1220 lines
36 KiB
Plaintext
1220 lines
36 KiB
Plaintext
|
ALCATEL-IND1-IPSEC-MIB DEFINITIONS ::= BEGIN
|
||
|
|
|
||
|
|
IMPORTS
|
||
|
|
MODULE-IDENTITY, OBJECT-TYPE, Unsigned32, Counter32
|
||
|
|
FROM SNMPv2-SMI
|
||
|
|
TEXTUAL-CONVENTION, RowStatus, DisplayString, TruthValue
|
||
|
|
FROM SNMPv2-TC
|
||
|
|
MODULE-COMPLIANCE, OBJECT-GROUP
|
||
|
|
FROM SNMPv2-CONF
|
||
|
|
InetAddressType, InetAddress
|
||
|
|
FROM INET-ADDRESS-MIB
|
||
|
|
softentIND1IPsec
|
||
|
|
FROM ALCATEL-IND1-BASE;
|
||
|
|
|
||
|
|
|
||
|
|
alcatelIND1IPsecMIB MODULE-IDENTITY
|
||
|
|
LAST-UPDATED "200707020000Z"
|
||
|
|
ORGANIZATION "Alcatel - Architects Of An Internet World"
|
||
|
|
CONTACT-INFO
|
||
|
|
"Please consult with Customer Service to insure the most appropriate
|
||
|
|
version of this document is used with the products in question:
|
||
|
|
|
||
|
|
Alcatel-Lucent, Enterprise Solutions Division
|
||
|
|
(Formerly Alcatel Internetworking, Incorporated)
|
||
|
|
26801 West Agoura Road
|
||
|
|
Agoura Hills, CA 91301-5122
|
||
|
|
United States Of America
|
||
|
|
|
||
|
|
Telephone: North America +1 800 995 2696
|
||
|
|
Latin America +1 877 919 9526
|
||
|
|
Europe +31 23 556 0100
|
||
|
|
Asia +65 394 7933
|
||
|
|
All Other +1 818 878 4507
|
||
|
|
|
||
|
|
Electronic Mail: support@ind.alcatel.com
|
||
|
|
World Wide Web: http://alcatel-lucent.com/wps/portal/enterprise
|
||
|
|
File Transfer Protocol: ftp://ftp.ind.alcatel.com/pub/products/mibs"
|
||
|
|
|
||
|
|
DESCRIPTION
|
||
|
|
"This module describes an authoritative enterprise-specific Simple
|
||
|
|
Network Management Protocol (SNMP) Management Information Base (MIB):
|
||
|
|
|
||
|
|
Proprietary IPsec MIB definitions
|
||
|
|
|
||
|
|
The right to make changes in specification and other information
|
||
|
|
contained in this document without prior notice is reserved.
|
||
|
|
|
||
|
|
No liability shall be assumed for any incidental, indirect, special,
|
||
|
|
or consequential damages whatsoever arising from or related to this
|
||
|
|
document or the information contained herein.
|
||
|
|
|
||
|
|
Vendors, end-users, and other interested parties are granted
|
||
|
|
non-exclusive license to use this specification in connection with
|
||
|
|
management of the products for which it is intended to be used.
|
||
|
|
|
||
|
|
Copyright (C) 1995-2007 Alcatel-Lucent
|
||
|
|
ALL RIGHTS RESERVED WORLDWIDE"
|
||
|
|
|
||
|
|
REVISION "200707020000Z"
|
||
|
|
DESCRIPTION
|
||
|
|
"The latest version of this MIB Module."
|
||
|
|
|
||
|
|
::= { softentIND1IPsec 1 }
|
||
|
|
|
||
|
|
|
||
|
|
alcatelIND1IPsecMIBObjects OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIB 1 }
|
||
|
|
|
||
|
|
--
|
||
|
|
-- Textual Conventions
|
||
|
|
--
|
||
|
|
|
||
|
|
IPsecName ::= TEXTUAL-CONVENTION
|
||
|
|
DISPLAY-HINT "20a"
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The name of a table entry."
|
||
|
|
SYNTAX OCTET STRING (SIZE(1..20))
|
||
|
|
|
||
|
|
IPsecDescription ::= TEXTUAL-CONVENTION
|
||
|
|
DISPLAY-HINT "200a"
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Optional description of a table entry."
|
||
|
|
SYNTAX OCTET STRING (SIZE(0..200))
|
||
|
|
|
||
|
|
IPsecPortNumber ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A port number value. 0 is the wildcard value to match any port."
|
||
|
|
SYNTAX INTEGER (0..65535)
|
||
|
|
|
||
|
|
IPsecPrefixLength ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Significant bits in an IPv6 address prefix. 0..32 is the valid range
|
||
|
|
for IPv4 addresses. 0..128 is valid for IPv6 addresses"
|
||
|
|
SYNTAX INTEGER (0..128)
|
||
|
|
|
||
|
|
IPsecULProtocol ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An upper-layer protocol number. 255 is the wildcard value to match
|
||
|
|
any protocol."
