HM2-VPN-MIB

All MIBs › HM2-VPN-MIB

Organization: Hirschmann Automation and Control GmbH

Last Updated: 2014-03-14

Category: Technology: VPN, VPN and Security, Vendor: Belden

Description: Hirschmann HiOS (HM2) VPN MIB for IPsec and SSL VPN tunnel configuration and status monitoring.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HM2-VPN-MIB?

HM2-VPN-MIB is a Hirschmann Automation and Control GmbH proprietary MIB (built on HM2-TC-MIB) configuring IPsec/IKE VPN connections. Its objects cover max/max-active connection count, next connection index, and a connection table (index, IKE version, startup mode, IKE lifetime, DPD (Dead Peer Detection) timeout, local/remote address, authentication type/mode, CA/remote/local certificate, private key, password, PSK (Pre-Shared Key), local/remote ID and ID type, and DH (Diffie-Hellman) algorithm). As a configuration/status MIB it lets an administrator confirm IKE/IPsec authentication and DPD tuning on a Hirschmann VPN device. It is deployed on Hirschmann Automation and Control GmbH VPN-capable equipment. Engineers can download the HM2-VPN-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HM2-VPN-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Hirschmann Automation and Control GmbH VPN-capable equipment

Monitoring Examples

An administrator checks hm2VpnConnIkeDpdTimeout and hm2VpnConnIkeAuthType to confirm VPN dead-peer-detection and authentication configuration on a Hirschmann VPN device.

What Can Be Monitored

IKE/IPsec VPN connection configuration

Imported Objects

From HM2-TC-MIB

HmLargeDisplayString
HmTimeSeconds1970
hm2ConfigurationMibs	OBJECT-IDENTITY

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TruthValue

How to Use in IPNetwork Monitor

Example using hm2VpnConnInfoIpsecInBytes OID:

