HUAWEI-WLAN-SECURITY-MIB

All MIBs › HUAWEI-WLAN-SECURITY-MIB

Organization: Huawei Technologies Co.,Ltd.

Last Updated: 2014-02-13

Category: Domain: Security, Technology: Wireless, Vendor: Huawei, Wireless and WLAN

Description: Huawei WLAN MIB for managing wireless security configurations including WPA/WPA2, 802.1X authentication, and encryption profiles.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-WLAN-SECURITY-MIB?

HUAWEI-WLAN-SECURITY-MIB is a Huawei enterprise MIB for wireless LAN security, managing configuration of WPA/WPA2 security modes, 802.1X authentication settings, and encryption profiles on Huawei WLAN access points and controllers. It exposes configuration objects describing which security scheme and encryption profile are applied to a given wireless SSID or radio, rather than raw traffic statistics. Its monitoring value is in verifying that intended wireless security policy is actually in force, and, where authentication-state objects exist, detecting failed 802.1X authentication attempts that could indicate misconfigured clients or credential/certificate problems. It relies on standard WPA/WPA2 and 802.1X protocol concepts and is used alongside other Huawei WLAN MIBs covering AP/controller status and radio configuration. Deployment context is Huawei enterprise or campus wireless networks (APs and WLAN controllers) requiring secure client authentication and encryption. Network engineers evaluating or troubleshooting this functionality can download the HUAWEI-WLAN-SECURITY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-WLAN-SECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei wireless access point
Huawei WLAN controller

Monitoring Examples

An administrator would check the configured WPA/WPA2 security mode and 802.1X authentication settings for a given SSID/profile to confirm they match intended policy, and would monitor authentication-related objects for a rise in failed 802.1X attempts, which would indicate client misconfiguration or a certificate/credential issue affecting wireless access.

What Can Be Monitored

WPA/WPA2 security mode
802.1X authentication configuration
encryption profile settings
authentication failure indications

