path: root/MIBS/junos/JNX-GDOI-MIB

-- *******************************************************************
-- Juniper Networks GVPN object mibs
--
-- Copyright (c) 2001-2018, Juniper Networks, Inc.
-- All rights reserved.
--
-- The contents of this document are subject to change without notice.
-- *******************************************************************
JNX-GDOI-MIB DEFINITIONS ::= BEGIN

    IMPORTS
        MODULE-IDENTITY, OBJECT-TYPE, Counter32, Counter64, Integer32, Unsigned32
           FROM SNMPv2-SMI
        InetAddress, InetAddressType
           FROM INET-ADDRESS-MIB
        TEXTUAL-CONVENTION, DisplayString, TimeInterval
           FROM SNMPv2-TC
        jnxMibs
           FROM JUNIPER-SMI;

-- ------------------------------------------------------------------ --
-- GDOI MIB Module Identity
-- ------------------------------------------------------------------ --
jnxGdoiMIB MODULE-IDENTITY
    LAST-UPDATED "201801040000Z"
    ORGANIZATION "Juniper Networks, Inc."
    CONTACT-INFO
        "Juniper Technical Assistance Center
            Juniper Networks, Inc.
            1133 Innovation Way,
            Sunnyvale, CA 94089
            E-mail: support@juniper.net"
    DESCRIPTION
        "Initial version, implements only the GDOI GM notifications and
            following tables for GDOI protocol.
            - GDOI Group Table
            - GDOI Gm Table
            - GDOI Gm Kek Table
            - GDOI Gm Tek SelectorTable
            - GDOI Gm Tek PolicyTable
        "
    ::=  { jnxMibs 759}

-- ------------------------------------------------------------------ --
-- GDOI MIB Textual Conventions
-- ------------------------------------------------------------------ --

JnxGdoiIdentificationType ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the type of value used to
        identify a GDOI entity (i.e. Group, Key Server, or Group
        Member).

        Following are the Identification Type Values:

          ID Type              Value
          -------              -----
          RESERVED               0  -- Not Used
          ID_IPV4_ADDR           1  -- ipv4Address
          ID_FQDN                2  -- domainName

          ID_RFC822_ADDR         3  -- userName
          (ID_USER_FQDN)

          ID_IPV4_ADDR_SUBNET    4  -- ipv4Subnet - Not in RFC 4306
          ID_IPV6_ADDR           5  -- ipv6Address
          ID_IPV6_ADDR_SUBNET    6  -- ipv6Subnet - Not in RFC 4306
          ID_IPV4_ADDR_RANGE     7  -- ipv4Range  - Not in RFC 4306
          ID_IPV6_ADDR_RANGE     8  -- ipv6Range  - Not in RFC 4306
          ID_DER_ASN1_DN         9  -- caDistinguishedName
          ID_DER_ASN1_GN         10 -- caGeneralName
          ID_KEY_ID              11 -- groupNumber

        Following are the mappings to the type values above:

          'ipv4Address' : a single four (4) octet IPv4 address.

          'domainName'  : a fully-qualified domain name string.  An
               example is, 'example.com'.  The string MUST not
               contain any terminators (e.g., NULL, CR, etc.).

          'userName'    : a fully-qualified RFC 822 username or email
               address string. An example is, 'jsmith@example.com'.
               The string MUST not contain any terminators.

          'ipv4Subnet'  : a range of IPv4 addresses, represented by
               two four (4) octet values concatenated together.  The
               first value is an IPv4 address.  The second is an
               IPv4 network mask.  Note that ones (1s) in the network
               mask indicate that the corresponding bit in the address
               is fixed, while zeros (0s) indicate a 'wildcard' bit.

          'ipv6Address' : a single sixteen (16) octet IPv6 address.

          'ipv6Subnet'  : a range of IPv6 addresses, represented by
               two sixteen (16) octet values concatenated together.
               The first value is an IPv6 address.  The second is an
               IPv network mask.  Note that ones (1s) in the network
               mask indicate that the corresponding bit in the address
               is fixed, while zeros (0s) indicate a 'wildcard' bit.

          'ipv4Range'   : a range of IPv4 addresses, represented by
               two four (4) octet values.  The first value is the
               beginning IPv4 address (inclusive) and the second
               value is the ending IPv4 address (inclusive).  All
               addresses falling between the two specified addresses
               are considered to be within the list.

          'ipv6Range'   : a range of IPv6 addresses, represented by
               two sixteen (16) octet values.  The first value is the
               beginning IPv6 address (inclusive) and the second
               value is the ending IPv6 address (inclusive).  All
               addresses falling between the two specified addresses
               are considered to be within the list.

          'caDistinguishedName' : the binary DER encoding of an ASN.1
               X.500 Distinguished Name [X.501].

          'caGeneralName' : the binary DER encoding of an ASN.1
               X.500 GeneralName [X.509].

          'groupNumber' : a four (4) octet group identifier."

    REFERENCE
        "IANA ISAKMP Registry - 'Magic Numbers' for ISAKMP Protocol
         Section: IPSEC Identification Type
         http://www.iana.org/assignments/isakmp-registry

         RFC 4306 - Section: 3.5. Identification Payloads"
    SYNTAX          INTEGER  {
                        ipv4Address(1),
                        domainName(2),
                        userName(3),
                        ipv4Subnet(4),
                        ipv6Address(5),
                        ipv6Subnet(6),
                        ipv4Range(7),
                        ipv6Range(8),
                        caDistinguishedName(9),
                        caGeneralName(10),
                        groupNumber(11)
                    }

JnxGdoiIdentificationValue ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "255d"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the actual value of used to
        identify a GDOI entity (i.e. Group, Key Server, or Group
        Member).  The value of the JnxGdoiIdentificationValue object can
        be parsed based on the value of the associated
        JnxGdoiIdentificationType object.

        The following JnxGdoiIdentificationType values indicate that the
         JnxGdoiIdentificationValue object should be parsed as a binary
        string of octets with the given lengths if a length is not
        associated with the object:

          ipv4Address(1)   -- 4 octets
          ipv4Subnet(4)    -- 8 octets
          ipv6Address(5)   -- 16 octets
          ipv6Subnet(6)    -- 32 octets
          ipv4Range(7)     -- 8 octets
          ipv6Range(8)     -- 32 octets
          groupNumber(11)  -- 4 octets

        The following  JnxGdoiIdentificationType values indicate that
        the JnxGdoiIdentificationValue object should be parsed as an
        ASCII string of characters. Note that a length MUST be
        associated with the object in these cases:

          domainName(2)
          userName(3)
          caDistinguishedName(9)
          caGeneralName(10)

        Note that the length of 48 octets was chosen because the
        gdoiKsKekEntry, gdoiGmKekEntry, gdoiKsTekEntry, &
        gdoiGmTekEntry will exceed the OID size limit of 255 octets
        if this size is any larger than 48 octets."

    REFERENCE
        "IANA ISAKMP Registry - 'Magic Numbers' for ISAKMP Protocol
         Section: IPSEC Identification Type
         http://www.iana.org/assignments/isakmp-registry

         RFC 4306 - Section: 3.5. Identification Payloads"
    SYNTAX          OCTET STRING (SIZE (0..48))

JnxGdoiKekSPI ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "16x"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating a SPI (Security Parameter
        Index) of sixteen (16) octets for a KEK.  The SPI must be the
        ISAKMP Header cookie pair where the first 8 octets become the
        'Initiator Cookie' field of the GROUPKEY-PUSH message ISAKMP
        HDR, and the second 8 octets become the 'Responder Cookie' in
        the same HDR.  These cookies are assigned by the Key Server."

    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK Payload"
    SYNTAX          OCTET STRING (SIZE (16))

JnxGdoiIpProtocolId ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the IP
        Protocol being used for the rekey datagram.  Some possible
        values are:

          ID Value  ID Type
          --------  -------
             06       TCP    -- ipProtocolTCP
             17       UDP    -- ipProtocolUDP"

    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK Payload"
    SYNTAX          INTEGER  {
                        ipProtocolUnknown(0),
                        ipProtocolTCP(1),
                        ipProtocolUDP(2)
                    }

JnxGdoiKeyManagementAlgorithm ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the key/KEK
        management algorithm being used to provide forward or
        backward access control (i.e. used to exclude group
        members).

