RAPID-IPSEC-SA-MON-MIB-EXT DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Counter32, Gauge32, Integer32, Integer32, NOTIFICATION-TYPE, OBJECT-IDENTITY, enterprises FROM SNMPv2-SMI TEXTUAL-CONVENTION, TruthValue FROM SNMPv2-TC ifIndex FROM RFC1213-MIB IpsecDoiIdentType, IpsecDoiEncapsulationMode, IpsecDoiEspTransform, IpsecDoiAhTransform, IpsecDoiAuthAlgorithm, IpsecDoiIpcompTransform, IpsecDoiSecProtocolId FROM IPSEC-ISAKMP-IKE-DOI-TC rapidstream FROM RAPID-MIB; rsIpsecSaMonModule MODULE-IDENTITY LAST-UPDATED "200003211200Z" ORGANIZATION "WatchGuard Technologies, Inc." CONTACT-INFO " Ella Yu WatchGuard Technologies, Inc. 1841 Zanker Road San Jose, CA 95112 USA 408-519-4888 ella.yu@watchguard.com " DESCRIPTION "The MIB module describes generic IPSec objects defined in IETF working draft 'draft-ieft-ipsec-monitor-mib-01' and RapidStream's extension." REVISION "200003211200Z" DESCRIPTION "Initial revision." REVISION "200211011200Z" DESCRIPTION "Changed CONTACT-INFO." ::= { rapidstream 3 } IpsecSaCreatorIdent ::= TEXTUAL-CONVENTION DISPLAY-HINT "d" STATUS current DESCRIPTION "A value indicating how an SA was created." SYNTAX INTEGER { unknown(0), static(1), -- statically created ike(2), -- IKE other(3) } IpsecIpv6Address ::= TEXTUAL-CONVENTION DISPLAY-HINT "2x:2x:2x:2x:2x:2x:1d.1d.1d.1d" STATUS current DESCRIPTION "This data type is used to model IPv6 address prefixes. This is a binary string of 16 octets in network byte-order." SYNTAX OCTET STRING (SIZE (16)) rsIpsecSaMonitorMIB OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all IPSec branches." ::= { rsIpsecSaMonModule 1 } -- significant branches rsSaTables OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all SA tables." ::= { rsIpsecSaMonitorMIB 1 } rsSaStatistics OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are global counters for IPSec security associations." ::= { rsIpsecSaMonitorMIB 2 } rsSaErrors OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are global error counters for IPSec security associations." ::= { rsIpsecSaMonitorMIB 3 } rsSaTraps OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are traps for IPSec security associations." ::= { rsIpsecSaMonitorMIB 4 } rsSaTrapObjects OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for objects which are used as part of traps." ::= { rsIpsecSaMonitorMIB 5 } rsSaTrapControl OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are trap controls for IPSec security associations." ::= { rsIpsecSaMonitorMIB 6 } rsSaGroups OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which describe the groups in this MIB." ::= { rsIpsecSaMonitorMIB 7 } rsSaConformance OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which describe the conformance for this MIB." ::= { rsIpsecSaMonitorMIB 8 } -- the IPSec Inbound ESP MIB-Group -- -- a collection of objects providing information about -- IPSec Inbound ESP SAs rsIpsecSaEspInTable OBJECT-TYPE SYNTAX SEQUENCE OF RSIpsecSaEspInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec inbound ESP SAs. There should be one row for every inbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { rsSaTables 1 } rsIpsecSaEspInEntry OBJECT-TYPE SYNTAX RSIpsecSaEspInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec inbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ rsIpsecSaEspInAddress, rsIpsecSaEspInSpi } ::= { rsIpsecSaEspInTable 1 } RSIpsecSaEspInEntry ::= SEQUENCE { rsIpsecSaEspInAddress IpAddress, rsIpsecSaEspInSpi Integer32, rsIpsecSaEspInDestId OCTET STRING, rsIpsecSaEspInDestIdType IpsecDoiIdentType, rsIpsecSaEspInSourceId OCTET STRING, rsIpsecSaEspInSourceIdType IpsecDoiIdentType, rsIpsecSaEspInProtocol Integer32, rsIpsecSaEspInDestPort Integer32, rsIpsecSaEspInSourcePort Integer32, rsIpsecSaEspInCreator IpsecSaCreatorIdent, rsIpsecSaEspInEncapsulation IpsecDoiEncapsulationMode, rsIpsecSaEspInEncAlg IpsecDoiEspTransform, rsIpsecSaEspInEncKeyLength Integer32, rsIpsecSaEspInAuthAlg IpsecDoiAuthAlgorithm, rsIpsecSaEspInLimitSeconds Integer32, rsIpsecSaEspInLimitKbytes Integer32, rsIpsecSaEspInAccSeconds Counter32, rsIpsecSaEspInAccKbytes Counter32, rsIpsecSaEspInUserOctets Counter32, rsIpsecSaEspInPackets Counter32, rsIpsecSaEspInDecryptErrors Counter32, rsIpsecSaEspInAuthErrors Counter32, rsIpsecSaEspInReplayErrors Counter32, rsIpsecSaEspInPolicyErrors