Graham McIntire
b4f8b40b7f
- Remove PVC volume mount from k8s/deployment.yaml - Delete k8s/mib-pvc.yaml (no longer needed) - Update .gitignore to commit MIB files to git - Add mix import_mibs task to copy MIBs from LibreNMS - Add all MIB files from priv/mibs/ to git This fixes the multi-attach volume error in Kubernetes where new pods couldn't start because the RWO (ReadWriteOnce) PVC was attached to the old pod. MIBs are now part of the Docker image and can be used by all pods simultaneously.
2259 lines
78 KiB
Text
2259 lines
78 KiB
Text
RAPID-IPSEC-SA-MON-MIB-EXT DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS
|
|
MODULE-IDENTITY, OBJECT-TYPE, Counter32, Gauge32,
|
|
Integer32, Integer32, NOTIFICATION-TYPE,
|
|
OBJECT-IDENTITY, enterprises
|
|
FROM SNMPv2-SMI
|
|
TEXTUAL-CONVENTION, TruthValue
|
|
FROM SNMPv2-TC
|
|
ifIndex FROM RFC1213-MIB
|
|
IpsecDoiIdentType,
|
|
IpsecDoiEncapsulationMode,
|
|
IpsecDoiEspTransform,
|
|
IpsecDoiAhTransform,
|
|
IpsecDoiAuthAlgorithm,
|
|
IpsecDoiIpcompTransform,
|
|
IpsecDoiSecProtocolId
|
|
FROM IPSEC-ISAKMP-IKE-DOI-TC
|
|
rapidstream
|
|
FROM RAPID-MIB;
|
|
|
|
rsIpsecSaMonModule MODULE-IDENTITY
|
|
LAST-UPDATED "200003211200Z"
|
|
ORGANIZATION "WatchGuard Technologies, Inc."
|
|
CONTACT-INFO
|
|
" Ella Yu
|
|
WatchGuard Technologies, Inc.
|
|
1841 Zanker Road
|
|
San Jose, CA 95112
|
|
USA
|
|
|
|
408-519-4888
|
|
ella.yu@watchguard.com "
|
|
|
|
DESCRIPTION
|
|
"The MIB module describes generic IPSec objects
|
|
defined in IETF working draft
|
|
'draft-ieft-ipsec-monitor-mib-01' and RapidStream's
|
|
extension."
|
|
REVISION "200003211200Z"
|
|
DESCRIPTION
|
|
"Initial revision."
|
|
REVISION "200211011200Z"
|
|
DESCRIPTION
|
|
"Changed CONTACT-INFO."
|
|
::= { rapidstream 3 }
|
|
|
|
IpsecSaCreatorIdent ::= TEXTUAL-CONVENTION
|
|
DISPLAY-HINT "d"
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A value indicating how an SA was created."
|
|
SYNTAX INTEGER {
|
|
unknown(0),
|
|
static(1), -- statically created
|
|
ike(2), -- IKE
|
|
other(3)
|
|
}
|
|
|
|
IpsecIpv6Address ::= TEXTUAL-CONVENTION
|
|
DISPLAY-HINT "2x:2x:2x:2x:2x:2x:1d.1d.1d.1d"
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This data type is used to model IPv6 address prefixes. This
|
|
is a binary string of 16 octets in network byte-order."
|
|
SYNTAX OCTET STRING (SIZE (16))
|
|
|
|
rsIpsecSaMonitorMIB OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all IPSec branches."
|
|
::= { rsIpsecSaMonModule 1 }
|
|
|
|
-- significant branches
|
|
|
|
rsSaTables OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all SA tables."
|
|
::= { rsIpsecSaMonitorMIB 1 }
|
|
|
|
rsSaStatistics OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all objects which
|
|
are global counters for IPSec security associations."
|
|
::= { rsIpsecSaMonitorMIB 2 }
|
|
|
|
rsSaErrors OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all objects which
|
|
are global error counters for IPSec security associations."
|
|
::= { rsIpsecSaMonitorMIB 3 }
|
|
|
|
rsSaTraps OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all objects which
|
|
are traps for IPSec security associations."
|
|
::= { rsIpsecSaMonitorMIB 4 }
|
|
|
|
rsSaTrapObjects OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for objects which are
|
|
used as part of traps."
|
|
::= { rsIpsecSaMonitorMIB 5 }
|
|
|
|
rsSaTrapControl OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all objects which
|
|
are trap controls for IPSec security associations."
|
|
::= { rsIpsecSaMonitorMIB 6 }
|
|
|
|
rsSaGroups OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all objects which
|
|
describe the groups in this MIB."
|
|
::= { rsIpsecSaMonitorMIB 7 }
|
|
|
|
rsSaConformance OBJECT-IDENTITY
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This is the base object identifier for all objects which
|
|
describe the conformance for this MIB."
|
|
::= { rsIpsecSaMonitorMIB 8 }
|
|
|
|
-- the IPSec Inbound ESP MIB-Group
|
|
--
|
|
-- a collection of objects providing information about
|
|
-- IPSec Inbound ESP SAs
|
|
|
|
rsIpsecSaEspInTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF RSIpsecSaEspInEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The (conceptual) table containing information on IPSec
|
|
inbound ESP SAs.
|
|
|
|
There should be one row for every inbound ESP security
|
|
association that exists in the entity. The maximum number of
|
|
rows is implementation dependent."
|
|
::= { rsSaTables 1 }
|
|
|
|
rsIpsecSaEspInEntry OBJECT-TYPE
|
|
SYNTAX RSIpsecSaEspInEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry (conceptual row) containing the information on a
|
|
particular IPSec inbound ESP SA.
|
|
|
|
A row in this table cannot be created or deleted by SNMP
|
|
operations on columns of the table."
|
|
INDEX{ rsIpsecSaEspInAddress, rsIpsecSaEspInSpi }
|
|
::= { rsIpsecSaEspInTable 1 }
|
|
|
|
RSIpsecSaEspInEntry ::= SEQUENCE {
|
|
|
|
rsIpsecSaEspInAddress IpAddress,
|
|
rsIpsecSaEspInSpi Integer32,
|
|
|
|
rsIpsecSaEspInDestId OCTET STRING,
|
|
rsIpsecSaEspInDestIdType IpsecDoiIdentType,
|
|
rsIpsecSaEspInSourceId OCTET STRING,
|
|
rsIpsecSaEspInSourceIdType IpsecDoiIdentType,
|
|
rsIpsecSaEspInProtocol Integer32,
|
|
rsIpsecSaEspInDestPort Integer32,
|
|
rsIpsecSaEspInSourcePort Integer32,
|
|
|
|
rsIpsecSaEspInCreator IpsecSaCreatorIdent,
|
|
|
|
rsIpsecSaEspInEncapsulation IpsecDoiEncapsulationMode,
|
|
rsIpsecSaEspInEncAlg IpsecDoiEspTransform,
|
|
rsIpsecSaEspInEncKeyLength Integer32,
|
|
rsIpsecSaEspInAuthAlg IpsecDoiAuthAlgorithm,
|
|
|
|
rsIpsecSaEspInLimitSeconds Integer32,
|
|
rsIpsecSaEspInLimitKbytes Integer32,
|
|
|
|
rsIpsecSaEspInAccSeconds Counter32,
|
|
rsIpsecSaEspInAccKbytes Counter32,
|
|
rsIpsecSaEspInUserOctets Counter32,
|
|
rsIpsecSaEspInPackets Counter32,
|
|
|
|
rsIpsecSaEspInDecryptErrors Counter32,
|
|
rsIpsecSaEspInAuthErrors Counter32,
|
|
rsIpsecSaEspInReplayErrors Counter32,
|
|
rsIpsecSaEspInPolicyErrors Counter32,
|
|
rsIpsecSaEspInPadErrors Counter32,
|
|
rsIpsecSaEspInOtherReceiveErrors Counter32
|
|
|
|
|
|
}
|
|
|
|
rsIpsecSaEspInAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination address of the SA.
