HPN-ICF-OBJP-MIB

All MIBs › HPN-ICF-OBJP-MIB

Last Updated: 2014-03-10

Category: Vendor: H3C/HH3C, Vendor: HP/HPE

Description: Manages object policy (OBJP) address object groups used in ACLs and security policies on HP/Comware devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HPN-ICF-OBJP-MIB?

HPN-ICF-OBJP-MIB is an HP Networking (Comware/H3C) vendor MIB for managing object-policy (OBJP) constructs, which are named address/service object groups referenced by ACLs and security-zone policies on the device, along with runtime hit statistics for zone-pair rules built on those objects. It exposes a zone-pair running-info table that records source/destination security zones, IP version, rule ID, and per-rule match packet counts with the timestamp of the last match. For hardware/software status monitoring, the match-count and last-match-time fields are directly useful for confirming that a security policy rule is actually being exercised by traffic (or conversely, flagging a rule that never matches, suggesting a misconfiguration or unused policy), which supports firewall/security-policy health monitoring on the device. It depends conceptually on the device's security-zone and ACL/object-group configuration model rather than a specific IETF MIB. It is deployed on HP/H3C Comware security gateways, firewalls, or routers implementing zone-based policy with object-group-based rule matching. Engineers can download the HPN-ICF-OBJP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-OBJP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP/H3C Comware security gateway/firewall

Monitoring Examples

An administrator would poll hpnicfObjpZonePairRunningInfoTable, keyed by hpnicfObjpZonePairSrcZone/hpnicfObjpZonePairDstZone/hpnicfObjpZonePairRuleID, and inspect hpnicfObjpZonePairMatchPacketCount alongside hpnicfObjpZonePairLastMatchTime to confirm a given zone-pair security rule is actively matching traffic. A rule whose hpnicfObjpZonePairLastMatchTime is stale despite expected traffic flow would indicate the object-policy rule is misconfigured or traffic is bypassing it, while hpnicfObjpZonePairIPVersion confirms whether the rule applies to IPv4 or IPv6 traffic.

What Can Be Monitored

zone-pair rule match packet count
last match timestamp per rule
source/destination security zone
rule IP version

Imported Objects

From HPN-ICF-OID-MIB

hpnicfCommon

OBJECT-IDENTITY

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

How to Use in IPNetwork Monitor

Example using hpnicfObjpZonePairMatchPacketCount OID:

Select an HP/H3C Comware security gateway/firewall (zone-pair object-policy hit stats) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpnicfObjpZonePairMatchPacketCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of packets matching the rule. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpnicfObjp	1.3.6.1.4.1.11.2.14.11.15.2.155			Object-policy management information base for managing devices that support object policy.
hpnicfObjpZonePairObjects	1.3.6.1.4.1.11.2.14.11.15.2.155.1
hpnicfObjpZonePairRunningInfoTable	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1		not-accessible	Object policy of zone pair running information base.
hpnicfObjpZonePairRunningInfoEntry	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1.1		not-accessible	Object policy of zone pair running information entry.
OCT hpnicfObjpZonePairSrcZone	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1.1.1	OCTET STRING	not-accessible	Name of the source security zone.
OCT hpnicfObjpZonePairDstZone	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1.1.2	OCTET STRING	not-accessible	Name of the destination security zone.
INT hpnicfObjpZonePairIPVersion	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1.1.3	INTEGER	not-accessible	IP protocol version.
U32 hpnicfObjpZonePairRuleID	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1.1.4	Unsigned32	not-accessible	Rule ID of object policy.
C64 hpnicfObjpZonePairMatchPacketCountEx	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1.1.5	Counter64	read-only	Number of packets matching the rule.
U32 hpnicfObjpZonePairLastMatchTime	1.3.6.1.4.1.11.2.14.11.15.2.155.1.1.1.6	Unsigned32	read-only	Interval in seconds between the last match and 1970/1/1 00:00:00.

RFC description

Manages object policy (zone pair) configurations and statistics for network access control.

Start monitoring HP/H3C Comware security gateway/firewall (zone-pair object-policy hit stats) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HPN-ICF-OBJP-MIB