TPT-HIGH-AVAIL-MIB

All MIBs › TPT-HIGH-AVAIL-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-09-08

Category: Firewall and Intrusion Prevention

Description: Manages TippingPoint IPS high availability pair configuration, failover state, and synchronization status.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-HIGH-AVAIL-MIB?

TPT-HIGH-AVAIL-MIB is a Trend Micro TippingPoint MIB tracking the high-availability (HA) pair status of IPS appliances, including failover fault state, synchronization/threshold settings, and "zero power" fail-open/bypass mode. Categories exposed include fault detection objects, HA threshold configuration, transparent/fail-open state, and per-segment bypass status. Its monitoring focus is heavily on software/system status: highAvailFaultState and highAvailFaultCause reveal why an HA event or failover occurred, and highAvailZeroPowerState/highAvailZeroPowerQuantity indicate whether and how many inline segments have dropped into fail-open bypass mode, a critical signal that traffic is passing uninspected. It works alongside TPT-HEALTH-MIB, since a hardware sensor fault (temperature, fan) can be the trigger for an HA failover captured here, and both build on TippingPoint's core device-management MIB framework. It's deployed on TippingPoint IPS appliances running in redundant HA pairs in mission-critical inline security segments, and the TPT-HIGH-AVAIL-MIB MIB defines the objects administrators poll to monitor that redundancy.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-HIGH-AVAIL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TippingPoint (Trend Micro) IPS appliances deployed in HA pairs

Monitoring Examples

An administrator polls highAvailFaultState and highAvailFaultCause to determine why a failover occurred on a primary appliance. highAvailZeroPowerState and highAvailZeroPowerQuantity are checked to see how many segments have gone into fail-open/bypass mode, a serious signal that packet inspection is not occurring on those links. highAvailTransparentPartner is read to identify the peer unit in the HA pair for event correlation during the incident.

What Can Be Monitored

HA fault state and cause
HA/failover threshold enablement and percent
transparent (fail-open/bypass) mode state
zero-power (bypass) segment count
HA partner identification

Imported Objects

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

From TPT-PORT-CONFIG-MIB

EnabledOrNot

From TPT-TPAMIBS-MIB

tpt-tpa-eventsV2
tpt-tpa-objs
tpt-tpa-unkparams

How to Use in IPNetwork Monitor

Example using tptPerfProtNotifyMissedAlerts OID:

Select a TippingPoint IPS appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type tptPerfProtNotifyMissedAlerts into the Find box to locate it in the OID tree, then select it and click OK. The number of alerts missed during the performance protection period. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
tpt_high_avail_objs	1.3.6.1.4.1.10734.3.3.2.6			Device information related to high availability. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
U32 highAvailTimeStamp	1.3.6.1.4.1.10734.3.3.2.6.1	Unsigned32	read-only	The time of the last transition of the fault state (in seconds since January 1, 1970). This value is zero if the fault state has not changed since the last reboot.
FAU highAvailFaultState	1.3.6.1.4.1.10734.3.3.2.6.2	FaultState	read-only	The current fault state of the device.
FAU highAvailFaultCause	1.3.6.1.4.1.10734.3.3.2.6.3	FaultCause	read-only	The reason for the current fault state of the device.
ENA highAvailThresholdEnabled	1.3.6.1.4.1.10734.3.3.2.6.4	EnabledOrNot	read-only	The current fallback threshold enabled setting for the device.
I32 highAvailThresholdPercent	1.3.6.1.4.1.10734.3.3.2.6.5	Integer32	read-only	If the fallback threshold is enabled, the percent (0-100) packet loss at which the device is configured to enter the fallback state.
ENA highAvailEnabled	1.3.6.1.4.1.10734.3.3.2.6.6	EnabledOrNot	read-only	Whether intrinisic high availability is enabled for this device.
CON highAvailTransparentState	1.3.6.1.4.1.10734.3.3.2.6.7	ConnectionState	read-only	State of the connection to the device's transparent HA partner.
ENA highAvailTransparentEnabled	1.3.6.1.4.1.10734.3.3.2.6.8	EnabledOrNot	read-only	Whether transparent high availability is enabled for this device.
OCT highAvailTransparentPartner	1.3.6.1.4.1.10734.3.3.2.6.9	OCTET STRING	read-only	Network address OR serial number of the device's transparent HA partner.
ZPH highAvailZeroPowerState	1.3.6.1.4.1.10734.3.3.2.6.10	ZphaState	read-only	The current zero-power HA state of the device.
U32 highAvailZeroPowerQuantity	1.3.6.1.4.1.10734.3.3.2.6.11	Unsigned32	read-only	The number of segments with zero-power HA modules.
highAvailZeroPowerTable	1.3.6.1.4.1.10734.3.3.2.6.12		not-accessible	Table of IP addresses on the device and their attributes.
highAvailZeroPowerEntry	1.3.6.1.4.1.10734.3.3.2.6.12.1		not-accessible	An entry in the host IP address table. Rows cannot be created or deleted.
U32 highAvailZeroPowerIndex	1.3.6.1.4.1.10734.3.3.2.6.12.1.1	Unsigned32	not-accessible	Index into the ZPHA table, starting with 1.
OCT highAvailZeroPowerSegment	1.3.6.1.4.1.10734.3.3.2.6.12.1.2	OCTET STRING	read-only	The name of the segment to which the ZPHA is attached.
ZPH highAvailZeroPowerActive	1.3.6.1.4.1.10734.3.3.2.6.12.1.3	ZphaState	read-only	Whether the ZPHA is currently active on this segment.
ZPH highAvailZeroPowerAction	1.3.6.1.4.1.10734.3.3.2.6.12.1.4	ZphaAction	read-only	The action (usually bypass) that the segment takes when ZPHA is active.
ZPH highAvailZeroPowerMode	1.3.6.1.4.1.10734.3.3.2.6.12.1.5	ZphaMode	read-only	The fiber mode (single or multi) of this ZPHA.
ZPH highAvailZeroPowerPresence	1.3.6.1.4.1.10734.3.3.2.6.13	ZphaPresent	read-only	An indication of whether ZPHA is supported on the device.
NTF tptIhaNotify	1.3.6.1.4.1.10734.3.3.3.0.15			Notification: Used to inform the management station of changes in the intrinsic HA fault state on the device.
NTF tptTrhaNotify	1.3.6.1.4.1.10734.3.3.3.0.18			Notification: Used to inform the management station of changes in the transparent HA state on the device.
NTF tptPerfProtNotify	1.3.6.1.4.1.10734.3.3.3.0.21			Notification: Used to inform the management station of changes in performance protection on the device.
NTF tptZphaNotify	1.3.6.1.4.1.10734.3.3.3.0.24			Notification: Used to inform the management station of changes in a ZPHA state on the device.
OCT tptIhaNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.81	OCTET STRING	read-only	The unique identifier of the device sending this notification.
U32 tptIhaNotifyTimeStamp	1.3.6.1.4.1.10734.3.3.3.1.82	Unsigned32	read-only	The time of this notification (in seconds since January 1, 1970).
FAU tptIhaNotifyFaultState	1.3.6.1.4.1.10734.3.3.3.1.83	FaultState	read-only	The current fault state of the device.
FAU tptIhaNotifyFaultCause	1.3.6.1.4.1.10734.3.3.3.1.84	FaultCause	read-only	The reason for the current fault state of the device.
OCT tptTrhaNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.86	OCTET STRING	read-only	The unique identifier of the device sending this notification.
U32 tptTrhaNotifyTimeStamp	1.3.6.1.4.1.10734.3.3.3.1.87	Unsigned32	read-only	The time of this notification (in seconds since January 1, 1970).
CON tptTrhaNotifyNewState	1.3.6.1.4.1.10734.3.3.3.1.88	ConnectionState	read-only	The new transparent HA state of the device.
OCT tptPerfProtNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.141	OCTET STRING	read-only	The unique identifier of the device sending this notification.
U32 tptPerfProtNotifyTimeStamp	1.3.6.1.4.1.10734.3.3.3.1.142	Unsigned32	read-only	The time of this notification (in seconds since January 1, 1970).
PER tptPerfProtNotifyPhase	1.3.6.1.4.1.10734.3.3.3.1.143	PerfProtPhase	read-only	Whether entering, remaining in, or exiting performance protection mode.
U32 tptPerfProtNotifyPacketLoss	1.3.6.1.4.1.10734.3.3.3.1.144	Unsigned32	read-only	The current packet loss rate per thousand (percent * 10). When exiting performance protection mode, this value is 0.
U32 tptPerfProtNotifyLossThreshold	1.3.6.1.4.1.10734.3.3.3.1.145	Unsigned32	read-only	The current packet loss threshold per thousand (percent * 10).
U32 tptPerfProtNotifyDuration	1.3.6.1.4.1.10734.3.3.3.1.146	Unsigned32	read-only	The number of seconds performance protection will be in force.
C64 tptPerfProtNotifyMissedAlertsEx	1.3.6.1.4.1.10734.3.3.3.1.147	Counter64	read-only	The number of alerts missed during the performance protection period. When entering performance protection mode, this value is 0.
OCT tptZphaNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.161	OCTET STRING	read-only	The unique identifier of the device sending this notification.
U32 tptZphaNotifyTimeStamp	1.3.6.1.4.1.10734.3.3.3.1.162	Unsigned32	read-only	The time of this notification (in seconds since January 1, 1970).
OCT tptZphaNotifySegmentName	1.3.6.1.4.1.10734.3.3.3.1.163	OCTET STRING	read-only	The name of the segment whose ZPHA changed state, or an empty string to indicate the external ZPHA.
ZPH tptZphaNotifyNewState	1.3.6.1.4.1.10734.3.3.3.1.164	ZphaState	read-only	The new state of the ZPHA that has changed.

RFC description

High availability and fault state monitoring for Trend Micro security devices.

Start monitoring TippingPoint IPS appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-HIGH-AVAIL-MIB