|
||
|
|
SYNTAX INTEGER (0..255)
|
||
|
|
|
||
|
|
IPsecAdminState ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Administrative state."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
enabled(1),
|
||
|
|
disabled(2)
|
||
|
|
}
|
||
|
|
|
||
|
|
IPsecSAType ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"SA type."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
ah(2),
|
||
|
|
esp(3)
|
||
|
|
}
|
||
|
|
|
||
|
|
IPsecESPAlgorithm ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"ESP algorithms."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
none(0),
|
||
|
|
descbc(2),
|
||
|
|
des3cbc(3),
|
||
|
|
null(11),
|
||
|
|
aescbc(12),
|
||
|
|
aesctr(13)
|
||
|
|
}
|
||
|
|
|
||
|
|
IPsecAHAlgorithm ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"AH algorithms."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
none(0),
|
||
|
|
hmacmd5(2),
|
||
|
|
hmacsha1(3),
|
||
|
|
aesxcbcmac(9)
|
||
|
|
}
|
||
|
|
|
||
|
|
IPsecOperationalState ::= TEXTUAL-CONVENTION
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Operational state.
|
||
|
|
|
||
|
|
enabled(1) - The entry is enabled.
|
||
|
|
|
||
|
|
disabled(2) - The entry is administratively disabled or
|
||
|
|
DNS resolution has experienced a permanent failure.
|
||
|
|
|
||
|
|
dnspending(3) - Awaiting DNS resolution before making
|
||
|
|
the entry active."
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
enabled(1),
|
||
|
|
disabled(2),
|
||
|
|
dnspending(3)
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- Global IPsec Configuration
|
||
|
|
--
|
||
|
|
|
||
|
|
alaIPsecConfig OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIBObjects 1 }
|
||
|
|
|
||
|
|
alaIPsecSecurityKeyTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF AlaIPsecSecurityKeyEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table allowing the configuration of the switch's IPsec security key.
|
||
|
|
The security key is used to encrypt and IPsec related information
|
||
|
|
retained in permanent storage.
|
||
|
|
|
||
|
|
There is always a single row in this table with an index value of 1."
|
||
|
|
::= { alaIPsecConfig 1 }
|
||
|
|
|
||
|
|
alaIPsecSecurityKeyEntry OBJECT-TYPE
|
||
|
|
SYNTAX AlaIPsecSecurityKeyEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The security key entry."
|
||
|
|
INDEX { alaIPsecSecurityKeyID }
|
||
|
|
::= { alaIPsecSecurityKeyTable 1 }
|
||
|
|
|
||
|
|
AlaIPsecSecurityKeyEntry ::= SEQUENCE {
|
||
|
|
alaIPsecSecurityKeyID Unsigned32,
|
||
|
|
alaIPsecSecurityKeyCurrent OCTET STRING,
|
||
|
|
alaIPsecSecurityKeyNew OCTET STRING
|
||
|
|
}
|
||
|
|
|
||
|
|
alaIPsecSecurityKeyID OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The row's identifier. Only one entry is ever present, with an
|
||
|
|
ID value of 1."
|
||
|
|
::= { alaIPsecSecurityKeyEntry 1 }
|
||
|
|
|
||
|
|
alaIPsecSecurityKeyCurrent OBJECT-TYPE
|
||
|
|
SYNTAX OCTET STRING (SIZE(16))
|
||
|
|
MAX-ACCESS read-write
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The current value of the IPsec security key. If an attempt
|
||
|
|
is made to read the value of this object, a zero-length octet
|
||
|
|
string will be returned."
|
||
|
|
::= { alaIPsecSecurityKeyEntry 2 }
|
||
|
|
|
||
|
|
alaIPsecSecurityKeyNew OBJECT-TYPE
|
||
|
|
SYNTAX OCTET STRING (SIZE(16))
|
||
|
|
MAX-ACCESS read-write
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Used to set a new value for the IPsec security key.
|
||
|
|
|
||
|
|
Both alaIPsecSecurityKeyCurrent (with its correct value) and
|
||
|
|
alaIPsecSecurityKeyNew must be specified in the same SNMP SET
|
||
|
|
message. If alaIPsecSecurityKeyCurrent is not present, or if
|
||
|
|
its value is incorrect, the attempt to set a new key will fail."
|
||
|
|
::= { alaIPsecSecurityKeyEntry 3 }
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- IPsec Statistics Table
|
||
|
|
--
|
||
|
|
|
||
|
|
alaIPsecStatisticsTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF AlaIPsecStatisticsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table allowing the IPv6 statistics to be retrieved."
|
||
|
|
::= { alaIPsecConfig 2 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsEntry OBJECT-TYPE
|
||
|
|
SYNTAX AlaIPsecStatisticsEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The statistics entry."
|
||
|
|
INDEX { alaIPsecStatisticsProtocol }
|
||
|
|
::= { alaIPsecStatisticsTable 1 }
|
||
|
|
|
||
|
|
AlaIPsecStatisticsEntry ::= SEQUENCE {
|
||
|
|
alaIPsecStatisticsProtocol INTEGER,
|
||
|
|
alaIPsecStatisticsInSuccessful Counter32,
|
||
|
|
alaIPsecStatisticsInPolicyViolation Counter32,
|
||
|
|
alaIPsecStatisticsInNoSA Counter32,
|
||
|
|
alaIPsecStatisticsInUnknownSPI Counter32,
|
||
|
|
alaIPsecStatisticsInAHReplay Counter32,
|
||
|
|
alaIPsecStatisticsInESPReplay Counter32,
|
||
|
|
alaIPsecStatisticsInAHAuthenticationSuccess Counter32,
|
||
|
|
alaIPsecStatisticsInAHAuthenticationFail Counter32,
|
||
|
|
alaIPsecStatisticsInESPAuthenticationSuccess Counter32,
|
||
|
|
alaIPsecStatisticsInESPAuthenticationFail Counter32,
|
||
|
|
alaIPsecStatisticsInBadPacket Counter32,
|
||
|
|
alaIPsecStatisticsInNoMemory Counter32,
|
||
|
|
alaIPsecStatisticsOutSuccessful Counter32,
|
||
|
|
alaIPsecStatisticsOutPolicyViolation Counter32,
|
||
|
|
alaIPsecStatisticsOutNoSA Counter32,
|
||
|
|
alaIPsecStatisticsOutBadPacket Counter32,
|
||
|
|
alaIPsecStatisticsOutNoMemory Counter32,
|
||
|
|
alaIPsecStatisticsInDiscarded Counter32,
|
||
|
|
alaIPsecStatisticsOutDiscarded Counter32
|
||
|
|
}
|
||
|
|
|
||
|
|
alaIPsecStatisticsProtocol OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
ipv6(6)
|
||
|
|
}
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"IP protocol version covered by the IPsec statistics."