Imported Objects

From HUAWEI-WLAN-DEVICE-MIB

hwApIndex	OBJECT-TYPE
hwApMac	OBJECT-TYPE
hwApRegionIndex	OBJECT-TYPE

From HUAWEI-WLAN-MIB

hwWlan

MODULE-IDENTITY

From HUAWEI-WLAN-RADIO-MIB

hwRadioID

OBJECT-TYPE

From HUAWEI-WLAN-SERVICE-MIB

hwWlanServiceEssSsid	OBJECT-TYPE
hwWlanServiceStaMac	OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hwWlanSecurity	1.3.6.1.4.1.2011.6.139.6			huawei HUAWEI-WLAN-SECURITY-MIB.
hwWsecProfileTable	1.3.6.1.4.1.2011.6.139.6.1		not-accessible	WLAN access security profile table.
hwWsecProfileEntry	1.3.6.1.4.1.2011.6.139.6.1.1		not-accessible	WLAN access security profile entry.
OCT hwWsecProfileName	1.3.6.1.4.1.2011.6.139.6.1.1.1	OCTET STRING	read-write	WLAN access security profile Name.
T/F hwWsecProfileWEPDataEncrypt	1.3.6.1.4.1.2011.6.139.6.1.1.2	TruthValue	read-write	When this attribute is TRUE, WEP data will be encrypted. When this attribute is FALSE, WEP data will not be encrypted. The default value of this attribute is FALSE.
I32 hwWsecProfileWEPDefaultKeyID	1.3.6.1.4.1.2011.6.139.6.1.1.3	Integer32	read-write	This attribute shall indicate the use of the first, second, third, or fourth element of the WEPDefaultKeys array when set to values of zero, one, two, or three. The default value of this attribute shall be 0.
I32 hwWsecProfileWEPKeyMappingLength	1.3.6.1.4.1.2011.6.139.6.1.1.4	Integer32	read-write	The maximum number of tuples that hwWsecWEPKeyMappings can hold.
IP hwWsecProfileAsuIpAddr	1.3.6.1.4.1.2011.6.139.6.1.1.5	IpAddress	read-write	ASU IP address for WAPI certification authentication
OCT hwWsecProfileCaCertFileName	1.3.6.1.4.1.2011.6.139.6.1.1.6	OCTET STRING	read-write	CA certification file name
OCT hwWsecProfileAsuCertFileName	1.3.6.1.4.1.2011.6.139.6.1.1.7	OCTET STRING	read-write	ASU certification file name
OCT hwWsecProfileAcCertFileName	1.3.6.1.4.1.2011.6.139.6.1.1.8	OCTET STRING	read-write	AC certification file name
OCT hwWsecProfileAcPrvKeyFileName	1.3.6.1.4.1.2011.6.139.6.1.1.9	OCTET STRING	read-write	AC private key file name
I32 hwWsecProfileRsnaVersion	1.3.6.1.4.1.2011.6.139.6.1.1.10	Integer32	read-only	The highest WAPI/RSNA version this entity supports. See 7.3.2.9.
I32 hwWsecProfileWapiVersion	1.3.6.1.4.1.2011.6.139.6.1.1.11	Integer32	read-only	This object indicates the highest WAPI version that this entity supports.
ROW hwWsecProfileRowStatus	1.3.6.1.4.1.2011.6.139.6.1.1.12	RowStatus	read-create	Row status
OCT hwWsecProfileCaPfxPassword	1.3.6.1.4.1.2011.6.139.6.1.1.13	OCTET STRING	read-write	Description.
INT hwWsecProfileCaCertState	1.3.6.1.4.1.2011.6.139.6.1.1.14	INTEGER	read-only	Description.
OCT hwWsecProfileAsuPfxPassword	1.3.6.1.4.1.2011.6.139.6.1.1.15	OCTET STRING	read-write	Description.
INT hwWsecProfileAsuCertState	1.3.6.1.4.1.2011.6.139.6.1.1.16	INTEGER	read-only	Description.
OCT hwWsecProfileAcPfxPassword	1.3.6.1.4.1.2011.6.139.6.1.1.17	OCTET STRING	read-write	Description.
INT hwWsecProfileAcCertState	1.3.6.1.4.1.2011.6.139.6.1.1.18	INTEGER	read-only	Description.
OCT hwWsecProfileKeyPfxPassword	1.3.6.1.4.1.2011.6.139.6.1.1.19	OCTET STRING	read-write	Description.
INT hwWsecProfileAsuType	1.3.6.1.4.1.2011.6.139.6.1.1.20	INTEGER	read-write	Description.
INT hwWsecProfileWpaPtkRekeySwitch	1.3.6.1.4.1.2011.6.139.6.1.1.21	INTEGER	read-write	Description.
INT hwWsecProfileWpa2PtkRekeySwitch	1.3.6.1.4.1.2011.6.139.6.1.1.22	INTEGER	read-write	Description.
INT hwWsecProfileWpaWpa2PtkRekeySwitch	1.3.6.1.4.1.2011.6.139.6.1.1.23	INTEGER	read-write	Description.
I32 hwWsecProfileWpaPtkRekeyInterval	1.3.6.1.4.1.2011.6.139.6.1.1.24	Integer32	read-write	Description.
I32 hwWsecProfileWpa2PtkRekeyInterval	1.3.6.1.4.1.2011.6.139.6.1.1.25	Integer32	read-write	Description.
I32 hwWsecProfileWpaWpa2PtkRekeyInterval	1.3.6.1.4.1.2011.6.139.6.1.1.26	Integer32	read-write	Description.
hwWsecWEPDefaultKeysTable	1.3.6.1.4.1.2011.6.139.6.2		not-accessible	Conceptual table for WEP default keys. This table shall contain the four WEP default secret key values corresponding to the four possible KeyID values. The WEP default secret keys are logically WRITE-ONLY. Attempts to read the entries in this table shall return unsuccessful status and values of null or zero. The default value of each WEP default key shall be null.
