
| I32 hm2DynFwRuleIndex | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.1 | Integer32 | accessible-for-notify | Rule index of this dynamic firewall rule |
| STR hm2DynFwSourceAddress | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.2 | DisplayString | read-create | The source address of the packet to filter. Allowed formats are: - keyword 'any' - single address ('10.0.0.1') - CIDR address range ('10.0.0.0/8') - netobject ('$name') |
| STR hm2DynFwSourcePort | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.3 | DisplayString | read-create | The source port of the packet to filter. Allowed formats are: - keyword 'any' - single port ('10') - port range with first and last port separated by hyphen ('10-15') - comma separated list of ports ('1235,25,123') - combination of the points above ('10,25-30,125,1993') The number of named ports (1 for each individual port, 2 for port ranges) must not exceed 15. |
| STR hm2DynFwTargetAddress | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.4 | DisplayString | read-create | The destination address of the packet to filter. Allowed formats are: - keyword 'any' - single address ('10.0.0.1') - CIDR address range ('10.0.0.0/8') - netobject ('$name') |
| STR hm2DynFwTargetPort | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.5 | DisplayString | read-create | The destination port of the packet to filter. Allowed formats are: - keyword 'any' - single port ('10') - port range with first and last port separated by hyphen ('10-15') - comma separated list of ports ('1235,25,123') - combination of the points above ('10,25-30,125,1993') The number of named ports (1 for each individual port, 2 for port ranges) must not exceed 15. |
| INT hm2DynFwProto | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.6 | INTEGER | read-create | The IP protocol (RFC 791) for protocol-independent filtering. The following values are currently supported: o icmp(1): internet control message protocol (RFC 792) o igmp(2): internet group management protocol o ipip(3): IP in IP tunnelling (RFC 1853) o tcp(4): transmission control protocol (RFC 793) o udp(5): user datagram protocol (RFC 768) o esp(6): IPsec encapsulated security payload (RFC 2406) o ah(7): IPsec authentication header (RFC 2402) o icmpv6(8): internet control message protocol for IPv6 o any(9): apply to all protocols |
| STR hm2DynFwRuleParams | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.7 | DisplayString | read-create | Additional parameters to this rule as string. A parameter has the syntax: = Parameters are separated by a comma. If more than one value is given for a parameter, values are separated by a |-sign Following paramters are defined based on the different protocols: o icmp: type= (specify ICMP type to filter) code= (specify ICMP code to filter) o tcp: frag= (apply to fragments) flags= (apply to packets with give flags o udp/tcp: state= (apply to packets according current state of connection> o general: mac= (specify source MAC address for this rule) |
| INT hm2DynFwAction | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.8 | INTEGER | read-create | The action of the corresponding rule: o accept(1): Packets matching this rule are accepted and will be forwarded o drop(2): Packets matching this rule will be silently discarded o reject(3): Packets matching this rule will be dropped and the originator gets informed by an ICMP message |
| T/F hm2DynFwLog | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.9 | TruthValue | read-create | Set to true if application of this rule shall be logged |
| T/F hm2DynFwTrap | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.10 | TruthValue | read-create | Set to true if application of this rule shall send a trap. |
| ROW hm2DynFwRowStatus | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.11 | RowStatus | read-create | This is a standard row status value: - active(1): The rule is active. Note that until committed, the rule will not be applied. - notInService(2): The rule is inactive because of user action. - notReady(3): The rule is inactive because of agent action. - createAndGo(4): Create the rule with default parameters activated. - createAndWait(5): Create the rule inactive. - destroy(6): Delete the rule. You cannot delete a rule with interface mappings to it. |
