-- extracted from draft-ietf-ipsec-monitor-mib-01.txt -- at Mon Nov 15 17:11:15 1999 IPSEC-SA-MON-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Counter32, Gauge32, Integer32, Unsigned32, NOTIFICATION-TYPE, OBJECT-IDENTITY -- remove next line before release ,experimental FROM SNMPv2-SMI TEXTUAL-CONVENTION, TruthValue FROM SNMPv2-TC ifIndex FROM IF-MIB -- uncomment next line before release -- mib-2 FROM RFC1213-MIB IpsecDoiIdentType, IpsecDoiEncapsulationMode, IpsecDoiEspTransform, IpsecDoiAhTransform, IpsecDoiAuthAlgorithm, IpsecDoiIpcompTransform, IpsecDoiSecProtocolId FROM IPSEC-ISAKMP-IKE-DOI-TC; ipsecSaMonModule MODULE-IDENTITY LAST-UPDATED "9906031200Z" ORGANIZATION "IETF IPSec Working Group" CONTACT-INFO " Tim Jenkins TimeStep Corporation 362 Terry Fox Drive Kanata, ON K0A 2H0 Canada +1 (613) 599-3610 tjenkins@timestep.com John Shriver Intel Corporation 28 Crosby Drive Bedford, MA 01730 +1 (781) 687-1329 John.Shriver@intel.com " DESCRIPTION "The MIB module to describe generic IPSec objects, and entity level objects and events for those types." REVISION "9906031200Z" DESCRIPTION "Initial revision." -- replace xxx in next line before release, uncomment before release -- ::= { mib-2 xxx } -- delete next line before release ::= { experimental 500 } -- invalid! IpsecSaCreatorIdent ::= TEXTUAL-CONVENTION DISPLAY-HINT "d" STATUS current DESCRIPTION "A value indicating how an SA was created." SYNTAX INTEGER { unknown(0), static(1), -- statically created ike(2), -- IKE other(3) } IpsecIpv6Address ::= TEXTUAL-CONVENTION DISPLAY-HINT "2x:2x:2x:2x:2x:2x:1d.1d.1d.1d" STATUS current DESCRIPTION "This data type is used to model IPv6 address prefixes. This is a binary string of 16 octets in network byte-order." SYNTAX OCTET STRING (SIZE (16)) ipsecSaMonitorMIB OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all IPSec branches." ::= { ipsecSaMonModule 1 } -- significant branches saTables OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all SA tables." ::= { ipsecSaMonitorMIB 1 } saStatistics OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are global counters for IPSec security associations." ::= { ipsecSaMonitorMIB 2 } saErrors OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are global error counters for IPSec security associations." ::= { ipsecSaMonitorMIB 3 } saTraps OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are traps for IPSec security associations." ::= { ipsecSaMonitorMIB 4 } saTrapObjects OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for objects which are used as part of traps." ::= { ipsecSaMonitorMIB 5 } saTrapControl OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which are trap controls for IPSec security associations." ::= { ipsecSaMonitorMIB 6 } saGroups OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which describe the groups in this MIB." ::= { ipsecSaMonitorMIB 7 } saConformance OBJECT-IDENTITY STATUS current DESCRIPTION "This is the base object identifier for all objects which describe the conformance for this MIB." ::= { ipsecSaMonitorMIB 8 } -- the IPSec Inbound ESP MIB-Group -- -- a collection of objects providing information about -- IPSec Inbound ESP SAs ipsecSaEspInTable OBJECT-TYPE SYNTAX SEQUENCE OF IpsecSaEspInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec inbound ESP SAs. There should be one row for every inbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { saTables 1 } ipsecSaEspInEntry OBJECT-TYPE SYNTAX IpsecSaEspInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec inbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ ipsecSaEspInAddress, ipsecSaEspInSpi } ::= { ipsecSaEspInTable 1 } IpsecSaEspInEntry::= SEQUENCE { -- identification ipsecSaEspInAddress IpsecIpv6Address, ipsecSaEspInSpi Unsigned32, -- SA selectors ipsecSaEspInDestId OCTET STRING, ipsecSaEspInDestIdType IpsecDoiIdentType, ipsecSaEspInSourceId OCTET STRING, ipsecSaEspInSourceIdType IpsecDoiIdentType, ipsecSaEspInProtocol Integer32, ipsecSaEspInDestPort Integer32, ipsecSaEspInSourcePort Integer32, -- how created ipsecSaEspInCreator IpsecSaCreatorIdent, -- security services description ipsecSaEspInEncapsulation IpsecDoiEncapsulationMode, ipsecSaEspInEncAlg IpsecDoiEspTransform, ipsecSaEspInEncKeyLength Unsigned32, ipsecSaEspInAuthAlg IpsecDoiAuthAlgorithm, -- expiration limits ipsecSaEspInLimitSeconds Unsigned32, -- sec., 0 if none ipsecSaEspInLimitKbytes Unsigned32, -- 0 if none -- current operating statistics ipsecSaEspInAccSeconds Counter32, ipsecSaEspInAccKbytes Counter32, ipsecSaEspInUserOctets