Graham McIntire
b4f8b40b7f
- Remove PVC volume mount from k8s/deployment.yaml - Delete k8s/mib-pvc.yaml (no longer needed) - Update .gitignore to commit MIB files to git - Add mix import_mibs task to copy MIBs from LibreNMS - Add all MIB files from priv/mibs/ to git This fixes the multi-attach volume error in Kubernetes where new pods couldn't start because the RWO (ReadWriteOnce) PVC was attached to the old pod. MIBs are now part of the Docker image and can be used by all pods simultaneously.
313 lines
11 KiB
Text
313 lines
11 KiB
Text
-- *********************************************************************
|
|
-- CISCO-NAC-TC-MIB.my: Cisco NAC system Textual Conventions
|
|
--
|
|
-- May 2006, Liwei Lue
|
|
--
|
|
-- Copyright (c) 2006-2007 by Cisco Systems, Inc.
|
|
--
|
|
-- All rights reserved.
|
|
-- ********************************************************************
|
|
|
|
CISCO-NAC-TC-MIB DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS
|
|
MODULE-IDENTITY
|
|
FROM SNMPv2-SMI
|
|
TEXTUAL-CONVENTION
|
|
FROM SNMPv2-TC
|
|
ciscoMgmt
|
|
FROM CISCO-SMI;
|
|
|
|
|
|
ciscoNacTcMIB MODULE-IDENTITY
|
|
LAST-UPDATED "200605310000Z"
|
|
ORGANIZATION "Cisco Systems, Inc."
|
|
CONTACT-INFO
|
|
"Cisco Systems
|
|
Customer Service
|
|
|
|
Postal: 170 W Tasman Drive
|
|
San Jose, CA 95134
|
|
USA
|
|
|
|
Tel: +1 800 553-NETS
|
|
|
|
E-mail: cs-nac@cisco.com
|
|
cs-lan-switch-snmp@cisco.com"
|
|
DESCRIPTION
|
|
"This module defines the textual conventions for
|
|
Cisco Network Admission Control(NAC) system.
|
|
|
|
The Cisco Network Admission Control security
|
|
solution offers a systems approach to customers for
|
|
ensuring endpoint device compliancy and vulnerability
|
|
checks prior to production access to the network. Cisco
|
|
refers to these compliancy checks as posture
|
|
validations. The intent of this systems approach is to
|
|
prevent the spread of works, viruses, and rogue
|
|
applications across the network. This systems approach
|
|
requires integration with third party end point security
|
|
applications, as well as endpoint security servers.
|
|
|
|
Terminology used:
|
|
|
|
EOU - Extensible Authentication Protocol over UDP.
|
|
|
|
UCT - Un Conditional Transition.
|
|
|
|
CTA - Cisco Trust Agent.
|
|
|
|
EAP - Extensible Authentication Protocol. An extension
|
|
to PPP.
|
|
|
|
ACS/AAA - Cisco Secure Access Control Server. The
|
|
primary authorization server that is the network policy
|
|
decision point and is extended to support posture
|
|
validation.
|
|
|
|
NAD - Network Access Device that enforces network
|
|
access control policies through layer 2 or layer 3
|
|
challenge-responses with a network enabled Endpoint
|
|
device."
|
|
REVISION "200605310000Z"
|
|
DESCRIPTION
|
|
"The initial version of this MIB module."
|
|
::= { ciscoMgmt 530 }
|
|
|
|
|
|
-- Definitions of textual convention
|
|
|
|
CnnEouState ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Describes the EOU state.
|
|
|
|
initialize(1)
|
|
Indicates that the EOU state is in initialization.
|
|
|
|
State machine enters this state when a new
|
|
IP has been learned on the port. Cleanup of the
|
|
port configuration also force entering this
|
|
state. When entering this state, the followings
|
|
action take place:
|
|
- any previously configured policy are removed
|
|
- frees up any previously allocated memory
|
|
- does a UCT to 'hello' state.
|
|
|
|
hello(2)
|
|
Indicates that the EOU state is in hello state.
|
|
|
|
In this state the device sends a hello
|
|
message to get the association ID of the CTA and
|
|
also to check whether a CTA exists at all. The
|
|
device starts the hello timer and waits till that
|
|
time and if it doesn't get a response, it
|
|
retransmits the hello requests for max-retry times
|
|
before it declares the host as 'clientless'.
|
|
|
|
clientless(3)
|
|
Indicates that the EOU state is in client-less
|
|
state.
|
|
|
|
State machine enters this state when hello response
|
|
is not reached and in this state the device does
|
|
a pseudo authentication to download the policy
|
|
for Non-Responsive hosts and stays in this
|
|
state.
|
|
|
|
eapRequest(4)
|
|
Indicates that the EOU state is in EAP request
|
|
state.
|
|
|
|
In this state, the device sends EAP validate
|
|
requests to the CTA and awaits response from the
|
|
CTA, it starts the retransmit timeout and if
|
|
response is not received before that timer expires,
|
|
it retransmits the EAP requests.
|
|
|
|
response(5)
|
|
Indicates that the EOU state is in EAP response
|
|
state.
|
|
|
|
State machine enters this state when a response for
|
|
the EAP validate request is received from the CTA.
|
|
Device then builds a RADIUS request incorporating
|
|
the EAP packet and sends it to the ACS and awaits
|
|
response from the ACS. If the response from the
|
|
ACS is an access challenge it moves the port the
|
|
'eapRequest' state. But if it's a success, port
|
|
is moved to 'authenticated' state. If its Access-
|
|
Reject, port is moved to 'fail' state.