|
|
|
|
For implementations that do not support IPv6, this address
|
|
should appear as one of the IPv4-mapped IPv6 addresses as
|
|
defined in Section 2.5.4 of [IPV6AA].
|
|
|
|
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
|
|
used for IPv4 only nodes, while the prefix
|
|
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
|
|
nodes."
|
|
::= { rsIpsecSaEspInEntry 1 }
|
|
|
|
rsIpsecSaEspInSpi OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The security parameters index of the SA."
|
|
REFERENCE "RFC 2406 Section 2.1"
|
|
::= { rsIpsecSaEspInEntry 2 }
|
|
|
|
rsIpsecSaEspInDestId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (1..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination identifier of the SA, or 0 if unknown or if
|
|
the SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchanged during SA creation negotiation."
|
|
::= { rsIpsecSaEspInEntry 3 }
|
|
|
|
rsIpsecSaEspInDestIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by 'rsIpsecSaEspInDestId',
|
|
or 0 if unknown or if the SA uses transport mode
|
|
encapsulation."
|
|
::= { rsIpsecSaEspInEntry 4 }
|
|
|
|
rsIpsecSaEspInSourceId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (1..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source identifier of the SA, or 0 if unknown or if the
|
|
SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchange during SA creation negotiation."
|
|
::= { rsIpsecSaEspInEntry 5 }
|
|
|
|
rsIpsecSaEspInSourceIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by 'rsIpsecSaEspInSourceId',
|
|
or 0 if unknown or if the SA uses transport mode
|
|
encapsulation."
|
|
::= { rsIpsecSaEspInEntry 6 }
|
|
|
|
rsIpsecSaEspInProtocol OBJECT-TYPE
|
|
SYNTAX Integer32 (0..255)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The transport-layer protocol number that this SA carries,
|
|
or 0 if it carries any protocol."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaEspInEntry 7 }
|
|
|
|
rsIpsecSaEspInDestPort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaEspInEntry 8 }
|
|
|
|
rsIpsecSaEspInSourcePort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaEspInEntry 9 }
|
|
|
|
rsIpsecSaEspInCreator OBJECT-TYPE
|
|
SYNTAX IpsecSaCreatorIdent
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The creator of this SA.
|
|
|
|
This MIB makes no assumptions about how the SAs are created.
|
|
They may be created statically, or by a key exchange
|
|
protocol such as IKE, or by some other method."
|
|
::= { rsIpsecSaEspInEntry 10 }
|
|
|
|
rsIpsecSaEspInEncapsulation OBJECT-TYPE
|
|
SYNTAX IpsecDoiEncapsulationMode
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of encapsulation used by this SA."
|
|
::= { rsIpsecSaEspInEntry 11 }
|
|
|
|
rsIpsecSaEspInEncAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiEspTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the encryption algorithm
|
|
applied to traffic or 0 if there is no encryption used."
|
|
::= { rsIpsecSaEspInEntry 12 }
|
|
|
|
rsIpsecSaEspInEncKeyLength OBJECT-TYPE
|
|
SYNTAX Integer32 (0..65531)
|
|
UNITS "bits"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The length of the encryption key in bits used for the
|
|
algorithm specified in the 'rsIpsecSaEspInEncAlg' object, or 0
|
|
if the key length is implicit in the specified algorithm or
|
|
there is no encryption specified."
|
|
::= { rsIpsecSaEspInEntry 13 }
|
|
|
|
rsIpsecSaEspInAuthAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiAuthAlgorithm
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the hash algorithm applied to
|
|
traffic or 0 if there is no authentication used."
|
|
::= { rsIpsecSaEspInEntry 14 }
|
|
|
|
rsIpsecSaEspInLimitSeconds OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum lifetime in seconds of the SA, or 0 if there is
|
|
no time constraint on its expiration.
|
|
The display value is limited to 4294967295 seconds (more
|
|
than 136 years); values greater than that value will be
|
|
truncated."
|
|
::= { rsIpsecSaEspInEntry 15 }
|
|
|
|
rsIpsecSaEspInLimitKbytes OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum traffic in kilobytes that the SA is allowed to
|
|
support, or 0 if there is no traffic constraint on its
|
|
expiration.
|
|
|
|
The display value is limited to 4294967295 kilobytes; values
|
|
greater than that value will be truncated."
|
|
::= { rsIpsecSaEspInEntry 16 }
|
|
|
|
rsIpsecSaEspInAccSeconds OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of seconds accumulated against the SA's
|
|
expiration by time.
|
|
|
|
This is also the number of seconds that the SA has existed."
|
|
::= { rsIpsecSaEspInEntry 17 }
|
|
|
|
rsIpsecSaEspInAccKbytes OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of traffic accumulated that counts against the
|
|
SA's expiration by traffic limitation, measured in Kbytes.
|
|
|
|
This value may be 0 if the SA does not expire based on
|
|
traffic."
|
|
::= { rsIpsecSaEspInEntry 18 }
|
|
|
|
rsIpsecSaEspInUserOctets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "bytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of user level traffic measured in bytes handled
|
|
by the SA.
|
|
|
|
This is not necessarily the same as the amount of traffic
|
|
applied against the traffic expiration limit."
|
|
::= { rsIpsecSaEspInEntry 19 }
|
|
|
|
rsIpsecSaEspInPackets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets handled by the SA."
|
|
::= { rsIpsecSaEspInEntry 20 }
|
|
|
|
rsIpsecSaEspInDecryptErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to decryption
|
|
errors."
|
|
::= { rsIpsecSaEspInEntry 21 }
|
|
|
|
rsIpsecSaEspInAuthErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to
|
|
authentication errors."
|
|
::= { rsIpsecSaEspInEntry 22 }
|
|
|
|
rsIpsecSaEspInReplayErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to replay
|
|
errors."
|
|
::= { rsIpsecSaEspInEntry 23 }
|
|
|
|
rsIpsecSaEspInPolicyErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to policy
|
|
errors. This includes packets where the next protocol is
|
|
invalid."
|
|
::= { rsIpsecSaEspInEntry 24 }
|
|
|
|
rsIpsecSaEspInPadErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to pad value
|
|
errors.
|
|
|
|
Implementations that do not check this must not support this
|
|
object."
|
|
REFERENCE "RFC 2406 section 2.4"
|
|
::= { rsIpsecSaEspInEntry 25 }
|
|
|
|
rsIpsecSaEspInOtherReceiveErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to errors
|
|
other than decryption, authentication or replay errors. This
|
|
may include packets dropped due to a lack of receive
|
|
buffers, and may include packets dropped due to congestion
|
|
at the decryption element."
|
|
::= { rsIpsecSaEspInEntry 26 }
|
|
|
|
-- the IPSec Inbound AH MIB-Group
|
|
--
|
|
-- a collection of objects providing information about
|
|
-- IPSec Inbound AH SAs
|
|
|
|
rsIpsecSaAhInTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF RSIpsecSaAhInEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The (conceptual) table containing information on IPSec
|
|
inbound AH SAs.
|
|
There should be one row for every inbound AH security
|
|
association that exists in the entity. The maximum number of
|
|
rows is implementation dependent."
|
|
::= { rsSaTables 2 }
|
|
|
|
rsIpsecSaAhInEntry OBJECT-TYPE
|
|
SYNTAX RSIpsecSaAhInEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry (conceptual row) containing the information on a
|
|
particular IPSec inbound AH SA.
|
|
|
|
A row in this table cannot be created or deleted by SNMP
|
|
operations on columns of the table."