|
||
|
|
::= { alaIPsecStatisticsEntry 1 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInSuccessful OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets requiring IPsec processing
|
||
|
|
that were successfully handled."
|
||
|
|
::= { alaIPsecStatisticsEntry 2 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInPolicyViolation OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets that were dropped because
|
||
|
|
of policy violations."
|
||
|
|
::= { alaIPsecStatisticsEntry 3 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInNoSA OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets dropped because no
|
||
|
|
matching SA was found."
|
||
|
|
::= { alaIPsecStatisticsEntry 4 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInUnknownSPI OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets dropped because the SPI was
|
||
|
|
unknown."
|
||
|
|
::= { alaIPsecStatisticsEntry 5 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInAHReplay OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets that failed the AH replay
|
||
|
|
check."
|
||
|
|
::= { alaIPsecStatisticsEntry 6 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInESPReplay OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets taht failed the ESP
|
||
|
|
replay check."
|
||
|
|
::= { alaIPsecStatisticsEntry 7 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInAHAuthenticationSuccess OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets that successfully passed
|
||
|
|
AH authentication."
|
||
|
|
::= { alaIPsecStatisticsEntry 8 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInAHAuthenticationFail OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets that failed AH
|
||
|
|
authentication."
|
||
|
|
::= { alaIPsecStatisticsEntry 9 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInESPAuthenticationSuccess OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets that successfully passed
|
||
|
|
ESP authentication."
|
||
|
|
::= { alaIPsecStatisticsEntry 10 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInESPAuthenticationFail OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets that failed ESP
|
||
|
|
authentication."
|
||
|
|
::= { alaIPsecStatisticsEntry 11 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInBadPacket OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets requiring IPsec
|
||
|
|
processing that were not valid."
|
||
|
|
::= { alaIPsecStatisticsEntry 12 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInNoMemory OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming IPsec packets dropped because
|
||
|
|
no memory was available."
|
||
|
|
::= { alaIPsecStatisticsEntry 13 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsOutSuccessful OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of outgoing packets requiring IPsec processing
|
||
|
|
that were successfully handled."
|
||
|
|
::= { alaIPsecStatisticsEntry 14 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsOutPolicyViolation OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of outgoing packets dropped because of a
|
||
|
|
policy violation."
|
||
|
|
::= { alaIPsecStatisticsEntry 15 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsOutNoSA OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of outgoing packets dropped because no matching
|
||
|
|
SA was found."
|
||
|
|
::= { alaIPsecStatisticsEntry 16 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsOutBadPacket OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of outgoing packets requiring IPsec processing
|
||
|
|
that were not valid."
|
||
|
|
::= { alaIPsecStatisticsEntry 17 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsOutNoMemory OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of outgoing IPsec packets dropped because no
|
||
|
|
memory was available."
|
||
|
|
::= { alaIPsecStatisticsEntry 18 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsInDiscarded OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of incoming packets dropped because they matched
|
||
|
|
a discard policy."
|
||
|
|
::= { alaIPsecStatisticsEntry 19 }
|
||
|
|
|
||
|
|
alaIPsecStatisticsOutDiscarded OBJECT-TYPE
|
||
|
|
SYNTAX Counter32
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Number of outgoing packets dropped because they matched
|
||
|
|
a discard policy."
|
||
|
|
::= { alaIPsecStatisticsEntry 20 }
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- Security Policy Table
|
||
|
|
--
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF AlaIPsecSecurityPolicyEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table allowing the configuration of IPsec security policies."
|
||
|
|
::= { alcatelIND1IPsecMIBObjects 2 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyEntry OBJECT-TYPE
|
||
|
|
SYNTAX AlaIPsecSecurityPolicyEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A security policy entry."