        Following are the possible KEK management algorithm values &
        JnxGdoiKeyManagementAlgorithm mappings:

          KEK Management Type  Value
          -------------------  -----
           LKH                   1  -- keyMgmtLkh"

    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK Payload"
    SYNTAX          INTEGER  {
                        keyMgmtNone(0),
                        keyMgmtLkh(1)
                    }

JnxGdoiEncryptionAlgorithm ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        encryption algorithm being used.

        Following are the possible updated encryption algorithm
        values & JnxGdoiEncryptionAlgorithm mappings after RFC 4306:

          Encryption Algorithm Type          Value
          ---------------------------------  -----
           ENCR_DES_IV64                       1  -- encrAlgDes64
           ENCR_DES                            2  -- encrAlgDes
           ENCR_3DES                           3  -- encrAlg3Des
           ENCR_RC5                            4  -- encrAlgRc5
           ENCR_IDEA                           5  -- encrAlgIdea
           ENCR_CAST                           6  -- encrAlgCast
           ENCR_BLOWFISH                       7  -- encrAlgBlowfish
           ENCR_3IDEA                          8  -- encrAlg3Idea
           ENCR_DES_IV32                       9  -- encrAlgDes32
           ENCR_NULL                           11 -- encrAlgNull
           ENCR_AES_CBC                        12 -- encrAlgAesCbc
           ENCR_AES_CTR                        13 -- encrAlgAesCtr
           ENCR_AES-CCM_8                      14 -- encrAlgAesCcm8
           ENCR_AES-CCM_12                     15 -- encrAlgAesCcm12
           ENCR_AES-CCM_16                     16 -- encrAlgAesCcm16
           AES-GCM (8-octet ICV)               18 -- encrAlgAesGcm8
           AES-GCM (12-octet ICV)              19 -- encrAlgAesGcm12
           AES-GCM (16-octet ICV)              20 -- encrAlgAesGcm16
           ENCR_NULL_AUTH_AES_GMAC             21
               -- encrAlgNullAuthAesGmac
           ENCR_CAMELLIA_CBC                   23
               -- encrAlgCamelliaCbc
           ENCR_CAMELLIA_CTR                   24
               -- encrAlgCamelliaCtr
           ENCR_CAMELLIA_CCM (8-octet ICV)     25
               -- encrAlgCamelliaCcm8
           ENCR_CAMELLIA_CCM (12-octet ICV)    26
               -- encrAlgCamelliaCcm12
           ENCR_CAMELLIA_CCM (16-octet ICV)    27
               -- encrAlgCamelliaCcm16

        Following are the possible ESP transform identifiers &
        JnxGdoiEncryptionAlgorithm mappings from RFC 2407:

          IPsec ESP Transform ID    Value
          ------------------------  -----
           ESP_DES_IV64               1  -- encrAlgDes64
           ESP_DES                    2  -- encrAlgDes
           ESP_3DES                   3  -- encrAlg3Des
           ESP_RC5                    4  -- encrAlgRc5
           ESP_IDEA                   5  -- encrAlgIdea
           ESP_CAST                   6  -- encrAlgCast
           ESP_BLOWFISH               7  -- encrAlgBlowfish
           ESP_3IDEA                  8  -- encrAlg3Idea
           ESP_DES_IV32               9  -- encrAlgDes32
           ESP_RC4                    10 -- encrAlgRc4
           ESP_NULL                   11 -- encrAlgNull
           ESP_AES-CBC                12 -- encrAlgAesCbc
           ESP_AES-CTR                13 -- encrAlgAesCtr
           ESP_AES-CCM_8              14 -- encrAlgAesCcm8
           ESP_AES-CCM_12             15 -- encrAlgAesCcm12
           ESP_AES-CCM_16             16 -- encrAlgAesCcm16
           ESP_AES-GCM_8              18 -- encrAlgAesGcm8
           ESP_AES-GCM_12             19 -- encrAlgAesGcm12
           ESP_AES-GCM_16             20 -- encrAlgAesGcm16
           ESP_SEED_CBC               21 -- encrAlgSeedCbc
           ESP_CAMELLIA               22
               -- encrAlgCamelliaCbc, Ctr, Ccm8, Ccm12, Ccm16
           ESP_NULL_AUTH_AES-GMAC     23
               -- encrAlgNullAuthAesGmac

        Following are the possible KEK_ALGORITHM values specifying
        the encryption algorithm used with a KEK &
        JnxGdoiEncryptionAlgorithm mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           KEK_ALG_DES      1  -- encrAlgDes
           KEK_ALG_3DES     2  -- encrAlg3Des
           KEK_ALG_AES      3  -- encrAlgAesCbc"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Encryption Algorithm Transform IDs
         http://www.iana.org/assignments/ikev2-parameters

         IANA 'Magic Numbers' for ISAMP Protocol
         Section: IPSEC ESP Transform Identifiers
         http://www.iana.org/assignments/isakmp-registry

         RFC 2407 - Section: 4.4.4. IPSEC ESP Transform Identifiers
         RFC 3547 - Section: 5.3.3. KEK_ALGORITHM
         RFC 4306 - Section: 3.3.2. Transform Substructure
         RFC 4106, 4309, 4543, 5282, 5529"
    SYNTAX          INTEGER  {
                        encrAlgNone(0),
                        encrAlgDes64(1),
                        encrAlgDes(2),
                        encrAlg3Des(3),
                        encrAlgRc5(4),
                        encrAlgIdea(5),
                        encrAlgCast(6),
                        encrAlgBlowfish(7),
                        encrAlg3Idea(8),
                        encrAlgDes32(9),
                        encrAlgRc4(10),
                        encrAlgNull(11),
                        encrAlgAesCbc(12),
                        encrAlgAesCtr(13),
                        encrAlgAesCcm8(14),
                        encrAlgAesCcm12(15),
                        encrAlgAesCcm16(16),
                        encrAlgAesGcm8(18),
                        encrAlgAesGcm12(19),
                        encrAlgAesGcm16(20),
                        encrAlgNullAuthAesGmac(21),
                        encrAlgCamelliaCbc(23),
                        encrAlgCamelliaCtr(24),
                        encrAlgCamelliaCcm8(25),
                        encrAlgCamelliaCcm12(26),
                        encrAlgCamelliaCcm1(27),
                        encrAlgSeedCbc(28)
                    }

JnxGdoiPseudoRandomFunction ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        pseudo-random function (PRF) being used.

        Following are the possible updated PRF values &
        JnxGdoiPseudoRandomFunction mappings after RFC 4306:

          Pseudo-Random Function Type        Value
          ---------------------------------  -----
           PRF_HMAC_MD5                        1  -- prfMd5Hmac
           PRF_HMAC_SHA1                       2  -- prfSha1Hmac
           PRF_HMAC_TIGER                      3  -- prfTigerHmac
           PRF_AES128_XCBC                     4  -- prfAes128Xcbc
           PRF_HMAC_SHA2_256                   5  -- prfSha2Hmac256
           PRF_HMAC_SHA2_384                   6  -- prfSha2Hmac384
           PRF_HMAC_SHA2_512                   7  -- prfSha2Hmac512
           PRF_AES128_CMAC                     8  -- prfAes128Cmac

        Following are the possible SIG_HASH_ALGORITHM values &
        JnxGdoiPseudoRandomFunction mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           SIG_HASH_MD5     1  -- prfMd5Hmac
           SIG_HASH_SHA1    2  -- prfSha1Hmac"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Pseudo-random Function Transform IDs
         http://www.iana.org/assignments/ikev2-parameters

         RFC 3547 - Section: 5.3.6. SIG_HASH_ALGORITHM
         RFC 4306 - Section: 3.3.2. Transform Substructure
         RFC 4615, 4868"
    SYNTAX          INTEGER  {
                        prfNone(0),
                        prfMd5Hmac(1),
                        prfSha1Hmac(2),
                        prfTigerHmac(3),
                        prfAes128Xcbc(4),
                        prfSha2Hmac256(5),
                        prfSha2Hmac384(6),
                        prfSha2Hmac512(7),
                        prfAes128Cmac(8)
                    }

JnxGdoiIntegrityAlgorithm ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        integirty algorithm being used.