|
|
INDEX{ rsIpsecSaAhInAddress, rsIpsecSaAhInSpi }
|
|
::= { rsIpsecSaAhInTable 1 }
|
|
|
|
RSIpsecSaAhInEntry ::= SEQUENCE {
|
|
|
|
rsIpsecSaAhInAddress IpAddress,
|
|
rsIpsecSaAhInSpi Integer32,
|
|
|
|
rsIpsecSaAhInDestId OCTET STRING,
|
|
rsIpsecSaAhInDestIdType IpsecDoiIdentType,
|
|
rsIpsecSaAhInSourceId OCTET STRING,
|
|
rsIpsecSaAhInSourceIdType IpsecDoiIdentType,
|
|
rsIpsecSaAhInProtocol Integer32,
|
|
rsIpsecSaAhInDestPort Integer32,
|
|
rsIpsecSaAhInSourcePort Integer32,
|
|
|
|
rsIpsecSaAhInCreator IpsecSaCreatorIdent,
|
|
|
|
rsIpsecSaAhInEncapsulation IpsecDoiEncapsulationMode,
|
|
rsIpsecSaAhInAuthAlg IpsecDoiAhTransform,
|
|
|
|
rsIpsecSaAhInLimitSeconds Integer32,
|
|
rsIpsecSaAhInLimitKbytes Integer32,
|
|
|
|
rsIpsecSaAhInAccSeconds Counter32,
|
|
rsIpsecSaAhInAccKbytes Counter32,
|
|
rsIpsecSaAhInUserOctets Counter32,
|
|
rsIpsecSaAhInPackets Counter32,
|
|
|
|
-- error statistics
|
|
rsIpsecSaAhInAuthErrors Counter32,
|
|
rsIpsecSaAhInReplayErrors Counter32,
|
|
rsIpsecSaAhInPolicyErrors Counter32,
|
|
rsIpsecSaAhInOtherReceiveErrors Counter32
|
|
}
|
|
|
|
rsIpsecSaAhInAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination address of the SA.
|
|
|
|
For implementations that do not support IPv6, this address
|
|
should appear as one of the IPv4-mapped IPv6 addresses as
|
|
defined in Section 2.5.4 of [IPV6AA].
|
|
|
|
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
|
|
used for IPv4 only nodes, while the prefix
|
|
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
|
|
nodes."
|
|
::= { rsIpsecSaAhInEntry 1 }
|
|
|
|
rsIpsecSaAhInSpi OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The security parameters index of the SA."
|
|
REFERENCE "RFC 2402 Section 2.4"
|
|
::= { rsIpsecSaAhInEntry 2 }
|
|
|
|
rsIpsecSaAhInDestId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (1..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination identifier of the SA, or 0 if unknown or if
|
|
the SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchange during SA creation negotiation."
|
|
::= { rsIpsecSaAhInEntry 3 }
|
|
|
|
rsIpsecSaAhInDestIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by 'rsIpsecSaAhInDestId', or
|
|
0 if unknown or if the SA uses transport mode
|
|
encapsulation."
|
|
::= { rsIpsecSaAhInEntry 4 }
|
|
|
|
rsIpsecSaAhInSourceId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (1..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source identifier of the SA, or 0 if unknown or if the
|
|
SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchange during SA creation negotiation."
|
|
::= { rsIpsecSaAhInEntry 5 }
|
|
|
|
rsIpsecSaAhInSourceIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by 'rsIpsecSaAhInSourceId',
|
|
or 0 if unknown or if the SA uses transport mode
|
|
encapsulation."
|
|
::= { rsIpsecSaAhInEntry 6 }
|
|
|
|
rsIpsecSaAhInProtocol OBJECT-TYPE
|
|
SYNTAX Integer32 (0..255)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The transport-layer protocol number that this SA carries,
|
|
or 0 if it carries any protocol."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaAhInEntry 7 }
|
|
|
|
rsIpsecSaAhInDestPort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaAhInEntry 8 }
|
|
|
|
rsIpsecSaAhInSourcePort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaAhInEntry 9 }
|
|
|
|
rsIpsecSaAhInCreator OBJECT-TYPE
|
|
SYNTAX IpsecSaCreatorIdent
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The creator of this SA.
|
|
|
|
This MIB makes no assumptions about how the SAs are created.
|
|
They may be created statically, or by a key exchange
|
|
protocol such as IKE, or by some other method."
|
|
::= { rsIpsecSaAhInEntry 10 }
|
|
|
|
rsIpsecSaAhInEncapsulation OBJECT-TYPE
|
|
SYNTAX IpsecDoiEncapsulationMode
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of encapsulation used by this SA."
|
|
::= { rsIpsecSaAhInEntry 11 }
|
|
|
|
rsIpsecSaAhInAuthAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiAhTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the hash algorithm applied to
|
|
traffic carried by this SA if it uses ESP or 0 if there is
|
|
no authentication applied by ESP."
|
|
::= { rsIpsecSaAhInEntry 12 }
|
|
|
|
rsIpsecSaAhInLimitSeconds OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum lifetime in seconds of the SA, or 0 if there is
|
|
no time constraint on its expiration.
|
|
|
|
The display value is limited to 4294967295 seconds (more
|
|
than 136 years); values greater than that value will be
|
|
truncated."
|
|
::= { rsIpsecSaAhInEntry 13 }
|
|
|
|
rsIpsecSaAhInLimitKbytes OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum traffic in Kbytes that the SA is allowed to
|
|
support, or 0 if there is no traffic constraint on its
|
|
expiration.
|
|
|
|
The display value is limited to 4294967295 kilobytes; values
|
|
greater than that value will be truncated."
|
|
::= { rsIpsecSaAhInEntry 14 }
|
|
|
|
rsIpsecSaAhInAccSeconds OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of seconds accumulated against the SA's
|
|
expiration by time.
|
|
|
|
This is also the number of seconds that the SA has existed."
|
|
::= { rsIpsecSaAhInEntry 15 }
|
|
|
|
rsIpsecSaAhInAccKbytes OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of traffic accumulated that counts against the
|
|
SA's expiration by traffic limitation, measured in Kbytes.
|
|
This value may be 0 if the SA does not expire based on
|
|
traffic."
|
|
::= { rsIpsecSaAhInEntry 16 }
|
|
|
|
rsIpsecSaAhInUserOctets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "bytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of user level traffic measured in bytes handled
|
|
by the SA.
|
|
|
|
This is not necessarily the same as the amount of traffic
|
|
applied against the traffic expiration limit."
|
|
::= { rsIpsecSaAhInEntry 17 }
|
|
|
|
rsIpsecSaAhInPackets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets handled by the SA."
|
|
::= { rsIpsecSaAhInEntry 18 }
|
|
|
|
rsIpsecSaAhInAuthErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to
|
|
authentication errors."
|
|
::= { rsIpsecSaAhInEntry 19 }
|
|
|
|
rsIpsecSaAhInReplayErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to replay
|
|
errors."
|
|
::= { rsIpsecSaAhInEntry 20 }
|
|
|
|
rsIpsecSaAhInPolicyErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to policy
|
|
errors. This includes packets where the next protocol is
|
|
invalid."
|
|
::= { rsIpsecSaAhInEntry 21 }
|
|
|
|
rsIpsecSaAhInOtherReceiveErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to errors
|
|
other than decryption, authentication or replay errors. This
|
|
may include packets dropped due to a lack of receive
|
|
buffers, and may include packets dropped due to congestion
|
|
at the authentication element."
|
|
::= { rsIpsecSaAhInEntry 22 }
|
|
|
|
|
|
-- the IPSec Inbound IPCOMP MIB-Group
|
|
--
|
|
-- a collection of objects providing information about
|
|
-- IPSec Inbound IPCOMP SAs
|
|
|
|
rsIpsecSaIpcompInTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF RSIpsecSaIpcompInEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The (conceptual) table containing information on IPSec
|
|
inbound IPCOMP SAs.
|
|
|
|
There should be one row for every inbound IPCOMP (security)
|
|
association that exists in the entity. The maximum number of
|
|
rows is implementation dependent."
|
|
::= { rsSaTables 3 }
|
|
|
|
rsIpsecSaIpcompInEntry OBJECT-TYPE
|
|
SYNTAX RSIpsecSaIpcompInEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry (conceptual row) containing the information on a
|
|
particular IPSec inbound IPCOMP SA.
|
|
A row in this table cannot be created or deleted by SNMP
|
|
operations on columns of the table."