Select a Hirschmann industrial switch/gateway (IPsec/IKE VPN) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hm2VpnConnInfoIpsecInBytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of input Bytes from this IPsec tunnel. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
HMT hm2VpnCertificateCertUploadDate	1.3.6.1.4.1.248.11.120.1.4.10.1.8	HmTimeSeconds1970	read-only	Time and date of last write access using the content of the variable hm2SystemTime.
HMT hm2VpnCertificateEndDate	1.3.6.1.4.1.248.11.120.1.4.10.1.5	HmTimeSeconds1970	read-only	Time and date when certificate will expire.
hm2VpnCertificateEntry	1.3.6.1.4.1.248.11.120.1.4.10.1		not-accessible	A certificate file entry. A certificate file which has been copied to the device and can be used for VPN connections.
STR hm2VpnCertificateFileName	1.3.6.1.4.1.248.11.120.1.4.10.1.6	DisplayString	read-only	Name of the file consisting of alphanumeric characters plus hyphen, underscore and dot.
hm2VpnCertificateGroup	1.3.6.1.4.1.248.11.120.1.4
I32 hm2VpnCertificateIndex	1.3.6.1.4.1.248.11.120.1.4.10.1.1	Integer32	not-accessible	Index of the entry.
STR hm2VpnCertificateIssuer	1.3.6.1.4.1.248.11.120.1.4.10.1.3	DisplayString	read-only	Certificate issuer.
I32 hm2VpnCertificateNoConnections	1.3.6.1.4.1.248.11.120.1.4.10.1.11	Integer32	read-only	Number of active connections that use this certificate. The certificate cannot be deleted from the device unless there are no active connections using it (this field is set to 0).
STR hm2VpnCertificatePrivateKeyFile	1.3.6.1.4.1.248.11.120.1.4.10.1.10	DisplayString	read-only	Name of the file consisting of alphanumeric characters plus hyphen, underscore and dot.
INT hm2VpnCertificatePrivateKeyStatus	1.3.6.1.4.1.248.11.120.1.4.10.1.9	INTEGER	read-only	Shows if a Peer certificate has a private key uploaded on the device. A Peer certificate cannot be used without a private key uploaded to the device. Does not apply to CA certificates.
HMT hm2VpnCertificateStartDate	1.3.6.1.4.1.248.11.120.1.4.10.1.4	HmTimeSeconds1970	read-only	Time and date when certificate is begining to be valid.
STR hm2VpnCertificateSubject	1.3.6.1.4.1.248.11.120.1.4.10.1.2	DisplayString	read-only	Subject field of certificate.
hm2VpnCertificateTable	1.3.6.1.4.1.248.11.120.1.4.10		not-accessible	The list of certificates available on the device.
INT hm2VpnCertificateType	1.3.6.1.4.1.248.11.120.1.4.10.1.7	INTEGER	read-only	Type of the container file used.
STR hm2VpnCertificateUploadPassphrase	1.3.6.1.4.1.248.11.120.1.4.1	DisplayString	read-write	Setting the correct passphrase here before uploading an encrypted private key or an encrypted PKCS12 container will trigger the decryption of the uploaded file before storing on the device. The value cannot be read and is not stored after the file transfer. WARNING: the file is stored unencrypted on the device. Use with care!
INT hm2VpnCertificateUserActions	1.3.6.1.4.1.248.11.120.1.4.10.1.12	INTEGER	read-write	Provides a way to delete unused certificate files from the device. A certificate can only be deleted if there are no active connections using it (see hm2VpnCertificateNoConnections). Deleting a Peer certificate automatically deletes the private key asociated with it (if any).
I32 hm2VpnConnActiveMax	1.3.6.1.4.1.248.11.120.1.2.2	Integer32	read-only	Maximum number of active (and up) VPN connections supported.
BIT hm2VpnConnDebug	1.3.6.1.4.1.248.11.120.1.2.10.1.33	Bits	read-create	Used for debugging purpose of the VPN connections. May affect the performance significant. Please handle with care. If the bit is set informational(0) messages, unhandled(1) messages (not handled by the stack) are logged to the event log