        Following are the possible updated integrity algorithm
        values & JnxGdoiIntegrityAlgorithm mappings after RFC 4306:

          Integrity Algorithm Type  Value
          ------------------------  -----
           AUTH_HMAC_MD5_96           1  -- authAlgMd5Hmac96
           AUTH_HMAC_SHA1_96          2  -- authAlgSha1Hmac96
           AUTH_DES_MAC               3  -- authAlgDesMac
           AUTH_KPDK_MD5              4  -- authAlgMd5Kpdk
           AUTH_AES_XCBC_96           5  -- authAlgAesXcbc96
           AUTH_HMAC_MD5_128          6  -- authAlgMd5Hmac128
           AUTH_HMAC_SHA1_160         7  -- authAlgSha1Hmac160
           AUTH_AES_CMAC_96           8  -- authAlgAesCmac96
           AUTH_AES_128_GMAC          9  -- authAlgAes128Gmac
           AUTH_AES_192_GMAC          10 -- authAlgAes192Gmac
           AUTH_AES_256_GMAC          11 -- authAlgAes256Gmac
           AUTH_HMAC_SHA2_256_128     12 -- authAlgSha2Hmac256to128
           AUTH_HMAC_SHA2_384_192     13 -- authAlgSha2Hmac384to192
           AUTH_HMAC_SHA2_512_256     14 -- authAlgSha2Hmac512to256

        Following are the possible legacy authentication algorithm
        values & JnxGdoIntegrityAlgorithm mappings from RFC 2407:

          Algorithm Type  Value
          --------------  -----
           HMAC-MD5         1  -- authAlgMd5Hmac96
           HMAC-SHA         2  -- authAlgSha1Hmac96
           DES-MAC          3  -- authAlgDesMac
           KPDK             4  -- authAlgMd5Kpdk"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Integrity Algorithm Transform IDs
         http://www.iana.org/assignments/ikev2-parameters

         RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.3.6. SIG_HASH_ALGORITHM
         RFC 4306 - Section: 3.3.2. Transform Substructure
         RFC 4494, 4543, 4595, 4868"
    SYNTAX          INTEGER  {
                        authAlgNone(0),
                        authAlgMd5Hmac96(1),
                        authAlgSha1Hmac96(2),
                        authAlgDesMac(3),
                        authAlgMd5Kpdk(4),
                        authAlgAesXcbc96(5),
                        authAlgMd5Hmac128(6),
                        authAlgSha1Hmac160(7),
                        authAlgAesCmac96(8),
                        authAlgAes128Gmac(9),
                        authAlgAes192Gmac(10),
                        authAlgAes256Gmac(11),
                        authAlgSha2Hmac256to128(12),
                        authAlgSha2Hmac384to192(13),
                        authAlgSha2Hmac512to256(14)
                    }

JnxGdoiSignatureMethod ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        integirty algorithm being used.

        Following are the possible updated authentication method
        values & JnxGdoiSignatureMethod mappings after RFC 4306:

          Authentication Method                Value
          -----------------------------------  -----
           RSA Digital Signature                 1  -- sigRsa
           Shared Key Message Integrity Code     2  -- sigSharedKey
           DSS Digital Signature                 3  -- sigDss
           ECDSA w/ SHA-256 (P-256 curve)        9  -- sigEcdsa256
           ECDSA w/ SHA-384 (P-384 curve)        10 -- sigEcdsa384
           ECDSA w/ SHA-512 (P-521 curve)        11 -- sigEcdsa512

        Following are the possible legacy IPsec authentication method
        values & JnxGdoiSignatureMethod mappings from RFC 2409:

          Authentication Method             Value
          --------------------------------  -----
           Pre-Shared Key                     1  -- sigSharedKey
           DSS Signature                      2  -- sigDss
           RSA Signature                      3  -- sigRsa
           Encryption w/ RSA                  4  -- sigEncryptRsa
           Revised Encryption w/ RSA          5  -- sigRevEncryptRsa
           ECDSA w/ SHA-256 (P-256 curve)     9  -- sigEcdsa256
           ECDSA w/ SHA-384 (P-384 curve)     10 -- sigEcdsa384
           ECDSA w/ SHA-512 (P-521 curve)     11 -- sigEcdsa512

        Following are the possible POP algorithm values &
        JnxGdoiSignatureMethod mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           POP_ALG_RSA      1  -- sigRsa
           POP_ALG_DSS      2  -- sigDss
           POP_ALG_ECDSS    3  -- sigEcdsa256, 384, 512

        Following are the possible SIG_ALGORITHM values &
        JnxGdoiSignatureMethod mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           SIG_ALG_RSA      1  -- sigRsa
           SIG_ALG_DSS      2  -- sigDss
           SIG_ALG_ECDSS    3  -- sigEcdsa256, 384, 512"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Integrity Algorithm Transform IDs
         http://www.iana.org/assignments/ikev2-parameters

         RFC 2409 - Section:  Appendix A. Authentication Method
         RFC 3547 - Sections: 5.3.SA KEK payload
              5.3.7.      SIG_ALGORITHM
         RFC 4306 - Section:  3.8.Authentication Payload
         RFC 4754"
    SYNTAX          INTEGER  {
                        sigNone(0),
                        sigRsa(1),
                        sigSharedKey(2),
                        sigDss(3),
                        sigEncryptRsa(4),
                        sigRevEncryptRsa(5),
                        sigEcdsa256(9),
                        sigEcdsa384(10),
                        sigEcdsa512(11)
                    }

JnxGdoiDiffieHellmanGroup ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        Diffie-Hellman Group being used.

        Following are the possible updated Diffie-Hellman Group
        values & JnxGdoiDiffieHellmanGroup mappings after RFC 4306:

          Diffie-Hellman Group Type  Value
          -------------------------  -----
           NONE                        0  -- dhNone
           Group 1 - 768 Bit MODP      1  -- dhGroup1
           Group 2 - 1024 Bit MODP     2  -- dhGroup2
           1536-bit MODP Group         5  -- dh1536Modp
           2048-bit MODP Group         14 -- dh2048Modp
           3072-bit MODP Group         15 -- dh3072Modp
           4096-bit MODP Group         16 -- dh4096Modp
           6144-bit MODP Group         17 -- dh6144Modp
           8192-bit MODP Group         18 -- dh8192Modp
           256-bit random ECP group    19 -- dhEcp256
           84-bit random ECP group     20 -- dhEcp84
           521-bit random ECP group    21 -- dhEcp521
           1024-bit MODP w/ 160-bit    22 -- dh1024Modp160
             Prime Order Subgroup
           2048-bit MODP w/ 224-bit    23 -- dh2048Modp224
             Prime Order Subgroup
           2048-bit MODP w/ 256-bit    24 -- dh2048Modp256
             Prime Order Subgroup
           192-bit Random ECP Group    25 -- dhEcp192
           224-bit Random ECP Group    26 -- dhEcp224

        Following are the possible legacy Diffie-Hellman Group
        values & JnxGdoiDiffieHellmanGroup mappings from RFC 2409:

          Diffie-Hellman Group Type  Value
          -------------------------  -----
           Group 1 - 768 Bit MODP      1  -- dhGroup1
           Group 2 - 1024 Bit MODP     2  -- dhGroup2
           EC2N group on GP[2^155]     3  -- dhEc2nGp155
           EC2N group on GP[2^185]     4  -- dhEc2nGp185"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Diffie-Hellman Group Transform IDs
         http://www.iana.org/assignments/ikev2-parameters

         RFC 2409 - Sections: 6.1. First Oakley Default Group
              6.2. Second Oakley Default Group
              6.3. Third Oakley Default Group
              6.4. Fourth Oakley Default Group"
    SYNTAX          INTEGER  {
                        dhNone(0),
                        dhGroup1(1),
                        dhGroup2(2),
                        dhEc2nGp155(3),
                        dhEc2nGp185(4),
                        dh1536Modp(5),
                        dh2048Modp(14),
                        dh3072Modp(15),
                        dh4096Modp(16),
                        dh6144Modp(17),
                        dh8192Modp(18),
                        dhEcp256(19),
                        dhEcp84(20),
                        dhEcp521(21),
                        dh1024Modp160(22),
                        dh2048Modp224(23),
                        dh2048Modp256(24),
                        dhEcp192(25),
                        dhEcp224(26)
                    }

JnxGdoiEncapsulationMode ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        Encapsulation Mode being used.