hwWsecWEPDefaultKeysEntry	1.3.6.1.4.1.2011.6.139.6.2.1		not-accessible	An Entry (conceptual row) in the WEP Default Keys Table.
I32 hwWsecWEPDefaultKeyIndex	1.3.6.1.4.1.2011.6.139.6.2.1.1	Integer32	not-accessible	The auxiliary variable used to identify instances of the columnar objects in the WEP Default Keys Table. The value of this variable is equal to the WEPDefaultKeyID + 1
OCT hwWsecWEPDefaultKeyValue	1.3.6.1.4.1.2011.6.139.6.2.1.2	OCTET STRING	read-write	A WEP default secret hexadecimal key value. 10 byte for WEP-40, 26 byte for WEP-104, 32 byte for WEP-128. Reading this variable shall return unsuccessful status or null or zero.
STR hwWsecWEPPassPhrase	1.3.6.1.4.1.2011.6.139.6.2.1.4	DisplayString	read-write	A WEP default secret ASCII key value. 5 byte for WEP-40, 13 byte for WEP-104, 16 byte for WEP-128. Reading this variable shall return unsuccessful status or null or zero.
hwWsecWEPKeyMappingsTable	1.3.6.1.4.1.2011.6.139.6.3		not-accessible	Conceptual table for WEP Key Mappings. The MIB supports the ability to share a separate WEP key for each RA/TA pair. The Key Mappings Table contains zero or one entry for each MAC address and contains two fields for each entry: WEPOn and the corresponding WEP key. The WEP key mappings are logically WRITE-ONLY. Attempts to read the entries in this table shall return unsuccessful status and values of null or zero. The default value for all WEPOn fields is FALSE.
hwWsecWEPKeyMappingsEntry	1.3.6.1.4.1.2011.6.139.6.3.1		not-accessible	An Entry (conceptual row) in the WEP Key Mappings Table.
I32 hwWsecWEPKeyMappingIndex	1.3.6.1.4.1.2011.6.139.6.3.1.1	Integer32	not-accessible	The auxiliary variable used to identify instances of the columnar objects in the WEP Key Mappings Table.
MAC hwWsecWEPKeyMappingAddress	1.3.6.1.4.1.2011.6.139.6.3.1.2	MacAddress	read-create	The MAC address of the STA for which the values from this key mapping entry are to be used.
T/F hwWsecWEPKeyMappingWEPOn	1.3.6.1.4.1.2011.6.139.6.3.1.3	TruthValue	read-create	Boolean as to whether WEP is to be used when communicating with the hwWsecWEPKeyMappingAddress STA.
OCT hwWsecWEPKeyMappingValue	1.3.6.1.4.1.2011.6.139.6.3.1.4	OCTET STRING	read-create	A WEP secret key value.
ROW hwWsecWEPKeyMappingStatus	1.3.6.1.4.1.2011.6.139.6.3.1.5	RowStatus	read-create	The status column used for creating, modifying, and deleting instances of the columnar objects in the WEP key mapping Table.
hwWsecAuthSuitesTable	1.3.6.1.4.1.2011.6.139.6.4		not-accessible	This table lists the AKM suites supported by this entity. Each AKM suite can be individually enabled and disabled. The AKM suite list in the RSN information element is formed using the information in this table.
hwWsecAuthSuitesEntry	1.3.6.1.4.1.2011.6.139.6.4.1		not-accessible	An entry (row) in the hwWsecAuthSuitesTable.
INT hwWsecAuthSuiteIndex	1.3.6.1.4.1.2011.6.139.6.4.1.1	INTEGER	not-accessible	The auxiliary variable used as an index into the hwWsecAuthSuitesTable.
OCT hwWsecAuthSuite	1.3.6.1.4.1.2011.6.139.6.4.1.2	OCTET STRING	read-only	The selector of an AKM suite. It consists of an OUI (the first 3 octets) and a cipher suite identifier (the last octet). 0x00147201 : WAPI certification authentication 0x00147202 : WAPI preShare key authentication 0x000FAC01 : WPA1(WPA version 1) 802.1X authentication 0x000FAC02 : WPA1(WPA version 1) preShare key authentication 0x00E0FC01 : WPA2(WPA version 2) 802.1X authentication 0x00E0FC02 : WPA2(WPA version 2) preShare key authentication 0x00E0FC03 : share key (for WEP) 0x00E0FC04 : open system (no authentication) 0x00E0FC05 : wpa-wpa2-preShareKey 0x00E0FC06 : wpa-wpa2-8021x
T/F hwWsecAuthSuiteEnabled	1.3.6.1.4.1.2011.6.139.6.4.1.3	TruthValue	read-write	This variable indicates whether the corresponding AKM suite is enabled/disabled.
T/F hwWsecAuthPreauthenticationImplemented	1.3.6.1.4.1.2011.6.139.6.4.1.4	TruthValue	read-only	This variable indicates whether the entity supports WAPI pre-authentication. This cannot be TRUE unless hwWsecAuthOptionImplemented is TRUE.
T/F hwWsecAuthPreauthenticationEnabled	1.3.6.1.4.1.2011.6.139.6.4.1.5	TruthValue	read-write	When this object is set to TRUE, this shall indicate that WAPI pre-authentication is enabled on this entity. This object requires that WAPI authentication of this profile Enabled.