|
|
INDEX{ rsIpsecSaIpcompInAddress, rsIpsecSaIpcompInCpi }
|
|
::= { rsIpsecSaIpcompInTable 1 }
|
|
|
|
RSIpsecSaIpcompInEntry ::= SEQUENCE {
|
|
|
|
rsIpsecSaIpcompInAddress IpAddress,
|
|
rsIpsecSaIpcompInCpi IpsecDoiIpcompTransform,
|
|
|
|
rsIpsecSaIpcompInDestId OCTET STRING,
|
|
rsIpsecSaIpcompInDestIdType IpsecDoiIdentType,
|
|
rsIpsecSaIpcompInSourceId OCTET STRING,
|
|
rsIpsecSaIpcompInSourceIdType IpsecDoiIdentType,
|
|
rsIpsecSaIpcompInProtocol Integer32,
|
|
rsIpsecSaIpcompInDestPort Integer32,
|
|
rsIpsecSaIpcompInSourcePort Integer32,
|
|
|
|
rsIpsecSaIpcompInCreator IpsecSaCreatorIdent,
|
|
|
|
rsIpsecSaIpcompInEncapsulation IpsecDoiEncapsulationMode,
|
|
rsIpsecSaIpcompInDecompAlg IpsecDoiIpcompTransform,
|
|
|
|
rsIpsecSaIpcompInSeconds Counter32,
|
|
rsIpsecSaIpcompInUserOctets Counter32,
|
|
rsIpsecSaIpcompInPackets Counter32,
|
|
|
|
rsIpsecSaIpcompInDecompErrors Counter32,
|
|
rsIpsecSaIpcompInOtherReceiveErrors Counter32
|
|
}
|
|
|
|
rsIpsecSaIpcompInAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination address of the SA.
|
|
|
|
For implementations that do not support IPv6, this address
|
|
should appear as one of the IPv4-mapped IPv6 addresses as
|
|
defined in Section 2.5.4 of [IPV6AA].
|
|
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
|
|
used for IPv4 only nodes, while the prefix
|
|
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
|
|
nodes."
|
|
::= { rsIpsecSaIpcompInEntry 1 }
|
|
|
|
rsIpsecSaIpcompInCpi OBJECT-TYPE
|
|
SYNTAX IpsecDoiIpcompTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The CPI of the SA. Since the lower values of CPIs are
|
|
reserved to be the same as the algorithm, the syntax for
|
|
this object is the same as the transform."
|
|
REFERENCE "RFC 2393 Section 3.3"
|
|
::= { rsIpsecSaIpcompInEntry 2 }
|
|
|
|
rsIpsecSaIpcompInDestId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (1..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination identifier of the SA, or 0 if unknown or if
|
|
the SA uses transport mode, or 0 if this SA is used with
|
|
multiple SAs in protection suites.
|
|
|
|
This value, if non-zero, is taken directly from the optional
|
|
ID payloads that are exchange during SA creation
|
|
negotiation."
|
|
::= { rsIpsecSaIpcompInEntry 3 }
|
|
|
|
rsIpsecSaIpcompInDestIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by
|
|
'rsIpsecSaIpcompInDestId', or 0 if unknown or if the SA uses
|
|
transport mode, or 0 if this SA is used with multiple SAs in
|
|
protection suites."
|
|
::= { rsIpsecSaIpcompInEntry 4 }
|
|
|
|
rsIpsecSaIpcompInSourceId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (1..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source identifier of the SA, or 0 if unknown or if the
|
|
SA uses transport mode encapsulation, or 0 if this SA is
|
|
used with multiple SAs in protection suites.
|
|
|
|
This value, if non-zero, is taken directly from the optional
|
|
ID payloads that are exchange during SA creation
|
|
negotiation."
|
|
::= { rsIpsecSaIpcompInEntry 5 }
|
|
|
|
rsIpsecSaIpcompInSourceIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by
|
|
'rsIpsecSaIpcompInSourceId', or 0 if unknown or if the SA uses
|
|
transport mode encapsulation, or 0 if this SA is used with
|
|
multiple SAs in protection suites."
|
|
::= { rsIpsecSaIpcompInEntry 6 }
|
|
|
|
rsIpsecSaIpcompInProtocol OBJECT-TYPE
|
|
SYNTAX Integer32 (0..255)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The transport-layer protocol number that this SA carries,
|
|
or 0 if it carries any protocol."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaIpcompInEntry 7 }
|
|
|
|
rsIpsecSaIpcompInDestPort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaIpcompInEntry 8 }
|
|
|
|
rsIpsecSaIpcompInSourcePort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaIpcompInEntry 9 }
|
|
|
|
rsIpsecSaIpcompInCreator OBJECT-TYPE
|
|
SYNTAX IpsecSaCreatorIdent
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The creator of this SA.
|
|
|
|
This MIB makes no assumptions about how the SAs are created.
|
|
They may be created statically, or by a key exchange
|
|
protocol such as IKE, or by some other method."
|
|
::= { rsIpsecSaIpcompInEntry 10 }
|
|
|
|
rsIpsecSaIpcompInEncapsulation OBJECT-TYPE
|
|
SYNTAX IpsecDoiEncapsulationMode
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of encapsulation used by this SA."
|
|
::= { rsIpsecSaIpcompInEntry 11 }
|
|
|
|
rsIpsecSaIpcompInDecompAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiIpcompTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the decompression algorithm
|
|
applied to traffic."
|
|
::= { rsIpsecSaIpcompInEntry 12 }
|
|
|
|
rsIpsecSaIpcompInSeconds OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of seconds that the SA has existed."
|
|
::= { rsIpsecSaIpcompInEntry 13 }
|
|
|
|
rsIpsecSaIpcompInUserOctets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "bytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of user level traffic measured in bytes handled
|
|
by the SA."
|
|
::= { rsIpsecSaIpcompInEntry 14 }
|
|
|
|
rsIpsecSaIpcompInPackets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets handled by the SA."
|
|
::= { rsIpsecSaIpcompInEntry 15 }
|
|
|
|
rsIpsecSaIpcompInDecompErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to
|
|
decompression errors."
|
|
::= { rsIpsecSaIpcompInEntry 16 }
|
|
|
|
rsIpsecSaIpcompInOtherReceiveErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to errors
|
|
other than decompression errors. This may include packets
|
|
dropped due to a lack of receive buffers, and packets
|
|
dropped due to congestion at the decompression element."
|
|
::= { rsIpsecSaIpcompInEntry 17 }
|
|
|
|
|
|
-- the IPSec Outbound ESP MIB-Group
|
|
--
|
|
-- a collection of objects providing information about
|
|
-- IPSec Outbound ESP SAs
|
|
|
|
rsIpsecSaEspOutTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF RSIpsecSaEspOutEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The (conceptual) table containing information on IPSec
|
|
Outbound ESP SAs.
|
|
|
|
There should be one row for every outbound ESP security
|
|
association that exists in the entity. The maximum number of
|
|
rows is implementation dependent."
|
|
::= { rsSaTables 4 }
|
|
|
|
rsIpsecSaEspOutEntry OBJECT-TYPE
|
|
SYNTAX RSIpsecSaEspOutEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry (conceptual row) containing the information on a
|
|
particular IPSec Outbound ESP SA.
|
|
|
|
A row in this table cannot be created or deleted by SNMP
|
|
operations on columns of the table."