        Following are the possible Encapsulation Mode
        values & JnxGdoiEncapsulationMode mappings from RFC 2407:

          Encapsulation Mode            Value
          ----------------------------  -----
           Tunnel                         1  -- encapTunnel
           Transport                      2  -- encapTransport
           UDP-Encapsulated-Tunnel        3  -- encapUdpTunnel
           UDP-Encapsulated-Transport     4  -- encapUdpTransport"

    REFERENCE
        "IANA 'Magic Numbers' for ISAKMP Protocol
         Section: Encapsulation Mode
         http://www.iana.org/assignments/isakmp-registry

         RFC 2407 - Section: 4.5. IPSEC Security Assoc. Attributes
         RFC 3947"
    SYNTAX          INTEGER  {
                        encapUnknown(0),
                        encapTunnel(1),
                        encapTransport(2),
                        encapUdpTunnel(3),
                        encapUdpTransport(4)
                    }

JnxGdoiSecurityProtocol ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        Security Protocol being used.

        Following are the possible Security Protocol ID
        values & JnxGdoiSecurityProtocol mappings from the
        GDOI RFC 3547:

          Security Protocol ID    Value
          ----------------------  -----
           GDOI_PROTO_IPSEC_ESP     1  -- secProtocolIpsecEsp"

    REFERENCE       "RFC 3547 - Section: 5.4. SA TEK Payload"
    SYNTAX          INTEGER  {
                        secProtocolUnknown(0),
                        secProtocolIpsecEsp(1)
                    }

JnxGdoiTekSPI ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "4x"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating a SPI (Security Parameter
        Index) of four (4) octets for a TEK using ESP."

    REFERENCE       "RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    SYNTAX          OCTET STRING (SIZE (4))

JnxGdoiKekStatus ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the status of a GDOI KEK and
        its corresponding Security Association (SA).

        'inUse' : KEK currently being used to encrypt new KEK/TEKs
        'new'   : KEK currently being sent to all peers
        'old'   : KEK that has expired and is no longer being used"
    SYNTAX          INTEGER  {
                        inUse(1),
                        new(2),
                        old(3)
                    }

JnxGdoiTekStatus ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the status of a GDOI TEK and
        its corresponding Security Association (SA).

        'inbound'       : TEK is being used as inbound (receive) SA
        'outbound'      : TEK is being used as outbound (transmit) SA
        'biDirectional' : TEK is being used as both inbound and outbound SA"
    SYNTAX          INTEGER  {
                        inbound(1),
                        outbound(2),
                        biDirectional(3)
                    }

JnxGdoiUnsigned16 ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "2d"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating a 16-bit unsigned integer
        value."
    SYNTAX          OCTET STRING (SIZE (2))

JnxGdoiPolicyMismatchAction ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the default action
        for packets that does not match TEK policy/SA.

        'drop'   : Drop packets that do not match the TEK policy/SA.
        'forward': Forward the packets as received that do not match the TEK
                   policy/SA
        'unknown': The default action for TEK policy/SA mismatch is unknown."
    SYNTAX          INTEGER  {
                        drop(1),
                        forward(2),
                        unknown(3)
                    }

-- ------------------------------------------------------------------ --
-- GDOI MIB Groups
-- ------------------------------------------------------------------ --

jnxGdoiMIBNotifications  OBJECT IDENTIFIER
    ::= { jnxGdoiMIB 0 }

jnxGdoiMIBObjects  OBJECT IDENTIFIER
    ::= { jnxGdoiMIB 1 }

-- ------------------------------------------------------------------ --
-- GDOI MIB Notifications
-- ------------------------------------------------------------------ --
--
-- *---------------------------------------------------------------- --
-- * GDOI Group Member (GM) Notifications
-- *---------------------------------------------------------------- --

jnxGdoiGmRegister NOTIFICATION-TYPE
    OBJECTS         {
                        jnxGdoiGmRegKeyServerIdType,
                        jnxGdoiGmRegKeyServerIdValue
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it is starting to
        register with its GDOI Group's Key Server.  Registration
        includes downloading keying & security association material.
        This is equivalent to a Group Member or Initiator sending the
        first message of a GROUPKEY-PULL exchange to its Group's Key
        Server."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.3. Initiator Operations"
   ::= { jnxGdoiMIBNotifications 5 }

jnxGdoiGmRegistrationComplete NOTIFICATION-TYPE
    OBJECTS         {
                        jnxGdoiGmRegKeyServerIdType,
                        jnxGdoiGmRegKeyServerIdValue
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it has successfully
        registered with a Key Server in its GDOI Group.  This is
        equivalent to a Group Member receiving the last message of
        a GROUPKEY-PULL exchange from the Key Server containing
        KEKs, TEKs, and their associated policies."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.3. Initiator Operations"
   ::= { jnxGdoiMIBNotifications 6 }

jnxGdoiGmReRegister NOTIFICATION-TYPE
    OBJECTS         {
                        jnxGdoiGmRegKeyServerIdType,
                        jnxGdoiGmRegKeyServerIdValue
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it is starting to
        re-register with a Key Server in its GDOI Group.  A Group
        Member needs to re-register to the key server if its keying &
        security association material has expired and it has not
        received a rekey from the key server to refresh the material.
        This is equivalent to a Group Member sending the first
        message of a GROUPKEY-PULL exchange to the Key Server of a
        Group it is already registered with."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.3. Initiator Operations"
   ::= { jnxGdoiMIBNotifications 7 }

jnxGdoiGmRekeyReceived NOTIFICATION-TYPE
    OBJECTS         {
                        jnxGdoiGmRegKeyServerIdType,
                        jnxGdoiGmRegKeyServerIdValue,
                        jnxGdoiGmRekeysReceived
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it has successfully
        received and processed a rekey from a Key Server in its GDOI
        Group.  Periodically the key server sends a rekey to refresh
        the keying & security association material.  This is
        equivalent to a Group Member receiving a GROUPKEY-PUSH
        message from the Key Server of the Group it is already
        registered with."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              4.   GROUPKEY-PUSH Message
              4.8. Group Member Operations"
   ::= { jnxGdoiMIBNotifications 8 }

jnxGdoiGmRekeyFailure NOTIFICATION-TYPE
    OBJECTS         {
                        jnxGdoiGmRegKeyServerIdType,
                        jnxGdoiGmRegKeyServerIdValue,
                        jnxGdoiGmRekeysReceived
                    }
    STATUS          current
    DESCRIPTION
        "An error notification from a Group Member when it is unable
        to successfully process and install a rekey (GROUPKEY-PUSH
        message) sent by the Key Server in its Group that it is
        registered with."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              4.   GROUPKEY-PUSH Message
              4.8. Group Member Operations"
   ::= { jnxGdoiMIBNotifications 11 }


-- ------------------------------------------------------------------ --
-- GDOI MIB Management Objects
-- ------------------------------------------------------------------ --
--
-- *---------------------------------------------------------------- --
-- * The GDOI "Group" Table
-- *---------------------------------------------------------------- --

jnxGdoiGroupTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF JnxGdoiGroupEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Groups in use on
        the network device being queried.
        This table is modified to include only fields related to
        Group Member"
    ::= { jnxGdoiMIBObjects 1 }

jnxGdoiGroupEntry OBJECT-TYPE
    SYNTAX          JnxGdoiGroupEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing GDOI Group information, uniquely
        identified by the GDOI Group ID."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads"
    INDEX           {
                        jnxGdoiGroupIdType,
                        jnxGdoiGroupIdValue
                    }
    ::= { jnxGdoiGroupTable 1 }