I32 hwWsecAuthUnicastKeysSupported	1.3.6.1.4.1.2011.6.139.6.4.1.6	Integer32	read-only	This object indicates the number of the unicast keys that a WAPI/RSNA of this entity supports.
INT hwWsecAuthPairwiseCipher	1.3.6.1.4.1.2011.6.139.6.4.1.7	INTEGER	read-write	The selector of a supported pairwise cipher. It consists of an OUI (the first 3 octets) and a cipher suite identifier (the last octet). 0x00147201 : WPI-SMS4 0x000FAC00 : Use group cipher suite 0x000FAC01 : WEP-40 0x000FAC02 : TKIP 0x000FAC04 : CCMP-default in an RSNA 0x000FAC05 : WEP-104 0x000FAC06 : wep-128 0x000FAC07 : tkip-ccmp 0x00E0FC01 : null (no encryption), only for open system authentication The cipher suite selector 00-0F-AC:4 (CCMP) shall be the default cipher suite value. The cipher suite selectors 00-0F-AC:1 (WEP-40) and 00-0F-AC:5 (WEP-104) are only valid as a group cipher suite in a transition security network (TSN) to allow pre-RSNA devices to join the BSS. Use of CCMP as the group cipher suite with TKIP as the pairwise cipher suite shall not be supported. NOTE?If the STAs can support CCMP, then there is no need for a weaker data confidentiality protocol. The cipher suite selector 00-0F-AC:0 (Use group cipher suite) is only valid as the pairwise cipher suite. An AP may specify the selector 00-0F-AC:0 (Use group cipher suite) for a pairwise cipher suite if it does not cipher selection, this shall be the only pairwise cipher selection the AP advertises. If CCMP is enabled, then the AP supports pairwise keys, and thus the suite selector 00-0F-AC:0 (Use group cipher suite) shall not be a valid option.
I32 hwWsecAuthPairwiseCipherSize	1.3.6.1.4.1.2011.6.139.6.4.1.8	Integer32	read-only	This object indicates the length in bits of the pairwise cipher key. This should be 256 for TKIP and 128 for CCMP.
INT hwWsecAuthUnicastRekeyMethod	1.3.6.1.4.1.2011.6.139.6.4.1.9	INTEGER	read-write	This object selects a mechanism for rekeying the WAPI/RSNA USK. The default is time-based, once per day. Rekeying the USK is only applicable to an entity acting in the AE or ASUE role.
U32 hwWsecAuthUnicastRekeyTime	1.3.6.1.4.1.2011.6.139.6.4.1.10	Unsigned32	read-write	The time in seconds after which the WAPI/RSNA USK shall be refreshed. The timer shall start at the moment the USK was set using the MLME-SETWPIKEYS.request primitive.
U32 hwWsecAuthUnicastRekeyPackets	1.3.6.1.4.1.2011.6.139.6.4.1.11	Unsigned32	read-write	A packet count (in 1000s of packets) after which the WAPI/RSNA USK shall be refreshed. The packet counter shall start at the moment the USK was set using the MLME-SETWPIKEYS.request primitive and it shall count all packets encrypted using the current USK.
INT hwWsecAuthMulticastCipher	1.3.6.1.4.1.2011.6.139.6.4.1.12	INTEGER	read-write	This object indicates the multicast cipher suite that this entity must adopt. The WAPI/RSNA information element shall adopt the value of this variable, which contains a 3-octet OUI and a one-octet cipher suite identifier. 0x00147201 : WPI-SMS4 0x000FAC01 : WEP-40 0x000FAC02 : TKIP 0x000FAC04 : CCMP-default in an RSNA 0x000FAC05 : WEP-104 0x000FAC06 : wep-128 0x000FAC07 : tkip-ccmp 0x00E0FC01 : null (no encryption), only for open system authentication
I32 hwWsecAuthMulticastCipherSize	1.3.6.1.4.1.2011.6.139.6.4.1.13	Integer32	read-only	This object indicates the length in bit of the multicast cipher key. This should be 256 for in SMS4. The former 128bits is the encryption key and the latter 128bits is the message integrity check key. This should be 256 for in TKIP. The former 128bits is the encryption key and the latter 128bits is the message integrity check key. This should be 128 for in CCMP. The 128bits is the encryption key and the message integrity check key. This should be 40 for in WEP-40. The 40bits is the encryption key. This should be 40 for in WEP-104. The 104bits is the encryption key. This should be 40 for in WEP-128. The 128bits is the encryption key.
INT hwWsecAuthMulticastRekeyMethod	1.3.6.1.4.1.2011.6.139.6.4.1.14	INTEGER	read-write	This object selects a mechanism for rekeying the WAPI/RSNA MSK. The default is time-based, once per day. Rekeying the MSK is only applicable to an entity acting in the Authenticator role.
U32 hwWsecAuthMulticastRekeyTime	1.3.6.1.4.1.2011.6.139.6.4.1.15	Unsigned32	read-write	The time in seconds after which the WAPI/RSNA MSK shall be refreshed. The timer shall start at the moment the MSK was set using the MLME-SETWPIKEYS.request primitive.