STR hm2VpnConnDesc	1.3.6.1.4.1.248.11.120.1.2.10.1.31	DisplayString	read-create	User defined text.
hm2VpnConnectionGroup	1.3.6.1.4.1.248.11.120.1.2
hm2VpnConnEntry	1.3.6.1.4.1.248.11.120.1.2.10.1		not-accessible	A VPN connection entry.
INT hm2VpnConnIkeAlgDh	1.3.6.1.4.1.248.11.120.1.2.10.1.20	INTEGER	read-create	Diffie-Hellman key agreement algorithm to be used for establishment of IKE-SA: o any: accept all supported algorithms as responder, use default as initiator o modp1024: RSA with 1024 bits modulus (DH Group 2) o modp1536: RSA with 1536 bits modulus (DH Group 5) o modp2048: RSA with 2048 bits modulus (DH Group 14) o modp3072: RSA with 3072 bits modulus (DH Group 15) o modp4096: RSA with 4096 bits modulus (DH Group 16)
INT hm2VpnConnIkeAlgEncr	1.3.6.1.4.1.248.11.120.1.2.10.1.22	INTEGER	read-create	Encryption algorithm to be used in IKE: o any: accept all supported algorithms as responder, use various pre-defined as initiator o des: DES o des3: Triple-DES o aes128: AES with 128 key bits o aes192: AES with 192 key bits o aes256: AES with 256 key bits
INT hm2VpnConnIkeAlgMac	1.3.6.1.4.1.248.11.120.1.2.10.1.21	INTEGER	read-create	Integrity (MAC) algorithm to be used in IKEv2: o any: accept all supported algorithms as responder, use various pre-defined as initiator o hmacmd5: HMAC-MD5 (length 96 bit) o hmacsha1: HMAC-SHA1 (length 96 bit) o hmacsha256: HMAC-SHA256 (length 128 bit) o hmacsha384: HMAC-SHA384 (length 196 bit) o hmacsha512: HMAC-SHA512 (length 256 bit)
STR hm2VpnConnIkeAuthCertCA	1.3.6.1.4.1.248.11.120.1.2.10.1.10	DisplayString	read-create	PEM encoded X.509 certificate file name (RFC 1422), if authentication type in 'hm2VpnConnIkeAuthType' is 'individualx509'. This certificate is used for RSA based signature verification in local and remote certificates. The file needs to be uploaded separately.
STR hm2VpnConnIkeAuthCertLocal	1.3.6.1.4.1.248.11.120.1.2.10.1.12	DisplayString	read-create	PEM encoded X.509 certificate file name (RFC 1422) to be used, if authentication type in 'hm2VpnConnIkeAuthType' is 'individualx509' or 'pkcs12'. This certificate is used for authentication of local peer at the remote side. The certificate binds the identity of local peer to it's public key, signed by the certification authority (CA) from 'hm2VpnConnIkeAuthCertCA'. The file needs to be uploaded separately.
STR hm2VpnConnIkeAuthCertRemote	1.3.6.1.4.1.248.11.120.1.2.10.1.11	DisplayString	read-create	PEM encoded X.509 certificate file name (RFC 1422), if authentication type in 'hm2VpnConnIkeAuthType' is 'individualx509'. This certificate is used for RSA based authentication of remote peer at the local side. This certificate binds the identity of remote peer to it's public key. It is optional because typically send by the remote peer while negotiating an ISAKMP/IKE security association. The file needs to be uploaded separately.
STR hm2VpnConnIkeAuthLocId	1.3.6.1.4.1.248.11.120.1.2.10.1.16	DisplayString	read-create	Local peer identifier to be sent within ID payload during negotiation. The ID payload is used to identify the initiator of the security association. The identity is used by the responder to determine the correct host system security policy requirement for the association (see RFC 2407, section 4.6.2 for details when using IKEv1 and RFC 4306, section 3.5 for IKEv2). Allowed formats for this object depend on 'hm2VpnConnIkeAuthLocType': o default: don't care o address: don't care, take IPv4 address or host name from hm2VpnConnIkeLocalAddr o id: - IPv4 address or host name - key identifier - fully qualified domain name - fully qualified RFC 822 email address - X.500 distinguished name (DN)
