HUAWEI-FIREWALL-MIB

All MIBs › HUAWEI-FIREWALL-MIB

Organization: Huawei Technologies Co.,Ltd.

Last Updated: 2013-07-30

Category: Domain: Security, VPN and Security, Vendor: Huawei

Description: Huawei firewall MIB providing objects to configure security zones, policies, NAT rules, and monitor session tables on Huawei firewall products.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-FIREWALL-MIB?

HUAWEI-FIREWALL-MIB is a Huawei-specific SNMP MIB (referencing draft-grall-firewall-mib-01) for monitoring firewall state on Huawei datacom devices under the hwDatacomm enterprise branch. It models security zones (hwFwZoneTable, indexed by hwFwZoneIndex, exposing hwFwZoneName, hwFwZonePriority, hwFwZoneIfList, and hwFwZoneIfNum), inter-zone relationships (hwFwInterZoneTable), connection-level statistics (hwFwConnectionStatTable keyed on hwFwConnectionStatService/hwFwConnectionStatType with hwFwConnectionStatCount), and event logging (hwFwBasicEventsTable, hwFwNetEventsTable) alongside notifications under hwFirewallMIBNotifications. This exposes counters that reveal firewall session/connection load and zone configuration state useful for capacity and security-posture monitoring. It depends on the broader Huawei enterprise MIB tree for its OID placement and complements other Huawei device MIBs. It is deployed on Huawei USG/Eudemon-class firewall appliances, and the HUAWEI-FIREWALL-MIB MIB is what network engineers load into their monitoring tools to poll this zone and connection data.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei USG/Eudemon-series firewalls (hwDatacomm platforms)

Monitoring Examples

An operator polls hwFwConnectionStatTable to track hwFwConnectionStatCount for a given hwFwConnectionStatService/hwFwConnectionStatType pair, and cross-checks hwFwZoneIfNum in hwFwZoneTable; a spike in half-open connection counts alongside an unexpected zone interface count would indicate a connection-exhaustion attack or misconfigured zone.

What Can Be Monitored

firewall connection/session statistics
security zone table entries and interface counts
inter-zone relationship table
basic and network firewall event logs
protocol aging-time settings
firewall notification/trap objects

Imported Objects

From HUAWEI-MIB

hwDatacomm

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From Q-BRIDGE-MIB

PortList

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using hwFwConnectionStatCount OID:

Select a Huawei USG/Eudemon-series firewall appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hwFwConnectionStatCount into the Find box to locate it in the OID tree, then select it and click OK. This is an integer that contains the value of the resource statistic. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hwFirewallMIB	1.3.6.1.4.1.2011.5.25.222			The MIB contains objects of firewall , referencing the draft-grall-firewall-mib-01.
hwFirewallMIBAgingTimeGroup	1.3.6.1.4.1.2011.5.25.222.3.2.8			This is the firewall Aging time group.
hwFirewallMIBCompliance	1.3.6.1.4.1.2011.5.25.222.3.1.1			The compliance statement for entities which implement the hwFirewallMIB.
hwFirewallMIBCompliances	1.3.6.1.4.1.2011.5.25.222.3.1
hwFirewallMIBConformance	1.3.6.1.4.1.2011.5.25.222.3
hwFirewallMIBEventsGroup	1.3.6.1.4.1.2011.5.25.222.3.2.1			Firewall events
hwFirewallMIBGroups	1.3.6.1.4.1.2011.5.25.222.3.2
hwFirewallMIBInterZoneGroup	1.3.6.1.4.1.2011.5.25.222.3.2.6			This is the firewall interzone group.
hwFirewallMIBLogGroup	1.3.6.1.4.1.2011.5.25.222.3.2.7			This is the firewall log group.
hwFirewallMIBNotificationGroup	1.3.6.1.4.1.2011.5.25.222.3.2.3			Firewall Notifications
hwFirewallMIBNotificationGroupRev1	1.3.6.1.4.1.2011.5.25.222.3.2.4			Firewall Notifications
hwFirewallMIBNotifications	1.3.6.1.4.1.2011.5.25.222.1.3
hwFirewallMIBObjects	1.3.6.1.4.1.2011.5.25.222.1
hwFirewallMIBStatisticsGroup	1.3.6.1.4.1.2011.5.25.222.3.2.2			Firewall statistics
hwFirewallMIBZoneGroup	1.3.6.1.4.1.2011.5.25.222.3.2.5			This is the firewall zone group.
STR hwFwBasicEventDescription	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.2.1.4	SnmpAdminString	read-only	A description of the event. The value of the object may be a zero-length string.
U32 hwFwBasicEventDetailsTableRow	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.2.1.5	Unsigned32	read-only	A pointer to a row in the table containing details about this event. Generally, the table will be the cfwNetEventsTable but a Cisco-defined table may also appear here. If there there is no more detailed information for this event the value of this object will have the value {0 0}.
U32 hwFwBasicEventIndex	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.2.1.1	Unsigned32	not-accessible	An index that uniquely identifies an entry in the log table. These indices are assigned beginning with 1 and increase by one with each new event logged.
hwFwBasicEvents	1.3.6.1.4.1.2011.5.25.222.1.1.2.3
hwFwBasicEventsEntry	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.2.1		not-accessible	An entry in the table, containing general information about an event. This table will always be sparse, i.e., each row will instanciate only a subet of the columnar objects.
hwFwBasicEventsTable	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.2		not-accessible	Table of basic data for firewall events. The agent may choose to delete the instances of cfwBasicEventsEntry as required because of lack of memory. The oldest Events will be selected first for deletion.
U32 hwFwBasicEventsTableLastRow	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.1	Unsigned32	read-only	The index value of the most recently created row in the cfwBasicEventsTable. This number starts at 1 and increase by one with each new log entry. When this number wraps, all events are deleted.
STR hwFwBasicEventTime	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.2.1.2	SnmpAdminString	read-only	The time that the event occurred.
SEC hwFwBasicSecurityEventType	1.3.6.1.4.1.2011.5.25.222.1.1.2.3.2.1.3	SecurityEvent	read-only	The type of security-related event that this row contains. If the event is not security-related this object will not be instantiated.
IP hwFwBinaryLogHostAddr	1.3.6.1.4.1.2011.5.25.222.1.2.5.12	IpAddress	read-only	IP address of log server.
U32 hwFwBinaryLogHostPort	1.3.6.1.4.1.2011.5.25.222.1.2.5.13	Unsigned32	read-only	Port number of log server.
IP hwFwBinaryLogSrcAddr	1.3.6.1.4.1.2011.5.25.222.1.2.5.14	IpAddress	read-only	IP address used by the device to communicate with the log server.
U32 hwFwBinaryLogSrcPort	1.3.6.1.4.1.2011.5.25.222.1.2.5.15	Unsigned32	read-only	Port number used by the device to communicate with the log server.
T/F hwFwBinaryLogStatus	1.3.6.1.4.1.2011.5.25.222.1.2.5.11	TruthValue	read-only	Whether binary log is enabled.
OCT hwFwBinaryLogVpnName	1.3.6.1.4.1.2011.5.25.222.1.2.5.16	OCTET STRING	read-only	Name of vpn-instance.
TIK hwFwBlackListLogInterval	1.3.6.1.4.1.2011.5.25.222.1.2.5.2	TimeTicks	read-only	Interval of blacklist log.
