HUAWEI-SECURITY-GLOBALIPCAR-MIB

All MIBs › HUAWEI-SECURITY-GLOBALIPCAR-MIB

Organization: Huawei Symantec Technologies Co., Ltd.

Last Updated: 2012-03-21

Category: Domain: Security, Quality of Service, Vendor: Huawei

Description: Huawei security global IP CAR (Committed Access Rate) MIB for per-IP bandwidth policing and rate limiting management.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-SECURITY-GLOBALIPCAR-MIB?

HUAWEI-SECURITY-GLOBALIPCAR-MIB is a Huawei-proprietary security module for the Global IP CAR (Committed Access Rate) feature on the Eudemon and USG firewall product series. It exposes per-IP rate-limiting policy configuration along with traffic statistics counting packets and bytes passed versus dropped for each policed IP address. Its monitoring value is largely performance/software status: pass and drop counters reveal whether the CAR policy is actively throttling a given source, which is a key signal during suspected denial-of-service or bandwidth-abuse conditions. It works alongside other Huawei security modules such as HUAWEI-SECURITY-FULLCONE-MIB and HUAWEI-SECURITY-IPSEC-MIB as part of the same firewall's security instrumentation. It is typically deployed on Eudemon/USG firewalls at the network edge to police per-source bandwidth and mitigate abusive or attacking hosts. Engineers can download the HUAWEI-SECURITY-GLOBALIPCAR-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-SECURITY-GLOBALIPCAR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei Eudemon firewalls
Huawei USG firewalls

Monitoring Examples

An admin would poll per-IP CAR statistics (an hwGlobalIpCarStatTable/hwGlobalIpCarStatEntry pattern) for passed and dropped packet/byte counts against the configured committed rate. A sudden spike in dropped packets for a specific source IP indicates that IP has exceeded its policed rate, often correlating with a DoS attempt or a misbehaving application. Comparing pass/drop ratios across policies helps tune CAR thresholds that are too aggressive for legitimate bursty traffic.

What Can Be Monitored

per-IP CAR policy configuration
passed packet/byte counters
dropped packet/byte counters
rate-limit threshold utilization

Imported Objects

From RFC1155-SMI

enterprises

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Gauge32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus

How to Use in IPNetwork Monitor

Example using hwGlobalIPCarInboundPassBytes OID:

Select a Huawei Eudemon/USG firewall (Global IP Committed Access Rate) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hwGlobalIPCarInboundPassBytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The global IP inbound traffic passed bytes. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
huawei	1.3.6.1.4.1.2011
huaweiUtility	1.3.6.1.4.1.2011.6
hwSecurity	1.3.6.1.4.1.2011.6.122
hwGlobalIPCar	1.3.6.1.4.1.2011.6.122.54			V1.00 The GlobalIPCar mib is for Eudemon and USG product series. The GlobalIPCar feature is to limit traffic rate for global IP
hwGlobalIPCarGlobalStats	1.3.6.1.4.1.2011.6.122.54.1
G32 hwGlobalIPCarIPTotal	1.3.6.1.4.1.2011.6.122.54.1.1	Gauge32	read-only	Total number of traffic limmited global IPs.
hwGlobalIPCarConfigTable	1.3.6.1.4.1.2011.6.122.54.2		not-accessible	This table specifies the configuration attributes for Huawei GlobalIPCar.
hwGlobalIPCarConfigEntry	1.3.6.1.4.1.2011.6.122.54.2.1		not-accessible	Each entry in the hwGlobalIPCarConfigTable holds a set of traffic monitoring configuration parameters associated with an instance of global IP.
IP hwGlobalIPCarGlobalIP	1.3.6.1.4.1.2011.6.122.54.2.1.1	IpAddress	not-accessible	Address of the global IP.
G32 hwGlobalIPCarVrfIndex	1.3.6.1.4.1.2011.6.122.54.2.1.2	Gauge32	not-accessible	Index for the virtual firewall(Vrf).
G32 hwGlobalIPCarInboundCarType	1.3.6.1.4.1.2011.6.122.54.2.1.3	Gauge32	read-only	If the global IP inbound traffic is limited.If yes, the value is 1.
G32 hwGlobalIPCarOutboundCarType	1.3.6.1.4.1.2011.6.122.54.2.1.4	Gauge32	read-only	If the global IP outbound traffic is limited.If yes, the value is 1.
G32 hwGlobalIPCarInboundCIR	1.3.6.1.4.1.2011.6.122.54.2.1.5	Gauge32	read-only	The global IP inbound committed information rate (CIR).
G32 hwGlobalIPCarOutboundCIR	1.3.6.1.4.1.2011.6.122.54.2.1.6	Gauge32	read-only	The global IP outbound committed information rate (CIR).
hwGlobalIPCarStatsTable	1.3.6.1.4.1.2011.6.122.54.3		not-accessible	This table specifies the status attributes for Huawei GlobalIPCar.
hwGlobalIPCarStatsEntry	1.3.6.1.4.1.2011.6.122.54.3.1		not-accessible	Each entry in the hwGlobalIPCarStatsTable holds a set of monitoring status parameters associated with an instance of Global IP.
C64 hwGlobalIPCarInboundPassBytesEx	1.3.6.1.4.1.2011.6.122.54.3.1.1	Counter64	read-only	The global IP inbound traffic passed bytes.
C64 hwGlobalIPCarOutboundPassBytes	1.3.6.1.4.1.2011.6.122.54.3.1.2	Counter64	read-only	The global IP outbound traffic passed bytes.
C64 hwGlobalIPCarInboundDropBytes	1.3.6.1.4.1.2011.6.122.54.3.1.3	Counter64	read-only	The global IP inbound traffic dropped bytes.
C64 hwGlobalIPCarOutboundDropBytes	1.3.6.1.4.1.2011.6.122.54.3.1.4	Counter64	read-only	The global IP outbound traffic dropped bytes.
hwGlobalIPCarTrapObject	1.3.6.1.4.1.2011.6.122.54.4
IP hwGlobalIPCarTrapGlobalIP	1.3.6.1.4.1.2011.6.122.54.4.1	IpAddress	accessible-for-notify	Global IP Address for trap.
G32 hwGlobalIPCarTrapVrfIndex	1.3.6.1.4.1.2011.6.122.54.4.2	Gauge32	accessible-for-notify	Index of the virtual fire wall(Vrf) for trap.
OCT hwGlobalIPCarTrapVrfName	1.3.6.1.4.1.2011.6.122.54.4.3	OCTET STRING	accessible-for-notify	Name for the virtual fire wall(Vrf) for trap.
hwGlobalIPCarNotifications	1.3.6.1.4.1.2011.6.122.54.5
NTF hwGlobalIPCarIPAdd	1.3.6.1.4.1.2011.6.122.54.5.1			Send the message when a Global-IP-Car configuration is added.
NTF hwGlobalIPCarIPDel	1.3.6.1.4.1.2011.6.122.54.5.2			Send the message when a Global-IP-Car configuration is deleted.
hwGlobalIPCarMibConformance	1.3.6.1.4.1.2011.6.122.54.6
hwGlobalIPCarMibCompliances	1.3.6.1.4.1.2011.6.122.54.6.1
hwGlobalIPCarMibCompliance	1.3.6.1.4.1.2011.6.122.54.6.1.1
hwGlobalIPCarMibGroups	1.3.6.1.4.1.2011.6.122.54.6.2
hwGlobalIPCarGlobalStatsGroup	1.3.6.1.4.1.2011.6.122.54.6.2.1
hwGlobalIPCarConfigTableGroup	1.3.6.1.4.1.2011.6.122.54.6.2.2			This group holds a set of traffic monitoring configuration parameters associated with an instance of global IP.
hwGlobalIPCarStatsTableGroup	1.3.6.1.4.1.2011.6.122.54.6.2.3			This group This group holds a set of traffic monitoring statis parameters associated with an instance of global IP.
hwGlobalIPCarTrapObjectGroup	1.3.6.1.4.1.2011.6.122.54.6.2.4			GlobalIPCar trap objects.
hwGlobalIPCarNotificationsGroup	1.3.6.1.4.1.2011.6.122.54.6.2.5			GlobalIPCar traps.

RFC description

Global IP traffic rate limiting for Huawei Eudemon and USG security appliances.

Start monitoring Huawei Eudemon/USG firewall (Global IP Committed Access Rate) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-SECURITY-GLOBALIPCAR-MIB