|
||
|
|
INDEX { alaIPsecSecurityPolicyID }
|
||
|
|
::= { alaIPsecSecurityPolicyTable 1 }
|
||
|
|
|
||
|
|
AlaIPsecSecurityPolicyEntry ::= SEQUENCE {
|
||
|
|
alaIPsecSecurityPolicyID Unsigned32,
|
||
|
|
alaIPsecSecurityPolicySourceType InetAddressType,
|
||
|
|
alaIPsecSecurityPolicySource InetAddress,
|
||
|
|
alaIPsecSecurityPolicySourcePrefixLength IPsecPrefixLength,
|
||
|
|
alaIPsecSecurityPolicySourcePort IPsecPortNumber,
|
||
|
|
alaIPsecSecurityPolicyDestinationType InetAddressType,
|
||
|
|
alaIPsecSecurityPolicyDestination InetAddress,
|
||
|
|
alaIPsecSecurityPolicyDestinationPrefixLength IPsecPrefixLength,
|
||
|
|
alaIPsecSecurityPolicyDestinationPort IPsecPortNumber,
|
||
|
|
alaIPsecSecurityPolicyULProtocol IPsecULProtocol,
|
||
|
|
alaIPsecSecurityPolicyICMPv6Type INTEGER,
|
||
|
|
alaIPsecSecurityPolicyDirection INTEGER,
|
||
|
|
alaIPsecSecurityPolicyName IPsecName,
|
||
|
|
alaIPsecSecurityPolicyDescription IPsecDescription,
|
||
|
|
alaIPsecSecurityPolicyAction INTEGER,
|
||
|
|
alaIPsecSecurityPolicyAdminState IPsecAdminState,
|
||
|
|
alaIPsecSecurityPolicyOperationalState IPsecOperationalState,
|
||
|
|
alaIPsecSecurityPolicyPriority INTEGER,
|
||
|
|
alaIPsecSecurityPolicyRowStatus RowStatus
|
||
|
|
}
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyID OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A unique identifier for this security policy. When creating a
|
||
|
|
new policy, a zero value must be specified. An available
|
||
|
|
policy ID will then be automatically assigned to the policy."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 1 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicySourceType OBJECT-TYPE
|
||
|
|
SYNTAX InetAddressType
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of source address specified. Currently only ipv6(2) is allowed."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 2 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicySource OBJECT-TYPE
|
||
|
|
SYNTAX InetAddress
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The source of packets covered by this policy."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 3 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicySourcePrefixLength OBJECT-TYPE
|
||
|
|
SYNTAX IPsecPrefixLength
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The number of bits of the source address used to determine
|
||
|
|
which packets are covered by this policy.
|
||
|
|
|
||
|
|
The default value varies depending upon the type of
|
||
|
|
source address specified:
|
||
|
|
IPv4 - 32
|
||
|
|
IPv6 - 128
|
||
|
|
DNS name - 0 (any other value is ignored)"
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 4 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicySourcePort OBJECT-TYPE
|
||
|
|
SYNTAX IPsecPortNumber
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The source port of packets covered by this policy. To
|
||
|
|
match packets from any port, specify the 0 wildcard value. A
|
||
|
|
wildcard policy will only be used when there is no exact match
|
||
|
|
to a destination port in another entry."
|
||
|
|
DEFVAL { 0 }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 5 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyDestinationType OBJECT-TYPE
|
||
|
|
SYNTAX InetAddressType
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of destination address specified. Currently only ipv6(2) is allowed."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 6 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyDestination OBJECT-TYPE
|
||
|
|
SYNTAX InetAddress
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The destination of packets covered by this policy."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 7 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyDestinationPrefixLength OBJECT-TYPE
|
||
|
|
SYNTAX IPsecPrefixLength
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The number of bits of the destination prefix used to determine
|
||
|
|
which packets are covered by this policy.
|
||
|
|
|
||
|
|
The default value varies depending upon the type of
|
||
|
|
destination address specified:
|
||
|
|
IPv4 - 32
|
||
|
|
IPv6 - 128
|
||
|
|
DNS name - 0 (any other value is ignored)"
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 8 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyDestinationPort OBJECT-TYPE
|
||
|
|
SYNTAX IPsecPortNumber
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The destination port of packets covered by this policy. To
|
||
|
|
match packets from any port, specify the 0 wildcard value. A
|
||
|
|
wildcard policy will only be used when there is no exact match
|
||
|
|
to a destination port in another entry."
|
||
|
|
DEFVAL { 0 }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 9 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyULProtocol OBJECT-TYPE
|
||
|
|
SYNTAX IPsecULProtocol
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The upper-layer protocol of packets covered by this policy.
|
||
|
|
To match all protocols, specify the 255 wildcard value. A wildcard
|
||
|
|
policy will only be used when there is no exact match to the protocol
|
||
|
|
value specified in another entry."
|
||
|
|
DEFVAL { 255 }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 10 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyICMPv6Type OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER (0..255)
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"If the upper-layer protocol is ICMPv6, an ICMPv6 type value may
|
||
|
|
be specified to restrict the policy to a specific packet type.
|
||
|
|
|
||
|
|
To match all ICMPv6 packets, the 0 wildcard value should be
|
||
|
|
specified."
|
||
|
|
DEFVAL { 0 }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 11 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyDirection OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
in(1),
|
||
|
|
out(2)
|
||
|
|
}
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The direction of traffic covered by this policy."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 12 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyName OBJECT-TYPE
|
||
|
|
SYNTAX IPsecName
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A name for this policy."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 13 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyDescription OBJECT-TYPE
|
||
|
|
SYNTAX IPsecDescription
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A detailed description of this policy."
|
||
|
|
DEFVAL { "" }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 14 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyAction OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
discard(0),
|
||
|
|
none(1),
|
||
|
|
ipsec(2)
|
||
|
|
}
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The action to take on traffic covered by this policy.
|
||
|
|
|
||
|
|
discard(0) means that all traffic covered by the policy
|
||
|
|
will be discarded.
|
||
|
|
|
||
|
|
none(1) means that no IPsec processing will be done on
|
||
|
|
the traffic covered by this policy.