|
|
INDEX{ rsIpsecSaEspOutAddress, rsIpsecSaEspOutSpi }
|
|
::= { rsIpsecSaEspOutTable 1 }
|
|
|
|
RSIpsecSaEspOutEntry ::= SEQUENCE {
|
|
|
|
rsIpsecSaEspOutAddress IpAddress,
|
|
rsIpsecSaEspOutSpi Integer32,
|
|
|
|
rsIpsecSaEspOutSourceId OCTET STRING,
|
|
rsIpsecSaEspOutSourceIdType IpsecDoiIdentType,
|
|
rsIpsecSaEspOutDestId OCTET STRING,
|
|
rsIpsecSaEspOutDestIdType IpsecDoiIdentType,
|
|
rsIpsecSaEspOutProtocol Integer32,
|
|
rsIpsecSaEspOutSourcePort Integer32,
|
|
rsIpsecSaEspOutDestPort Integer32,
|
|
|
|
rsIpsecSaEspOutCreator IpsecSaCreatorIdent,
|
|
|
|
rsIpsecSaEspOutEncapsulation IpsecDoiEncapsulationMode,
|
|
rsIpsecSaEspOutEncAlg IpsecDoiEspTransform,
|
|
rsIpsecSaEspOutEncKeyLength Integer32,
|
|
rsIpsecSaEspOutAuthAlg IpsecDoiAuthAlgorithm,
|
|
|
|
rsIpsecSaEspOutLimitSeconds Integer32,
|
|
rsIpsecSaEspOutLimitKbytes Integer32,
|
|
|
|
rsIpsecSaEspOutAccSeconds Counter32,
|
|
rsIpsecSaEspOutAccKbytes Counter32,
|
|
rsIpsecSaEspOutUserOctets Counter32,
|
|
rsIpsecSaEspOutPackets Counter32,
|
|
|
|
rsIpsecSaEspOutSendErrors Counter32
|
|
}
|
|
|
|
|
|
rsIpsecSaEspOutAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination address of the SA.
|
|
|
|
For implementations that do not support IPv6, this address
|
|
should appear as one of the IPv4-mapped IPv6 addresses as
|
|
defined in Section 2.5.4 of [IPV6AA].
|
|
|
|
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
|
|
used for IPv4 only nodes, while the prefix
|
|
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
|
|
nodes."
|
|
::= { rsIpsecSaEspOutEntry 1 }
|
|
|
|
rsIpsecSaEspOutSpi OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The security parameters index of the SA."
|
|
REFERENCE "RFC 2406 Section 2.1"
|
|
::= { rsIpsecSaEspOutEntry 2 }
|
|
|
|
rsIpsecSaEspOutSourceId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (4..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source identifier of the SA, or 0 if unknown or if the
|
|
SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchange during phase 2 negotiations."
|
|
::= { rsIpsecSaEspOutEntry 3 }
|
|
|
|
rsIpsecSaEspOutSourceIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by
|
|
'rsIpsecSaEspOutSourceId', or 0 if unknown or if the SA uses
|
|
transport mode encapsulation."
|
|
::= { rsIpsecSaEspOutEntry 4 }
|
|
|
|
rsIpsecSaEspOutDestId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (4..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination identifier of the SA, or 0 if unknown or if
|
|
the SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchange during phase 2 negotiations."
|
|
::= { rsIpsecSaEspOutEntry 5 }
|
|
|
|
rsIpsecSaEspOutDestIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by 'rsIpsecSaEspOutDestId',
|
|
or 0 if unknown or if the SA uses transport mode
|
|
encapsulation."
|
|
::= { rsIpsecSaEspOutEntry 6 }
|
|
|
|
rsIpsecSaEspOutProtocol OBJECT-TYPE
|
|
SYNTAX Integer32 (0..255)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The transport-layer protocol number that this SA carries,
|
|
or 0 if it carries any protocol."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaEspOutEntry 7 }
|
|
|
|
rsIpsecSaEspOutSourcePort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaEspOutEntry 8 }
|
|
|
|
rsIpsecSaEspOutDestPort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaEspOutEntry 9 }
|
|
|
|
rsIpsecSaEspOutCreator OBJECT-TYPE
|
|
SYNTAX IpsecSaCreatorIdent
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The creator of this SA.
|
|
|
|
This MIB makes no assumptions about how the SAs are created.
|
|
They may be created statically, or by a key exchange
|
|
protocol such as IKE, or by some other method."
|
|
::= { rsIpsecSaEspOutEntry 10 }
|
|
|
|
rsIpsecSaEspOutEncapsulation OBJECT-TYPE
|
|
SYNTAX IpsecDoiEncapsulationMode
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of encapsulation used by this SA."
|
|
::= { rsIpsecSaEspOutEntry 11 }
|
|
|
|
rsIpsecSaEspOutEncAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiEspTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the encryption algorithm
|
|
applied to traffic or 0 if there is no encryption used."
|
|
::= { rsIpsecSaEspOutEntry 12 }
|
|
|
|
rsIpsecSaEspOutEncKeyLength OBJECT-TYPE
|
|
SYNTAX Integer32 (0..65531)
|
|
UNITS "bits"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The length of the encryption key in bits used for the
|
|
algorithm specified in the 'rsIpsecSaEspOutEncAlg' object, or
|
|
0 if the key length is implicit in the specified algorithm
|
|
or there is no encryption specified."
|
|
::= { rsIpsecSaEspOutEntry 13 }
|
|
|
|
rsIpsecSaEspOutAuthAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiAuthAlgorithm
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the hash algorithm applied to
|
|
traffic or 0 if there is no authentication used."
|
|
::= { rsIpsecSaEspOutEntry 14 }
|
|
|
|
rsIpsecSaEspOutLimitSeconds OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum lifetime in seconds of the SA, or 0 if there is
|
|
no time constraint on its expiration.
|
|
|
|
The display value is limited to 4294967295 seconds (more
|
|
than 136 years); values greater than that value will be
|
|
truncated."
|
|
::= { rsIpsecSaEspOutEntry 15 }
|
|
|
|
rsIpsecSaEspOutLimitKbytes OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum traffic in kbytes that the SA is allowed to
|
|
support, or 0 if there is no traffic constraint on its
|
|
expiration.
|
|
|
|
The display value is limited to 4294967295 kilobytes; values
|
|
greater than that value will be truncated."
|
|
::= { rsIpsecSaEspOutEntry 16 }
|
|
|
|
rsIpsecSaEspOutAccSeconds OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of seconds accumulated against the SA's
|
|
expiration by time.
|
|
|
|
This is also the number of seconds that the SA has existed."
|
|
::= { rsIpsecSaEspOutEntry 17 }
|
|
|
|
rsIpsecSaEspOutAccKbytes OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of traffic accumulated that counts against the
|
|
SA's expiration by traffic limitation, measured in Kbytes.
|
|
|
|
This value may be 0 if the SA does not expire based on
|
|
traffic."
|
|
::= { rsIpsecSaEspOutEntry 18 }
|
|
|
|
rsIpsecSaEspOutUserOctets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "bytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of user level traffic measured in bytes handled
|
|
by the SA.
|
|
|
|
This is not necessarily the same as the amount of traffic
|
|
applied against the traffic expiration limit."
|
|
::= { rsIpsecSaEspOutEntry 19 }
|
|
|
|
rsIpsecSaEspOutPackets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets handled by the SA."
|
|
::= { rsIpsecSaEspOutEntry 20 }
|
|
|
|
rsIpsecSaEspOutSendErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to any error.
|
|
This may include errors due to a lack of transmit buffers."
|
|
::= { rsIpsecSaEspOutEntry 21 }
|
|
|
|
|
|
-- the IPSec Outbound AH MIB-Group
|
|
--
|
|
-- a collection of objects providing information about
|
|
-- IPSec Outbound AH SAs
|
|
|
|
rsIpsecSaAhOutTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF RSIpsecSaAhOutEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The (conceptual) table containing information on IPSec
|
|
Outbound AH SAs.
|
|
|
|
There should be one row for every outbound AH security
|
|
association that exists in the entity. The maximum number of
|
|
rows is implementation dependent."
|
|
::= { rsSaTables 5 }
|
|
|
|
rsIpsecSaAhOutEntry OBJECT-TYPE
|
|
SYNTAX RSIpsecSaAhOutEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry (conceptual row) containing the information on a
|
|
particular IPSec Outbound AH SA.
|
|
|
|
A row in this table cannot be created or deleted by SNMP
|
|
operations on columns of the table."