Counter32, ipsecSaEspInPackets Counter32, -- error statistics ipsecSaEspInDecryptErrors Counter32, ipsecSaEspInAuthErrors Counter32, ipsecSaEspInReplayErrors Counter32, ipsecSaEspInPolicyErrors Counter32, ipsecSaEspInPadErrors Counter32, ipsecSaEspInOtherReceiveErrors Counter32 } ipsecSaEspInAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { ipsecSaEspInEntry 1 } ipsecSaEspInSpi OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE"RFC 2406 Section 2.1" ::= { ipsecSaEspInEntry 2 } ipsecSaEspInDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during SA creation negotiation." ::= { ipsecSaEspInEntry 3 } ipsecSaEspInDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaEspInDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaEspInEntry 4 } ipsecSaEspInSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { ipsecSaEspInEntry 5 } ipsecSaEspInSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaEspInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaEspInEntry 6 } ipsecSaEspInProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaEspInEntry 7 } ipsecSaEspInDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaEspInEntry 8 } ipsecSaEspInSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaEspInEntry 9 } ipsecSaEspInCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { ipsecSaEspInEntry 10 } ipsecSaEspInEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { ipsecSaEspInEntry 11 } ipsecSaEspInEncAlg OBJECT-TYPE SYNTAX IpsecDoiEspTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used." ::= { ipsecSaEspInEntry 12 } ipsecSaEspInEncKeyLength OBJECT-TYPE SYNTAX Unsigned32 (0..65531) UNITS "bits" MAX-ACCESS read-only STATUS current DESCRIPTION "The length of the encryption key in bits used for the algorithm specified in the 'ipsecSaEspInEncAlg' object, or 0 if the key length is implicit in the specified algorithm or there is no encryption specified." ::= { ipsecSaEspInEntry 13 } ipsecSaEspInAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAuthAlgorithm MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used." ::= { ipsecSaEspInEntry 14 } ipsecSaEspInLimitSeconds OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { ipsecSaEspInEntry 15 } ipsecSaEspInLimitKbytes OBJECT-TYPE SYNTAX Unsigned32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in kilobytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { ipsecSaEspInEntry 16 } ipsecSaEspInAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { ipsecSaEspInEntry 17 } ipsecSaEspInAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in bytes. This value may be 0 if the SA does not expire based on traffic." ::= { ipsecSaEspInEntry 18 } ipsecSaEspInUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { ipsecSaEspInEntry 19 } ipsecSaEspInPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { ipsecSaEspInEntry 20 } ipsecSaEspInDecryptErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to decryption errors." ::= { ipsecSaEspInEntry 21 } ipsecSaEspInAuthErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to authentication errors." ::= { ipsecSaEspInEntry 22 } ipsecSaEspInReplayErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to replay errors." ::= { ipsecSaEspInEntry 23 } ipsecSaEspInPolicyErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid." ::= { ipsecSaEspInEntry 24 } ipsecSaEspInPadErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to pad value errors. Implementations that do not check this must not support this object." REFERENCE "RFC 2406 section 2.4" ::= { ipsecSaEspInEntry 25 } ipsecSaEspInOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element." ::= { ipsecSaEspInEntry 26 } -- the IPSec Inbound AH MIB-Group -- -- a collection of objects providing information about -- IPSec Inbound AH SAs ipsecSaAhInTable OBJECT-TYPE SYNTAX SEQUENCE OF IpsecSaAhInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec inbound AH SAs. There should be one row for every inbound AH security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { saTables 2 } ipsecSaAhInEntry OBJECT-TYPE SYNTAX IpsecSaAhInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec inbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ ipsecSaAhInAddress, ipsecSaAhInSpi } ::= { ipsecSaAhInTable 1 } IpsecSaAhInEntry::= SEQUENCE { -- identification ipsecSaAhInAddress IpsecIpv6Address, ipsecSaAhInSpi Unsigned32, -- SA selectors ipsecSaAhInDestId OCTET STRING, ipsecSaAhInDestIdType IpsecDoiIdentType, ipsecSaAhInSourceId OCTET STRING, ipsecSaAhInSourceIdType IpsecDoiIdentType, ipsecSaAhInProtocol Integer32, ipsecSaAhInDestPort