|
||
|
|
|
||
|
|
ipsec(2) means that IPsec processing will take place on
|
||
|
|
the traffic. One or more rules should be defined in the
|
||
|
|
IPsec Rule Table. If no rules are defined processing
|
||
|
|
is identical to none(0) being specified."
|
||
|
|
DEFVAL { ipsec }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 15 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyAdminState OBJECT-TYPE
|
||
|
|
SYNTAX IPsecAdminState
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Allows a policy to be administratively enabled or
|
||
|
|
disabled."
|
||
|
|
DEFVAL { enabled }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 16 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyOperationalState OBJECT-TYPE
|
||
|
|
SYNTAX IPsecOperationalState
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The operational state of this policy."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 17 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyPriority OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER (1..1000)
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The priority for this policy. When traffic would be covered by
|
||
|
|
multiple policies the policy with the highest priority value is
|
||
|
|
used. If two policies have the same priority, the one configured
|
||
|
|
first has precedence."
|
||
|
|
DEFVAL { 100 }
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 18 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyRowStatus OBJECT-TYPE
|
||
|
|
SYNTAX RowStatus
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Used to control the addition and removal of security
|
||
|
|
policy entries."
|
||
|
|
::= { alaIPsecSecurityPolicyEntry 19 }
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- Security Policy IPsec Rule Table
|
||
|
|
--
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyRuleTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF AlaIPsecSecurityPolicyRuleEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table allowing the configuration of the IPsec rules for
|
||
|
|
a security policy."
|
||
|
|
::= { alcatelIND1IPsecMIBObjects 3 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyRuleEntry OBJECT-TYPE
|
||
|
|
SYNTAX AlaIPsecSecurityPolicyRuleEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A security policy entry."
|
||
|
|
INDEX {
|
||
|
|
alaIPsecSecurityPolicyID,
|
||
|
|
alaIPsecSecurityPolicyRuleIndex
|
||
|
|
}
|
||
|
|
::= { alaIPsecSecurityPolicyRuleTable 1 }
|
||
|
|
|
||
|
|
AlaIPsecSecurityPolicyRuleEntry ::= SEQUENCE {
|
||
|
|
alaIPsecSecurityPolicyRuleIndex Unsigned32,
|
||
|
|
alaIPsecSecurityPolicyRuleProtocol INTEGER,
|
||
|
|
alaIPsecSecurityPolicyRuleMode INTEGER,
|
||
|
|
alaIPsecSecurityPolicyRuleRowStatus RowStatus
|
||
|
|
}
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyRuleIndex OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32 (1..10)
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Index specifying the order in which multiple rules for
|
||
|
|
the same security policy will be applied. Rules are
|
||
|
|
indexed by the order in which they are applied to the
|
||
|
|
original payload.
|
||
|
|
|
||
|
|
For example, for a security policy where an IPv6 payload
|
||
|
|
should be protected by an ESP header, which should be protected
|
||
|
|
by an AH header, there would be two Rule Table entries.
|
||
|
|
The ESP entry would have an index of 1 (first rule applied
|
||
|
|
to the payload). The AH entry would have an index of 2
|
||
|
|
(second rule applied)."
|
||
|
|
::= { alaIPsecSecurityPolicyRuleEntry 1 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyRuleProtocol OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
ah(1),
|
||
|
|
esp(2)
|
||
|
|
}
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Indicates the type of header required by the rule."
|
||
|
|
::= { alaIPsecSecurityPolicyRuleEntry 2 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyRuleMode OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
transport(1)
|
||
|
|
--tunnel(2)
|
||
|
|
}
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The mode in which the rule's protocol is running. At present,
|
||
|
|
only transport(1) is allowed. Until tunnel mode is supported,
|
||
|
|
transport(1) will be treated as the default value."
|
||
|
|
::= { alaIPsecSecurityPolicyRuleEntry 3 }
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyRuleRowStatus OBJECT-TYPE
|
||
|
|
SYNTAX RowStatus
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Used to control the addition and removal of security
|
||
|
|
policy IPsec rule entries."
|
||
|
|
::= { alaIPsecSecurityPolicyRuleEntry 4 }
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- IPsec Security Association Configuration Table
|
||
|
|
--
|
||
|
|
|
||
|
|
alaIPsecSAConfigTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF AlaIPsecSAConfigEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table allowing the manual configuration of Security
|
||
|
|
Associations in the Security Association Database (SAD)."
|
||
|
|
::= { alcatelIND1IPsecMIBObjects 4 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigEntry OBJECT-TYPE
|
||
|
|
SYNTAX AlaIPsecSAConfigEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Manually configured security association (SA) parameters."
|
||
|
|
INDEX { alaIPsecSAConfigID }
|
||
|
|
::= { alaIPsecSAConfigTable 1 }
|
||
|
|
|
||
|
|
AlaIPsecSAConfigEntry ::= SEQUENCE {
|
||
|
|
alaIPsecSAConfigID Unsigned32,
|
||
|
|
alaIPsecSAConfigType IPsecSAType,
|
||
|
|
alaIPsecSAConfigSourceType InetAddressType,
|
||
|
|
alaIPsecSAConfigSource InetAddress,
|
||
|
|
alaIPsecSAConfigDestinationType InetAddressType,
|
||
|
|
alaIPsecSAConfigDestination InetAddress,
|
||
|
|
alaIPsecSAConfigSPI Unsigned32,
|
||
|
|
alaIPsecSAConfigName IPsecName,
|
||
|
|
alaIPsecSAConfigDescription IPsecDescription,
|
||
|
|
alaIPsecSAConfigEncryptionAlgorithm IPsecESPAlgorithm,
|
||
|
|
alaIPsecSAConfigEncryptionKeyLength Unsigned32,
|
||
|
|
alaIPsecSAConfigAuthenticationAlgorithm IPsecAHAlgorithm,
|
||
|
|
alaIPsecSAConfigAdminState IPsecAdminState,
|
||
|
|
alaIPsecSAConfigOperationalState IPsecOperationalState,
|
||
|
|
alaIPsecSAConfigRowStatus RowStatus
|
||
|
|
}
|
||
|
|
|
||
|
|
alaIPsecSAConfigID OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A unique identifier for this manually configured SA.