|
|
INDEX{ rsIpsecSaAhOutAddress, rsIpsecSaAhOutSpi }
|
|
::= { rsIpsecSaAhOutTable 1 }
|
|
|
|
RSIpsecSaAhOutEntry ::= SEQUENCE {
|
|
|
|
rsIpsecSaAhOutAddress IpAddress,
|
|
rsIpsecSaAhOutSpi Integer32,
|
|
|
|
rsIpsecSaAhOutSourceId OCTET STRING,
|
|
rsIpsecSaAhOutSourceIdType IpsecDoiIdentType,
|
|
rsIpsecSaAhOutDestId OCTET STRING,
|
|
rsIpsecSaAhOutDestIdType IpsecDoiIdentType,
|
|
rsIpsecSaAhOutProtocol Integer32,
|
|
rsIpsecSaAhOutSourcePort Integer32,
|
|
rsIpsecSaAhOutDestPort Integer32,
|
|
|
|
rsIpsecSaAhOutCreator IpsecSaCreatorIdent,
|
|
|
|
rsIpsecSaAhOutEncapsulation IpsecDoiEncapsulationMode,
|
|
rsIpsecSaAhOutAuthAlg IpsecDoiAhTransform,
|
|
|
|
rsIpsecSaAhOutLimitSeconds Integer32,
|
|
rsIpsecSaAhOutLimitKbytes Integer32,
|
|
|
|
rsIpsecSaAhOutAccSeconds Counter32,
|
|
rsIpsecSaAhOutAccKbytes Counter32,
|
|
rsIpsecSaAhOutUserOctets Counter32,
|
|
rsIpsecSaAhOutPackets Counter32,
|
|
|
|
rsIpsecSaAhOutSendErrors Counter32
|
|
}
|
|
|
|
|
|
rsIpsecSaAhOutAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination address of the SA.
|
|
|
|
For implementations that do not support IPv6, this address
|
|
should appear as one of the IPv4-mapped IPv6 addresses as
|
|
defined in Section 2.5.4 of [IPV6AA].
|
|
|
|
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
|
|
used for IPv4 only nodes, while the prefix
|
|
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
|
|
nodes."
|
|
::= { rsIpsecSaAhOutEntry 1 }
|
|
|
|
rsIpsecSaAhOutSpi OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The security parameters index of the SA."
|
|
REFERENCE "RFC 2402 Section 2.4"
|
|
::= { rsIpsecSaAhOutEntry 2 }
|
|
|
|
rsIpsecSaAhOutSourceId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (4..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source identifier of the SA, or 0 if unknown or if the
|
|
SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchange during phase 2 negotiations."
|
|
::= { rsIpsecSaAhOutEntry 3 }
|
|
|
|
rsIpsecSaAhOutSourceIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by 'rsIpsecSaAhOutSourceId',
|
|
or 0 if unknown or if the SA uses transport mode
|
|
encapsulation."
|
|
::= { rsIpsecSaAhOutEntry 4 }
|
|
|
|
rsIpsecSaAhOutDestId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (4..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination identifier of the SA, or 0 if unknown or if
|
|
the SA uses transport mode encapsulation.
|
|
|
|
This value is taken directly from the optional ID payloads
|
|
that are exchange during phase 2 negotiations."
|
|
::= { rsIpsecSaAhOutEntry 5 }
|
|
|
|
rsIpsecSaAhOutDestIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by 'rsIpsecSaAhOutDestId',
|
|
or 0 if unknown or if the SA uses transport mode
|
|
encapsulation."
|
|
::= { rsIpsecSaAhOutEntry 6 }
|
|
|
|
rsIpsecSaAhOutProtocol OBJECT-TYPE
|
|
SYNTAX Integer32 (0..255)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The transport-layer protocol number that this SA carries,
|
|
or 0 if it carries any protocol."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaAhOutEntry 7 }
|
|
|
|
rsIpsecSaAhOutSourcePort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaAhOutEntry 8 }
|
|
|
|
rsIpsecSaAhOutDestPort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaAhOutEntry 9 }
|
|
|
|
rsIpsecSaAhOutCreator OBJECT-TYPE
|
|
SYNTAX IpsecSaCreatorIdent
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The creator of this SA.
|
|
|
|
This MIB makes no assumptions about how the SAs are created.
|
|
They may be created statically, or by a key exchange
|
|
protocol such as IKE, or by some other method."
|
|
::= { rsIpsecSaAhOutEntry 10 }
|
|
|
|
rsIpsecSaAhOutEncapsulation OBJECT-TYPE
|
|
SYNTAX IpsecDoiEncapsulationMode
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of encapsulation used by this SA."
|
|
::= { rsIpsecSaAhOutEntry 11 }
|
|
|
|
rsIpsecSaAhOutAuthAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiAhTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the hash algorithm applied to
|
|
traffic or 0 if there is no authentication used."
|
|
::= { rsIpsecSaAhOutEntry 12 }
|
|
|
|
rsIpsecSaAhOutLimitSeconds OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum lifetime in seconds of the SA, or 0 if there is
|
|
no time constraint on its expiration.
|
|
|
|
The display value is limited to 4294967295 seconds (more
|
|
than 136 years); values greater than that value will be
|
|
truncated."
|
|
::= { rsIpsecSaAhOutEntry 13 }
|
|
|
|
rsIpsecSaAhOutLimitKbytes OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The maximum traffic in Kbytes that the SA is allowed to
|
|
support, or 0 if there is no traffic constraint on its
|
|
expiration.
|
|
|
|
The display value is limited to 4294967295 kilobytes; values
|
|
greater than that value will be truncated."
|
|
::= { rsIpsecSaAhOutEntry 14 }
|
|
|
|
rsIpsecSaAhOutAccSeconds OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of seconds accumulated against the SA's
|
|
expiration by time.
|
|
|
|
This is also the number of seconds that the SA has existed."
|
|
::= { rsIpsecSaAhOutEntry 15 }
|
|
|
|
rsIpsecSaAhOutAccKbytes OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "kilobytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of traffic accumulated that counts against the
|
|
SA's expiration by traffic limitation, measured in Kbytes.
|
|
|
|
This value may be 0 if the SA does not expire based on
|
|
traffic."
|
|
::= { rsIpsecSaAhOutEntry 16 }
|
|
|
|
rsIpsecSaAhOutUserOctets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "bytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of user level traffic measured in bytes handled
|
|
by the SA.
|
|
|
|
This is not necessarily the same as the amount of traffic
|
|
applied against the traffic expiration limit."
|
|
::= { rsIpsecSaAhOutEntry 17 }
|
|
|
|
rsIpsecSaAhOutPackets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets handled by the SA."
|
|
::= { rsIpsecSaAhOutEntry 18 }
|
|
|
|
rsIpsecSaAhOutSendErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets discarded by the SA due to any error.
|
|
This may include errors due to a lack of transmit buffers."
|
|
::= { rsIpsecSaAhOutEntry 19 }
|
|
|
|
|
|
-- the IPSec Outbound IPCOMP MIB-Group
|
|
--
|
|
-- a collection of objects providing information about
|
|
-- IPSec Outbound IPCOMP SAs
|
|
|
|
rsIpsecSaIpcompOutTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF RSIpsecSaIpcompOutEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The (conceptual) table containing information on IPSec
|
|
Outbound IPCOMP SAs.
|
|
|
|
There should be one row for every outbound IPCOMP (security)
|
|
association that exists in the entity. The maximum number of
|
|
rows is implementation dependent."
|
|
::= { rsSaTables 6 }
|
|
|
|
rsIpsecSaIpcompOutEntry OBJECT-TYPE
|
|
SYNTAX RSIpsecSaIpcompOutEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry (conceptual row) containing the information on a
|
|
particular IPSec Outbound IPCOMP SA.
|
|
|
|
A row in this table cannot be created or deleted by SNMP
|
|
operations on columns of the table."