Integer32, ipsecSaAhInSourcePort Integer32, -- how created ipsecSaAhInCreator IpsecSaCreatorIdent, -- security services description ipsecSaAhInEncapsulation IpsecDoiEncapsulationMode, ipsecSaAhInAuthAlg IpsecDoiAhTransform, -- expiration limits ipsecSaAhInLimitSeconds Unsigned32, -- sec., 0 if none ipsecSaAhInLimitKbytes Unsigned32, -- 0 if none -- current operating statistics ipsecSaAhInAccSeconds Counter32, ipsecSaAhInAccKbytes Counter32, ipsecSaAhInUserOctets Counter32, ipsecSaAhInPackets Counter32, -- error statistics ipsecSaAhInAuthErrors Counter32, ipsecSaAhInReplayErrors Counter32, ipsecSaAhInPolicyErrors Counter32, ipsecSaAhInOtherReceiveErrors Counter32 } ipsecSaAhInAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { ipsecSaAhInEntry 1 } ipsecSaAhInSpi OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE "RFC 2402 Section 2.4" ::= { ipsecSaAhInEntry 2 } ipsecSaAhInDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { ipsecSaAhInEntry 3 } ipsecSaAhInDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaAhInDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaAhInEntry 4 } ipsecSaAhInSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { ipsecSaAhInEntry 5 } ipsecSaAhInSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaAhInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaAhInEntry 6 } ipsecSaAhInProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaAhInEntry 7 } ipsecSaAhInDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaAhInEntry 8 } ipsecSaAhInSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaAhInEntry 9 } ipsecSaAhInCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { ipsecSaAhInEntry 10 } ipsecSaAhInEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { ipsecSaAhInEntry 11 } ipsecSaAhInAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAhTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic carried by this SA if it uses ESP or 0 if there is no authentication applied by ESP." ::= { ipsecSaAhInEntry 12 } ipsecSaAhInLimitSeconds OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { ipsecSaAhInEntry 13 } ipsecSaAhInLimitKbytes OBJECT-TYPE SYNTAX Unsigned32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in bytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { ipsecSaAhInEntry 14 } ipsecSaAhInAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { ipsecSaAhInEntry 15 } ipsecSaAhInAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in bytes. This value may be 0 if the SA does not expire based on traffic." ::= { ipsecSaAhInEntry 16 } ipsecSaAhInUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { ipsecSaAhInEntry 17 } ipsecSaAhInPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { ipsecSaAhInEntry 18 } ipsecSaAhInAuthErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to authentication errors." ::= { ipsecSaAhInEntry 19 } ipsecSaAhInReplayErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to replay errors." ::= { ipsecSaAhInEntry 20 } ipsecSaAhInPolicyErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid." ::= { ipsecSaAhInEntry 21 } ipsecSaAhInOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the authentication element." ::= { ipsecSaAhInEntry 22 } -- the IPSec Inbound IPCOMP MIB-Group -- -- a collection of objects providing information about -- IPSec Inbound IPCOMP SAs ipsecSaIpcompInTable OBJECT-TYPE SYNTAX SEQUENCE OF IpsecSaIpcompInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec inbound IPCOMP SAs. There should be one row for every inbound IPCOMP (security) association that exists in the entity. The maximum number of rows is implementation dependent." ::= { saTables 3 } ipsecSaIpcompInEntry OBJECT-TYPE SYNTAX IpsecSaIpcompInEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec inbound IPCOMP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ ipsecSaIpcompInAddress, ipsecSaIpcompInCpi } ::= { ipsecSaIpcompInTable 1 } IpsecSaIpcompInEntry::= SEQUENCE { -- identification ipsecSaIpcompInAddress IpsecIpv6Address, ipsecSaIpcompInCpi IpsecDoiIpcompTransform, -- SA selectors (if needed) ipsecSaIpcompInDestId OCTET STRING, ipsecSaIpcompInDestIdType IpsecDoiIdentType, ipsecSaIpcompInSourceId OCTET STRING, ipsecSaIpcompInSourceIdType IpsecDoiIdentType, ipsecSaIpcompInProtocol Integer32, ipsecSaIpcompInDestPort Integer32, ipsecSaIpcompInSourcePort Integer32, -- how created ipsecSaIpcompInCreator IpsecSaCreatorIdent, -- security services description ipsecSaIpcompInEncapsulation IpsecDoiEncapsulationMode, ipsecSaIpcompInDecompAlg IpsecDoiIpcompTransform, -- current operating statistics