|
||
|
|
When creating a new SA, a zero value must be specified.
|
||
|
|
An available ID will then be automatically assigned to
|
||
|
|
the SA."
|
||
|
|
::= { alaIPsecSAConfigEntry 1 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigType OBJECT-TYPE
|
||
|
|
SYNTAX IPsecSAType
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of this SA: AH or ESP. Once set,
|
||
|
|
the type may not be changed."
|
||
|
|
::= { alaIPsecSAConfigEntry 2 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigSourceType OBJECT-TYPE
|
||
|
|
SYNTAX InetAddressType
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of source address specified. Currently only ipv6(2) is allowed."
|
||
|
|
::= { alaIPsecSAConfigEntry 3 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigSource OBJECT-TYPE
|
||
|
|
SYNTAX InetAddress
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The source of packets covered by this SA."
|
||
|
|
::= { alaIPsecSAConfigEntry 4 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigDestinationType OBJECT-TYPE
|
||
|
|
SYNTAX InetAddressType
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The type of destination address specified. Currently only ipv6(2) is allowed."
|
||
|
|
::= { alaIPsecSAConfigEntry 5 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigDestination OBJECT-TYPE
|
||
|
|
SYNTAX InetAddress
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The destination of packets covered by this SA."
|
||
|
|
::= { alaIPsecSAConfigEntry 6 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigSPI OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The Security Parameters Index (SPI) of this SA."
|
||
|
|
::= { alaIPsecSAConfigEntry 7 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigName OBJECT-TYPE
|
||
|
|
SYNTAX IPsecName
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The name of this manually configured SA."
|
||
|
|
::= { alaIPsecSAConfigEntry 8 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigDescription OBJECT-TYPE
|
||
|
|
SYNTAX IPsecDescription
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A detailed description for the manually created IPsec SA."
|
||
|
|
DEFVAL { "" }
|
||
|
|
::= { alaIPsecSAConfigEntry 9 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigEncryptionAlgorithm OBJECT-TYPE
|
||
|
|
SYNTAX IPsecESPAlgorithm
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"For an ESP SA, defines the encryption algorithm to be used.
|
||
|
|
null(11) should be specified if ESP is being used for integrity
|
||
|
|
only. If null(11) is specified,
|
||
|
|
alaIPsecSAConfigAuthenticationAlgorithm may not be none(0).
|
||
|
|
|
||
|
|
The value of this object is none(0) for AH SAs."
|
||
|
|
DEFVAL { none }
|
||
|
|
::= { alaIPsecSAConfigEntry 10 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigEncryptionKeyLength OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
UNITS "bits"
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"For those algorithms where multiple key lengths are supported,
|
||
|
|
specifies the key length to be used. Zero may be specified to
|
||
|
|
use the default key length."
|
||
|
|
DEFVAL { 0 }
|
||
|
|
::= { alaIPsecSAConfigEntry 11 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigAuthenticationAlgorithm OBJECT-TYPE
|
||
|
|
SYNTAX IPsecAHAlgorithm
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Defines the authentication algorithm to be used.
|
||
|
|
|
||
|
|
For ESP SAs, none(0) may be specified for encryption-only ESP.
|
||
|
|
For ESP integrity-only, ESP integrity and encryption, or for
|
||
|
|
AH SAs, hmacmd5(2), hmacsha1(3), or aesxcbcmac(9) must
|
||
|
|
be specified."
|
||
|
|
DEFVAL { none }
|
||
|
|
::= { alaIPsecSAConfigEntry 12 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigAdminState OBJECT-TYPE
|
||
|
|
SYNTAX IPsecAdminState
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Allows a manually configured SA to be administratively enabled
|
||
|
|
or disabled."
|
||
|
|
DEFVAL { enabled }
|
||
|
|
::= { alaIPsecSAConfigEntry 13 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigOperationalState OBJECT-TYPE
|
||
|
|
SYNTAX IPsecOperationalState
|
||
|
|
MAX-ACCESS read-only
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The operational state of the manually configured SA."
|
||
|
|
::= { alaIPsecSAConfigEntry 14 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigRowStatus OBJECT-TYPE
|
||
|
|
SYNTAX RowStatus
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Used to control the addition and removal of manually configured
|
||
|
|
IPsec SAs."
|
||
|
|
::= { alaIPsecSAConfigEntry 15 }
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- IPsec Key Configuration Table
|
||
|
|
--
|
||
|
|
|
||
|
|
alaIPsecKeyTable OBJECT-TYPE
|
||
|
|
SYNTAX SEQUENCE OF AlaIPsecKeyEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Table used to configure the keys used by manually
|
||
|
|
configured Security Associations in the IPsec Security
|
||
|
|
Association Configuration table."