|
|
INDEX{ rsIpsecSaIpcompOutAddress, rsIpsecSaIpcompOutCpi }
|
|
::= { rsIpsecSaIpcompOutTable 1 }
|
|
|
|
RSIpsecSaIpcompOutEntry ::= SEQUENCE {
|
|
|
|
rsIpsecSaIpcompOutAddress IpAddress,
|
|
rsIpsecSaIpcompOutCpi IpsecDoiIpcompTransform,
|
|
|
|
rsIpsecSaIpcompOutSourceId OCTET STRING,
|
|
rsIpsecSaIpcompOutSourceIdType IpsecDoiIdentType,
|
|
rsIpsecSaIpcompOutDestId OCTET STRING,
|
|
rsIpsecSaIpcompOutDestIdType IpsecDoiIdentType,
|
|
rsIpsecSaIpcompOutProtocol Integer32,
|
|
rsIpsecSaIpcompOutSourcePort Integer32,
|
|
rsIpsecSaIpcompOutDestPort Integer32,
|
|
|
|
rsIpsecSaIpcompOutCreator IpsecSaCreatorIdent,
|
|
|
|
rsIpsecSaIpcompOutEncapsulation IpsecDoiEncapsulationMode,
|
|
rsIpsecSaIpcompOutCompAlg IpsecDoiIpcompTransform,
|
|
|
|
rsIpsecSaIpcompOutSeconds Counter32,
|
|
rsIpsecSaIpcompOutUserOctets Counter32,
|
|
rsIpsecSaIpcompOutPackets Counter32
|
|
}
|
|
|
|
rsIpsecSaIpcompOutAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination address of the SA.
|
|
|
|
If the IPCOMP SA is shared across multiple SAs in protection
|
|
suites, this value may be 0.
|
|
|
|
For implementations that do not support IPv6, this address
|
|
should appear as one of the IPv4-mapped IPv6 addresses as
|
|
defined in Section 2.5.4 of [IPV6AA].
|
|
|
|
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
|
|
used for IPv4 only nodes, while the prefix
|
|
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
|
|
nodes."
|
|
::= { rsIpsecSaIpcompOutEntry 1 }
|
|
|
|
rsIpsecSaIpcompOutCpi OBJECT-TYPE
|
|
SYNTAX IpsecDoiIpcompTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The CPI of the SA. Since the lower values of CPIs are
|
|
reserved to be the same as the algorithm, the syntax for
|
|
this object is the same as the transform."
|
|
REFERENCE "RFC 2393 Section 3.3"
|
|
::= { rsIpsecSaIpcompOutEntry 2 }
|
|
|
|
rsIpsecSaIpcompOutSourceId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (4..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source identifier of the SA, or 0 if unknown or if the
|
|
SA uses transport mode encapsulation, or 0 if this SA is
|
|
used with multiple SAs in protection suites.
|
|
|
|
This value, if non-zero, is taken directly from the optional
|
|
ID payloads that are exchange during phase 2 negotiations."
|
|
::= { rsIpsecSaIpcompOutEntry 3 }
|
|
|
|
rsIpsecSaIpcompOutSourceIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by
|
|
'rsIpsecSaIpcompOutSourceId', or 0 if unknown or if the SA
|
|
uses transport mode encapsulation, or 0 if this SA is used
|
|
with multiple SAs in protection suites."
|
|
::= { rsIpsecSaIpcompOutEntry 4 }
|
|
|
|
rsIpsecSaIpcompOutDestId OBJECT-TYPE
|
|
SYNTAX OCTET STRING (SIZE (4..255))
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination identifier of the SA, or 0 if unknown or if
|
|
the SA uses transport mode encapsulation, or 0 if this SA is
|
|
used with multiple SAs in protection suites.
|
|
|
|
This value, if non-zero, is taken directly from the optional
|
|
ID payloads that are exchange during phase 2 negotiations."
|
|
::= { rsIpsecSaIpcompOutEntry 5 }
|
|
|
|
rsIpsecSaIpcompOutDestIdType OBJECT-TYPE
|
|
SYNTAX IpsecDoiIdentType
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of identifier presented by
|
|
'rsIpsecSaIpcompOutDestId', or 0 if unknown or if the SA uses
|
|
transport mode encapsulation, or 0 if this SA is used with
|
|
multiple SAs in protection suites."
|
|
::= { rsIpsecSaIpcompOutEntry 6 }
|
|
|
|
rsIpsecSaIpcompOutProtocol OBJECT-TYPE
|
|
SYNTAX Integer32 (0..255)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The transport-layer protocol number that this SA carries,
|
|
or 0 if it carries any protocol."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaIpcompOutEntry 7 }
|
|
|
|
rsIpsecSaIpcompOutSourcePort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaIpcompOutEntry 8 }
|
|
|
|
rsIpsecSaIpcompOutDestPort OBJECT-TYPE
|
|
SYNTAX Integer32 (0.. 65535)
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination port number of the protocol that this SA
|
|
carries, or 0 if it carries any port number."
|
|
REFERENCE "RFC2401 section 4.4.2"
|
|
::= { rsIpsecSaIpcompOutEntry 9 }
|
|
|
|
rsIpsecSaIpcompOutCreator OBJECT-TYPE
|
|
SYNTAX IpsecSaCreatorIdent
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The creator of this SA.
|
|
|
|
This MIB makes no assumptions about how the SAs are created.
|
|
They may be created statically, or by a key exchange
|
|
protocol such as IKE, or by some other method."
|
|
::= { rsIpsecSaIpcompOutEntry 10 }
|
|
|
|
rsIpsecSaIpcompOutEncapsulation OBJECT-TYPE
|
|
SYNTAX IpsecDoiEncapsulationMode
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of encapsulation used by this SA."
|
|
::= { rsIpsecSaIpcompOutEntry 11 }
|
|
|
|
rsIpsecSaIpcompOutCompAlg OBJECT-TYPE
|
|
SYNTAX IpsecDoiIpcompTransform
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A unique value representing the compression algorithm
|
|
applied to traffic."
|
|
::= { rsIpsecSaIpcompOutEntry 12 }
|
|
|
|
rsIpsecSaIpcompOutSeconds OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "seconds"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of seconds that the SA has existed."
|
|
::= { rsIpsecSaIpcompOutEntry 13 }
|
|
|
|
rsIpsecSaIpcompOutUserOctets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
UNITS "bytes"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The amount of user level traffic measured in bytes handled
|
|
by the SA.
|
|
|
|
This is not necessarily the same as the amount of traffic
|
|
applied against the traffic expiration limit."
|
|
::= { rsIpsecSaIpcompOutEntry 14 }
|
|
|
|
rsIpsecSaIpcompOutPackets OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of packets handled by the SA."
|
|
::= { rsIpsecSaIpcompOutEntry 15 }
|
|
|
|
|
|
--
|
|
-- entity IPSec statistics
|
|
--
|
|
rsIpsecEspCurrentInboundSAs OBJECT-TYPE
|
|
SYNTAX Gauge32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The current number of inbound ESP SAs in the entity."
|
|
::= { rsSaStatistics 1 }
|
|
|
|
rsIpsecEspTotalInboundSAs OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of inbound ESP SAs created in the entity
|
|
since boot time."
|
|
::= { rsSaStatistics 2 }
|
|
|
|
rsIpsecEspCurrentOutboundSAs OBJECT-TYPE
|
|
SYNTAX Gauge32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The current number of outbound ESP SAs in the entity."
|
|
::= { rsSaStatistics 3 }
|
|
|
|
rsIpsecEspTotalOutboundSAs OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of outbound ESP SAs created in the entity
|
|
since boot time."
|
|
::= { rsSaStatistics 4 }
|
|
|
|
rsIpsecAhCurrentInboundSAs OBJECT-TYPE
|
|
SYNTAX Gauge32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The current number of inbound AH SAs in the entity."
|
|
::= { rsSaStatistics 5 }
|
|
|
|
rsIpsecAhTotalInboundSAs OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of inbound AH SAs created in the entity
|
|
since boot time."
|
|
::= { rsSaStatistics 6 }
|
|
|
|
rsIpsecAhCurrentOutboundSAs OBJECT-TYPE
|
|
SYNTAX Gauge32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The current number of outbound AH SAs in the entity."
|
|
::= { rsSaStatistics 7 }
|
|
|
|
rsIpsecAhTotalOutboundSAs OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of outbound AH SAs created in the entity
|
|
since boot time."
|
|
::= { rsSaStatistics 8 }
|
|
|
|
rsIpsecIpcompCurrentInboundSAs OBJECT-TYPE
|
|
SYNTAX Gauge32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The current number of inbound IPCOMP SAs in the entity."