Counter32, rsIpsecSaEspInPadErrors Counter32, rsIpsecSaEspInOtherReceiveErrors Counter32 } rsIpsecSaEspInAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { rsIpsecSaEspInEntry 1 } rsIpsecSaEspInSpi OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE "RFC 2406 Section 2.1" ::= { rsIpsecSaEspInEntry 2 } rsIpsecSaEspInDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during SA creation negotiation." ::= { rsIpsecSaEspInEntry 3 } rsIpsecSaEspInDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaEspInDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaEspInEntry 4 } rsIpsecSaEspInSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { rsIpsecSaEspInEntry 5 } rsIpsecSaEspInSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaEspInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaEspInEntry 6 } rsIpsecSaEspInProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaEspInEntry 7 } rsIpsecSaEspInDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaEspInEntry 8 } rsIpsecSaEspInSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaEspInEntry 9 } rsIpsecSaEspInCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { rsIpsecSaEspInEntry 10 } rsIpsecSaEspInEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { rsIpsecSaEspInEntry 11 } rsIpsecSaEspInEncAlg OBJECT-TYPE SYNTAX IpsecDoiEspTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used." ::= { rsIpsecSaEspInEntry 12 } rsIpsecSaEspInEncKeyLength OBJECT-TYPE SYNTAX Integer32 (0..65531) UNITS "bits" MAX-ACCESS read-only STATUS current DESCRIPTION "The length of the encryption key in bits used for the algorithm specified in the 'rsIpsecSaEspInEncAlg' object, or 0 if the key length is implicit in the specified algorithm or there is no encryption specified." ::= { rsIpsecSaEspInEntry 13 } rsIpsecSaEspInAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAuthAlgorithm MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used." ::= { rsIpsecSaEspInEntry 14 } rsIpsecSaEspInLimitSeconds OBJECT-TYPE SYNTAX Integer32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { rsIpsecSaEspInEntry 15 } rsIpsecSaEspInLimitKbytes OBJECT-TYPE SYNTAX Integer32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in kilobytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { rsIpsecSaEspInEntry 16 } rsIpsecSaEspInAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { rsIpsecSaEspInEntry 17 } rsIpsecSaEspInAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic." ::= { rsIpsecSaEspInEntry 18 } rsIpsecSaEspInUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { rsIpsecSaEspInEntry 19 } rsIpsecSaEspInPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { rsIpsecSaEspInEntry 20 } rsIpsecSaEspInDecryptErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to decryption errors." ::= { rsIpsecSaEspInEntry 21 } rsIpsecSaEspInAuthErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to authentication errors." ::= { rsIpsecSaEspInEntry 22 } rsIpsecSaEspInReplayErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to replay errors." ::= { rsIpsecSaEspInEntry 23 } rsIpsecSaEspInPolicyErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid." ::= { rsIpsecSaEspInEntry 24 } rsIpsecSaEspInPadErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to pad value errors. Implementations that do not check this must not support this object." REFERENCE "RFC 2406 section 2.4" ::= { rsIpsecSaEspInEntry 25 } rsIpsecSaEspInOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element." ::= { rsIpsecSaEspInEntry 26 } -- the IPSec Inbound AH MIB-Group -- -- a collection of objects providing information about -- IPSec Inbound AH SAs rsIpsecSaAhInTable OBJECT-TYPE SYNTAX SEQUENCE OF RSIpsecSaAhInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec inbound AH SAs. There should be one row for every inbound AH security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { rsSaTables 2 } rsIpsecSaAhInEntry OBJECT-TYPE SYNTAX RSIpsecSaAhInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec inbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ rsIpsecSaAhInAddress, rsIpsecSaAhInSpi } ::= { rsIpsecSaAhInTable 1 } RSIpsecSaAhInEntry ::= SEQUENCE { rsIpsecSaAhInAddress IpAddress, rsIpsecSaAhInSpi Integer32, rsIpsecSaAhInDestId OCTET STRING, rsIpsecSaAhInDestIdType IpsecDoiIdentType, rsIpsecSaAhInSourceId