INT hm2VpnConnIkeAuthLocType	1.3.6.1.4.1.248.11.120.1.2.10.1.17	INTEGER	read-create	Type of local peer identifier in 'hm2VpnConnIkeAuthLocId': o default: If 'hm2VpnConnIkeAuthType' is 'psk' then use the IP address or host name from 'hm2VpnConnIkeLocalAddr' as local identifier. In case of 'individualx509' or 'pkcs12' use the DN from local certificate in 'hm2VpnConnIkeAuthCertLocal'. o address: use the IP address or DNS name from 'hm2VpnConnIkeLocalAddr' as local identifier. o id: use the configured value in hm2VpnConnIkeAuthLocId (it can be of any type in the description). For further information see RFC 2407, section 4.6.2
INT hm2VpnConnIkeAuthMode	1.3.6.1.4.1.248.11.120.1.2.10.1.9	INTEGER	read-create	The phase 1 exchange mode to be used (IKEv1).
STR hm2VpnConnIkeAuthPasswd	1.3.6.1.4.1.248.11.120.1.2.10.1.14	DisplayString	read-create	Passphrase to be used for decryption of private key from 'hm2VpnConnIkeAuthPrivKey' or the certificate container for 'pkcs12' type certificates which are uploaded encrypted.
STR hm2VpnConnIkeAuthPrivKey	1.3.6.1.4.1.248.11.120.1.2.10.1.13	DisplayString	read-create	Private key file name to be used, if authentication type in 'hm2VpnConnIkeAuthType' is 'individualx509' and the key stored on the device is encrypted with a passphrase (so it cannot automatically be matched with the certificate). Note that this is only the filename of the private key. The passphrase must be added to 'hm2VpnConnIkeAuthPasswd'.
STR hm2VpnConnIkeAuthPsk	1.3.6.1.4.1.248.11.120.1.2.10.1.15	DisplayString	read-create	Pre-shared key (passphrase) to be used if authentication type in 'hm2VpnConnIkeAuthType' is 'psk'. The pre-shared key sequence cannot contain newline or double-quote characters. Alternatively to characters sequence, pre-shared secrets can be represented as hexadecimal or Base64 encoded binary values. A character sequence beginning with 0x is interpreted as sequence hexadecimal digits. Similarly, a character sequence beginning with 0s is interpreted as Base64 encoded binary data.
STR hm2VpnConnIkeAuthRemId	1.3.6.1.4.1.248.11.120.1.2.10.1.18	DisplayString	read-create	Remote peer identifier to be compared with ID payload during negotiation. The ID payload is used to identify the initiator of the security association. The identity is used by the responder to determine the correct host system security policy requirement for the association (see RFC 2407, section 4.6.2 for details when using IKEv1 and RFC 4306, section 3.5 for IKEv2). Allowed formats for this entry depend on 'hm2VpnConnIkeAuthRemType': o any: don't care o address: don't care, take IPv4 address or host name from hm2VpnConnIkeRemoteAddr o id: - IPv4 address or host name - key identifier - fully qualified domain name - fully qualified RFC 822 email address - X.500 distinguished name (DN)
INT hm2VpnConnIkeAuthRemType	1.3.6.1.4.1.248.11.120.1.2.10.1.19	INTEGER	read-create	Type of remote peer identifier in hm2VpnConnIkeAuthRemId: o any: received remote identifier is not checked o address: use the IP address or host name from 'hm2VpnConnIkeRemoteAddr' as remote identifier. o id: use the configured value in hm2VpnConnIkeAuthRemId (it can be of any type in the description). For further information see RFC 2407, section 4.6.2
INT hm2VpnConnIkeAuthType	1.3.6.1.4.1.248.11.120.1.2.10.1.8	INTEGER	read-create	Type of authentication to be used: pre-shared key, individual X509 certificates (separate for CA and local identification) or one PKCS12 container with all the needed certificates (including the CA).