|
|
|
|
authenticated(6)
|
|
Indicates that the EOU state is in authenticated
|
|
state.
|
|
|
|
In this state policy installation happens and port
|
|
remains in this state until revalidation event is
|
|
triggered because of session timer expiry or when
|
|
status query fails. Status query generation and
|
|
response reception happens in this state only.
|
|
|
|
fail(7)
|
|
Indicates that the EOU state is in failed state.
|
|
|
|
When posture validation fails, system start the
|
|
hold timer and device waits till it expires
|
|
before trying for posture validation again.
|
|
|
|
abort(8)
|
|
Indicates that the EOU state is in abort state.
|
|
|
|
State machine enters this state because of
|
|
failing to complete posture validation due to lack
|
|
of response from CTA/RADIUS or any other reason.
|
|
|
|
aaaFail(9)
|
|
Indicates that the EOU state is in AAA failed
|
|
state.
|
|
|
|
State machine enters this state when RADIUS requests
|
|
to AAA server timeouts either due to the server not
|
|
being reachable or is down.
|
|
|
|
hold(10)
|
|
Indicates that the EOU state is in hold state.
|
|
|
|
This state represents the quiet or idle state
|
|
for the host. The host is put in the hold state
|
|
on events like hello response is not received
|
|
or the AAA server is not reachable. Host
|
|
remains in this state for hold the EOU hold
|
|
timeout period.
|
|
|
|
client(11)
|
|
Indicates that the EOU state is in client state.
|
|
|
|
This state is reached when the host sends a
|
|
response to EOU hello request from the
|
|
authenticating device. This state indicates the
|
|
presence of CTA on the device.
|
|
|
|
server(12)
|
|
Indicates that the EOU state is in server state.
|
|
|
|
This state represents that the authenticating
|
|
device is communicating with the AAA (RADIUS)
|
|
server. This state is reached when host send an
|
|
EOU response."
|
|
SYNTAX INTEGER {
|
|
initialize(1),
|
|
hello(2),
|
|
clientless(3),
|
|
eapRequest(4),
|
|
response(5),
|
|
authenticated(6),
|
|
fail(7),
|
|
abort(8),
|
|
aaaFail(9),
|
|
hold(10),
|
|
client(11),
|
|
server(12)
|
|
}
|
|
|
|
CnnEouAuthType ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Type of authentication for NAD.
|
|
|
|
clientless(1)
|
|
End point device that does not run Cisco
|
|
Trust Agent.
|
|
|
|
eap(2)
|
|
Authorized via Extensible Authentication
|
|
Protocol.
|
|
|
|
static(3)
|
|
Statically authorized or rejected individual
|
|
end point device.
|
|
|
|
unknown(4)
|
|
The authentication type of the endpoint host
|
|
is unknown."
|
|
SYNTAX INTEGER {
|
|
clientless(1),
|
|
eap(2),
|
|
static(3),
|
|
unknown(4)
|
|
}
|
|
|
|
CnnEouDeviceType ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The supported exempt device type on NAD.
|
|
|
|
ciscoIpPhone(1) - Cisco IP Phone"
|
|
SYNTAX INTEGER {
|
|
ciscoIpPhone(1)
|
|
}
|
|
|
|
CnnEouPostureToken ::= TEXTUAL-CONVENTION
|
|
STATUS deprecated
|
|
DESCRIPTION
|
|
"Posture token which representing the endpoint
|
|
device's relative compliance to the network
|
|
compliance policy.
|
|
|
|
unknown(1)
|
|
The posture credentials of the endpoint host
|
|
cannot be determined. The integrity of the
|
|
endpoint should be determined so proper posture
|
|
credentials can be attained and assessed for
|
|
network access authorization.
|
|
|
|
healthy(2)
|
|
The host complies with the currently required
|
|
credentials so no restrictions need to be
|
|
placed on this device.
|
|
|
|
checkup(3)
|
|
The host is within policy but doesn't have the
|
|
latest AV software; update recommended.
|
|
This profile state may be used to signal
|
|
management servers to proactively get this
|
|
machine into the 'healthy' state.
|
|
|
|
quarantine(4)
|
|
The host is out of policy and needs to be
|
|
restricted to a remediation network.
|
|
This device is not actively placing a threat on
|
|
other host but is susceptible to attack or
|
|
infection and should be updated as soon as
|
|
possible.
|
|
|
|
infected(5)
|
|
The host is an active threat to other hosts.
|
|
Network access should be severely restricted
|
|
and placed into remediation or totally denied
|
|
all network access.
|
|
|
|
This TEXTUAL-CONVENTION is deprecated and replaced by
|
|
CnnEouPostureTokenString."
|
|
SYNTAX INTEGER {
|
|
unknown(1),
|
|
healthy(2),
|
|
checkup(3),
|
|
quarantine(4),
|
|
infected(5)
|
|
}
|
|
|
|
CnnEouPostureTokenString ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Posture token which representing the endpoint
|
|
device's relative compliance to the network
|
|
compliance policy.
|
|
|
|
Valid characters are a-z, A-Z, 0-9, ,'#', '-', '_',
|
|
and '.'. Posture token string is case sensitive and
|
|
permits the value of empty string."
|
|
SYNTAX OCTET STRING (SIZE (0..255))
|
|
|
|
END
|