JnxGdoiGroupEntry ::= SEQUENCE {
        jnxGdoiGroupIdType                   JnxGdoiIdentificationType,
        jnxGdoiGroupIdLength                 Unsigned32,
        jnxGdoiGroupIdValue                  JnxGdoiIdentificationValue,
        jnxGdoiGroupName                     DisplayString
}

jnxGdoiGroupIdType OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationType
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse a GDOI Group ID.
        The GDOI RFC 3547 defines the types that can be used as a
        GDOI Group ID, and RFC 4306 defines all valid types that can
        be used as an identifier.  This Group ID type is sent as the
        'ID Type' field of the Identification Payload for a GDOI
        GROUPKEY-PULL exchange."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads"
    ::= { jnxGdoiGroupEntry 1 }

jnxGdoiGroupIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of a Group ID.  If no
        length is given (i.e. it has a value of 0), the default
        length of its jnxGdoiGroupIdType should be used as long as it
        is not reprsented by an ASCII string.  If the value has a
        type that is represented by an ASCII string, a length MUST
        be included.  If the length given is not 0, it should match
        the 'Payload Length' (subtracting the generic header length)
        of the Identification Payload for a GDOI GROUPKEY-PULL
        exchange."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads"
    ::= { jnxGdoiGroupEntry 2 }

jnxGdoiGroupIdValue OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationValue
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The value of a Group ID with its type indicated by the
        jnxGdoiGroupIdType.  Use the jnxGdoiGroupIdType to parse the
        Group ID correctly.  This Group ID value is sent as the
        'Identification Data' field of the Identification Payload
        for a GDOI GROUPKEY-PULL exchange."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads"
    ::= { jnxGdoiGroupEntry 3 }

jnxGdoiGroupName OBJECT-TYPE
    SYNTAX          DisplayString
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The string-readable name configured for or given to a GDOI
        Group."
    ::= { jnxGdoiGroupEntry 4 }

-- *---------------------------------------------------------------- --
-- * GDOI MIB Management Object Groups
-- *---------------------------------------------------------------- --

jnxGdoiPeers  OBJECT IDENTIFIER
    ::= { jnxGdoiMIBObjects 2 }

jnxGdoiSecAssociations  OBJECT IDENTIFIER
    ::= { jnxGdoiMIBObjects 3 }

-- *---------------------------------------------------------------- --
-- * The GDOI "Peers" Group
-- *---------------------------------------------------------------- --

-- #-------------------------------------------------------------- --
-- # The GDOI "Group Members" Table
-- #-------------------------------------------------------------- --

jnxGdoiGmTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF JnxGdoiGmEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Group Members (GMs)
        locally configured on the network device being queried.  Note
        that Local Group Members may or may not be registered to a
        Key Server in its GDOI Group on the same network device being
        queried."
    ::= { jnxGdoiPeers 2 }

jnxGdoiGmEntry OBJECT-TYPE
    SYNTAX          JnxGdoiGmEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing Local GDOI Group Member information,
        uniquely identified by Group & GM IDs. Because the Group
        Member is Local to the network device being queried, TEKs
        installed for this Group Member can be queried as well."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.3. Initiator Operations
              4.8. Group Member Operations"
    INDEX           {
                        jnxGdoiGroupIdType,
                        jnxGdoiGroupIdValue,
                        jnxGdoiGmIdType,
                        jnxGdoiGmIdValue
                    }
    ::= { jnxGdoiGmTable 1 }

JnxGdoiGmEntry ::= SEQUENCE {
        jnxGdoiGmIdType               JnxGdoiIdentificationType,
        jnxGdoiGmIdLength             Unsigned32,
        jnxGdoiGmIdValue              JnxGdoiIdentificationValue,
        jnxGdoiGmRegKeyServerIdType   JnxGdoiIdentificationType,
        jnxGdoiGmRegKeyServerIdLength Unsigned32,
        jnxGdoiGmRegKeyServerIdValue  JnxGdoiIdentificationValue,
        jnxGdoiGmActiveKEK            JnxGdoiKekSPI,
        jnxGdoiGmRekeysReceived       Counter32,
        jnxGdoiGmActiveTEKNum         Counter32
}

jnxGdoiGmIdType OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationType
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for a Initiator or Group Member.  RFC 4306
        defines all valid types that can be used as an identifier.
        These identification types are sent as the 'SRC ID Type' and
        'DST ID Type' of the KEK and TEK payloads for GDOI
        GROUPKEY-PULL and GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads"
    ::= { jnxGdoiGmEntry 1 }

jnxGdoiGmIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of a Group Member ID.  If
        no length is given (i.e. it has a value of 0), the default
        length of its jnxGdoiGmIdType should be used as long as
        it is not reprsented by an ASCII string.  If the value has a
        type that is represented by an ASCII string, a length MUST
        be included.  If the length given is not 0, it should match
        the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in
        the KEK and TEK payloads for GDOI GROUPKEY-PULL and
        GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmEntry 2 }

jnxGdoiGmIdValue OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationValue
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The value of the identity information for a Group Member with
        its type indicated by the jnxGdoiGmIdType.  Use the
        jnxGdoiGmIdType to parse the Group Member ID correctly.
        This Group Member ID value is sent as the 'SRC
        Identification Data' and 'DST Identification Data' of the
        KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
        exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmEntry 3 }

jnxGdoiGmRegKeyServerIdType OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information of this Group Member's registered Key Server.
        RFC 4306 defines all valid types that can be used as an
        identifier.  These identification types are sent as the 'SRC
        ID Type' and 'DST ID Type' of the KEK and TEK payloads for
        GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads"
    ::= { jnxGdoiGmEntry 4 }

jnxGdoiGmRegKeyServerIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the registered Key
        Server's ID.  If no length is given (i.e. it has a value
        of 0), the default length of its jnxGdoiGmRegKeyServerIdType
        should be used as long as it is not reprsented by an ASCII
        string.  If the value has a type that is represented by an
        ASCII string, a length MUST be included.  If the length given
        is not 0, it should match the 'SRC ID Data Len' and 'DST ID
        Data Len' fields sent in the KEK and TEK payloads for GDOI
        GROUPKEY-PULL and GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmEntry 5 }

jnxGdoiGmRegKeyServerIdValue OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for this Group Member's
        registered Key Server with its type indicated by the
        jnxGdoiGmRegKeyServerIdType.  Use the
        jnxGdoiGmRegKeyServerIdType to parse the registered Key
        Server's ID correctly.  This Key Server ID value is sent as
        the 'SRC Identification Data' and 'DST Identification Data'
        of the KEK and TEK payloads for GDOI GROUPKEY-PULL and
        GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmEntry 6 }

jnxGdoiGmActiveKEK OBJECT-TYPE
    SYNTAX          JnxGdoiKekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The SPI of the Key Encryption Key (KEK) that is currently
        being used by the Group Member to authenticate & decrypt a
        rekey from a GROUPKEY-PUSH message."
    ::= { jnxGdoiGmEntry 7 }

jnxGdoiGmRekeysReceived OBJECT-TYPE
    SYNTAX          Counter32
    UNITS           "GROUPKEY-PUSH Messages"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The sequence number of the last rekey successfully received
        from this Group Member's registered Key Server."
    REFERENCE
        "RFC 3547 - Sections: 3.2. Messages
              3.3. Initiator Operations
              4.   GROUPKEY-PUSH Message
              4.8. Group Member Operations
              5.6. Sequence Number Payload"
    ::= { jnxGdoiGmEntry 8 }

jnxGdoiGmActiveTEKNum OBJECT-TYPE
    SYNTAX          Counter32
    UNITS           "Number of traffic encryption keys"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The number of active traffic encryption keys (TEKS) currently
        being used by the Group Member to encrypt/decrypt/authenticate
        dataplane traffic."
    ::= { jnxGdoiGmEntry 9 }