T/F hwFwBlackListLogStatus	1.3.6.1.4.1.2011.5.25.222.1.2.5.1	TruthValue	read-only	Whether blacklist log is enabled.
C32 hwFwConnectionStatCountEx	1.3.6.1.4.1.2011.5.25.222.1.2.2.2.1.4	Counter32	read-only	This is an integer that contains the value of the resource statistic. If a type of 'gauge' is more appropriate this object will be omitted resulting in a sparse table.
STR hwFwConnectionStatDescription	1.3.6.1.4.1.2011.5.25.222.1.2.2.2.1.3	SnmpAdminString	read-only	A detailed textual description of this statistic.
hwFwConnectionStatEntry	1.3.6.1.4.1.2011.5.25.222.1.2.2.2.1		not-accessible	An entry in the table, containing information about a firewall statistic.
SER hwFwConnectionStatService	1.3.6.1.4.1.2011.5.25.222.1.2.2.2.1.1	Services	not-accessible	The identification of the type of connection providing statistics.
hwFwConnectionStatTable	1.3.6.1.4.1.2011.5.25.222.1.2.2.2		not-accessible	Table of firewall statistic instances.
CON hwFwConnectionStatType	1.3.6.1.4.1.2011.5.25.222.1.2.2.2.1.2	ConnectionStat	not-accessible	The state of the connections that this row contains statistics for.
TIK hwFwDefendLogInterval	1.3.6.1.4.1.2011.5.25.222.1.2.5.4	TimeTicks	read-only	Interval of defend log.
T/F hwFwDefendLogStatus	1.3.6.1.4.1.2011.5.25.222.1.2.5.3	TruthValue	read-only	Whether defend log is enabled.
hwFwEvents	1.3.6.1.4.1.2011.5.25.222.1.1
hwFwInterZone	1.3.6.1.4.1.2011.5.25.222.1.2.4
ASP hwFwInterZoneAspf	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.10	AspfProto	read-only	Type of protocol enabled aspf in this Interzone.
T/F hwFwInterZoneEnable	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.3	TruthValue	read-write	Enable or disable firewall on interzone, and show firewall status on interzone.
hwFwInterZoneEntry	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1		not-accessible	An entry in the table, containing information about a firewall Interzone.
U32 hwFwInterZoneIndex	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.1	Unsigned32	not-accessible	Index of the firewall interzone.
OCT hwFwInterZoneName	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.2	OCTET STRING	read-only	This object represents the name of a firewall Interzone.
G32 hwFwInterZoneNumOfEntries	1.3.6.1.4.1.2011.5.25.222.1.2.4.1	Gauge32	read-only	This object maintains a count of the number of entries that currently exist in the hwFwInterZoneTable.
U32 hwFwInterZonePktFltInAcl	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.5	Unsigned32	read-only	Basic or advanced acl number of the packet filtering that the direction is inbound.
PKT hwFwInterZonePktFltInDefaultRule	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.4	PktFltDefaultRule	read-only	Default rule of the packet filtering that the direction is inbound.
U32 hwFwInterZonePktFltInMacAcl	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.6	Unsigned32	read-only	Layer 2 acl number of the packet filtering that the direction is inbound.
U32 hwFwInterZonePktFltOutAcl	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.8	Unsigned32	read-only	Basic or advanced acl number of the packet filtering that the direction is outbound.
PKT hwFwInterZonePktFltOutDefaultRule	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.7	PktFltDefaultRule	read-only	Default rule of the packet filtering that the direction is outbound.
U32 hwFwInterZonePktFltOutMacAcl	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.9	Unsigned32	read-only	Layer 2 acl number of the packet filtering that the direction is outbound.
U32 hwFwInterZoneSessLogInAcl	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.11	Unsigned32	read-only	Acl number of interzone session log for inbound.
U32 hwFwInterZoneSessLogOutAcl	1.3.6.1.4.1.2011.5.25.222.1.2.4.2.1.12	Unsigned32	read-only	Acl number of interzone session log for outbound.
NTF hwFwInterzoneStatusNotification	1.3.6.1.4.1.2011.5.25.222.1.3.3			This notification is used for events involving security events. Send out firewall enable or disable event in Interzone.
hwFwInterZoneTable	1.3.6.1.4.1.2011.5.25.222.1.2.4.2		not-accessible	Table of firewall Interzone instances.
hwFwLog	1.3.6.1.4.1.2011.5.25.222.1.2.5
STR hwFwNetEventDescription	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.16	SnmpAdminString	read-only	A detailed description of the event.
IP hwFwNetEventDstIpAddress	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.7	IpAddress	read-only	Destination IP address in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different destination addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