I32 hm2VpnConnIkeDpdTimeout	1.3.6.1.4.1.248.11.120.1.2.10.1.5	Integer32	read-create	If greater than zero, the local peer sends Dead Peer Detection (DPD) messages (according to RFC 3706) to the remote peer. This value specifies the timeout in seconds, the remote peer is declared dead, if not responding. The value 0 disables this feature.
I32 hm2VpnConnIkeLifetime	1.3.6.1.4.1.248.11.120.1.2.10.1.4	Integer32	read-create	Lifetime of IKE security association in seconds. The maximum value is 24 hours (86400 seconds).
STR hm2VpnConnIkeLocalAddr	1.3.6.1.4.1.248.11.120.1.2.10.1.6	DisplayString	read-create	Hostname (FQDN) or IP address of local security gateway. If the value is 'any', then the IP address of the matching interface is used. Establishing the connection may be delayed until the hostname (if specified) can be resolved.
T/F hm2VpnConnIkeReAuth	1.3.6.1.4.1.248.11.120.1.2.10.1.23	TruthValue	read-create	whether re-keying of an IKE_SA should also re-authenticate the peer. In IKEv1, re-authentication is always done (also when set to false). In IKEv2, a value of false does re-keying without un-installing the IPsec SAs, a value of true creates a new IKE_SA from scratch and tries to recreate all IPsec SAs.
STR hm2VpnConnIkeRemoteAddr	1.3.6.1.4.1.248.11.120.1.2.10.1.7	DisplayString	read-create	Typically the hostname (FQDN) or IP address of remote security gateway. If this value is 'any', then any IP address is accepted when establishing an IKE-SA as responder. Also a network in CIDR notation, to be accepted when establishing the IKE-SA, is allowed as responder. As initiator such values are not allowed. Establishing the VPN connection may be delayed until the hostname (if specified) can be resolved.
INT hm2VpnConnIkeStartup	1.3.6.1.4.1.248.11.120.1.2.10.1.3	INTEGER	read-create	If this host acts as a responder it does not initiate a key exchange (IKE) nor connection parameters negotiation. Otherwise, this host acts as an initiator - then it initiates an IKE actively.
INT hm2VpnConnIkeVersion	1.3.6.1.4.1.248.11.120.1.2.10.1.2	INTEGER	read-create	Version of the IKE protocol: o ike: accept IKEv1/v2 as responder, start with IKEv2 as initiator o ikev1: used protocol is IKE version 1 (ISAKMP) o ikev2: used protocol is IKE version 2
I32 hm2VpnConnIndex	1.3.6.1.4.1.248.11.120.1.2.10.1.1	Integer32	accessible-for-notify	An index that uniquely identifies the entry in the table.
hm2VpnConnInfoEntry	1.3.6.1.4.1.248.11.120.1.2.15.1		not-accessible	A VPN connection entry.
U32 hm2VpnConnInfoEstablished	1.3.6.1.4.1.248.11.120.1.2.15.1.6	Unsigned32	read-only	Time in seconds since the connection has been established (is updated after IKE re-authentication).
STR hm2VpnConnInfoIKEInitiatorSPI	1.3.6.1.4.1.248.11.120.1.2.15.1.16	DisplayString	read-only	The IKE initiator SPI (local or remote, depends on initiator settings).
STR hm2VpnConnInfoIkeProposal	1.3.6.1.4.1.248.11.120.1.2.15.1.2	DisplayString	read-only	Algorithms the IKE use for key exchange.
U32 hm2VpnConnInfoIKEReauth	1.3.6.1.4.1.248.11.120.1.2.15.1.7	Unsigned32	read-only	Time in seconds when the next IKE re-authentication will take place.
U32 hm2VpnConnInfoIKERekeying	1.3.6.1.4.1.248.11.120.1.2.15.1.8	Unsigned32	read-only	Time in seconds when the next IKE re-keying will take place.
STR hm2VpnConnInfoIKEResponderSPI	1.3.6.1.4.1.248.11.120.1.2.15.1.17	DisplayString	read-only	The IKE responder SPI (local or remote, depends on initiator settings).