-- *---------------------------------------------------------------- --
-- * The GDOI "Security Associations (SA)" Group
-- *---------------------------------------------------------------- --
--
-- #-------------------------------------------------------------- --
-- # The GDOI "Group Member (GM) KEK SA" Table
-- #-------------------------------------------------------------- --

jnxGdoiGmKekTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF JnxGdoiGmKekEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Key Encryption Key
        (KEK) Security Associations (SAs) currently installed for
        GDOI entities acting as Group Members on the network device
        being queried.  There is one entry in this table for each
        KEK SA that has been installed and not yet deleted.  Each
        KEK SA is uniquely identified by a SPI at any given time."
    ::= { jnxGdoiSecAssociations 2 }

jnxGdoiGmKekEntry OBJECT-TYPE
    SYNTAX          JnxGdoiGmKekEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI KEK
        SA, uniquely identified by the Group ID, Group Member (GM)
        ID, & SPI value assigned by the GM's registered Key Server to
        the KEK.  There will be at least one KEK SA entry for each GM
        & two KEK SA entries for a given GM only during a KEK rekey
        when a new KEK is received & installed.  The KEK SPI is
        unique for every KEK for a given Group Member."
    REFERENCE
        "RFC 3547 - Sections: 1.     Introduction
          3.2.   Messages
          4.     GROUPKEY-PUSH Message
          5.3.   SA KEK Payload
          5.3.1. KEK Attributes
          5.5.   Key Download Payload"
    INDEX           {
                        jnxGdoiGroupIdType,
                        jnxGdoiGroupIdValue,
                        jnxGdoiGmIdType,
                        jnxGdoiGmIdValue,
                        jnxGdoiGmKekIndex
                    }
    ::= { jnxGdoiGmKekTable 1 }

JnxGdoiGmKekEntry ::= SEQUENCE {
        jnxGdoiGmKekIndex             Unsigned32,
        jnxGdoiGmKekSPI               JnxGdoiKekSPI,
        jnxGdoiGmKekSrcIdType         JnxGdoiIdentificationType,
        jnxGdoiGmKekSrcIdLength       Unsigned32,
        jnxGdoiGmKekSrcIdValue        JnxGdoiIdentificationValue,
        jnxGdoiGmKekSrcIdPort         JnxGdoiUnsigned16,
        jnxGdoiGmKekDstIdType         JnxGdoiIdentificationType,
        jnxGdoiGmKekDstIdLength       Unsigned32,
        jnxGdoiGmKekDstIdValue        JnxGdoiIdentificationValue,
        jnxGdoiGmKekDstIdPort         JnxGdoiUnsigned16,
        jnxGdoiGmKekIpProtocol        JnxGdoiIpProtocolId,
        jnxGdoiGmKekMgmtAlg           JnxGdoiKeyManagementAlgorithm,
        jnxGdoiGmKekEncryptAlg        JnxGdoiEncryptionAlgorithm,
        jnxGdoiGmKekEncryptKeyLength  Unsigned32,
        jnxGdoiGmKekSigHashAlg        JnxGdoiPseudoRandomFunction,
        jnxGdoiGmKekSigAlg            JnxGdoiSignatureMethod,
        jnxGdoiGmKekSigKeyLength      Unsigned32,
        jnxGdoiGmKekOakleyGroup       JnxGdoiDiffieHellmanGroup,
        jnxGdoiGmKekOriginalLifetime  Unsigned32,
        jnxGdoiGmKekRemainingLifetime Unsigned32,
        jnxGdoiGmKekStatus            JnxGdoiKekStatus
}

jnxGdoiGmKekIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the GM KEK in table.The value of the index is a
        number which begins at one and is incremented with each
        KEK that is used by the GM for that GDOI group."
    ::= { jnxGdoiGmKekEntry 1 }

jnxGdoiGmKekSPI OBJECT-TYPE
    SYNTAX          JnxGdoiKekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Security Parameter Index (SPI) of a KEK
        SA.  The SPI must be the ISAKMP Header cookie pair
        where the first 8 octets become the 'Initiator Cookie' field
        of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8
        octets become the 'Responder Cookie' in the same HDR.  As
        described above, these cookies are assigned by the GCKS."
    ::= { jnxGdoiGmKekEntry 2 }

jnxGdoiGmKekSrcIdType OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the source of a KEK SA.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'SRC ID Type' of
        the KEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.3. SA KEK payload
         RFC 4306 - Section:  3.5. Identification Payloads"
    ::= { jnxGdoiGmKekEntry 3 }

jnxGdoiGmKekSrcIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the source ID of
        a KEK SA.  If no length is given (i.e. it has a value
        of 0), the default length of its jnxGdoiGmKekSrcIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'SRC ID Data Len' field sent in the KEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload"
    ::= { jnxGdoiGmKekEntry 4 }

jnxGdoiGmKekSrcIdValue OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the source of
        a KEK SA with its type indicated by the
        jnxGdoiGmKekSrcIdType.  Use the jnxGdoiGmKekSrcIdType to parse
        the KEK Source ID correctly.  This ID value is sent as the 'SRC
        Identification Data' of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload"
    ::= { jnxGdoiGmKekEntry 5 }

jnxGdoiGmKekSrcIdPort OBJECT-TYPE
    SYNTAX          JnxGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the source ID of
        a KEK SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `SRC ID Port`
        field of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload"
    ::= { jnxGdoiGmKekEntry 6 }

jnxGdoiGmKekDstIdType OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the dest. (multicast rekey address) of a
        KEK SA.  RFC 4306 defines all valid types that can be used
        as an identifier. This identification type is sent as the
        'DST ID Type' of the KEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.3. SA KEK payload
         RFC 4306 - Section:  3.5. Identification Payloads"
    ::= { jnxGdoiGmKekEntry 7 }

jnxGdoiGmKekDstIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the destination ID of
        a KEK SA.  If no length is given (i.e. it has a value
        of 0), the default length of its jnxGdoiGmKekDstIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'DST ID Data Len' field sent in the KEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload"
    ::= { jnxGdoiGmKekEntry 8 }

jnxGdoiGmKekDstIdValue OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the destination of
        a KEK SA (multicast rekey address) with its type indicated by
        jnxGdoiGmKekDstIdType.  Use the jnxGdoiGmKekDstIdType to parse
        the KEK Dest. ID correctly.  This ID value is sent as the 'DST
        Identification Data' of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload"
    ::= { jnxGdoiGmKekEntry 9 }

jnxGdoiGmKekDstIdPort OBJECT-TYPE
    SYNTAX          JnxGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the dest. ID of
        a KEK SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `DST ID Port`
        field of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload"
    ::= { jnxGdoiGmKekEntry 10 }

jnxGdoiGmKekIpProtocol OBJECT-TYPE
    SYNTAX          JnxGdoiIpProtocolId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the IP protocol ID (e.g. UDP/TCP) being used
        for the rekey datagram."
    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK payload"
    ::= { jnxGdoiGmKekEntry 11 }

jnxGdoiGmKekMgmtAlg OBJECT-TYPE
    SYNTAX          JnxGdoiKeyManagementAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_MANAGEMENT_ALGORITHM which specifies
        the group KEK management algorithm used to provide forward
        or backward access control (i.e. used to exclude group
        members).

          KEK Management Type  Value
          -------------------  -----
           RESERVED              0
           LKH                   1
           RESERVED              2-127
           Private Use           128-255"
    REFERENCE
        "RFC 3547 - Section: 5.3.2. KEK_MANAGEMENT_ALGORITHM"
    ::= { jnxGdoiGmKekEntry 12 }

jnxGdoiGmKekEncryptAlg OBJECT-TYPE
    SYNTAX          JnxGdoiEncryptionAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_ALGORITHM which specifies the
        encryption algorithm used with the KEK SA.  A GDOI
        implementaiton must support KEK_ALG_3DES.

        Following are the KEK encryption algoritm values defined in
        the GDOI RFC 3547, however the JnxGdoiEncryptionAlgorithm TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           KEK_ALG_DES      1
           KEK_ALG_3DES     2
           KEK_ALG_AES      3
           RESERVED         4-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section 5.3.3. KEK_ALGORITHM"
    ::= { jnxGdoiGmKekEntry 13 }

jnxGdoiGmKekEncryptKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_KEY_LENGTH which specifies the KEK
        Algorithm key length (in bits)."
    REFERENCE       "RFC 3547 - Section: 5.3.4. KEK_KEY_LENGTH"
    ::= { jnxGdoiGmKekEntry 14 }

jnxGdoiGmKekSigHashAlg OBJECT-TYPE
    SYNTAX          JnxGdoiPseudoRandomFunction
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_HASH_ALGORITHM which specifies the SIG
        payload hash algorithm.  This is not required (i.e. could
        have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or
        SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a
        value of zero or SIG_HASH_SHA1).