I32 hwFwNetEventDstIpPort	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.11	Integer32	read-only	Destination UDP/TCP port in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different destination ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
STR hwFwNetEventDstVrfName	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.6	DisplayString	read-only	This object indicates the VRF's name.
STR hwFwNetEventIdentity	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.15	SnmpAdminString	read-only	This object will contain a description of the entity that caused the event. The entity could be a userid, username, processid or other identifier for the entity using the service. If there is no such information then this object will contain a zero-length string.
U32 hwFwNetEventIndex	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.1	Unsigned32	not-accessible	An index that uniquely identifies an entry in the log table. These indices are assigned beginning with one and increase by one with each new log entry. When this number wraps, all events are deleted in order to allow the NMS to differentiate between old and new events.
IP hwFwNetEventInsideDstIpAddress	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.8	IpAddress	read-only	Destination IP address after Network Address Translation has been applied. If NAT has not been applied to the destination address in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different destination addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
I32 hwFwNetEventInsideDstIpPort	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.12	Integer32	read-only	Destination UDP/TCP port after Port Address Translation has been applied. If PAT has not been applied to the Destination port in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different destination ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
IP hwFwNetEventInsideSrcIpAddress	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.5	IpAddress	read-only	Source IP address after Network Address Translation has been applied. If NAT has not been applied to the source address in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different source addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
I32 hwFwNetEventInsideSrcIpPort	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.10	Integer32	read-only	Source UDP/TCP port after Port Address Translation has been applied. If PAT has not been applied to the source port in this packet this object will not be instantiated, resulting in a sparse table. If the event is the result of multiple packets with different source ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
NUM hwFwNetEventInterface	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.2	InterfaceIndexOrZero	read-only	The interface most closely associated with this event. For example, for an event that relates to the receipt of a packet, this object identifies the interface on which the packet was received. If there are multiple interfaces associated with an event, the interface most closely associated with the cause of the event will be used. For example, for an event for the setup of a TCP connection, the interface on the initiator's side of the connection would be preferred. If there is no associated interface, then this object has the value zero.
hwFwNetEvents	1.3.6.1.4.1.2011.5.25.222.1.1.2
hwFwNetEventsEntry	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1		not-accessible	An entry in the table, containing detailed information about an event. Note that this table may be sparse. If Network Address Translation is not enabled hwFwNetEventInsideSrcIpAddress and hwFwNetEventInsideDstIpAddress will not be instantiated in the row. If Port Address Translation is not enabled hwFwNetEventInsideSrcIpPort and hwFwNetEventInsideDstIpPort will not be instantiated in the row. Entries are added to this table at the same time that events are added to the hwFwBasicEventsTable. These two tables may be configured to be different sizes so there may not be a one-to-one correspondence between rows in the two tables.
SER hwFwNetEventService	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.13	Services	read-only	The identification of the type of service involved with this event.
STR hwFwNetEventServiceInformation	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.14	SnmpAdminString	read-only	Specific service information. This can be used to describe the particular service indentified by hwFwNetEventService and can reflect whether the service is a local service or a gateway service. For example, if the value for hwFwNetEventService is loginTelnet then the string provided might be 'local telnet'.