| STR hm2DynFwDescription | 1.3.6.1.4.1.248.11.79.1.2.2.1.1.12 | DisplayString | read-create | User defined textual description related to this rule. |
| hm2DynFwRuleIfMappingTable | 1.3.6.1.4.1.248.11.79.1.2.2.2 | not-accessible | Table for mapping L3 rules to interfaces | |
| hm2DynFwRuleIfMappingEntry | 1.3.6.1.4.1.248.11.79.1.2.2.2.1 | not-accessible | Entry in rule interface mapping table | |
| I32 hm2DynFwIfmRuleIndex | 1.3.6.1.4.1.248.11.79.1.2.2.2.1.1 | Integer32 | not-accessible | The index of the DynFw rule this mapping entry is assigned to. The DynFw rule must exist before creation of mapping entry. |
| INT hm2DynFwIfmDirection | 1.3.6.1.4.1.248.11.79.1.2.2.2.1.2 | INTEGER | not-accessible | Meanings: - ingress(1): Apply this rule to packets arriving on this interface - egress(2): Apply this rule to packets leaving from this interface - both(3): Apply this rule to packets coming in and going out on this interface. If an ingress and an egress interface are given, this is taken to mean that the rule shall apply to packets arriving on the ingress interface AND to be leaving on the egress interface. A rule without ingress interface matches on all packets going out to the egress interface given, and vice versa. |
| U32 hm2DynFwIfmPriority | 1.3.6.1.4.1.248.11.79.1.2.2.2.1.3 | Unsigned32 | read-create | The priority is the sorting key for rules in to this interface. They don't need to be unique, but no clear order can be assumed among rules with the same priority. Priorities are processed in ascending order (0 highest priority). |
| NUM hm2DynFwIfmInterface | 1.3.6.1.4.1.248.11.79.1.2.2.2.1.4 | InterfaceIndex | not-accessible | The interface this mapping entry is applied to. This has to be either an hm2AgentSwitchIpInterfaceIfIndex or an hm2AgentSwitchIpVlanIfIndex. Note that for physical interfaces this only works if the corresponding hm2AgentSwitchIpInterfaceRoutingMode is set to enable. |
| ROW hm2DynFwIfmRowStatus | 1.3.6.1.4.1.248.11.79.1.2.2.2.1.5 | RowStatus | read-create | The RowStatus value for this entry with the usual meanings: - active(1): The interface mapping is in place - notInService(2): The interface mapping is not in place because the user said so - notReady(3): The interface mapping is not in place because the agent said so - createAndGo(4): Create this mapping with the default priority and activate it. - createAndWait(5): Create this mapping deactivated. - destroy(6): Destroy this interface mapping. |
| hm2DynFwStats | 1.3.6.1.4.1.248.11.79.1.2.4 | |||
| hm2DynFwGeneralStats | 1.3.6.1.4.1.248.11.79.1.2.4.1 | |||
| C64 hm2DynFwStatsTtPckEx | 1.3.6.1.4.1.248.11.79.1.2.4.1.1 | Counter64 | read-only | Total number of packets processed by the dynamic firewall |
| C64 hm2DynFwStatsTtPckSize | 1.3.6.1.4.1.248.11.79.1.2.4.1.2 | Counter64 | read-only | Total number of bytes processed by the dynamic firewall |
| C64 hm2DynFwStatsTtPckDenDrop | 1.3.6.1.4.1.248.11.79.1.2.4.1.3 | Counter64 | read-only | Total number of packets dropped or denied by the dynamic firewall |
| C64 hm2DynFwStatsTtPckAccepted | 1.3.6.1.4.1.248.11.79.1.2.4.1.4 | Counter64 | read-only | Total number of packets accepted by the dynamic firewall |
| hm2DynFwStatsTables | 1.3.6.1.4.1.248.11.79.1.2.4.2 | |||
| hm2DynFwStatsRuleTable | 1.3.6.1.4.1.248.11.79.1.2.4.2.1 | not-accessible | Table of per-rule statistics of the dynamic firewall | |
| hm2DynFwStatsRuleEntry | 1.3.6.1.4.1.248.11.79.1.2.4.2.1.1 | not-accessible | Statistics table entry for the dynamic firewall | |
| C64 hm2DynFwStatsPacketCount | 1.3.6.1.4.1.248.11.79.1.2.4.2.1.1.1 | Counter64 | read-only | Number of packets matched by this rule |
| C64 hm2DynFwStatsPacketSize | 1.3.6.1.4.1.248.11.79.1.2.4.2.1.1.2 | Counter64 | read-only | Number of bytes processed by this rule |
| HMT hm2DynFwStatsLastApplied | 1.3.6.1.4.1.248.11.79.1.2.4.2.1.1.3 | HmTimeSeconds1970 | read-only | Local system time (hm2SystemLocalTime) when the rule was applied the last time |
| hm2L3Fw | 1.3.6.1.4.1.248.11.79.1.3 | |||
| hm2L3RuleObjects | 1.3.6.1.4.1.248.11.79.1.3.1 | |||
| I32 hm2L3RuleCount | 1.3.6.1.4.1.248.11.79.1.3.1.1 | Integer32 | read-only | Number of current L3 rules |
| I32 hm2L3IfMappingRuleCount | 1.3.6.1.4.1.248.11.79.1.3.1.2 | Integer32 | read-only | Number of current L3 IF mapping entries. |