ipsecSaIpcompInSeconds Counter32, ipsecSaIpcompInUserOctets Counter32, ipsecSaIpcompInPackets Counter32, -- error statistics ipsecSaIpcompInDecompErrors Counter32, ipsecSaIpcompInOtherReceiveErrors Counter32 } ipsecSaIpcompInAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { ipsecSaIpcompInEntry 1 } ipsecSaIpcompInCpi OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform." REFERENCE "RFC 2393 Section 3.3" ::= { ipsecSaIpcompInEntry 2 } ipsecSaIpcompInDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { ipsecSaIpcompInEntry 3 } ipsecSaIpcompInDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaIpcompInDestId', or 0 if unknown or if the SA uses transport mode, or 0 if this SA is used with multiple SAs in protection suites." ::= { ipsecSaIpcompInEntry 4 } ipsecSaIpcompInSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during SA creation negotiation." ::= { ipsecSaIpcompInEntry 5 } ipsecSaIpcompInSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaIpcompInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites." ::= { ipsecSaIpcompInEntry 6 } ipsecSaIpcompInProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaIpcompInEntry 7 } ipsecSaIpcompInDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaIpcompInEntry 8 } ipsecSaIpcompInSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaIpcompInEntry 9 } ipsecSaIpcompInCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { ipsecSaIpcompInEntry 10 } ipsecSaIpcompInEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { ipsecSaIpcompInEntry 11 } ipsecSaIpcompInDecompAlg OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the decompression algorithm applied to traffic." ::= { ipsecSaIpcompInEntry 12 } ipsecSaIpcompInSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds that the SA has existed." ::= { ipsecSaIpcompInEntry 13 } ipsecSaIpcompInUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA." ::= { ipsecSaIpcompInEntry 14 } ipsecSaIpcompInPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { ipsecSaIpcompInEntry 15 } ipsecSaIpcompInDecompErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to decompression errors." ::= { ipsecSaIpcompInEntry 16 } ipsecSaIpcompInOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to errors other than decompression errors. This may include packets dropped due to a lack of receive buffers, and packets dropped due to congestion at the decompression element." ::= { ipsecSaIpcompInEntry 17 } -- the IPSec Outbound ESP MIB-Group -- -- a collection of objects providing information about -- IPSec Outbound ESP SAs ipsecSaEspOutTable OBJECT-TYPE SYNTAX SEQUENCE OF IpsecSaEspOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec Outbound ESP SAs. There should be one row for every outbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { saTables 4 } ipsecSaEspOutEntry OBJECT-TYPE SYNTAX IpsecSaEspOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec Outbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ ipsecSaEspOutAddress, ipsecSaEspOutSpi } ::= { ipsecSaEspOutTable 1 } IpsecSaEspOutEntry::= SEQUENCE { -- identification ipsecSaEspOutAddress IpsecIpv6Address, ipsecSaEspOutSpi Unsigned32, -- SA selectors ipsecSaEspOutSourceId OCTET STRING, ipsecSaEspOutSourceIdType IpsecDoiIdentType, ipsecSaEspOutDestId OCTET STRING, ipsecSaEspOutDestIdType IpsecDoiIdentType, ipsecSaEspOutProtocol Integer32, ipsecSaEspOutSourcePort Integer32, ipsecSaEspOutDestPort Integer32, -- how created ipsecSaEspOutCreator IpsecSaCreatorIdent, -- security services description ipsecSaEspOutEncapsulation IpsecDoiEncapsulationMode, ipsecSaEspOutEncAlg IpsecDoiEspTransform, ipsecSaEspOutEncKeyLength Unsigned32, ipsecSaEspOutAuthAlg IpsecDoiAuthAlgorithm, -- expiration limits ipsecSaEspOutLimitSeconds Unsigned32, -- sec., 0 if none ipsecSaEspOutLimitKbytes Unsigned32, -- 0 if none -- current operating statistics ipsecSaEspOutAccSeconds Counter32, ipsecSaEspOutAccKbytes Counter32, ipsecSaEspOutUserOctets Counter32, ipsecSaEspOutPackets Counter32, -- error statistics ipsecSaEspOutSendErrors Counter32 } ipsecSaEspOutAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { ipsecSaEspOutEntry 1 } ipsecSaEspOutSpi OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE"RFC 2406 Section 2.1" ::= { ipsecSaEspOutEntry 2 } ipsecSaEspOutSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { ipsecSaEspOutEntry 3 } ipsecSaEspOutSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaEspOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaEspOutEntry 4 } ipsecSaEspOutDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { ipsecSaEspOutEntry 5 } ipsecSaEspOutDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaEspOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaEspOutEntry 6 } ipsecSaEspOutProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaEspOutEntry 7 } ipsecSaEspOutSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaEspOutEntry 8 } ipsecSaEspOutDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaEspOutEntry 9 } ipsecSaEspOutCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { ipsecSaEspOutEntry 10 } ipsecSaEspOutEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { ipsecSaEspOutEntry 11 } ipsecSaEspOutEncAlg OBJECT-TYPE SYNTAX IpsecDoiEspTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used." ::= { ipsecSaEspOutEntry 12 } ipsecSaEspOutEncKeyLength OBJECT-TYPE SYNTAX Unsigned32 (0..65531) UNITS "bits" MAX-ACCESS read-only STATUS current DESCRIPTION "The length of the encryption key in bits used for the algorithm specified in the 'ipsecSaEspOutEncAlg' object, or 0 if the key length is implicit in the specified algorithm or there is no encryption specified." ::= { ipsecSaEspOutEntry 13 } ipsecSaEspOutAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAuthAlgorithm MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used." ::= { ipsecSaEspOutEntry 14 } ipsecSaEspOutLimitSeconds OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { ipsecSaEspOutEntry 15 } ipsecSaEspOutLimitKbytes OBJECT-TYPE SYNTAX Unsigned32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in bytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { ipsecSaEspOutEntry 16 } ipsecSaEspOutAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { ipsecSaEspOutEntry 17 } ipsecSaEspOutAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in bytes. This value may be 0 if the SA does not expire based on traffic." ::= { ipsecSaEspOutEntry 18 } ipsecSaEspOutUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { ipsecSaEspOutEntry 19 } ipsecSaEspOutPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { ipsecSaEspOutEntry 20 } ipsecSaEspOutSendErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers." ::= { ipsecSaEspOutEntry 21 } -- the IPSec Outbound AH MIB-Group -- -- a collection of objects providing information about -- IPSec Outbound AH SAs ipsecSaAhOutTable OBJECT-TYPE SYNTAX SEQUENCE OF IpsecSaAhOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec Outbound AH SAs. There should be one row for every outbound AH security association that exists in the entity. The maximum number of rows is implementation dependent." ::= { saTables 5 } ipsecSaAhOutEntry OBJECT-TYPE SYNTAX IpsecSaAhOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec Outbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ ipsecSaAhOutAddress, ipsecSaAhOutSpi } ::= { ipsecSaAhOutTable 1 } IpsecSaAhOutEntry::= SEQUENCE { -- identification ipsecSaAhOutAddress IpsecIpv6Address, ipsecSaAhOutSpi Unsigned32, -- SA selectors ipsecSaAhOutSourceId OCTET STRING, ipsecSaAhOutSourceIdType IpsecDoiIdentType, ipsecSaAhOutDestId OCTET STRING, ipsecSaAhOutDestIdType IpsecDoiIdentType, ipsecSaAhOutProtocol Integer32, ipsecSaAhOutSourcePort Integer32, ipsecSaAhOutDestPort Integer32, -- how created ipsecSaAhOutCreator IpsecSaCreatorIdent, -- security services description ipsecSaAhOutEncapsulation IpsecDoiEncapsulationMode, ipsecSaAhOutAuthAlg IpsecDoiAhTransform, -- expiration limits ipsecSaAhOutLimitSeconds Unsigned32, -- sec., 0 if none ipsecSaAhOutLimitKbytes Unsigned32, -- 0 if none -- current operating statistics ipsecSaAhOutAccSeconds Counter32, ipsecSaAhOutAccKbytes Counter32, ipsecSaAhOutUserOctets Counter32, ipsecSaAhOutPackets Counter32, -- error statistics ipsecSaAhOutSendErrors Counter32 } ipsecSaAhOutAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { ipsecSaAhOutEntry 1 } ipsecSaAhOutSpi OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The security parameters index of the SA." REFERENCE"RFC 2402 Section 2.4" ::= { ipsecSaAhOutEntry 2 } ipsecSaAhOutSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { ipsecSaAhOutEntry 3 } ipsecSaAhOutSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaAhOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaAhOutEntry 4 } ipsecSaAhOutDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { ipsecSaAhOutEntry 5 } ipsecSaAhOutDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaAhOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation." ::= { ipsecSaAhOutEntry 6 } ipsecSaAhOutProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaAhOutEntry 7 } ipsecSaAhOutSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaAhOutEntry 8 } ipsecSaAhOutDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaAhOutEntry 9 } ipsecSaAhOutCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { ipsecSaAhOutEntry 10 } ipsecSaAhOutEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { ipsecSaAhOutEntry 11 } ipsecSaAhOutAuthAlg OBJECT-TYPE SYNTAX IpsecDoiAhTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used." ::= { ipsecSaAhOutEntry 12 } ipsecSaAhOutLimitSeconds OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated." ::= { ipsecSaAhOutEntry 13 } ipsecSaAhOutLimitKbytes OBJECT-TYPE SYNTAX Unsigned32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The maximum traffic in bytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated." ::= { ipsecSaAhOutEntry 14 } ipsecSaAhOutAccSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed." ::= { ipsecSaAhOutEntry 15 } ipsecSaAhOutAccKbytes OBJECT-TYPE SYNTAX Counter32 UNITS "kilobytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in bytes. This value may be 0 if the SA does not expire based on traffic." ::= { ipsecSaAhOutEntry 16 } ipsecSaAhOutUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { ipsecSaAhOutEntry 17 } ipsecSaAhOutPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { ipsecSaAhOutEntry 18 } ipsecSaAhOutSendErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers." ::= { ipsecSaAhOutEntry 19 } -- the IPSec Outbound IPCOMP MIB-Group -- -- a collection of objects providing information about -- IPSec Outbound IPCOMP SAs ipsecSaIpcompOutTable OBJECT-TYPE SYNTAX SEQUENCE OF IpsecSaIpcompOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table containing information on IPSec Outbound IPCOMP SAs. There should be one row for every outbound IPCOMP (security) association that exists in the entity. The maximum number of rows is implementation dependent." ::= { saTables 6 } ipsecSaIpcompOutEntry OBJECT-TYPE SYNTAX IpsecSaIpcompOutEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) containing the information on a particular IPSec Outbound IPCOMP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table." INDEX{ ipsecSaIpcompOutAddress, ipsecSaIpcompOutCpi } ::= { ipsecSaIpcompOutTable 1 } IpsecSaIpcompOutEntry::= SEQUENCE { -- identification ipsecSaIpcompOutAddress IpsecIpv6Address, ipsecSaIpcompOutCpi IpsecDoiIpcompTransform, -- SA selectors ipsecSaIpcompOutSourceId OCTET STRING, ipsecSaIpcompOutSourceIdType IpsecDoiIdentType, ipsecSaIpcompOutDestId OCTET STRING, ipsecSaIpcompOutDestIdType IpsecDoiIdentType, ipsecSaIpcompOutProtocol Integer32, ipsecSaIpcompOutSourcePort Integer32, ipsecSaIpcompOutDestPort Integer32, -- how created ipsecSaIpcompOutCreator IpsecSaCreatorIdent, -- security services description ipsecSaIpcompOutEncapsulation IpsecDoiEncapsulationMode, ipsecSaIpcompOutCompAlg IpsecDoiIpcompTransform, -- current operating statistics ipsecSaIpcompOutSeconds Counter32, ipsecSaIpcompOutUserOctets Counter32, ipsecSaIpcompOutPackets Counter32 } ipsecSaIpcompOutAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "The destination address of the SA. If the IPCOMP SA is shared across multiple SAs in protection suites, this value may be 0. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes." ::= { ipsecSaIpcompOutEntry 1 } ipsecSaIpcompOutCpi OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform." REFERENCE"RFC 2393 Section 3.3" ::= { ipsecSaIpcompOutEntry 2 } ipsecSaIpcompOutSourceId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { ipsecSaIpcompOutEntry 3 } ipsecSaIpcompOutSourceIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaIpcompOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites." ::= { ipsecSaIpcompOutEntry 4 } ipsecSaIpcompOutDestId OBJECT-TYPE SYNTAX OCTET STRING (SIZE (4..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations." ::= { ipsecSaIpcompOutEntry 5 } ipsecSaIpcompOutDestIdType OBJECT-TYPE SYNTAX IpsecDoiIdentType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of identifier presented by 'ipsecSaIpcompOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites." ::= { ipsecSaIpcompOutEntry 6 } ipsecSaIpcompOutProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The transport-layer protocol number that this SA carries, or 0 if it carries any protocol." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaIpcompOutEntry 7 } ipsecSaIpcompOutSourcePort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The source port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaIpcompOutEntry 8 } ipsecSaIpcompOutDestPort OBJECT-TYPE SYNTAX Integer32 (0.. 