U32 hwWsecAuthMulticastRekeyPackets	1.3.6.1.4.1.2011.6.139.6.4.1.16	Unsigned32	read-write	A packet count (in 1000s of packets) after which the WAPI/RSNA MSK shall be refreshed. The packet counter shall start at the moment the MSK was set using the MLME-SETWPIKEYS.request primitive and it shall count all packets encrypted using the current MSK.
T/F hwWsecAuthMulticastRekeyStrict	1.3.6.1.4.1.2011.6.139.6.4.1.17	TruthValue	read-write	This object signals that the MSK shall be refreshed whenever a STA leaves the BSS that possesses the MSK.
OCT hwWsecAuthPSKValue	1.3.6.1.4.1.2011.6.139.6.4.1.18	OCTET STRING	read-write	The PSK for when WAPI/RSNA in PSK mode is the selected AKM suite. In that case, the BK/PMK will obtain its value from this object. This object is logically write-only. Reading this variable shall return unsuccessful status or null or zero. WAPI need 16 byte Hex, RSNA need 32 byte Hex. User should input Hex data for this node.
STR hwWsecAuthPSKPassPhrase	1.3.6.1.4.1.2011.6.139.6.4.1.19	DisplayString	read-write	The PSK, for when WAPI/RSNA in PSK mode is the selected AKM suite, is configured by hwWsecAuthPSKValue. An alternative manner of setting the PSK uses the password-to-key algorithm. This variable provides a means to enter a pass-phrase. When this object is written, the WAPI/RSNA entity shall use the password-to-key algorithm to derive a pre-shared and populate hwWsecAuthPSKValue with this key. This object is logically write-only. Reading this variable shall return unsuccessful status or null or zero.
U32 hwWsecAuthCertificateUpdateCount	1.3.6.1.4.1.2011.6.139.6.4.1.20	Unsigned32	read-write	The number of times messages in the WAPI Certificate Authentication Handshake protocol will be retried per Certificate Authentication Handshake attempt.
U32 hwWsecAuthMulticastUpdateCount	1.3.6.1.4.1.2011.6.139.6.4.1.21	Unsigned32	read-write	The number of times Message 1 in the WAPI Multicast Key Announcement Handshake will be retried per MSK Handshake attempt. The number of times Message 1 in the RSNA Group Key Handshake will be retried per GTK Handshake attempt.
U32 hwWsecAuthUnicastUpdateCount	1.3.6.1.4.1.2011.6.139.6.4.1.22	Unsigned32	read-write	The number of times Message 1 and Message 3 in the WAPI Unicast Key Negotiation Handshake will be retried per USK Handshake attempt. The number of times Message 1 and Message 3 in the RSNA 4-Way Handshake will be retried per 4-Way Handshake attempt.
U32 hwWsecAuthBKLifetime	1.3.6.1.4.1.2011.6.139.6.4.1.23	Unsigned32	read-write	The maximum lifetime of a BK in the BK cache.
U32 hwWsecAuthBKReauthThreshold	1.3.6.1.4.1.2011.6.139.6.4.1.24	Unsigned32	read-write	The percentage of the BK lifetime that should expire before a WAI/RSNA re-authentication occurs.
U32 hwWsecAuthSATimeout	1.3.6.1.4.1.2011.6.139.6.4.1.25	Unsigned32	read-write	The maximum time a security association shall take to set up.
T/F hwWsecAuthExcludeUnencrypted	1.3.6.1.4.1.2011.6.139.6.4.1.26	TruthValue	read-write	When this attribute is TRUE, the STA shall not indicate at the MAC service interface received MSDUs that have the Protected Frame subfield of the Frame Control field equal to zero. When this attribute is FALSE, the STA may accept MSDUs that have the Protected Frame subfield of the Frame Control field equal to zero. The default value of this attribute shall be FALSE.
I32 hwWsecAuthDot1XMethod	1.3.6.1.4.1.2011.6.139.6.4.1.27	Integer32	read-write	Leaf don't sustain for V2R3 on 2012/11/26.
T/F hwWsecAuthControlledAuthControl	1.3.6.1.4.1.2011.6.139.6.4.1.28	TruthValue	read-only	This attribute indicates whether the entity enable the authentication. If the value is '0' which means 'authentication disabled', the state of the controlled port shall be set to 'authenticated'; else the value is '1' which means 'authentication enabled', the state of the controlled port shall be based on the hwWsecAuthControlledPortControl.
I32 hwWsecAuthControlledPortControl	1.3.6.1.4.1.2011.6.139.6.4.1.29	Integer32	read-only	This attribute, when the hwWsecAuthControlledAuthControl is set to true, shall be effective and indicate the methods by which the port is controlled. If the value is '0' which means 'auto', the state of the controlled port shall be based on the result of the authentication; else the value is '1' which means 'force unauthenticated', the state of the controlled port shall be unconditionally set to 'unauthenticated'.