|
||
|
|
::= { alcatelIND1IPsecMIBObjects 5 }
|
||
|
|
|
||
|
|
alaIPsecKeyEntry OBJECT-TYPE
|
||
|
|
SYNTAX AlaIPsecKeyEntry
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"An IPsec key. Keys in the table must be uniquely
|
||
|
|
identified by the combination of key type and key name.
|
||
|
|
However, since the key name can be up to 255 characters,
|
||
|
|
beyond the 128-element size limit for SNMP index objects,
|
||
|
|
the key ID is used to uniquely identify a key for SNMP
|
||
|
|
access."
|
||
|
|
INDEX { alaIPsecKeyID }
|
||
|
|
::= { alaIPsecKeyTable 1 }
|
||
|
|
|
||
|
|
AlaIPsecKeyEntry ::= SEQUENCE {
|
||
|
|
alaIPsecKeyID Unsigned32,
|
||
|
|
alaIPsecKeyType INTEGER,
|
||
|
|
alaIPsecKeyName OCTET STRING,
|
||
|
|
alaIPsecKey OCTET STRING,
|
||
|
|
alaIPsecKeyEncrypted TruthValue,
|
||
|
|
alaIPsecKeyRowStatus RowStatus
|
||
|
|
}
|
||
|
|
|
||
|
|
alaIPsecKeyID OBJECT-TYPE
|
||
|
|
SYNTAX Unsigned32
|
||
|
|
MAX-ACCESS not-accessible
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A unique identifier for this key. When creating a
|
||
|
|
new key, a zero value must be specified. An available
|
||
|
|
ID will then be automatically assigned to the key."
|
||
|
|
::= { alaIPsecKeyEntry 1 }
|
||
|
|
|
||
|
|
alaIPsecKeyType OBJECT-TYPE
|
||
|
|
SYNTAX INTEGER {
|
||
|
|
saAuthentication(1),
|
||
|
|
saEncryption(2)
|
||
|
|
}
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Indicates if the key is to be used for encryption or
|
||
|
|
authentication by a SA. Once a key is created, its type
|
||
|
|
may not be changed."
|
||
|
|
::= { alaIPsecKeyEntry 2 }
|
||
|
|
|
||
|
|
alaIPsecKeyName OBJECT-TYPE
|
||
|
|
SYNTAX OCTET STRING (SIZE(1..255))
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The name of the key.
|
||
|
|
|
||
|
|
For manually-configured SA keys, the name is limited to
|
||
|
|
a maximum length of 20 characters and should correspond
|
||
|
|
to an entry in the alaIPsecSAConfigTable.
|
||
|
|
|
||
|
|
The key name may not be changed once a key is created."
|
||
|
|
::= { alaIPsecKeyEntry 3 }
|
||
|
|
|
||
|
|
alaIPsecKey OBJECT-TYPE
|
||
|
|
SYNTAX OCTET STRING
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The key value. The value specified must match the required
|
||
|
|
key length for the algorithm using the key. If
|
||
|
|
an attempt is made to read the value of this object a
|
||
|
|
zero-length octet string will be returned."
|
||
|
|
::= { alaIPsecKeyEntry 4 }
|
||
|
|
|
||
|
|
alaIPsecKeyEncrypted OBJECT-TYPE
|
||
|
|
SYNTAX TruthValue
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"If true, the key value is specified in AOS encrypted form.
|
||
|
|
For example, keys being restored from the configuration file."
|
||
|
|
DEFVAL { false }
|
||
|
|
::= { alaIPsecKeyEntry 5 }
|
||
|
|
|
||
|
|
alaIPsecKeyRowStatus OBJECT-TYPE
|
||
|
|
SYNTAX RowStatus
|
||
|
|
MAX-ACCESS read-create
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"Used to control the addition and removal of keys."
|
||
|
|
::= { alaIPsecKeyEntry 6 }
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- conformance information
|
||
|
|
--
|
||
|
|
|
||
|
|
alcatelIND1IPsecMIBConformance OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIB 2 }
|
||
|
|
alcatelIND1IPsecMIBCompliances OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIBConformance 1 }
|
||
|
|
alcatelIND1IPsecMIBGroups OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIBConformance 2 }
|
||
|
|
|
||
|
|
alaIPsecCompliance MODULE-COMPLIANCE
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"The compliance statement for Alcatel switches
|
||
|
|
implementing ALCATEL-IND1-IPSEC-MIB."