65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The destination port number of the protocol that this SA carries, or 0 if it carries any port number." REFERENCE "RFC2401 section 4.4.2" ::= { ipsecSaIpcompOutEntry 9 } ipsecSaIpcompOutCreator OBJECT-TYPE SYNTAX IpsecSaCreatorIdent MAX-ACCESS read-only STATUS current DESCRIPTION "The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method." ::= { ipsecSaIpcompOutEntry 10 } ipsecSaIpcompOutEncapsulation OBJECT-TYPE SYNTAX IpsecDoiEncapsulationMode MAX-ACCESS read-only STATUS current DESCRIPTION "The type of encapsulation used by this SA." ::= { ipsecSaIpcompOutEntry 11 } ipsecSaIpcompOutCompAlg OBJECT-TYPE SYNTAX IpsecDoiIpcompTransform MAX-ACCESS read-only STATUS current DESCRIPTION "A unique value representing the compression algorithm applied to traffic." ::= { ipsecSaIpcompOutEntry 12 } ipsecSaIpcompOutSeconds OBJECT-TYPE SYNTAX Counter32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds that the SA has existed." ::= { ipsecSaIpcompOutEntry 13 } ipsecSaIpcompOutUserOctets OBJECT-TYPE SYNTAX Counter32 UNITS "bytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit." ::= { ipsecSaIpcompOutEntry 14 } ipsecSaIpcompOutPackets OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of packets handled by the SA." ::= { ipsecSaIpcompOutEntry 15 } -- -- entity IPSec statistics -- ipsecEspCurrentInboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of inbound ESP SAs in the entity." ::= { saStatistics 1 } ipsecEspTotalInboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound ESP SAs created in the entity since boot time." ::= { saStatistics 2 } ipsecEspCurrentOutboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of outbound ESP SAs in the entity." ::= { saStatistics 3 } ipsecEspTotalOutboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound ESP SAs created in the entity since boot time." ::= { saStatistics 4 } ipsecAhCurrentInboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of inbound AH SAs in the entity." ::= { saStatistics 5 } ipsecAhTotalInboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound AH SAs created in the entity since boot time." ::= { saStatistics 6 } ipsecAhCurrentOutboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of outbound AH SAs in the entity." ::= { saStatistics 7 } ipsecAhTotalOutboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound AH SAs created in the entity since boot time." ::= { saStatistics 8 } ipsecIpcompCurrentInboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of inbound IPCOMP SAs in the entity." ::= { saStatistics 9 } ipsecIpcompTotalInboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound IPCOMP SAs created in the entity since boot time." ::= { saStatistics 10 } ipsecIpcompCurrentOutboundSAs OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current number of outbound IPCOMP SAs in the entity." ::= { saStatistics 11 } ipsecIpcompTotalOutboundSAs OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound IPCOMP SAs created in the entity since boot time." ::= { saStatistics 12 } -- -- IPSec error counts -- ipsecDecryptionErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time with decryption errors." ::= { saErrors 1 } ipsecAuthenticationErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time with authentication errors. This includes all packets in which the hash value is determined to be invalid, for both ESP and AH SAs." ::= { saErrors 2 } ipsecReplayErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time with replay errors." ::= { saErrors 3 } ipsecPolicyErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time and discarded due to policy errors. This includes packets that had selectors that were invalid for the SA that carried them." ::= { saErrors 4 } ipsecOtherReceiveErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity in SAs since boot time and discarded due to errors not due to decryption, authentication, replay or policy." ::= { saErrors 5 } ipsecSendErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets to be sent by the entity in SAs since boot time and discarded due to errors." ::= { saErrors 6 } ipsecUnknownSpiErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by the entity since boot time with SPIs or CPIs that were not valid." ::= { saErrors 7 } -- -- traps -- -- -- some objects used in trap reporting -- -- NOTE: A MAX-ACCESS value of 'accessible-for-notify' was wanted -- for these objects; this would not compile with smicng 2.2.07 -- ipsecSecurityProtocol OBJECT-TYPE