INT hm2VpnConnInfoIkeVersionUsed	1.3.6.1.4.1.248.11.120.1.2.15.1.1	INTEGER	read-only	Version of the IKE protocol used by connection: o ikev1: used protocol is IKE version 1 (ISAKMP) o ikev2: used protocol is IKE version 2
C64 hm2VpnConnInfoIpsecInBytesEx	1.3.6.1.4.1.248.11.120.1.2.15.1.10	Counter64	read-only	Number of input Bytes from this IPsec tunnel.
C64 hm2VpnConnInfoIpsecInPackets	1.3.6.1.4.1.248.11.120.1.2.15.1.11	Counter64	read-only	Number of input packets from this IPsec tunnel.
STR hm2VpnConnInfoIpsecInSPI	1.3.6.1.4.1.248.11.120.1.2.15.1.18	DisplayString	read-only	The input IPsec SPI.
U32 hm2VpnConnInfoIpsecInUse	1.3.6.1.4.1.248.11.120.1.2.15.1.12	Unsigned32	read-only	Time in seconds since the IPsec tunnel has received last time data.
C64 hm2VpnConnInfoIpsecOutBytes	1.3.6.1.4.1.248.11.120.1.2.15.1.13	Counter64	read-only	Number of output Bytes to this IPsec tunnel.
C64 hm2VpnConnInfoIpsecOutPackets	1.3.6.1.4.1.248.11.120.1.2.15.1.14	Counter64	read-only	Number of output packets to this IPsec tunnel.
STR hm2VpnConnInfoIpsecOutSPI	1.3.6.1.4.1.248.11.120.1.2.15.1.19	DisplayString	read-only	The output IPsec SPI.
U32 hm2VpnConnInfoIpsecOutUse	1.3.6.1.4.1.248.11.120.1.2.15.1.15	Unsigned32	read-only	Time in seconds since to the IPsec tunnel has sent last time data.
STR hm2VpnConnInfoIpsecProposal	1.3.6.1.4.1.248.11.120.1.2.15.1.3	DisplayString	read-only	Algorithms IPsec use for the data communication.
U32 hm2VpnConnInfoIpsecRekeying	1.3.6.1.4.1.248.11.120.1.2.15.1.9	Unsigned32	read-only	Time in seconds when the next IPsec re-keying will take place.
STR hm2VpnConnInfoLocalHost	1.3.6.1.4.1.248.11.120.1.2.15.1.4	DisplayString	read-only	Local host detected by IKE.
STR hm2VpnConnInfoRemoteHost	1.3.6.1.4.1.248.11.120.1.2.15.1.5	DisplayString	read-only	Remote host detected by IKE.
hm2VpnConnInfoTable	1.3.6.1.4.1.248.11.120.1.2.15		not-accessible	A list of VPN connections.
INT hm2VpnConnIpsecAlgDh	1.3.6.1.4.1.248.11.120.1.2.10.1.27	INTEGER	read-create	Diffie-Hellman key agreement algorithm to be used for IPsec-SA session key establishment: o any: accept all supported algorithms as responder, use various pre-defined as initiator o modp1024: RSA with 1024 bits modulus (DH Group 2) o modp1536: RSA with 1536 bits modulus (DH Group 5) o modp2048: RSA with 2048 bits modulus (DH Group 14) o modp3072: RSA with 3072 bits modulus (DH Group 15) o modp4096: RSA with 4096 bits modulus (DH Group 16) o none: no Perfect Forward Secrecy (PFS)
INT hm2VpnConnIpsecAlgEncr	1.3.6.1.4.1.248.11.120.1.2.10.1.29	INTEGER	read-create	Encryption algorithm to be used for payload encryption in IPsec: o any: accept all supported algorithms as responder, use various pre-defined as initiator o des: DES o des3: Triple-DES o aes128: AES-CBC with 128 key bits o aes192: AES-CBC with 192 key bits o aes256: AES-CBC with 256 key bits o aes128ctr: AES-COUNTER with 128 key bits o aes192ctr: AES-COUNTER with 192 key bits o aes256ctr: AES-COUNTER with 256 key bits o aes128gcm64: AES-GCM with 64 bit ICV with 128 key bits o aes128gcm96: AES-GCM with 96 bit ICV with 128 key bits o aes128gcm128: AES-GCM with 128 bit ICV with 128 key bits o aes192gcm64: AES-GCM with 64 bit ICV with 192 key bits o aes192gcm96: AES-GCM with 96 bit ICV with 192 key bits o aes192gcm128: AES-GCM with 128 bit ICV with 192 key bits o aes256gcm64: AES-GCM with 64 bit ICV with 256 key bits o aes256gcm96: AES-GCM with 96 bit ICV with 256 key bits o aes256gcm128: AES-GCM with 128 bit ICV with 256 key bits