| T/F hm2L3RulePendingActions | 1.3.6.1.4.1.248.11.79.1.3.1.3 | TruthValue | read-only | This value describes, whether the L3 rule table was modified but not yet written to the firewall implementation (set to true). After writing all modifications to the firewall, the value switches automatically back to false. |
| HMA hm2L3CommitPendingActions | 1.3.6.1.4.1.248.11.79.1.3.1.4 | HmActionValue | read-write | Setting this value to action(2) writes not yet committed changes to the firewall (L3 and Interface Mapping Table). After writing all modifications, the value switches automatically back to noop(1). |
| hm2L3RuleTables | 1.3.6.1.4.1.248.11.79.1.3.2 | |||
| hm2L3RuleTable | 1.3.6.1.4.1.248.11.79.1.3.2.1 | not-accessible | The list of L3 rules for this firewall | |
| hm2L3RuleEntry | 1.3.6.1.4.1.248.11.79.1.3.2.1.1 | not-accessible | L3 rule entry. | |
| I32 hm2L3RuleIndex | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.1 | Integer32 | accessible-for-notify | Rule index of this L3 rule |
| STR hm2L3SourceAddress | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.2 | DisplayString | read-create | The source address of the packet to filter. Allowed formats are: - keyword 'any' - single address ('10.0.0.1') - CIDR address range ('10.0.0.0/8') - netobject ('$name') - a prepending '!' selects the complement set |
| STR hm2L3SourcePort | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.3 | DisplayString | read-create | The source port of the packet to reroute. Allowed formats are: - keyword 'any' - single port ('10') - port range with first and last port separated by hyphen ('10-15') - comma separated list of ports ('1235,25,123') - combination of the points above ('10,25-30,125,1993') The number of named ports (1 for each individual port, 2 for port ranges) must not exceed 15. |
| STR hm2L3TargetAddress | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.4 | DisplayString | read-create | The destination address of the packet to filter. Allowed formats are: - keyword 'any' - single address ('10.0.0.1') - CIDR address range ('10.0.0.0/8') - netobject ('$name') |
| STR hm2L3TargetPort | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.5 | DisplayString | read-create | The destination port of the packet to. Allowed formats are: - keyword 'any' - single port ('10') - port range with first and last port separated by hyphen ('10-15') - comma separated list of ports ('1235,25,123') - combination of the points above ('10,25-30,125,1993') The number of named ports (1 for each individual port, 2 for port ranges) must not exceed 15. |
| INT hm2L3Proto | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.6 | INTEGER | read-create | The IP protocol (RFC 791) for protocol-independent filtering. The following values are currently supported: o icmp(1): internet control message protocol (RFC 792) o igmp(2): internet group management protocol o ipip(3): IP in IP tunnelling (RFC 1853) o tcp(4): transmission control protocol (RFC 793) o udp(5): user datagram protocol (RFC 768) o esp(6): IPsec encapsulated security payload (RFC 2406) o ah(7): IPsec authentication header (RFC 2402) o icmpv6(8): internet control message protocol for IPv6 o any(9): apply to all protocols |
| STR hm2L3RuleParams | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.7 | DisplayString | read-create | Additional parameters to this rule as string. A parameter has the syntax: = Parameters are separated by a comma. If more than one value is given for a parameter, values are separated by a |-sign (pipe). Following parameters are defined based on the different protocols: o icmp: type= (specify ICMP type to filter) code= (specify ICMP code to filter) o tcp: flags= (apply to packets with given flags) o general: state= (apply to packets according to current state of connection>) mac= (specify source MAC address for this rule) frag= (apply to fragments) |
| INT hm2L3Action | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.8 | INTEGER | read-create | The action of the corresponding rule: o accept(1): Packets matching this rule are accepted and will be forwarded o drop(2): Packets matching this rule will be silently discarded o reject(3): Packets matching this rule will be dropped and the originator gets informed by an ICMP message o enforce-modbus(4): Packets matching this rule are enforced by modbus enforcer and will be forwarded or discarded. The selected protocol should be tcp or udp o enforce-opc(5): Packets matching this rule are enforced by opc enforcer and will be forwarded or discarded. The selected protocol should be tcp |
