HUAWEI-SECURITY-PKI-MIB

All MIBs › HUAWEI-SECURITY-PKI-MIB

Organization: Huawei Symantec Technologies Co., Ltd.

Last Updated: 2010-03-01

Category: Domain: Security, Vendor: Huawei

Description: Huawei security PKI MIB for managing certificate authorities, enrollment requests, and certificate lifecycle on security devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-SECURITY-PKI-MIB?

HUAWEI-SECURITY-PKI-MIB is a Huawei Symantec (Eudemon/USG firewall product line) proprietary MIB (enterprise OID 2011) reporting PKI (Public Key Infrastructure) certificate/CRL configuration and validity. Its objects cover CRL URL, LDAP server IP/port/version, CRL/certificate attribute and distinguished name, certificate URL/save-name, CA/local certificate validity start/end time and issuer/subject, CRL validity start/end time and issuer, and CMP (Certificate Management Protocol)/SCEP (Simple Certificate Enrollment Protocol) URL and CMP session name. As a configuration/status MIB it lets an administrator confirm certificate validity windows and CA/CRL server reachability before relying on certificate-based VPN authentication. It is deployed on Huawei Eudemon/USG firewall appliances. Engineers can download the HUAWEI-SECURITY-PKI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-SECURITY-PKI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei Eudemon/USG firewall appliances (PKI)

Monitoring Examples

An administrator checks hwPKILocalCertFinishTime to confirm how much longer a firewall's local certificate remains valid before it needs to be renewed on a Huawei Eudemon/USG firewall.