SYNTAX IpsecDoiSecProtocolId MAX-ACCESS read-only STATUS current DESCRIPTION "A security protocol associated with the trap." ::= { saTrapObjects 1 } ipsecSPI OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "An SPI associated with a trap. Where the security protocol associated with the trap is IPCOMP, this value has a maximum of 65535." ::= { saTrapObjects 2 } ipsecLocalAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "A local IP address associated with the trap." ::= { saTrapObjects 3 } ipsecPeerAddress OBJECT-TYPE SYNTAX IpsecIpv6Address MAX-ACCESS read-only STATUS current DESCRIPTION "A peer IP address associated with the trap." ::= { saTrapObjects 4 } -- -- trap control -- espAuthFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether espAuthFailureTrap traps should be generated." DEFVAL { false } ::= { saTrapControl 1 } ahAuthFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether ahAuthFailureTrap traps should be generated." DEFVAL { false } ::= { saTrapControl 2 } espReplayFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether espReplayFailureTrap traps should be generated." DEFVAL { false } ::= { saTrapControl 3 } ahReplayFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether ahReplayFailureTrap traps should be generated." DEFVAL { false } ::= { saTrapControl 4 } espPolicyFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether espPolicyFailureTrap traps should be generated." DEFVAL { false } ::= { saTrapControl 5 } ahPolicyFailureTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether ahPolicyFailureTrap traps should be generated." DEFVAL { false } ::= { saTrapControl 6 } invalidSpiTrapEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether invalidSpiTrap traps should be generated." DEFVAL { false } ::= { saTrapControl 7 } -- -- the traps themselves -- espAuthFailureTrap NOTIFICATION-TYPE OBJECTS { ipsecSaEspInAuthErrors } STATUS current DESCRIPTION "IPSec packets with invalid hashes were found in an inbound ESP SA. The total number of authentication errors accumulated is sent for the specific row of the 'ipsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { saTraps 0 1 } ahAuthFailureTrap NOTIFICATION-TYPE OBJECTS { ipsecSaAhInAuthErrors } STATUS current DESCRIPTION "IPSec packets with invalid hashes were found in an inbound AH SA. The total number of authentication errors accumulated is sent for the specific row of the 'ipsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { saTraps 0 2 } espReplayFailureTrap NOTIFICATION-TYPE OBJECTS { ipsecSaEspInReplayErrors } STATUS current DESCRIPTION "IPSec packets with invalid sequence numbers were found in an inbound ESP SA. The total number of replay errors accumulated is sent for the specific row of the 'ipsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { saTraps 0 3 } ahReplayFailureTrap NOTIFICATION-TYPE OBJECTS { ipsecSaAhInReplayErrors } STATUS current DESCRIPTION "IPSec packets with invalid sequence numbers were found in the specified AH SA. The total number of replay errors accumulated is sent for the specific row of the 'ipsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { saTraps 0 4 } espPolicyFailureTrap NOTIFICATION-TYPE OBJECTS { ipsecSaEspInPolicyErrors } STATUS current DESCRIPTION "IPSec packets carrying packets with invalid selectors for the specified ESP SA were found. The total number of policy errors accumulated is sent for the specific row of the 'ipsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { saTraps 0 5 } ahPolicyFailureTrap NOTIFICATION-TYPE OBJECTS { ipsecSaAhInPolicyErrors } STATUS current DESCRIPTION "IPSec packets carrying packets with invalid selectors for the specified AH SA were found. The total number of policy errors accumulated is sent for the specific row of the 'ipsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet." ::= { saTraps 0 6 } espInvalidSpiTrap NOTIFICATION-TYPE OBJECTS { ipsecLocalAddress, ipsecSecurityProtocol, ipsecPeerAddress, ipsecSPI, ifIndex } STATUS current DESCRIPTION "A packet with an unknown SPI was detected from the specified peer with the specified SPI using the specified protocol. The destination address of the received packet is specified by 'ipsecLocalAddress'. The value 'ifIndex' may be 0 if this optional linkage is unsupported. If the object 'ipsecSecurityProtocol' has the value for IPCOMP, then the 'ipsecSPI' object is the CPI of the packet. Implementations SHOULD send one trap per peer (within a reasonable time period), rather than sending one trap per packet." ::= { saTraps 0 7 } END