| T/F hm2L3Log | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.9 | TruthValue | read-create | Set to true if application of this rule shall be logged |
| T/F hm2L3Trap | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.10 | TruthValue | read-create | Set to true if application of this rule shall send a trap. |
| ROW hm2L3RowStatus | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.11 | RowStatus | read-create | This is a standard row status value: - active(1): The rule is active. Note that until committed, the rule will not be applied. You cannot activate the rule if an enforcer mappings to an inactive profile. - notInService(2): The rule is inactive because of user action. - notReady(3): The rule is inactive because of agent action. - createAndGo(4): Create the rule with default parameters activated. - createAndWait(5): Create the rule inactive. - destroy(6): Delete the rule. You cannot delete a rule with interface mappings to it. |
| STR hm2L3Description | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.12 | DisplayString | read-create | User defined textual description related to this rule. |
| I32 hm2DPIProfileIndex | 1.3.6.1.4.1.248.11.79.1.3.2.1.1.13 | Integer32 | read-create | The index of the DPI profile this rule is assigned to depending on enforcer action. Value 0 no DPI profile this rule is assigned to. You cannot assign the rule to an inactive profile if an active enforcer will mapping to it. |
| hm2L3RuleIfMappingTable | 1.3.6.1.4.1.248.11.79.1.3.2.2 | not-accessible | Table for mapping L3 rules to interfaces | |
| hm2L3RuleIfMappingEntry | 1.3.6.1.4.1.248.11.79.1.3.2.2.1 | not-accessible | Entry in rule interface mapping table | |
| I32 hm2L3IfmRuleIndex | 1.3.6.1.4.1.248.11.79.1.3.2.2.1.1 | Integer32 | not-accessible | The index of the L3 rule this mapping entry is assigned to. The rule must exist before the mapping entry can be created. |
| INT hm2L3IfmDirection | 1.3.6.1.4.1.248.11.79.1.3.2.2.1.2 | INTEGER | not-accessible | Meanings: - ingress(1): Apply this rule to packets arriving on this interface - egress(2): Apply this rule to packets leaving from this interface - both(3): Apply this rule to packets coming in and going out on this interface. If an ingress and an egress interface are given, this is taken to mean that the rule shall apply to packets arriving on the ingress interface AND to-be leaving on the egress interface. A rule without ingress interface matches on all packets going out to the egress interface given, and vice versa. |
| U32 hm2L3IfmPriority | 1.3.6.1.4.1.248.11.79.1.3.2.2.1.3 | Unsigned32 | read-create | The priority is the sorting key for rules in to this interface. They don't need to be unique, but no clear order can be assumed among rules with the same priority. Priorities are processed in ascending order (0 highest priority. |
| NUM hm2L3IfmInterface | 1.3.6.1.4.1.248.11.79.1.3.2.2.1.4 | InterfaceIndex | not-accessible | The interface this mapping entry is assigned to. This has to be either an hm2AgentSwitchIpInterfaceIfIndex or an hm2AgentSwitchIpVlanIfIndex. Note that for physical interfaces this only works if the corresponding hm2AgentSwitchIpInterfaceRoutingMode is set to enable. |
| ROW hm2L3IfmRowStatus | 1.3.6.1.4.1.248.11.79.1.3.2.2.1.5 | RowStatus | read-create | The RowStatus value for this entry with the usual meanings: - active(1): The interface mapping is in place - notInService(2): The interface mapping is not in place because the user said so - notReady(3): The interface mapping is not in place because the agent said so - createAndGo(4): Create this mapping with the default priority and activate it. - createAndWait(5): Create this mapping deactivated. - destroy(6): Destroy this interface mapping. |
| hm2L3Stats | 1.3.6.1.4.1.248.11.79.1.3.4 | |||
| hm2L3GeneralStats | 1.3.6.1.4.1.248.11.79.1.3.4.1 | |||
| C64 hm2L3StatsTotalPck | 1.3.6.1.4.1.248.11.79.1.3.4.1.1 | Counter64 | read-only | Total number of packets processed by the L3 firewall |
| C64 hm2L3StatsTotalPckSize | 1.3.6.1.4.1.248.11.79.1.3.4.1.2 | Counter64 | read-only | Total number of bytes processed by the L3 firewall |