What Can Be Monitored

certificate/CRL validity windows and CA server configuration

Imported Objects

From RFC1155-SMI

enterprises

From SNMPv2-SMI

Gauge32
IpAddress
OBJECT-TYPE

From SNMPv2-TC

DateAndTime

OIDs

OID symbolic	OID numeric	Type	Access	Description
huawei	1.3.6.1.4.1.2011
huaweiUtility	1.3.6.1.4.1.2011.6
hwSecurity	1.3.6.1.4.1.2011.6.122
hwPKI	1.3.6.1.4.1.2011.6.122.34			V1.00 The PKI mib is for Eudemon and USG product series.
hwPKINotification	1.3.6.1.4.1.2011.6.122.34.0
hwPKITrapObject	1.3.6.1.4.1.2011.6.122.34.0.1
OCT hwPKICrlUrl	1.3.6.1.4.1.2011.6.122.34.0.1.1	OCTET STRING	accessible-for-notify	the URL for getting CRL.
IP hwPKILdapIP	1.3.6.1.4.1.2011.6.122.34.0.1.2	IpAddress	accessible-for-notify	the IP address of LDAP server.
G32 hwPKILdapPort	1.3.6.1.4.1.2011.6.122.34.0.1.3	Gauge32	accessible-for-notify	the port of LDAP server.
G32 hwPKILdapVersion	1.3.6.1.4.1.2011.6.122.34.0.1.4	Gauge32	accessible-for-notify	the version of LDAP server.
OCT hwPKICrlAttribute	1.3.6.1.4.1.2011.6.122.34.0.1.5	OCTET STRING	accessible-for-notify	the attribute of CRL.
OCT hwPKICrlDN	1.3.6.1.4.1.2011.6.122.34.0.1.6	OCTET STRING	accessible-for-notify	the distinguished name of CRL.
OCT hwPKICertUrl	1.3.6.1.4.1.2011.6.122.34.0.1.7	OCTET STRING	accessible-for-notify	the URL for getting certificate.
OCT hwPKICertSaveName	1.3.6.1.4.1.2011.6.122.34.0.1.8	OCTET STRING	accessible-for-notify	the saved name of certificate.
OCT hwPKICertAttribute	1.3.6.1.4.1.2011.6.122.34.0.1.9	OCTET STRING	accessible-for-notify	the attribute of certificate.
OCT hwPKICertDN	1.3.6.1.4.1.2011.6.122.34.0.1.10	OCTET STRING	accessible-for-notify	the distinguished name of certificate.
DAT hwPKICACertStartTime	1.3.6.1.4.1.2011.6.122.34.0.1.11	DateAndTime	accessible-for-notify	the start time of CA certificate.
DAT hwPKICACertFinishTime	1.3.6.1.4.1.2011.6.122.34.0.1.12	DateAndTime	accessible-for-notify	the finish time of CA certificate.
OCT hwPKICACertIssuer	1.3.6.1.4.1.2011.6.122.34.0.1.13	OCTET STRING	accessible-for-notify	the issuer of CA certificate.
OCT hwPKICACertSubject	1.3.6.1.4.1.2011.6.122.34.0.1.14	OCTET STRING	accessible-for-notify	the subject of CA certificate.
DAT hwPKILocalCertStartTime	1.3.6.1.4.1.2011.6.122.34.0.1.15	DateAndTime	accessible-for-notify	the start time of local certificate.
DAT hwPKILocalCertFinishTime	1.3.6.1.4.1.2011.6.122.34.0.1.16	DateAndTime	accessible-for-notify	the finish time of local certificate.
OCT hwPKILocalCertIssuer	1.3.6.1.4.1.2011.6.122.34.0.1.17	OCTET STRING	accessible-for-notify	the issuer of local certificate.
OCT hwPKILocalCertSubject	1.3.6.1.4.1.2011.6.122.34.0.1.18	OCTET STRING	accessible-for-notify	the subject of local certificate.
DAT hwPKICrlStartTime	1.3.6.1.4.1.2011.6.122.34.0.1.19	DateAndTime	accessible-for-notify	the start time of CRL.
DAT hwPKICrlFinishTime	1.3.6.1.4.1.2011.6.122.34.0.1.20	DateAndTime	accessible-for-notify	the finish time of CRL.
OCT hwPKICrlIssuer	1.3.6.1.4.1.2011.6.122.34.0.1.21	OCTET STRING	accessible-for-notify	the issuer of CRL.
OCT hwPKICMPUrl	1.3.6.1.4.1.2011.6.122.34.0.1.22	OCTET STRING	accessible-for-notify	the url of the CMP server
OCT hwPKICASubject	1.3.6.1.4.1.2011.6.122.34.0.1.23	OCTET STRING	accessible-for-notify	the subject name of the CA
OCT hwPKICMPSessionName	1.3.6.1.4.1.2011.6.122.34.0.1.24	OCTET STRING	accessible-for-notify	the name of the CMP session
OCT hwPKISCEPUrl	1.3.6.1.4.1.2011.6.122.34.0.1.25	OCTET STRING	accessible-for-notify	the url of the SCEP server
OCT hwPKIDomainName	1.3.6.1.4.1.2011.6.122.34.0.1.26	OCTET STRING	accessible-for-notify	the name of the PKI domain
OCT hwPKIKeyName	1.3.6.1.4.1.2011.6.122.34.0.1.27	OCTET STRING	accessible-for-notify	the name of the RSA key pair
G32 hwPKIKeyBit	1.3.6.1.4.1.2011.6.122.34.0.1.28	Gauge32	accessible-for-notify	the bit of the RSA key pair
hwPKITraps	1.3.6.1.4.1.2011.6.122.34.0.2
NTF hwPKIGetCrlSucHttp	1.3.6.1.4.1.2011.6.122.34.0.2.1			Send the message when get crl successfully with HTTP.
NTF hwPKIGetCrlFailHttp	1.3.6.1.4.1.2011.6.122.34.0.2.2			Send the message when get crl unsuccessfully with HTTP.
NTF hwPKIGetCrlSucLdap	1.3.6.1.4.1.2011.6.122.34.0.2.3			Send the message when get crl successfully with LDAP.
NTF hwPKIGetCrlFailLdap	1.3.6.1.4.1.2011.6.122.34.0.2.4			Send the message when get crl unsuccessfully with LDAP.
NTF hwPKIGetCertSucHttp	1.3.6.1.4.1.2011.6.122.34.0.2.5			Send the message when get certificate successfully with HTTP.
NTF hwPKIGetCertFailHttp	1.3.6.1.4.1.2011.6.122.34.0.2.6			Send the message when get certificate unsuccessfully with HTTP.
NTF hwPKIGetCertSucLdap	1.3.6.1.4.1.2011.6.122.34.0.2.7			Send the message when get certificate successfully with LDAP.
NTF hwPKIGetCertFailLdap	1.3.6.1.4.1.2011.6.122.34.0.2.8			Send the message when get certificate unsuccessfully with LDAP.
NTF hwPKICACertInvalid	1.3.6.1.4.1.2011.6.122.34.0.2.9			Send the message when the CA certificate is invalid.
NTF hwPKICACertValid	1.3.6.1.4.1.2011.6.122.34.0.2.10			Send the message when the CA certificate is valid.
NTF hwPKICACertNearlyExpired	1.3.6.1.4.1.2011.6.122.34.0.2.11			Send the message when the CA certificate is nearly expired.
NTF hwPKILocalCertInvalid	1.3.6.1.4.1.2011.6.122.34.0.2.12			Send the message when the local certificate is invalid.
NTF hwPKILocalCertValid	1.3.6.1.4.1.2011.6.122.34.0.2.13			Send the message when the local certificate is valid.
NTF hwPKILocalCertNearlyExpired	1.3.6.1.4.1.2011.6.122.34.0.2.14			Send the message when the local certificate is nearly expired.
NTF hwPKICrlInvalid	1.3.6.1.4.1.2011.6.122.34.0.2.15			Send the message when the crl is invalid.
NTF hwPKICrlValid	1.3.6.1.4.1.2011.6.122.34.0.2.16			Send the message when the crl is valid.
NTF hwPKICrlNearlyExpired	1.3.6.1.4.1.2011.6.122.34.0.2.17			Send the message when the crl is nearly expired.
NTF hwPKIRequestCertSucCmp	1.3.6.1.4.1.2011.6.122.34.0.2.18			Send the message when requesting local certificate through CMPv2 succeeded.
NTF hwPKIRequestCertFailCmp	1.3.6.1.4.1.2011.6.122.34.0.2.19			Send the message when requesting local certificate through CMPv2 failed.
NTF hwPKIRequestCertSucScep	1.3.6.1.4.1.2011.6.122.34.0.2.20			Send the message when requesting local certificate through SCEP succeeded.
NTF hwPKIRequestCertFailScep	1.3.6.1.4.1.2011.6.122.34.0.2.21			Send the message when requesting local certificate through SCEP failed.
NTF hwPKIRsaHrpBackFail	1.3.6.1.4.1.2011.6.122.34.0.2.22			Send the message when backing up the RSA key pair to the standby device failed.

RFC description

Manages Public Key Infrastructure configuration for Huawei Eudemon and USG security appliances.

Start monitoring Huawei Eudemon/USG firewall appliance (PKI certificate/CRL management) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-SECURITY-PKI-MIB

What Is HUAWEI-SECURITY-PKI-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description