OCTET STRING, rsIpsecSaAhInSourceIdType IpsecDoiIdentType, rsIpsecSaAhInProtocol Integer32, rsIpsecSaAhInDestPort Integer32, rsIpsecSaAhInSourcePort Integer32, rsIpsecSaAhInCreator IpsecSaCreatorIdent, rsIpsecSaAhInEncapsulation IpsecDoiEncapsulationMode, rsIpsecSaAhInAuthAlg IpsecDoiAhTransform, rsIpsecSaAhInLimitSeconds Integer32, rsIpsecSaAhInLimitKbytes Integer32, rsIpsecSaAhInAccSeconds Counter32, rsIpsecSaAhInAccKbytes Counter32, rsIpsecSaAhInUserOctets Counter32, rsIpsecSaAhInPackets Counter32, -- error statistics rsIpsecSaAhInAuthErrors Counter32, rsIpsecSaAhInReplayErrors Counter32, rsIpsecSaAhInPolicyErrors Counter32, rsIpsecSaAhInOtherReceiveErrors Counter32 } rsIpsecSaAhInAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { rsIpsecSaAhInEntry 1 } rsIpsecSaAhInSpi OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE "RFC 2402 Section 2.4" ::= { rsIpsecSaAhInEntry 2 } rsIpsecSaAhInDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { rsIpsecSaAhInEntry 3 } rsIpsecSaAhInDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaAhInDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaAhInEntry 4 } rsIpsecSaAhInSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { rsIpsecSaAhInEntry 5 } rsIpsecSaAhInSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaAhInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaAhInEntry 6 } rsIpsecSaAhInProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaAhInEntry 7 } rsIpsecSaAhInDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaAhInEntry 8 } rsIpsecSaAhInSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaAhInEntry 9 } rsIpsecSaAhInCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { rsIpsecSaAhInEntry 10 } rsIpsecSaAhInEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { rsIpsecSaAhInEntry 11 } rsIpsecSaAhInAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAhTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic carried by this SA if it uses ESP or 0 if there is no authentication applied by ESP." ::= { rsIpsecSaAhInEntry 12 } rsIpsecSaAhInLimitSeconds OBJECT-TYPE SYNTAX Integer32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { rsIpsecSaAhInEntry 13 } rsIpsecSaAhInLimitKbytes OBJECT-TYPE SYNTAX Integer32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in Kbytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { rsIpsecSaAhInEntry 14 } rsIpsecSaAhInAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { rsIpsecSaAhInEntry 15 } rsIpsecSaAhInAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic." ::= { rsIpsecSaAhInEntry 16 } rsIpsecSaAhInUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { rsIpsecSaAhInEntry 17 } rsIpsecSaAhInPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { rsIpsecSaAhInEntry 18 } rsIpsecSaAhInAuthErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to authentication errors." ::= { rsIpsecSaAhInEntry 19 } rsIpsecSaAhInReplayErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to replay errors." ::= { rsIpsecSaAhInEntry 20 } rsIpsecSaAhInPolicyErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid." ::= { rsIpsecSaAhInEntry 21 } rsIpsecSaAhInOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the authentication element." ::= { rsIpsecSaAhInEntry 22 } -- the IPSec Inbound IPCOMP MIB-Group -- -- a collection of objects providing information about -- IPSec Inbound IPCOMP SAs rsIpsecSaIpcompInTable OBJECT-TYPE SYNTAX SEQUENCE OF RSIpsecSaIpcompInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec inbound IPCOMP SAs. There should be one row for every inbound IPCOMP (security) association that exists in the entity. The maximum number of rows is implementation dependent." ::= { rsSaTables 3 } rsIpsecSaIpcompInEntry OBJECT-TYPE SYNTAX RSIpsecSaIpcompInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec inbound IPCOMP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ rsIpsecSaIpcompInAddress, rsIpsecSaIpcompInCpi } ::= { rsIpsecSaIpcompInTable 1 } RSIpsecSaIpcompInEntry ::= SEQUENCE { rsIpsecSaIpcompInAddress IpAddress, rsIpsecSaIpcompInCpi IpsecDoiIpcompTransform, rsIpsecSaIpcompInDestId OCTET STRING, rsIpsecSaIpcompInDestIdType IpsecDoiIdentType, rsIpsecSaIpcompInSourceId OCTET STRING, rsIpsecSaIpcompInSourceIdType IpsecDoiIdentType, rsIpsecSaIpcompInProtocol Integer32, rsIpsecSaIpcompInDestPort