IP hwFwNetEventSrcIpAddress	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.4	IpAddress	read-only	Source IP address in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different source addresses, this value may be zero or an address taken from an arbitrarily chosen packet in the sequence of packets causing the event.
I32 hwFwNetEventSrcIpPort	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.9	Integer32	read-only	Source UDP/TCP port in the IP packet that caused the event. If there is no packet associated with the event this object has the value of zero. If the event is the result of multiple packets with different source ports, this value may be zero or a port taken from an arbitrarily chosen packet in the sequence of packets causing the event.
STR hwFwNetEventSrcVrfName	1.3.6.1.4.1.2011.5.25.222.1.1.2.4.1.3	DisplayString	read-only	This object indicates the VRF's name.
hwFwNetEventsTable	1.3.6.1.4.1.2011.5.25.222.1.1.2.4		not-accessible	Table of detailed data for network events. The agent may choose to delete the instances of hwFwBasicEventsEntry as required because of lack of memory. It is an implementation-specific matter as to when this deletion may occur. It is recommended that the oldest log instances are deleted first.
U32 hwFwNetEventsTableLastRow	1.3.6.1.4.1.2011.5.25.222.1.1.2.1	Unsigned32	read-only	The index value of the last row in the hwFwNetEventsTable. This number starts at 1 and increase by one with each new log entry. When this number wraps, all events are deleted.
hwFwProtoAgingTime	1.3.6.1.4.1.2011.5.25.222.1.2.7
TIK hwFwRtspAgingTime	1.3.6.1.4.1.2011.5.25.222.1.2.7.3	TimeTicks	read-only	Aging time for Rtsp stream.
TIK hwFwRtspMediaAgingTime	1.3.6.1.4.1.2011.5.25.222.1.2.7.4	TimeTicks	read-only	Aging time for Rtsp media stream.
NTF hwFwSecurityNotification	1.3.6.1.4.1.2011.5.25.222.1.3.2			This notification is used for events involving security events. The included objects provide more detailed information about the event.
TIK hwFwSessionLogInterval	1.3.6.1.4.1.2011.5.25.222.1.2.5.8	TimeTicks	read-only	Interval of session log.
T/F hwFwSessionLogStatus	1.3.6.1.4.1.2011.5.25.222.1.2.5.7	TruthValue	read-only	Whether session log is enabled.
T/F hwFwSessionNatLogStatus	1.3.6.1.4.1.2011.5.25.222.1.2.5.9	TruthValue	read-only	Whether session nat log is enabled.
T/F hwFwSessionOutBandLogStatus	1.3.6.1.4.1.2011.5.25.222.1.2.5.10	TruthValue	read-only	Whether the out-of-band mode of sending log is enabled.
TIK hwFwSipAgingTime	1.3.6.1.4.1.2011.5.25.222.1.2.7.1	TimeTicks	read-only	Aging time for Sip stream.
TIK hwFwSipMediaAgingTime	1.3.6.1.4.1.2011.5.25.222.1.2.7.2	TimeTicks	read-only	Aging time for Sip media stream.
TIK hwFwStatisticLogInterval	1.3.6.1.4.1.2011.5.25.222.1.2.5.6	TimeTicks	read-only	Interval of statistic log.
T/F hwFwStatisticLogStatus	1.3.6.1.4.1.2011.5.25.222.1.2.5.5	TruthValue	read-only	Whether statistic log is enabled.
hwFwStatistics	1.3.6.1.4.1.2011.5.25.222.1.2.2
hwFwSystem	1.3.6.1.4.1.2011.5.25.222.1.2
hwFwZone	1.3.6.1.4.1.2011.5.25.222.1.2.3
hwFwZoneEntry	1.3.6.1.4.1.2011.5.25.222.1.2.3.2.1		not-accessible	An entry in the table, containing information about a firewall zone.
OCT hwFwZoneIfList	1.3.6.1.4.1.2011.5.25.222.1.2.3.2.1.4	OCTET STRING	read-only	The set of interface which belong to the firewall zone.
G32 hwFwZoneIfNum	1.3.6.1.4.1.2011.5.25.222.1.2.3.2.1.5	Gauge32	read-only	The number of interface in this firewall zone.
U32 hwFwZoneIndex	1.3.6.1.4.1.2011.5.25.222.1.2.3.2.1.1	Unsigned32	not-accessible	This object represents the name of a firewall zone.
OCT hwFwZoneName	1.3.6.1.4.1.2011.5.25.222.1.2.3.2.1.2	OCTET STRING	read-only	This object represents the name of a firewall zone.
G32 hwFwZoneNumOfEntries	1.3.6.1.4.1.2011.5.25.222.1.2.3.1	Gauge32	read-only	This object maintains a count of the number of entries that currently exist in the hwFwZoneTable.
U32 hwFwZonePriority	1.3.6.1.4.1.2011.5.25.222.1.2.3.2.1.3	Unsigned32	read-only	This object represents the priority of a firewall zone.
hwFwZoneTable	1.3.6.1.4.1.2011.5.25.222.1.2.3.2		not-accessible	Table of firewall zone instances.

RFC description

Firewall security events, attack detection, and blacklist management for Huawei devices.

Start monitoring Huawei USG/Eudemon-series firewall appliance with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-FIREWALL-MIB