|
||
|
|
MODULE
|
||
|
|
MANDATORY-GROUPS {
|
||
|
|
alaIPsecConfigGroup,
|
||
|
|
alaIPsecSecurityPolicyGroup,
|
||
|
|
alaIPsecSAConfigGroup,
|
||
|
|
alaIPsecKeyGroup
|
||
|
|
}
|
||
|
|
::= { alcatelIND1IPsecMIBCompliances 1 }
|
||
|
|
|
||
|
|
|
||
|
|
--
|
||
|
|
-- units of conformance
|
||
|
|
--
|
||
|
|
|
||
|
|
alaIPsecConfigGroup OBJECT-GROUP
|
||
|
|
OBJECTS {
|
||
|
|
-- alaIPsecSecurityKeyID,
|
||
|
|
alaIPsecSecurityKeyCurrent,
|
||
|
|
alaIPsecSecurityKeyNew,
|
||
|
|
-- alaIPsecStatisticsProtocol,
|
||
|
|
alaIPsecStatisticsInSuccessful,
|
||
|
|
alaIPsecStatisticsInPolicyViolation,
|
||
|
|
alaIPsecStatisticsInNoSA,
|
||
|
|
alaIPsecStatisticsInUnknownSPI,
|
||
|
|
alaIPsecStatisticsInAHReplay,
|
||
|
|
alaIPsecStatisticsInESPReplay,
|
||
|
|
alaIPsecStatisticsInAHAuthenticationSuccess,
|
||
|
|
alaIPsecStatisticsInAHAuthenticationFail,
|
||
|
|
alaIPsecStatisticsInESPAuthenticationSuccess,
|
||
|
|
alaIPsecStatisticsInESPAuthenticationFail,
|
||
|
|
alaIPsecStatisticsInBadPacket,
|
||
|
|
alaIPsecStatisticsInNoMemory,
|
||
|
|
alaIPsecStatisticsOutSuccessful,
|
||
|
|
alaIPsecStatisticsOutPolicyViolation,
|
||
|
|
alaIPsecStatisticsOutNoSA,
|
||
|
|
alaIPsecStatisticsOutBadPacket,
|
||
|
|
alaIPsecStatisticsOutNoMemory,
|
||
|
|
alaIPsecStatisticsInDiscarded,
|
||
|
|
alaIPsecStatisticsOutDiscarded
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A collection of objects to support global configuration
|
||
|
|
of IPsec."
|
||
|
|
::= { alcatelIND1IPsecMIBGroups 1 }
|
||
|
|
|
||
|
|
|
||
|
|
alaIPsecSecurityPolicyGroup OBJECT-GROUP
|
||
|
|
OBJECTS {
|
||
|
|
-- alaIPsecSecurityPolicyID
|
||
|
|
alaIPsecSecurityPolicySource,
|
||
|
|
alaIPsecSecurityPolicySourceType,
|
||
|
|
alaIPsecSecurityPolicySourcePrefixLength,
|
||
|
|
alaIPsecSecurityPolicySourcePort,
|
||
|
|
alaIPsecSecurityPolicyDestination,
|
||
|
|
alaIPsecSecurityPolicyDestinationType,
|
||
|
|
alaIPsecSecurityPolicyDestinationPrefixLength,
|
||
|
|
alaIPsecSecurityPolicyDestinationPort,
|
||
|
|
alaIPsecSecurityPolicyULProtocol,
|
||
|
|
alaIPsecSecurityPolicyICMPv6Type,
|
||
|
|
alaIPsecSecurityPolicyDirection,
|
||
|
|
alaIPsecSecurityPolicyName,
|
||
|
|
alaIPsecSecurityPolicyDescription,
|
||
|
|
alaIPsecSecurityPolicyAction,
|
||
|
|
alaIPsecSecurityPolicyAdminState,
|
||
|
|
alaIPsecSecurityPolicyOperationalState,
|
||
|
|
alaIPsecSecurityPolicyPriority,
|
||
|
|
alaIPsecSecurityPolicyRowStatus,
|
||
|
|
-- alaIPsecSecurityPolicyRuleIndex,
|
||
|
|
alaIPsecSecurityPolicyRuleProtocol,
|
||
|
|
alaIPsecSecurityPolicyRuleMode,
|
||
|
|
alaIPsecSecurityPolicyRuleRowStatus
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A collection of objects to support management of IPsec
|
||
|
|
security policies."
|
||
|
|
::= { alcatelIND1IPsecMIBGroups 2 }
|
||
|
|
|
||
|
|
alaIPsecSAConfigGroup OBJECT-GROUP
|
||
|
|
OBJECTS {
|
||
|
|
-- alaIPsecSAConfigID,
|
||
|
|
alaIPsecSAConfigType,
|
||
|
|
alaIPsecSAConfigSource,
|
||
|
|
alaIPsecSAConfigSourceType,
|
||
|
|
alaIPsecSAConfigDestination,
|
||
|
|
alaIPsecSAConfigDestinationType,
|
||
|
|
alaIPsecSAConfigSPI,
|
||
|
|
alaIPsecSAConfigName,
|
||
|
|
alaIPsecSAConfigDescription,
|
||
|
|
alaIPsecSAConfigEncryptionAlgorithm,
|
||
|
|
alaIPsecSAConfigEncryptionKeyLength,
|
||
|
|
alaIPsecSAConfigAuthenticationAlgorithm,
|
||
|
|
alaIPsecSAConfigAdminState,
|
||
|
|
alaIPsecSAConfigOperationalState,
|
||
|
|
alaIPsecSAConfigRowStatus
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A collection of objects to support management of manually
|
||
|
|
configured IPsec SAs."
|
||
|
|
::= { alcatelIND1IPsecMIBGroups 3 }
|
||
|
|
|
||
|
|
|
||
|
|
alaIPsecKeyGroup OBJECT-GROUP
|
||
|
|
OBJECTS {
|
||
|
|
-- alaIPsecKeyID,
|
||
|
|
alaIPsecKeyType,
|
||
|
|
alaIPsecKeyName,
|
||
|
|
alaIPsecKey,
|
||
|
|
alaIPsecKeyEncrypted,
|
||
|
|
alaIPsecKeyRowStatus
|
||
|
|
}
|
||
|
|
STATUS current
|
||
|
|
DESCRIPTION
|
||
|
|
"A collection of objects to support management of keys."
|
||
|
|
::= { alcatelIND1IPsecMIBGroups 4 }
|
||
|
|
|
||
|
|
END
|