| C64 hm2L3StatsTotalPckDenDrop | 1.3.6.1.4.1.248.11.79.1.3.4.1.3 | Counter64 | read-only | Total number of packets dropped or denied by the L3 firewall |
| C64 hm2L3StatsTotalPckAccepted | 1.3.6.1.4.1.248.11.79.1.3.4.1.4 | Counter64 | read-only | Total number of packets accepted by the L3 firewall |
| hm2L3StatsTables | 1.3.6.1.4.1.248.11.79.1.3.4.2 | |||
| hm2L3StatsRuleTable | 1.3.6.1.4.1.248.11.79.1.3.4.2.1 | not-accessible | Table of per-rule statistics of the L3 firewall | |
| hm2L3StatsRuleEntry | 1.3.6.1.4.1.248.11.79.1.3.4.2.1.1 | not-accessible | Statistics table entry for the L3 firewall | |
| C64 hm2L3StatsPacketCount | 1.3.6.1.4.1.248.11.79.1.3.4.2.1.1.1 | Counter64 | read-only | Number of packets matched by this rule |
| C64 hm2L3StatsPacketSize | 1.3.6.1.4.1.248.11.79.1.3.4.2.1.1.2 | Counter64 | read-only | Number of bytes processed by this rule |
| HMT hm2L3StatsLastApplied | 1.3.6.1.4.1.248.11.79.1.3.4.2.1.1.3 | HmTimeSeconds1970 | read-only | Time of last application of the rule in seconds since the Unix epoch. |
| hm2DPIProfileModbusObjects | 1.3.6.1.4.1.248.11.79.1.3.11 | |||
| T/F hm2DPIProfileModbusPendingActions | 1.3.6.1.4.1.248.11.79.1.3.11.1 | TruthValue | read-only | This value describes, whether the DPI MODBUS profile table was modified but not yet written to the enforcer implementation (set to true). After writing all modifications to the enforcer, the value switches automatically back to false. |
| HMA hm2DPIProfileModbusCommitPendingActions | 1.3.6.1.4.1.248.11.79.1.3.11.2 | HmActionValue | read-write | Setting this value to action(2) writes not yet committed changes to the enforcer (DPI MODBUS Profile Table). After writing all modifications, the value switches automatically back to noop(1). |
| hm2DPIProfileOpcObjects | 1.3.6.1.4.1.248.11.79.1.3.12 | |||
| T/F hm2DPIProfileOpcPendingActions | 1.3.6.1.4.1.248.11.79.1.3.12.1 | TruthValue | read-only | This value describes, whether the L3 OPC profile table was modified but not yet written to the enforcer implementation (set to true). After writing all modifications to the enforcer, the value switches automatically back to false. |
| HMA hm2DPIProfileOpcCommitPendingActions | 1.3.6.1.4.1.248.11.79.1.3.12.2 | HmActionValue | read-write | Setting this value to action(2) writes not yet committed changes to the enforcer (DPI OPC Profile Table). After writing all modifications, the value switches automatically back to noop(1). |
| hm2DPIProfileTables | 1.3.6.1.4.1.248.11.79.1.3.21 | |||
| hm2DPIProfileModbusTable | 1.3.6.1.4.1.248.11.79.1.3.21.1 | not-accessible | The list of DPI MODBUS profiles for this enforcer | |
| hm2DPIProfileModbusEntry | 1.3.6.1.4.1.248.11.79.1.3.21.1.1 | not-accessible | DPI MODBUS profile entry. | |
| I32 hm2DPIProfileModbusIndex | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.1 | Integer32 | accessible-for-notify | Profile index of this DPI MODBUS profile |
| STR hm2DPIProfileModbusDescription | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.2 | DisplayString | read-create | User defined textual description related to this profile. |
| INT hm2DPIProfileModbusFunctionType | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.3 | INTEGER | read-create | The function types of the corresponding function codes: o readonly(1): Selects read only function codes for the function code list. o readwrite(2): Selects read write function codes for the function code list. o programming(3): Selects programming function codes for the function code list. o all(4): Selects all possible function codes for the function code list. Any function code will be allowed. o advanced(5): Keeps the function code list from the previous selection and makes it editable by the user. |