T/F hwWsecAuthOptionalImplemented	1.3.6.1.4.1.2011.6.139.6.4.1.30	TruthValue	read-only	This attribute, when true, shall indicate that the WAPI, WPA, RSNA option is implemented; else, this attribute shall be false.
hwWsecStatsTable	1.3.6.1.4.1.2011.6.139.6.5		not-accessible	This table maintains per-STA statistics in an RSN. The entry with hwWsecStatsSTAAddress set to FF-FF-FF-FF-FF-FF shall contain statistics for broadcast/multicast traffic.
hwWsecStatsEntry	1.3.6.1.4.1.2011.6.139.6.5.1		not-accessible	An entry in the hwWsecStatsTable.
MAC hwWsecStatsSTAAddress	1.3.6.1.4.1.2011.6.139.6.5.1.1	MacAddress	read-only	The MAC address of the STA to which the statistics in this conceptual row belong.
I32 hwWsecStatsVersion	1.3.6.1.4.1.2011.6.139.6.5.1.2	Integer32	read-only	The RSNA version with which the STA associated.
OCT hwWsecStatsBKIDUsed	1.3.6.1.4.1.2011.6.139.6.5.1.3	OCTET STRING	read-only	The selector of the last BKID of WAPI used in the last Unicast Key Negotiation Handshake. The selector of the last PMKID of RSNA used in the last 4-Way Handshake.
INT hwWsecStatsAuthenticationSuiteSelected	1.3.6.1.4.1.2011.6.139.6.5.1.4	INTEGER	read-only	The selector of the last AKM suite negotiated.
INT hwWsecStatsUnicastCipherSelected	1.3.6.1.4.1.2011.6.139.6.5.1.5	INTEGER	read-only	The selector of the last unicast cipher suite negotiated.
INT hwWsecStatsMulticastCipherSelected	1.3.6.1.4.1.2011.6.139.6.5.1.6	INTEGER	read-only	The selector of the last multicast cipher suite negotiated
INT hwWsecStatsAuthenticationSuiteRequested	1.3.6.1.4.1.2011.6.139.6.5.1.7	INTEGER	read-only	The selector of the last AKM suite requested.
INT hwWsecStatsUnicastCipherRequested	1.3.6.1.4.1.2011.6.139.6.5.1.8	INTEGER	read-only	The selector of the last unicast cipher suite requested
INT hwWsecStatsMulticastCipherRequested	1.3.6.1.4.1.2011.6.139.6.5.1.9	INTEGER	read-only	The selector of the last multicast cipher suite requested.
C32 hwWsecStatsWEPICVErrorCount	1.3.6.1.4.1.2011.6.139.6.5.1.10	Counter32	read-only	This counter shall increment when a frame is received with the Protected Frame subfield of the Frame Control field set to one and the value of the ICV as received in the frame does not match the ICV value that is calculated for the contents of the received frame. ICV errors for TKIP are not counted in this variable but in hwWsecStatsTKIPICVErrors.
C32 hwWsecStatsWEPExcludedCount	1.3.6.1.4.1.2011.6.139.6.5.1.11	Counter32	read-only	This counter shall increment when a frame is received with the Protected Frame subfield of the Frame Control field set to zero and the value of hwWsecProfileExcludeUnencrypted causes that frame to be discarded.
C32 hwWsecStatsWEPUndecryptableCount	1.3.6.1.4.1.2011.6.139.6.5.1.12	Counter32	read-only	This counter shall increment when a frame is received with the Protected Frame subfield of the Frame Control field set to one and the WEPOn value for the key mapped to the transmitter's MAC address indicates that the frame should not have been encrypted or that frame is discarded due to the receiving STA not implementing the privacy option.
C32 hwWsecStatsTKIPICVErrors	1.3.6.1.4.1.2011.6.139.6.5.1.13	Counter32	read-only	Counts the number of TKIP ICV errors encountered when decrypting packets for the STA.
C32 hwWsecStatsTKIPLocalMICFailures	1.3.6.1.4.1.2011.6.139.6.5.1.14	Counter32	read-only	Counts the number of MIC failures encountered when checking the integrity of packets received from the STA at this entity.
C32 hwWsecStatsTKIPRemoteMICFailures	1.3.6.1.4.1.2011.6.139.6.5.1.15	Counter32	read-only	Counts the number of MIC failures encountered by the STA identified by dot11StatsSTAAddress and reported back to this entity.
C32 hwWsecStatsTKIPReplays	1.3.6.1.4.1.2011.6.139.6.5.1.16	Counter32	read-only	Counts the number of TKIP replay errors detected.
C32 hwWsecStatsCCMPReplays	1.3.6.1.4.1.2011.6.139.6.5.1.17	Counter32	read-only	The number of received CCMP MPDUs discarded by the replay mechanism.
C32 hwWsecStatsCCMPDecryptErrors	1.3.6.1.4.1.2011.6.139.6.5.1.18	Counter32	read-only	The number of received MPDUs discarded by the CCMP decryption algorithm.