Integer32, rsIpsecSaIpcompInSourcePort Integer32, rsIpsecSaIpcompInCreator IpsecSaCreatorIdent, rsIpsecSaIpcompInEncapsulation IpsecDoiEncapsulationMode, rsIpsecSaIpcompInDecompAlg IpsecDoiIpcompTransform, rsIpsecSaIpcompInSeconds Counter32, rsIpsecSaIpcompInUserOctets Counter32, rsIpsecSaIpcompInPackets Counter32, rsIpsecSaIpcompInDecompErrors Counter32, rsIpsecSaIpcompInOtherReceiveErrors Counter32 } rsIpsecSaIpcompInAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { rsIpsecSaIpcompInEntry 1 } rsIpsecSaIpcompInCpi OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform." REFERENCE "RFC 2393 Section 3.3" ::= { rsIpsecSaIpcompInEntry 2 } rsIpsecSaIpcompInDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { rsIpsecSaIpcompInEntry 3 } rsIpsecSaIpcompInDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaIpcompInDestId', or 0 if unknown or if the SA uses transport mode, or 0 if this SA is used with multiple SAs in protection suites." ::= { rsIpsecSaIpcompInEntry 4 } rsIpsecSaIpcompInSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { rsIpsecSaIpcompInEntry 5 } rsIpsecSaIpcompInSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaIpcompInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites." ::= { rsIpsecSaIpcompInEntry 6 } rsIpsecSaIpcompInProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaIpcompInEntry 7 } rsIpsecSaIpcompInDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaIpcompInEntry 8 } rsIpsecSaIpcompInSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaIpcompInEntry 9 } rsIpsecSaIpcompInCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { rsIpsecSaIpcompInEntry 10 } rsIpsecSaIpcompInEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { rsIpsecSaIpcompInEntry 11 } rsIpsecSaIpcompInDecompAlg OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the decompression algorithm applied to traffic." ::= { rsIpsecSaIpcompInEntry 12 } rsIpsecSaIpcompInSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds that the SA has existed." ::= { rsIpsecSaIpcompInEntry 13 } rsIpsecSaIpcompInUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA." ::= { rsIpsecSaIpcompInEntry 14 } rsIpsecSaIpcompInPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { rsIpsecSaIpcompInEntry 15 } rsIpsecSaIpcompInDecompErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to decompression errors." ::= { rsIpsecSaIpcompInEntry 16 } rsIpsecSaIpcompInOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to errors other than decompression errors. This may include packets dropped due to a lack of receive buffers, and packets dropped due to congestion at the decompression element." ::= { rsIpsecSaIpcompInEntry 17 } -- the IPSec Outbound ESP MIB-Group -- -- a collection of objects providing information about -- IPSec Outbound ESP SAs rsIpsecSaEspOutTable OBJECT-TYPE SYNTAX SEQUENCE OF RSIpsecSaEspOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec Outbound ESP SAs. There should be one row for every outbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { rsSaTables 4 } rsIpsecSaEspOutEntry OBJECT-TYPE SYNTAX RSIpsecSaEspOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec Outbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ rsIpsecSaEspOutAddress, rsIpsecSaEspOutSpi } ::= { rsIpsecSaEspOutTable 1 } RSIpsecSaEspOutEntry ::= SEQUENCE { rsIpsecSaEspOutAddress IpAddress, rsIpsecSaEspOutSpi Integer32, rsIpsecSaEspOutSourceId OCTET STRING, rsIpsecSaEspOutSourceIdType IpsecDoiIdentType, rsIpsecSaEspOutDestId OCTET STRING, rsIpsecSaEspOutDestIdType IpsecDoiIdentType, rsIpsecSaEspOutProtocol Integer32, rsIpsecSaEspOutSourcePort Integer32, rsIpsecSaEspOutDestPort Integer32, rsIpsecSaEspOutCreator IpsecSaCreatorIdent, rsIpsecSaEspOutEncapsulation IpsecDoiEncapsulationMode, rsIpsecSaEspOutEncAlg IpsecDoiEspTransform, rsIpsecSaEspOutEncKeyLength Integer32, rsIpsecSaEspOutAuthAlg IpsecDoiAuthAlgorithm, rsIpsecSaEspOutLimitSeconds Integer32, rsIpsecSaEspOutLimitKbytes Integer32, rsIpsecSaEspOutAccSeconds Counter32, rsIpsecSaEspOutAccKbytes Counter32, rsIpsecSaEspOutUserOctets Counter32, rsIpsecSaEspOutPackets Counter32, rsIpsecSaEspOutSendErrors Counter32 } rsIpsecSaEspOutAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { rsIpsecSaEspOutEntry 1 } rsIpsecSaEspOutSpi OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE "RFC 2406 Section 2.1" ::= { rsIpsecSaEspOutEntry 2 } rsIpsecSaEspOutSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { rsIpsecSaEspOutEntry 3 } rsIpsecSaEspOutSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaEspOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaEspOutEntry 4 } rsIpsecSaEspOutDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { rsIpsecSaEspOutEntry 5 } rsIpsecSaEspOutDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaEspOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaEspOutEntry 6 } rsIpsecSaEspOutProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaEspOutEntry 7 } rsIpsecSaEspOutSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaEspOutEntry 8 } rsIpsecSaEspOutDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaEspOutEntry 9 } rsIpsecSaEspOutCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { rsIpsecSaEspOutEntry 10 } rsIpsecSaEspOutEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { rsIpsecSaEspOutEntry 11 } rsIpsecSaEspOutEncAlg OBJECT-TYPE SYNTAX IpsecDoiEspTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used." ::= { rsIpsecSaEspOutEntry 12 } rsIpsecSaEspOutEncKeyLength OBJECT-TYPE SYNTAX Integer32 (0..65531) UNITS "bits" MAX-ACCESS read-only STATUS current DESCRIPTION "The length of the encryption key in bits used for the algorithm specified in the 'rsIpsecSaEspOutEncAlg' object, or 0 if the key length is implicit in the specified algorithm or there is no encryption specified." ::= { rsIpsecSaEspOutEntry 13 } rsIpsecSaEspOutAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAuthAlgorithm MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used." ::= { rsIpsecSaEspOutEntry 14 } rsIpsecSaEspOutLimitSeconds OBJECT-TYPE SYNTAX Integer32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { rsIpsecSaEspOutEntry 15 } rsIpsecSaEspOutLimitKbytes OBJECT-TYPE SYNTAX Integer32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in kbytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { rsIpsecSaEspOutEntry 16 } rsIpsecSaEspOutAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { rsIpsecSaEspOutEntry 17 } rsIpsecSaEspOutAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic." ::= { rsIpsecSaEspOutEntry 18 } rsIpsecSaEspOutUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { rsIpsecSaEspOutEntry 19 } rsIpsecSaEspOutPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { rsIpsecSaEspOutEntry 20 } rsIpsecSaEspOutSendErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers." ::= { rsIpsecSaEspOutEntry 21 } -- the IPSec Outbound AH MIB-Group -- -- a collection of objects providing information about -- IPSec Outbound AH SAs rsIpsecSaAhOutTable OBJECT-TYPE SYNTAX SEQUENCE OF RSIpsecSaAhOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec Outbound AH SAs. There should be one row for every outbound AH security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { rsSaTables 5 } rsIpsecSaAhOutEntry OBJECT-TYPE SYNTAX RSIpsecSaAhOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec Outbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ rsIpsecSaAhOutAddress, rsIpsecSaAhOutSpi } ::= { rsIpsecSaAhOutTable 1 } RSIpsecSaAhOutEntry ::= SEQUENCE { rsIpsecSaAhOutAddress IpAddress, rsIpsecSaAhOutSpi Integer32, rsIpsecSaAhOutSourceId OCTET STRING, rsIpsecSaAhOutSourceIdType IpsecDoiIdentType, rsIpsecSaAhOutDestId OCTET STRING, rsIpsecSaAhOutDestIdType IpsecDoiIdentType, rsIpsecSaAhOutProtocol Integer32, rsIpsecSaAhOutSourcePort Integer32, rsIpsecSaAhOutDestPort Integer32, rsIpsecSaAhOutCreator IpsecSaCreatorIdent, rsIpsecSaAhOutEncapsulation IpsecDoiEncapsulationMode, rsIpsecSaAhOutAuthAlg IpsecDoiAhTransform, rsIpsecSaAhOutLimitSeconds Integer32, rsIpsecSaAhOutLimitKbytes Integer32, rsIpsecSaAhOutAccSeconds Counter32, rsIpsecSaAhOutAccKbytes Counter32, rsIpsecSaAhOutUserOctets Counter32, rsIpsecSaAhOutPackets Counter32, rsIpsecSaAhOutSendErrors Counter32 } rsIpsecSaAhOutAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { rsIpsecSaAhOutEntry 1 } rsIpsecSaAhOutSpi OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE "RFC 2402 Section 2.4" ::= { rsIpsecSaAhOutEntry 2 } rsIpsecSaAhOutSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { rsIpsecSaAhOutEntry 3 } rsIpsecSaAhOutSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaAhOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaAhOutEntry 4 } rsIpsecSaAhOutDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { rsIpsecSaAhOutEntry 5 } rsIpsecSaAhOutDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaAhOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { rsIpsecSaAhOutEntry 6 } rsIpsecSaAhOutProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaAhOutEntry 7 } rsIpsecSaAhOutSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaAhOutEntry 8 } rsIpsecSaAhOutDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaAhOutEntry 9 } rsIpsecSaAhOutCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { rsIpsecSaAhOutEntry 10 } rsIpsecSaAhOutEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { rsIpsecSaAhOutEntry 11 } rsIpsecSaAhOutAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAhTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used." ::= { rsIpsecSaAhOutEntry 12 } rsIpsecSaAhOutLimitSeconds OBJECT-TYPE SYNTAX Integer32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { rsIpsecSaAhOutEntry 13 } rsIpsecSaAhOutLimitKbytes OBJECT-TYPE SYNTAX Integer32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in Kbytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { rsIpsecSaAhOutEntry 14 } rsIpsecSaAhOutAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { rsIpsecSaAhOutEntry 15 } rsIpsecSaAhOutAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic." ::= { rsIpsecSaAhOutEntry 16 } rsIpsecSaAhOutUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { rsIpsecSaAhOutEntry 17 } rsIpsecSaAhOutPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { rsIpsecSaAhOutEntry 18 } rsIpsecSaAhOutSendErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers." ::= { rsIpsecSaAhOutEntry 19 } -- the IPSec Outbound IPCOMP MIB-Group -- -- a collection of objects providing information about -- IPSec Outbound IPCOMP SAs rsIpsecSaIpcompOutTable OBJECT-TYPE SYNTAX SEQUENCE OF RSIpsecSaIpcompOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec Outbound IPCOMP SAs. There should be one row for every outbound IPCOMP (security) association that exists in the entity. The maximum number of rows is implementation dependent." ::= { rsSaTables 6 } rsIpsecSaIpcompOutEntry OBJECT-TYPE SYNTAX RSIpsecSaIpcompOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec Outbound IPCOMP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ rsIpsecSaIpcompOutAddress, rsIpsecSaIpcompOutCpi } ::= { rsIpsecSaIpcompOutTable 1 } RSIpsecSaIpcompOutEntry ::= SEQUENCE { rsIpsecSaIpcompOutAddress IpAddress, rsIpsecSaIpcompOutCpi IpsecDoiIpcompTransform, rsIpsecSaIpcompOutSourceId OCTET STRING, rsIpsecSaIpcompOutSourceIdType IpsecDoiIdentType, rsIpsecSaIpcompOutDestId OCTET STRING, rsIpsecSaIpcompOutDestIdType IpsecDoiIdentType, rsIpsecSaIpcompOutProtocol Integer32, rsIpsecSaIpcompOutSourcePort Integer32, rsIpsecSaIpcompOutDestPort Integer32, rsIpsecSaIpcompOutCreator IpsecSaCreatorIdent, rsIpsecSaIpcompOutEncapsulation IpsecDoiEncapsulationMode, rsIpsecSaIpcompOutCompAlg IpsecDoiIpcompTransform, rsIpsecSaIpcompOutSeconds Counter32, rsIpsecSaIpcompOutUserOctets Counter32, rsIpsecSaIpcompOutPackets Counter32 } rsIpsecSaIpcompOutAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. If the IPCOMP SA is shared across multiple SAs in protection suites, this value may be 0. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { rsIpsecSaIpcompOutEntry 1 } rsIpsecSaIpcompOutCpi OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform." REFERENCE "RFC 2393 Section 3.3" ::= { rsIpsecSaIpcompOutEntry 2 } rsIpsecSaIpcompOutSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { rsIpsecSaIpcompOutEntry 3 } rsIpsecSaIpcompOutSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaIpcompOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites." ::= { rsIpsecSaIpcompOutEntry 4 } rsIpsecSaIpcompOutDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { rsIpsecSaIpcompOutEntry 5 } rsIpsecSaIpcompOutDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'rsIpsecSaIpcompOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites." ::= { rsIpsecSaIpcompOutEntry 6 } rsIpsecSaIpcompOutProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaIpcompOutEntry 7 } rsIpsecSaIpcompOutSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaIpcompOutEntry 8 } rsIpsecSaIpcompOutDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { rsIpsecSaIpcompOutEntry 9 } rsIpsecSaIpcompOutCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { rsIpsecSaIpcompOutEntry 10 } rsIpsecSaIpcompOutEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { rsIpsecSaIpcompOutEntry 11 } rsIpsecSaIpcompOutCompAlg OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the compression algorithm applied to traffic." ::= { rsIpsecSaIpcompOutEntry 12 } rsIpsecSaIpcompOutSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds that the SA has existed." ::= { rsIpsecSaIpcompOutEntry 13 } rsIpsecSaIpcompOutUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { rsIpsecSaIpcompOutEntry 14 } rsIpsecSaIpcompOutPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { rsIpsecSaIpcompOutEntry 15 } -- -- entity IPSec statistics -- rsIpsecEspCurrentInboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of inbound ESP SAs in the entity." ::= { rsSaStatistics 1 } rsIpsecEspTotalInboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound ESP SAs created in the entity since boot time." ::= { rsSaStatistics 2 } rsIpsecEspCurrentOutboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of outbound ESP SAs in the entity." ::= { rsSaStatistics 3 } rsIpsecEspTotalOutboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound ESP SAs created in the entity since boot time." ::= { rsSaStatistics 4 } rsIpsecAhCurrentInboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of inbound AH SAs in the entity." ::= { rsSaStatistics 5 } rsIpsecAhTotalInboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound AH SAs created in the entity since boot time." ::= { rsSaStatistics 6 } rsIpsecAhCurrentOutboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of outbound AH SAs in the entity." ::= { rsSaStatistics 7 } rsIpsecAhTotalOutboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound AH SAs created in the entity since boot time." ::= { rsSaStatistics 8 } rsIpsecIpcompCurrentInboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of inbound IPCOMP SAs in the entity." ::= { rsSaStatistics 9 } rsIpsecIpcompTotalInboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound IPCOMP SAs created in the entity since boot time." ::= { rsSaStatistics 10 } rsIpsecIpcompCurrentOutboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of outbound IPCOMP SAs in the entity." ::= { rsSaStatistics 11 } rsIpsecIpcompTotalOutboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound IPCOMP SAs created in the entity since boot time." ::= { rsSaStatistics 12 } -- -- IPSec error counts -- rsIpsecDecryptionErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time with decryption errors." ::= { rsSaErrors 1 } rsIpsecAuthenticationErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time with authentication errors. This includes all packets in which the hash value is determined to be invalid, for both ESP and AH SAs." ::= { rsSaErrors 2 } rsIpsecReplayErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time with replay errors." ::= { rsSaErrors 3 } rsIpsecPolicyErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time and discarded due to policy errors. This includes packets that had selectors that were invalid for the SA that carried them." ::= { rsSaErrors 4 } rsIpsecOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time and discarded due to errors not due to decryption, authentication, replay or policy." ::= { rsSaErrors 5 } rsIpsecSendErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets to be sent by the entity in SAs since boot time and discarded due to errors." ::= { rsSaErrors 6 } rsIpsecUnknownSpiErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity since boot time with SPIs or CPIs that were not valid." ::= { rsSaErrors 7 } -- -- traps -- -- -- some objects used in trap reporting -- -- NOTE: A MAX-ACCESS value of 'accessible-for-notify' was wanted -- for these objects; this would not compile with smicng 2.2.07 -- rsIpsecSecurityProtocol OBJECT-TYPE SYNTAX IpsecDoiSecProtocolId MAX-ACCESS read-only STATUS current DESCRIPTION "A security protocol associated with the trap." ::= { rsSaTrapObjects 1 } rsIpsecSPI OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "An SPI associated with a trap. Where the security protocol associated with