        Following are the Signature Hash Algorithm values defined in
        the GDOI RFC 3547, however the JnxGdoiPseudoRandomFunction TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           SIG_HASH_MD5     1
           SIG_HASH_SHA1    2
           RESERVED         3-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section: 5.3.6. SIG_HASH_ALGORITHM"
    ::= { jnxGdoiGmKekEntry 15 }

jnxGdoiGmKekSigAlg OBJECT-TYPE
    SYNTAX          JnxGdoiSignatureMethod
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_ALGORITHM which specifies the SIG
        payload signature algorithm.  A GDOI implementation must
        support SIG_ALG_RSA.

        Following are the Signature Algorithm values defined in
        the GDOI RFC 3547, however the JnxGdoiSignatureMethod TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           SIG_ALG_RSA      1
           SIG_ALG_DSS      2
           SIG_ALG_ECDSS    3
           RESERVED         4-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section: 5.3.7. SIG_ALGORITHM"
    ::= { jnxGdoiGmKekEntry 16 }

jnxGdoiGmKekSigKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_KEY_LENGTH which specifies the length
        of the SIG payload key."
    REFERENCE       "RFC 3547 - Section 5.3.8. SIG_KEY_LENGTH"
    ::= { jnxGdoiGmKekEntry 17 }

jnxGdoiGmKekOakleyGroup OBJECT-TYPE
    SYNTAX          JnxGdoiDiffieHellmanGroup
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KE_OAKLEY_GROUP which specifies the OAKLEY
        or Diffie-Hellman Group used to compute the PFS secret in the
        optional KE payload of the GDOI GROUPKEY-PULL exchange."
    REFERENCE       "RFC 3547 - Section 5.3.9. KE_OAKLEY_GROUP"
    ::= { jnxGdoiGmKekEntry 18 }

jnxGdoiGmKekOriginalLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_KEY_LIFETIME which specifies the maximum
        time for which a KEK is valid.  The GCKS may refresh the KEK
        at any time before the end of the valid period.  The value is
        a four (4) octet (32-bit) number defining a valid time period
        in seconds."
    REFERENCE       "RFC 3547 - Section 5.3.5. KEK_KEY_LIFETIME"
    ::= { jnxGdoiGmKekEntry 19 }

jnxGdoiGmKekRemainingLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the remaining time for which a KEK is valid.
        The value is a four (4) octet (32-bit) number which begins at
        the value of jnxGdoiGmKekOriginalLifetime and counts down to 0
        in seconds.  If the lifetime has already expired, this value
        should remain at zero (0) until the GCKS refreshes the KEK."
    REFERENCE       "RFC 3547 - Section 5.3.5. KEK_KEY_LIFETIME"
    ::= { jnxGdoiGmKekEntry 20 }

jnxGdoiGmKekStatus OBJECT-TYPE
    SYNTAX          JnxGdoiKekStatus
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The status of the KEK SA.  When this status value is
        queried, one of the following is returned:
        inUse(1), new(2), old(3)."
    ::= { jnxGdoiGmKekEntry 21 }

-- #-------------------------------------------------------------- --
-- # The GDOI "Group Member (GM) TEK Selector" Table
-- #-------------------------------------------------------------- --

jnxGdoiGmTekSelectorTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF JnxGdoiGmTekSelectorEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Traffic Encryption Key
        (TEK) Security Associations (SAs/Policies) pushed by a
        Key Server & installed for GDOI entities acting as Group
        Members (GMs) on the network device being queried.  There is
        one entry in this table for each unique TEK traffic selector
        (Source/Destination tuple) that has been downloaded from the
        Key Server and installed on the Group Member."
    ::= { jnxGdoiSecAssociations 5 }

jnxGdoiGmTekSelectorEntry OBJECT-TYPE
    SYNTAX          JnxGdoiGmTekSelectorEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI TEK
        Policy/SA, uniquely identified by the Group ID, Group Member
        ID, Source/Destination IDs & Ports, and TEK SPI.  There will
        be one or more TEK entries for each TEK Policy/SA received
        and installed by the given Group Member from its registered
        Key Server, each with a unique <SRC-ID, SRC-PORT, DST-ID,
        DST-PORT, SPI> 5-tuple. This table does not contain the SPI
        which is part of the TEK policy table."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
          3.2. Messages
          4.   GROUPKEY-PUSH Message
          5.4. SA TEK Payload"
    INDEX           {
                        jnxGdoiGroupIdType,
                        jnxGdoiGroupIdValue,
                        jnxGdoiGmIdType,
                        jnxGdoiGmIdValue,
                        jnxGdoiGmTekSelectorIndex
                    }
    ::= { jnxGdoiGmTekSelectorTable 1 }

JnxGdoiGmTekSelectorEntry ::= SEQUENCE {
        jnxGdoiGmTekSelectorIndex           Unsigned32,
        jnxGdoiGmTekSrcIdType               JnxGdoiIdentificationType,
        jnxGdoiGmTekSrcIdLength             Unsigned32,
        jnxGdoiGmTekSrcIdValue              JnxGdoiIdentificationValue,
        jnxGdoiGmTekSrcIdPort               JnxGdoiUnsigned16,
        jnxGdoiGmTekDstIdType               JnxGdoiIdentificationType,
        jnxGdoiGmTekDstIdLength             Unsigned32,
        jnxGdoiGmTekDstIdValue              JnxGdoiIdentificationValue,
        jnxGdoiGmTekDstIdPort               JnxGdoiUnsigned16,
        jnxGdoiGmTekSecurityProtocol        JnxGdoiSecurityProtocol,
        jnxGdoiGmTekPolicyMismatchAction    JnxGdoiPolicyMismatchAction
}

jnxGdoiGmTekSelectorIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the Source/Destination pair secured by the
        GM TEK.The value of the index is a number which begins at
        one and is incremented with each Source/Destination pair that
        is secured by the GM TEK policy for that GDOI group."
    ::= { jnxGdoiGmTekSelectorEntry 1 }

jnxGdoiGmTekSrcIdType OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the source of a TEK Policy/SA.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'SRC ID Type' of
        the TEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads"
    ::= { jnxGdoiGmTekSelectorEntry 2 }

jnxGdoiGmTekSrcIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the source ID of
        a TEK Policy/SA.  If no length is given (i.e. it has a value
        of 0), the default length of its jnxGdoiGmTekSrcIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'SRC ID Data Len' field sent in the TEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekSelectorEntry 3 }

jnxGdoiGmTekSrcIdValue OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the source of
        a TEK Policy/SA with its type indicated by the
        jnxGdoiGmTekSrcIdType.  Use the jnxGdoiGmTekSrcIdType to parse
        the TEK Source ID correctly.  This ID value is sent as the 'SRC
        Identification Data' of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekSelectorEntry 4 }

jnxGdoiGmTekSrcIdPort OBJECT-TYPE
    SYNTAX          JnxGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the source ID of
        a TEK Policy/SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `SRC ID Port`
        field of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekSelectorEntry 5 }

jnxGdoiGmTekDstIdType OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the dest. of a TEK Policy/SA.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'DST ID Type' of
        the TEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5. Identification Payloads"
    ::= { jnxGdoiGmTekSelectorEntry 6 }

jnxGdoiGmTekDstIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the destination ID of
        a TEK Policy/SA.  If no length is given (i.e. it has a value
        of 0), the default length of its jnxGdoiGmTekDstIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'DST ID Data Len' field sent in the TEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekSelectorEntry 7 }

jnxGdoiGmTekDstIdValue OBJECT-TYPE
    SYNTAX          JnxGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the destination of
        a TEK Policy/SA with its type indicated by the
        jnxGdoiGmTekDstIdType.  Use the jnxGdoiGmTekDstIdType to parse
        the TEK Dest. ID correctly.  This ID value is sent as the 'DST
        Identification Data' of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekSelectorEntry 8 }

jnxGdoiGmTekDstIdPort OBJECT-TYPE
    SYNTAX          JnxGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the dest. ID of
        a TEK Policy/SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `DST ID Port`
        field of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekSelectorEntry 9 }

jnxGdoiGmTekSecurityProtocol OBJECT-TYPE
    SYNTAX          JnxGdoiSecurityProtocol
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Protocol-ID field of a SA TEK (SAT) payload
        which specifies the Security Protocol for a TEK.