INT hm2VpnConnIpsecAlgMac	1.3.6.1.4.1.248.11.120.1.2.10.1.28	INTEGER	read-create	Integrity (MAC) algorithm to be used in IPsec: o any: accept all supported algorithms as responder, use various pre-defined as initiator o hmacmd5: HMAC-MD5 (length 96 bit) o hmacsha1: HMAC-SHA1 (length 96 bit) o hmacsha256: HMAC-SHA256 (length 128 bit) o hmacsha384: HMAC-SHA384 (length 196 bit) o hmacsha512: HMAC-SHA512 (length 256 bit)
I32 hm2VpnConnIpsecLifetime	1.3.6.1.4.1.248.11.120.1.2.10.1.25	Integer32	read-create	Lifetime of IPsec security association in seconds. The maximum value is 8 hours (28800 seconds).
INT hm2VpnConnIpsecMode	1.3.6.1.4.1.248.11.120.1.2.10.1.24	INTEGER	read-create	IPsec encapsulation mode.
STR hm2VpnConnLastError	1.3.6.1.4.1.248.11.120.1.2.10.1.32	HmLargeDisplayString	read-only	Last error notification occurred for this connection. This is useful if the connection does not reach the up state to see if an error has occurred in the proposal exchange or when establishing the tunnel. In most cases this variable should be empty.
I32 hm2VpnConnMargintime	1.3.6.1.4.1.248.11.120.1.2.10.1.26	Integer32	read-create	How long before connection expiry or keying-channel expiry should attempts to negotiate a replacement begin. The maximum value is half an hour (1800 seconds). The margin time needs to be at most half of the lifetime.
I32 hm2VpnConnMax	1.3.6.1.4.1.248.11.120.1.2.1	Integer32	read-only	Maximum number of VPN connections supported. Notice that the maximum number of active and up VPN connections is limited to hm2VpnConnActiveMax.
I32 hm2VpnConnNext	1.3.6.1.4.1.248.11.120.1.2.3	Integer32	read-only	This object always holds an appropriate value to be used for hm2VpnConnIndex when creating entries in the hm2VpnConnTable. The value 0 indicates that no unassigned entries are available. To obtain the hm2VpnConnIndex value for a new entry, the management station issues a SNMP retrieval operation to obtain the current value of this object. After each row creation or deletion the agent modifies the value to the next unassigned index.
INT hm2VpnConnOperStatus	1.3.6.1.4.1.248.11.120.1.2.10.1.30	INTEGER	read-only	The current operational status of the VPN connection: o 'up': the IKE-SA and all IPsec SAs are up; o 'down': the IKE-SA and all IPsec SAs are down; o 'negotiation': key exchange and algorithm negotiation is in progress (or, as responder, waiting to be contacted for that purpose); o 'constructing': the IKE-SA is up, but at least one IPsec-SA is not established so far; o 'dormant': waiting for a precondition to be fulfilled before connection setup, e.g.: - a dynamically assigned IP address; - successful hostname resolution; - assignment of a valid system time. o 're-keying': key exchange is in progress after timeout of lifetime has occured, either IKE or IPSEC;
ROW hm2VpnConnRowStatus	1.3.6.1.4.1.248.11.120.1.2.10.1.34	RowStatus	read-create	The row status of this table entry. If the row status is 'active' then it is not allowed to change any value (this applies also to active traffic selectors). The maximum number of active VPN connections is limited to hm2VpnConnMax. The maximum number of active and up VPN connections is limited to hm2VpnConnActiveMax.
hm2VpnConnTable	1.3.6.1.4.1.248.11.120.1.2.10		not-accessible	A list of VPN connections.
NTF hm2VpnDownTrap	1.3.6.1.4.1.248.11.120.0.2			A hm2VpnDownTrap trap signals that a VPN connection is about to enter the down state from some other state (see 'hm2VpnConnOperStatus').
hm2VpnGeneralGroup	1.3.6.1.4.1.248.11.120.1.1
hm2VpnMib	1.3.6.1.4.1.248.11.120			This MIB defines the SNMP interface for Hirschmann VPN implementations.
hm2VpnMibNotifications	1.3.6.1.4.1.248.11.120.0
hm2VpnMibObjects	1.3.6.1.4.1.248.11.120.1
hm2VpnMibSNMPExtensionActiveRow	1.3.6.1.4.1.248.11.120.3.4			Indicates that an active row shall be changed.