| STR hm2DPIProfileModbusFunctionCodeList | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.4 | DisplayString | read-create | The function codes for this enforcer as string. A function code has the syntax: Function codes are separated by a comma. If more than one value is given for a function code, values are separated by a | -sign (pipe). Following function codes are defined: || (apply to packets with given function codes , address range , address range ) 1| (apply to packets with given function code read coils, coil address range ) 2| (apply to packets with given function code read discrete inputs, input address range ) 3| (apply to packets with given function code read holding registers, register address range ) 4| (apply to packets with given function code read input registers, register address range ) 5| (apply to packets with given function code write single coil, coil address range ) 6| (apply to packets with given function code write single register, register address range ) 7 (apply to packets with given function code read exception status) 8 (apply to packets with given function code diagnostic) 11 (apply to packets with given function code get com event counter) 12 (apply to packets with given function code get comm event log) 13 (apply to packets with given function code program (584/984)) 14 (apply to packets with given function code poll (584/984)) 15| (apply to packets with given function code write multiple coils, coil address range ) 16| (apply to packets with given function code write multiple registers, register address range ) 17 (apply to packets with given function code report slave id) 20 (apply to packets with given function code read file record) 21 (apply to packets with given function code write file record) 22| (apply to packets with given function code mask write register, register address range ) 23|| (apply to packets with given function code read/write multiple registers, read address range , write address range ) 24| (apply to packets with given function code read fifo queue, pointer address range ) 40 (apply to packets with given function code program (concept)) 42 (apply to packets with given function code concept symbol table) 43 (apply to packets with given function code encapsulated interface transport) 48 (apply to packets with given function code advantech co. ltd. - management functions) 66 (apply to packets with given function code scan data inc. - expanded read holding registers) 67 (apply to packets with given function code scan data inc. - expanded write holding registers) 90 (apply to packets with given function code unity programming/ofs) 100 (apply to packets with given function code scattered register read) 125 (apply to packets with given function code schneider electric - firmware replacement) 126 (apply to packets with given function code schneider electric - program) |
| STR hm2DPIProfileModbusUnitIdentifierList | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.5 | DisplayString | read-create | Unit identifiers for this enforcer as string. A unit identifier has the syntax: To specify no options, the value 'none' must be given. Unit identifiers are separated by a comma. Following unit identifiers are defined: (apply to packets for which a unit identifier is set) |
| T/F hm2DPIProfileModbusSanityCheck | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.6 | TruthValue | read-create | Set to true if apply to packets for which a sanity check including format and specification shall be done |
| T/F hm2DPIProfileModbusException | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.7 | TruthValue | read-create | Set to true if apply to packets for which a device exception message shall be sent |
| T/F hm2DPIProfileModbusReset | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.8 | TruthValue | read-create | Set to true if apply to packets for which a reset connection message shall be sent |
| ROW hm2DPIProfileModbusRowStatus | 1.3.6.1.4.1.248.11.79.1.3.21.1.1.9 | RowStatus | read-create | This is a standard row status value: - active(1): The profile is active. You cannot modify it. - notInService(2): The profile is inactive because of user action. You cannot inactivate the profile if an active enforcer mappings to it. - notReady(3): The profile is inactive because of agent action. - createAndGo(4): Create the profile with default parameters activated. - createAndWait(5): Create the profile inactive. - destroy(6): Delete the profile. You cannot delete the active profile or if an enforcer mappings to it. |
| hm2DPIProfileOpcTable | 1.3.6.1.4.1.248.11.79.1.3.21.2 | not-accessible | The list of DPI OPC profiles for this enforcer | |
| hm2DPIProfileOpcEntry | 1.3.6.1.4.1.248.11.79.1.3.21.2.1 | not-accessible | DPI OPC profile entry. | |