        Following are the Security Protocol values defined in
        the GDOI RFC 3547, however the JnxGdoiSecurityProtocol TC
        defines all possible values.

          Protocol ID             Value
          ----------------------  -----
           RESERVED                 0
           GDOI_PROTO_IPSEC_ESP     1
           RESERVED                 2-127
           Private Use              128-255"
    REFERENCE       "RFC 3547 - Section: 5.4. SA TEK Payload"
    ::= { jnxGdoiGmTekSelectorEntry 10 }

jnxGdoiGmTekPolicyMismatchAction OBJECT-TYPE
    SYNTAX          JnxGdoiPolicyMismatchAction
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Default action for packets that does not match TEK Policy/SA
        received from group key server"
    ::= { jnxGdoiGmTekSelectorEntry 11 }

-- #-------------------------------------------------------------- --
-- # The GDOI "Group Member (GM) TEK Policy" Table
-- #-------------------------------------------------------------- --

jnxGdoiGmTekPolicyTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF JnxGdoiGmTekPolicyEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Traffic Encryption Key
        (TEK) Security Associations (SAs/Policies) received by a
        Key Server & installed for GDOI entities acting as Group
        Members (GMs) on the network device being queried.  There is
        one entry in this table for each TEK SA that has been
        installed on the Group Member."
    ::= { jnxGdoiSecAssociations 6 }

jnxGdoiGmTekPolicyEntry OBJECT-TYPE
    SYNTAX          JnxGdoiGmTekPolicyEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI TEK
        Policy/SA, uniquely identified by the Group ID, Group Member
        ID, TEK Selector (Source/Destination IDs & Ports), and TEK
        Policy index (TEK SPI and direction).  There will be one or
        more TEK entries for each TEK Policy/SA received and installed
        by the given Group Member from its registered Key Server, each
        with a unique <SRC-ID, SRC-PORT, DST-ID, DST-PORT, SPI> tuple.
        This table contains the SPI information corresponding to a TEK
        Selector index."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
          3.2. Messages
          4.   GROUPKEY-PUSH Message
          5.4. SA TEK Payload"
    INDEX           {
                        jnxGdoiGroupIdType,
                        jnxGdoiGroupIdValue,
                        jnxGdoiGmIdType,
                        jnxGdoiGmIdValue,
                        jnxGdoiGmTekSelectorIndex,
                        jnxGdoiGmTekPolicyIndex
                    }
    ::= { jnxGdoiGmTekPolicyTable 1 }

JnxGdoiGmTekPolicyEntry ::= SEQUENCE {
        jnxGdoiGmTekPolicyIndex         Unsigned32,
        jnxGdoiGmTekSPI                 JnxGdoiTekSPI,
        jnxGdoiGmTekEncapsulationMode   JnxGdoiEncapsulationMode,
        jnxGdoiGmTekEncryptionAlgorithm JnxGdoiEncryptionAlgorithm,
        jnxGdoiGmTekEncryptionKeyLength Unsigned32,
        jnxGdoiGmTekIntegrityAlgorithm  JnxGdoiIntegrityAlgorithm,
        jnxGdoiGmTekIntegrityKeyLength  Unsigned32,
        jnxGdoiGmTekWindowSize          Unsigned32,
        jnxGdoiGmTekOriginalLifetime    Unsigned32,
        jnxGdoiGmTekRemainingLifetime   Unsigned32,
        jnxGdoiGmTekStatus              JnxGdoiTekStatus
}

jnxGdoiGmTekPolicyIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the SPI used to secure the GM TEK.The value of
        the index is a number which begins at one and is incremented
        with each row of the GM TEK SPI table."
    ::= { jnxGdoiGmTekPolicyEntry 1 }

jnxGdoiGmTekSPI OBJECT-TYPE
    SYNTAX          JnxGdoiTekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Security Parameter Index (SPI) of a TEK
        Policy/SA.  The SPI must be the SPI for ESP."
    REFERENCE       "RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 2 }

jnxGdoiGmTekEncapsulationMode OBJECT-TYPE
    SYNTAX          JnxGdoiEncapsulationMode
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Encapsulation Mode of a TEK (IPsec SA).

        Following are the Encapsulation Mode values defined in
        RFC 2407, however the JnxGdoiEncapsulationMode TC defines all
        possible values.

          Encapsulation Mode  Value
          ------------------  -----
           RESERVED             0
           Tunnel               1
           Transport            2"
    REFERENCE
        "RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 3 }

jnxGdoiGmTekEncryptionAlgorithm OBJECT-TYPE
    SYNTAX          JnxGdoiEncryptionAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Transform ID field of a PROTO_IPSEC_ESP
        payload which specifies the ESP transform to be used.  If
        no encryption is used, this value will be zero (0).

        Following are the ESP Transform values defined in RFC 2407,
        however the JnxGdoiEncryptionAlgorithm TC defines all possible
        values.

          IPsec ESP Transform ID    Value
          ------------------------  -----
           RESERVED                   0
           ESP_DES_IV64               1
           ESP_DES                    2
           ESP_3DES                   3
           ESP_RC5                    4
           ESP_IDEA                   5
           ESP_CAST                   6
           ESP_BLOWFISH               7
           ESP_3IDEA                  8
           ESP_DES_IV32               9
           ESP_RC4                    10
           ESP_NULL                   11"
    REFERENCE
        "RFC 2407 - Section: 4.4.4. IPSEC ESP Transform Identifiers
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 4 }

jnxGdoiGmTekEncryptionKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length of the key used for encryption in a TEK
        (in bits)."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 5 }

jnxGdoiGmTekIntegrityAlgorithm OBJECT-TYPE
    SYNTAX          JnxGdoiIntegrityAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Authentication Algorithm for a TEK IPsec
        ESP SA.  If no authentication is used, this value will be
        zero (0).

        Following are the Authentication Algorithm values defined in
        RFC 2407, however the JnxGdoiEncryptionAlgorithm TC defines all
        possible values.

          Algorithm Type  Value
          --------------  -----
           HMAC-MD5         1
           HMAC-SHA         2
           DES-MAC          3
           KPDK             4"
    REFERENCE
        "RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 6 }

jnxGdoiGmTekIntegrityKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length of the key used for integrity/authentication in a
        TEK (in bits)."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 7 }

jnxGdoiGmTekWindowSize OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "GROUPKEY-PUSH Messages"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The size of the Time Based Anti-Replay (TBAR) window used by
        this TEK Policy/SA."
    REFERENCE
        "RFC 2407 - Section: 4.6.3.2. REPLAY-STATUS
         RFC 3547 - Section: 6.3.4.   Replay/Reflection Attack
              Protection"
    ::= { jnxGdoiGmTekPolicyEntry 8 }

jnxGdoiGmTekOriginalLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SA Life Type defined in RFC 2407 which
        specifies the maximum time for which a TEK IPsec SA is valid.
        The GCKS may refresh the TEK at any time before the end of
        the valid period.  The value is a four (4) octet (32-bit)
        number defining a valid time period in seconds."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 9 }

jnxGdoiGmTekRemainingLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the remaining time for which a TEK is valid.
        The value is a four (4) octet (32-bit) number which begins at
        the value of jnxGdoiGmTekOriginalLifetime and counts down to 0
        in seconds."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    ::= { jnxGdoiGmTekPolicyEntry 10 }

jnxGdoiGmTekStatus OBJECT-TYPE
    SYNTAX          JnxGdoiTekStatus
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The status of the TEK Policy/SA.  When this status value is
        queried, one of the following is returned:
        inbound(1), outbound(2), biDirectional(3)."
    ::= { jnxGdoiGmTekPolicyEntry 11 }
END