hm2VpnMibSNMPExtensionGroup	1.3.6.1.4.1.248.11.120.3
hm2VpnMibSNMPExtensionInitiatorAny	1.3.6.1.4.1.248.11.120.3.5			Indicates that for a VPN connection as initiator the remote end point is set to any.
hm2VpnMibSNMPExtensionNoTrafficSelector	1.3.6.1.4.1.248.11.120.3.1			Indicates that for a VPN connection no active traffic selectors are available.
hm2VpnMibSNMPExtensionTooManyActive	1.3.6.1.4.1.248.11.120.3.2			Indicates that too many VPN connections are in active state.
hm2VpnMibSNMPExtensionTooManyConns	1.3.6.1.4.1.248.11.120.3.3			Indicates that too many VPN connections shall be added to the configuration.
STR hm2VpnTrafficSelDesc	1.3.6.1.4.1.248.11.120.1.3.1.1.6	DisplayString	read-create	User defined text.
STR hm2VpnTrafficSelDstAddr	1.3.6.1.4.1.248.11.120.1.3.1.1.3	DisplayString	read-create	Host or subnet address in CIDR notation (a.b.c.d/n) for which this traffic descriptor (and the associated VPN connection) is responsible. This address is compared to the destination address of IP packets sent, when determining the associated IPsec and IKE-SA. The special keyword 'any' means that the address comparison always matches.
STR hm2VpnTrafficSelDstRest	1.3.6.1.4.1.248.11.120.1.3.1.1.5	DisplayString	read-create	The optional destination restrictions (names or numbers) , e.g. tcp/http which is equal to 6/80, or udp which is equal to udp/any or /53 which is equal to any/53
hm2VpnTrafficSelEntry	1.3.6.1.4.1.248.11.120.1.3.1.1		not-accessible	A traffic selector entry. A traffic selector defines the subnet/host addresses for which this IPSec connection (SA) is responsible.
hm2VpnTrafficSelGroup	1.3.6.1.4.1.248.11.120.1.3
I32 hm2VpnTrafficSelIndex	1.3.6.1.4.1.248.11.120.1.3.1.1.1	Integer32	not-accessible	An index that (together with the connection index hm2VpnConnIndex) identifies the entry in the traffic selector table. This index can be choosen freely, but must be greater than 0.
ROW hm2VpnTrafficSelRowStatus	1.3.6.1.4.1.248.11.120.1.3.1.1.7	RowStatus	read-create	The row status of this table entry. Only traffic selector entries with an 'active' row status will be considered if the connections row status is set 'active'. Independent of that dependency any value in this entry can be changed only if the row status is not 'active'.
STR hm2VpnTrafficSelSrcAddr	1.3.6.1.4.1.248.11.120.1.3.1.1.2	DisplayString	read-create	Host or subnet address in CIDR notation (a.b.c.d/n) for which this traffic descriptor (and the associated VPN connection) is responsible. This address is compared to the source address of IP packets sent, when determining the associated IPsec and IKE-SA. The special keyword 'any' means that the address comparison always matches.
STR hm2VpnTrafficSelSrcRest	1.3.6.1.4.1.248.11.120.1.3.1.1.4	DisplayString	read-create	The optional source restrictions (names or numbers) , e.g. tcp/http which is equal to 6/80, or udp which is equal to udp/any or /53 which is equal to any/53
hm2VpnTrafficSelTable	1.3.6.1.4.1.248.11.120.1.3.1		not-accessible	A list of traffic selectors. For details on the role of traffic selectors in IPsec protocol see RFC 2409, section 5.5 and RFC 4306, section 2.9.
NTF hm2VpnUpTrap	1.3.6.1.4.1.248.11.120.0.1			A hm2VpnUpTrap trap signals that a VPN connection is about to enter the up state from some other state (see 'hm2VpnConnOperStatus').

RFC description

Hirschmann VPN management for connections, traffic selection, and certificate provisioning.

Start monitoring Hirschmann industrial switch/gateway (IPsec/IKE VPN) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HM2-VPN-MIB