| I32 hm2DPIProfileOpcIndex | 1.3.6.1.4.1.248.11.79.1.3.21.2.1.1 | Integer32 | accessible-for-notify | Profile index of this DPI OPC profile |
| STR hm2DPIProfileOpcDescription | 1.3.6.1.4.1.248.11.79.1.3.21.2.1.2 | DisplayString | read-create | User defined textual description related to this profile. |
| T/F hm2DPIProfileOpcSanityCheck | 1.3.6.1.4.1.248.11.79.1.3.21.2.1.3 | TruthValue | read-create | Set to true if apply to packets for which a sanity check including format and specification shall be done |
| T/F hm2DPIProfileOpcFragmentCheck | 1.3.6.1.4.1.248.11.79.1.3.21.2.1.4 | TruthValue | read-create | Set to true if apply to packets for which a fragment check shall be done |
| U32 hm2DPIProfileOpcTimeoutConnect | 1.3.6.1.4.1.248.11.79.1.3.21.2.1.5 | Unsigned32 | read-create | Set to nonzero if apply to packets for which a timeout at connect in seconds shall be done. Value 0 disables this match criteria. |
| ROW hm2DPIProfileOpcRowStatus | 1.3.6.1.4.1.248.11.79.1.3.21.2.1.6 | RowStatus | read-create | This is a standard row status value: - active(1): The profile is active. You cannot modify it. - notInService(2): The profile is inactive because of user action. You cannot inactivate the profile if an active enforcer mappings to it. - notReady(3): The profile is inactive because of agent action. - createAndGo(4): Create the profile with default parameters activated. - createAndWait(5): Create the profile inactive. - destroy(6): Delete the profile. You cannot delete the active profile or if an enforcer mappings to it. |
| hm2FwLearningMode | 1.3.6.1.4.1.248.11.79.1.4 | |||
| hm2FLMObjects | 1.3.6.1.4.1.248.11.79.1.4.1 | |||
| HME hm2FLMAdminState | 1.3.6.1.4.1.248.11.79.1.4.1.1 | HmEnabledStatus | read-write | Enable or disable the Firewall Learning Mode. |
| INT hm2FLMAction | 1.3.6.1.4.1.248.11.79.1.4.1.2 | INTEGER | read-write | Actions to control the Firewall Learning Mode. |
| INT hm2FLMAppState | 1.3.6.1.4.1.248.11.79.1.4.1.3 | INTEGER | read-only | State of running FLM Application. |
| INT hm2FLMAppInfoEnum | 1.3.6.1.4.1.248.11.79.1.4.1.4 | INTEGER | read-only | Memory status of FLM Application. |
| STR hm2FLMAppInfoString | 1.3.6.1.4.1.248.11.79.1.4.1.5 | SnmpAdminString | read-only | Special status message. |
| U32 hm2FLML3Entries | 1.3.6.1.4.1.248.11.79.1.4.1.6 | Unsigned32 | read-only | Number of Layer 3 entries in the connection table. |
| U32 hm2FLMFreeMem | 1.3.6.1.4.1.248.11.79.1.4.1.7 | Unsigned32 | read-only | Free memory(%) for learning data. |
| U32 hm2FLMMaxEntries | 1.3.6.1.4.1.248.11.79.1.4.1.8 | Unsigned32 | read-only | Number of maximum interface entries that can be selected. |
| hm2FLMTables | 1.3.6.1.4.1.248.11.79.1.4.2 | |||
| hm2FLMInterfaceTable | 1.3.6.1.4.1.248.11.79.1.4.2.1 | not-accessible | The list of interfaces selected for Firewall Learning Mode. | |
| hm2FLMInterfaceEntry | 1.3.6.1.4.1.248.11.79.1.4.2.1.1 | not-accessible | Interface selected for Firewall Learning Mode. | |
| NUM hm2FLMInterfaceIndex | 1.3.6.1.4.1.248.11.79.1.4.2.1.1.1 | InterfaceIndex | read-write | Interface index of the entry. |
| ROW hm2FLMInterfaceRowStatus | 1.3.6.1.4.1.248.11.79.1.4.2.1.1.2 | RowStatus | read-create | This is a standard row status value: - active(1): The interface is active. - notInService(2): The interface is inactive because routing was disabled. - notReady(3): The interface is inactive because of agent action. - createAndGo(4): Create the interface with default parameters activated. - createAndWait(5): Create the interface inactive. - destroy(6): Delete the interface. |
| hm2FwConformance | 1.3.6.1.4.1.248.11.79.2 | |||
| hm2FwCompliances | 1.3.6.1.4.1.248.11.79.2.1 | |||
| hm2FwCompliance | 1.3.6.1.4.1.248.11.79.2.1.1 | The compliance statement for an SNMP entity which implements the Hirschmann firewall MIB. | ||
| hm2FwGroups | 1.3.6.1.4.1.248.11.79.2.2 | |||
| hm2FwGeneralGroup | 1.3.6.1.4.1.248.11.79.2.2.1 | A collection of all Hirschmann objects provided by the firewall module. | ||
| hm2FwNotificationsGroup | 1.3.6.1.4.1.248.11.79.2.2.2 | A collection of all Hirschmann notifications provided by the firewall module. |
RFC description
SNMP interface for Hirschmann firewall modules, including dynamic and Layer 3 firewall configuration.
Start monitoring Hirschmann industrial Ethernet switch (built-in firewall module) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.