C32 hwWsecStatsWAISignatureErrors	1.3.6.1.4.1.2011.6.139.6.5.1.19	Counter32	read-only	This counter shall increment when the signature in the received WAI packet is wrong.
C32 hwWsecStatsWAIHMACErrors	1.3.6.1.4.1.2011.6.139.6.5.1.20	Counter32	read-only	This counter shall increment when the message authentication code in the received WAI packet is wrong.
C32 hwWsecStatsWAIAuthenticationResultFailures	1.3.6.1.4.1.2011.6.139.6.5.1.21	Counter32	read-only	This counter shall increment when the WAI authentication is unsuccessful.
C32 hwWsecStatsWAIDiscardCounters	1.3.6.1.4.1.2011.6.139.6.5.1.22	Counter32	read-only	This counter shall increment when the received WAI packet is discarded.
C32 hwWsecStatsWAITimeoutCounters	1.3.6.1.4.1.2011.6.139.6.5.1.23	Counter32	read-only	This counter shall increment when the WAI packet is timeout.
C32 hwWsecStatsWAIFormatErrors	1.3.6.1.4.1.2011.6.139.6.5.1.24	Counter32	read-only	This counter shall increment when there exists format error in the WAI packet.
C32 hwWsecStatsWAICertificateHandshakeFailures	1.3.6.1.4.1.2011.6.139.6.5.1.25	Counter32	read-only	This counter shall increment when the WAI certificate authentication is unsuccessful.
C32 hwWsecStatsWAIUnicastHandshakeFailures	1.3.6.1.4.1.2011.6.139.6.5.1.26	Counter32	read-only	This counter shall increment when the WAI unicast key negotiation process is unsuccessful.
C32 hwWsecStatsWAIMulticastHandshakeFailures	1.3.6.1.4.1.2011.6.139.6.5.1.27	Counter32	read-only	This counter shall increment when the WAI multicast key announcement process is unsuccessful.
C32 hwWsecStatsWPIReplayCounter	1.3.6.1.4.1.2011.6.139.6.5.1.28	Counter32	read-only	The number of received WPI MPDUs discarded by the replay mechanism.
C32 hwWsecStatsWPIDecryptableErrors	1.3.6.1.4.1.2011.6.139.6.5.1.29	Counter32	read-only	The number of received MPDUs discarded by the WPI decryption algorithm because of no valid key.
C32 hwWsecStatsWPIMICErrors	1.3.6.1.4.1.2011.6.139.6.5.1.30	Counter32	read-only	The number of received MPDUs discarded because of the MIC check error during the WPI decryption.
T/F hwWsecStatsControlledPortStatus	1.3.6.1.4.1.2011.6.139.6.5.1.31	TruthValue	read-only	This attribute indicates the state of the controlled port in a authenticator subsystem. If value is '1', the state is set to'authenticated'; else, the state is set to 'unauthenticated'.
I32 hwWsecStatsNumberOfPTKSAReplayCounters	1.3.6.1.4.1.2011.6.139.6.5.1.32	Integer32	read-only	Specifies the number of PTKSA replay counters per association: 0 ?> 1 replay counter, 1 ?> 2 replay counters, 2 ?> 4 replay counters, 3 ?> 16 replay counters
I32 hwWsecStatsNumberOfGTKSAReplayCounters	1.3.6.1.4.1.2011.6.139.6.5.1.33	Integer32	read-only	Specifies the number of GTKSA replay counters per association: 0 ?> 1 replay counter, 1 ?> 2 replay counters, 2 ?> 4 replay counters, 3 ?> 16 replay counters
I32 hwWsecStatsTKIPCounterMeasuresInvoked	1.3.6.1.4.1.2011.6.139.6.5.1.34	Integer32	read-only	Counts the number of times that a TKIP MIC failure occurred two times within 60 s and TKIP countermeasures were invoked. This attribute counts both local and remote MIC failure events reported to this STA. It increments every time TKIP countermeasures are invoked
I32 hwWsecStatsWpa4WayHandshakeFailures	1.3.6.1.4.1.2011.6.139.6.5.1.35	Integer32	read-only	Counts the number of 4-Way Handshake failures.
hwWsecBatchProfileInfo	1.3.6.1.4.1.2011.6.139.6.6
I32 hwWsecBatchProfileStartNumber	1.3.6.1.4.1.2011.6.139.6.6.1	Integer32	read-write	The security profile start number in batch operation. This node is used with node hwWsecBatchProfileWantNumber, for example, hwWsecBatchProfileStartNumber is set to one, and hwWsecBatchProfileWantNumber is set to three, then get the node hwWsecBatchProfileReturnNumber,hwWsecBatchProfileName, that means start from the first security profile, get three security profile's name list. if it dose not exist three security profile, the hwWsecBatchProfileReturnNumber will be the real security profile number, otherwise, it is equal to hwWsecBatchProfileWantNumber.