the trap is IPCOMP, this value has a maximum of 65535." ::= { rsSaTrapObjects 2 } rsIpsecLocalAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "A local IP address associated with the trap." ::= { rsSaTrapObjects 3 } rsIpsecPeerAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "A peer IP address associated with the trap." ::= { rsSaTrapObjects 4 } -- -- trap control -- rsEspAuthFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether espAuthFailureTrap traps should be generated." DEFVAL { false } ::= { rsSaTrapControl 1 } rsAhAuthFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether ahAuthFailureTrap traps should be generated." DEFVAL { false } ::= { rsSaTrapControl 2 } rsEspReplayFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether espReplayFailureTrap traps should be generated." DEFVAL { false } ::= { rsSaTrapControl 3 } rsAhReplayFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether ahReplayFailureTrap traps should be generated." DEFVAL { false } ::= { rsSaTrapControl 4 } rsEspPolicyFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether espPolicyFailureTrap traps should be generated." DEFVAL { false } ::= { rsSaTrapControl 5 } rsAhPolicyFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether ahPolicyFailureTrap traps should be generated." DEFVAL { false } ::= { rsSaTrapControl 6 } rsInvalidSpiTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether invalidSpiTrap traps should be generated." DEFVAL { false } ::= { rsSaTrapControl 7 } -- -- the traps themselves -- rsEspAuthFailureTrap NOTIFICATION-TYPE OBJECTS { rsIpsecSaEspInAuthErrors } STATUS current DESCRIPTION "IPSec packets with invalid hashes were found in an inbound ESP SA. The total number of authentication errors accumulated is sent for the specific row of the 'rsIpsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { rsSaTraps 0 1 } rsAhAuthFailureTrap NOTIFICATION-TYPE OBJECTS { rsIpsecSaAhInAuthErrors } STATUS current DESCRIPTION "IPSec packets with invalid hashes were found in an inbound AH SA. The total number of authentication errors accumulated is sent for the specific row of the 'rsIpsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { rsSaTraps 0 2 } rsEspReplayFailureTrap NOTIFICATION-TYPE OBJECTS { rsIpsecSaEspInReplayErrors } STATUS current DESCRIPTION "IPSec packets with invalid sequence numbers were found in an inbound ESP SA. The total number of replay errors accumulated is sent for the specific row of the 'rsIpsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { rsSaTraps 0 3 } rsAhReplayFailureTrap NOTIFICATION-TYPE OBJECTS { rsIpsecSaAhInReplayErrors } STATUS current DESCRIPTION "IPSec packets with invalid sequence numbers were found in the specified AH SA. The total number of replay errors accumulated is sent for the specific row of the 'rsIpsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { rsSaTraps 0 4 } rsEspPolicyFailureTrap NOTIFICATION-TYPE OBJECTS { rsIpsecSaEspInPolicyErrors } STATUS current DESCRIPTION "IPSec packets carrying packets with invalid selectors for the specified ESP SA were found. The total number of policy errors accumulated is sent for the specific row of the 'rsIpsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { rsSaTraps 0 5 } rsAhPolicyFailureTrap NOTIFICATION-TYPE OBJECTS { rsIpsecSaAhInPolicyErrors } STATUS current DESCRIPTION "IPSec packets carrying packets with invalid selectors for the specified AH SA were found. The total number of policy errors accumulated is sent for the specific row of the 'rsIpsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { rsSaTraps 0 6 } rsInvalidSpiTrap NOTIFICATION-TYPE OBJECTS { rsIpsecLocalAddress, rsIpsecSecurityProtocol, rsIpsecPeerAddress, rsIpsecSPI, ifIndex } STATUS current DESCRIPTION "A packet with an unknown SPI was detected from the specified peer with the specified SPI using the specified protocol. The destination address of the received packet is specified by 'ipsecLocalAddress'. The value 'ifIndex' may be 0 if this optional linkage is unsupported. If the object 'ipsecSecurityProtocol' has the value for IPCOMP, then the 'ipsecSPI' object is the CPI of the packet. Implementations SHOULD send one trap per peer (within a reasonable time period), rather than sending one trap per packet." ::= { rsSaTraps 0 7 } END