I32 hwWsecBatchProfileWantNumber	1.3.6.1.4.1.2011.6.139.6.6.2	Integer32	read-write	The security profile number that want to get in batch operation.This node is used with node hwWsecBatchProfileWantNumber, for example, hwWsecBatchProfileStartNumber is set to one, and hwWsecBatchProfileWantNumber is set to three, then get the node hwWsecBatchProfileReturnNumber,hwWsecBatchProfileName, that means start from the first security profile, get three security profile's name list. if it dose not exist three security profile, the hwWsecBatchProfileReturnNumber will be the real security profile number, otherwise, it is equal to hwWsecBatchProfileWantNumber.
I32 hwWsecBatchProfileReturnNumber	1.3.6.1.4.1.2011.6.139.6.6.3	Integer32	read-only	The ess number get in batch operation.
OCT hwWsecBatchProfileName	1.3.6.1.4.1.2011.6.139.6.6.4	OCTET STRING	read-only	The names of security profile which are determined by node hwWsecBatchProfileStratNumber and node hwWsecBatchProfileWantNumber. each hwWsecProfileName name is divided by '?'.
hwWsecNotifications	1.3.6.1.4.1.2011.6.139.6.9
hwWsecNotify	1.3.6.1.4.1.2011.6.139.6.9.1
NTF hwStaAuthErrorNotify	1.3.6.1.4.1.2011.6.139.6.9.1.1			Description.
NTF hwStaAssociationFailNotify	1.3.6.1.4.1.2011.6.139.6.9.1.2			Description.
NTF hwUserWithInvalidCerficationInbreakNetworkNotify	1.3.6.1.4.1.2011.6.139.6.9.1.3			Description.
NTF hwStationRepititiveAttackNotify	1.3.6.1.4.1.2011.6.139.6.9.1.4			Description.
NTF hwTamperAttackNotify	1.3.6.1.4.1.2011.6.139.6.9.1.5			Description.
NTF hwLowSafeLevelAttackNotify	1.3.6.1.4.1.2011.6.139.6.9.1.6			Description.
NTF hwAddressRedirectionAttackNotify	1.3.6.1.4.1.2011.6.139.6.9.1.7			Description.
NTF hwWepIDConflictNotify	1.3.6.1.4.1.2011.6.139.6.9.1.8			Description.
NTF hwStaAuthEncryptModeNotMatchNotify	1.3.6.1.4.1.2011.6.139.6.9.1.9			Description.
hwWsecNotifyObjects	1.3.6.1.4.1.2011.6.139.6.9.2
I32 hwStaAuthenticationMode	1.3.6.1.4.1.2011.6.139.6.9.2.1	Integer32	read-only	Description.
I32 hwStaAuthenticationFailCause	1.3.6.1.4.1.2011.6.139.6.9.2.2	Integer32	read-only	Description.
I32 hwStaAssociationFailCause	1.3.6.1.4.1.2011.6.139.6.9.2.3	Integer32	read-only	Description.
MAC hwStaAssocBssid	1.3.6.1.4.1.2011.6.139.6.9.2.4	MacAddress	read-only	Description.
INT hwStaFailCodeType	1.3.6.1.4.1.2011.6.139.6.9.2.5	INTEGER	read-only	Description.
MAC hwWepIDConflictTrapAPMAC	1.3.6.1.4.1.2011.6.139.6.9.2.6	MacAddress	read-only	Description.
I32 hwWepIDConflictTrapAPID	1.3.6.1.4.1.2011.6.139.6.9.2.7	Integer32	read-only	Description.
I32 hwWepIDConflictTrapRadioId	1.3.6.1.4.1.2011.6.139.6.9.2.8	Integer32	read-only	Description.
OCT hwWepIDConflictTrapPreSSID	1.3.6.1.4.1.2011.6.139.6.9.2.9	OCTET STRING	read-only	Description.
OCT hwWepIDConflictTrapCurrSSID	1.3.6.1.4.1.2011.6.139.6.9.2.10	OCTET STRING	read-only	Description.
I32 hwWepIDConflictTrapCipherIdx	1.3.6.1.4.1.2011.6.139.6.9.2.11	Integer32	read-only	Description.
I32 hwWlanStaAuthEncryptMode	1.3.6.1.4.1.2011.6.139.6.9.2.12	Integer32	read-only	Description.
I32 hwWlanVapAuthEncryptMode	1.3.6.1.4.1.2011.6.139.6.9.2.13	Integer32	read-only	Description.
OCT hwStaAuthenticationFailCauseStr	1.3.6.1.4.1.2011.6.139.6.9.2.14	OCTET STRING	read-only	Description.
OCT hwStaAssociationFailCauseStr	1.3.6.1.4.1.2011.6.139.6.9.2.15	OCTET STRING	read-only	Description.
hwWlanSecurityObject	1.3.6.1.4.1.2011.6.139.6.10
hwWlanSecurityConformance	1.3.6.1.4.1.2011.6.139.6.11
hwWlanSecurityCompliances	1.3.6.1.4.1.2011.6.139.6.11.1
hwWlanSecurityCompliance	1.3.6.1.4.1.2011.6.139.6.11.1.1			Description.
hwWlanSecurityObjectGroups	1.3.6.1.4.1.2011.6.139.6.11.2
hwWsecProfileGroup	1.3.6.1.4.1.2011.6.139.6.11.2.1			Description.
hwWsecWEPDefaultKeysGroup	1.3.6.1.4.1.2011.6.139.6.11.2.2			Description.
hwWsecWEPKeyMappingsGroup	1.3.6.1.4.1.2011.6.139.6.11.2.3			Description.
hwWsecAuthSuitesGroup	1.3.6.1.4.1.2011.6.139.6.11.2.4			Description.
hwWsecStatsGroup	1.3.6.1.4.1.2011.6.139.6.11.2.5			Description.
hwWsecBatchProfileInfoGroup	1.3.6.1.4.1.2011.6.139.6.11.2.6			Description.
hwWsecNotifyGroup	1.3.6.1.4.1.2011.6.139.6.11.2.7			Description.
hwWsecNotifyObjectsGroup	1.3.6.1.4.1.2011.6.139.6.11.2.8			Description.

RFC description

Vendor-private Huawei MIB for WLAN security management, including WAPI pre-authentication and authentication policy configuration.

Start monitoring Huawei wireless access point/WLAN controller (WPA/WPA2/802.1X security) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-WLAN-SECURITY-MIB

What Is HUAWEI-WLAN-SECURITY-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description