|
|
::= { rsSaStatistics 9 }
|
|
|
|
rsIpsecIpcompTotalInboundSAs OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of inbound IPCOMP SAs created in the
|
|
entity since boot time."
|
|
::= { rsSaStatistics 10 }
|
|
|
|
rsIpsecIpcompCurrentOutboundSAs OBJECT-TYPE
|
|
SYNTAX Gauge32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The current number of outbound IPCOMP SAs in the entity."
|
|
::= { rsSaStatistics 11 }
|
|
|
|
rsIpsecIpcompTotalOutboundSAs OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of outbound IPCOMP SAs created in the
|
|
entity since boot time."
|
|
::= { rsSaStatistics 12 }
|
|
|
|
|
|
--
|
|
-- IPSec error counts
|
|
--
|
|
|
|
rsIpsecDecryptionErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of packets received by the entity in SAs
|
|
since boot time with decryption errors."
|
|
::= { rsSaErrors 1 }
|
|
|
|
rsIpsecAuthenticationErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of packets received by the entity in SAs
|
|
since boot time with authentication errors.
|
|
|
|
This includes all packets in which the hash value is
|
|
determined to be invalid, for both ESP and AH SAs."
|
|
::= { rsSaErrors 2 }
|
|
|
|
rsIpsecReplayErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of packets received by the entity in SAs
|
|
since boot time with replay errors."
|
|
::= { rsSaErrors 3 }
|
|
|
|
rsIpsecPolicyErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of packets received by the entity in SAs
|
|
since boot time and discarded due to policy errors. This
|
|
includes packets that had selectors that were invalid for
|
|
the SA that carried them."
|
|
::= { rsSaErrors 4 }
|
|
|
|
rsIpsecOtherReceiveErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of packets received by the entity in SAs
|
|
since boot time and discarded due to errors not due to
|
|
decryption, authentication, replay or policy."
|
|
::= { rsSaErrors 5 }
|
|
|
|
rsIpsecSendErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of packets to be sent by the entity in SAs
|
|
since boot time and discarded due to errors."
|
|
::= { rsSaErrors 6 }
|
|
|
|
rsIpsecUnknownSpiErrors OBJECT-TYPE
|
|
SYNTAX Counter32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The total number of packets received by the entity since
|
|
boot time with SPIs or CPIs that were not valid."
|
|
::= { rsSaErrors 7 }
|
|
|
|
|
|
--
|
|
-- traps
|
|
--
|
|
|
|
--
|
|
-- some objects used in trap reporting
|
|
--
|
|
-- NOTE: A MAX-ACCESS value of 'accessible-for-notify' was wanted
|
|
-- for these objects; this would not compile with smicng 2.2.07
|
|
--
|
|
|
|
rsIpsecSecurityProtocol OBJECT-TYPE
|
|
SYNTAX IpsecDoiSecProtocolId
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A security protocol associated with the trap."
|
|
::= { rsSaTrapObjects 1 }
|
|
|
|
rsIpsecSPI OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An SPI associated with a trap. Where the security protocol
|
|
associated with the trap is IPCOMP, this value has a maximum
|
|
of 65535."
|
|
::= { rsSaTrapObjects 2 }
|
|
|
|
rsIpsecLocalAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A local IP address associated with the trap."
|
|
::= { rsSaTrapObjects 3 }
|
|
|
|
rsIpsecPeerAddress OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A peer IP address associated with the trap."
|
|
::= { rsSaTrapObjects 4 }
|
|
|
|
--
|
|
-- trap control
|
|
--
|
|
|
|
rsEspAuthFailureTrapEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether espAuthFailureTrap traps should be
|
|
generated."
|
|
DEFVAL { false }
|
|
::= { rsSaTrapControl 1 }
|
|
|
|
rsAhAuthFailureTrapEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether ahAuthFailureTrap traps should be
|
|
generated."
|
|
DEFVAL { false }
|
|
::= { rsSaTrapControl 2 }
|
|
|
|
rsEspReplayFailureTrapEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether espReplayFailureTrap traps should be
|
|
generated."
|
|
DEFVAL { false }
|
|
::= { rsSaTrapControl 3 }
|
|
|
|
rsAhReplayFailureTrapEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether ahReplayFailureTrap traps should be
|
|
generated."
|
|
DEFVAL { false }
|
|
::= { rsSaTrapControl 4 }
|
|
|
|
rsEspPolicyFailureTrapEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether espPolicyFailureTrap traps should be
|
|
generated."
|
|
DEFVAL { false }
|
|
::= { rsSaTrapControl 5 }
|
|
|
|
rsAhPolicyFailureTrapEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether ahPolicyFailureTrap traps should be
|
|
generated."
|
|
DEFVAL { false }
|
|
::= { rsSaTrapControl 6 }
|
|
|
|
rsInvalidSpiTrapEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Indicates whether invalidSpiTrap traps should be
|
|
generated."
|
|
DEFVAL { false }
|
|
::= { rsSaTrapControl 7 }
|
|
|
|
--
|
|
-- the traps themselves
|
|
--
|
|
|
|
rsEspAuthFailureTrap NOTIFICATION-TYPE
|
|
OBJECTS {
|
|
rsIpsecSaEspInAuthErrors
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"IPSec packets with invalid hashes were found in an inbound
|
|
ESP SA. The total number of authentication errors
|
|
accumulated is sent for the specific row of the
|
|
'rsIpsecSaEspInTable' table for the SA; this provides the
|
|
identity of the SA in which the error occurred.
|
|
|
|
Implementations SHOULD send one trap per SA (within a
|
|
reasonable time period), rather than sending one trap per
|
|
packet."
|
|
::= { rsSaTraps 0 1 }
|
|
|
|
rsAhAuthFailureTrap NOTIFICATION-TYPE
|
|
OBJECTS {
|
|
rsIpsecSaAhInAuthErrors
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"IPSec packets with invalid hashes were found in an inbound
|
|
AH SA. The total number of authentication errors accumulated
|
|
is sent for the specific row of the 'rsIpsecSaAhInTable' table
|
|
for the SA; this provides the identity of the SA in which
|
|
the error occurred.
|
|
|
|
Implementations SHOULD send one trap per SA (within a
|
|
reasonable time period), rather than sending one trap per
|
|
packet."
|
|
::= { rsSaTraps 0 2 }
|
|
|
|
rsEspReplayFailureTrap NOTIFICATION-TYPE
|
|
OBJECTS {
|
|
rsIpsecSaEspInReplayErrors
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"IPSec packets with invalid sequence numbers were found in
|
|
an inbound ESP SA. The total number of replay errors
|
|
accumulated is sent for the specific row of the
|
|
'rsIpsecSaEspInTable' table for the SA; this provides the
|
|
identity of the SA in which the error occurred.
|
|
|
|
Implementations SHOULD send one trap per SA (within a
|
|
reasonable time period), rather than sending one trap per
|
|
packet."
|
|
::= { rsSaTraps 0 3 }
|
|
|
|
rsAhReplayFailureTrap NOTIFICATION-TYPE
|
|
OBJECTS {
|
|
rsIpsecSaAhInReplayErrors
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"IPSec packets with invalid sequence numbers were found in
|
|
the specified AH SA. The total number of replay errors
|
|
accumulated is sent for the specific row of the
|
|
'rsIpsecSaAhInTable' table for the SA; this provides the
|
|
identity of the SA in which the error occurred.
|
|
|
|
Implementations SHOULD send one trap per SA (within a
|
|
reasonable time period), rather than sending one trap per
|
|
packet."
|
|
::= { rsSaTraps 0 4 }
|
|
|
|
rsEspPolicyFailureTrap NOTIFICATION-TYPE
|
|
OBJECTS {
|
|
rsIpsecSaEspInPolicyErrors
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"IPSec packets carrying packets with invalid selectors for
|
|
the specified ESP SA were found. The total number of policy
|
|
errors accumulated is sent for the specific row of the
|
|
|
|
'rsIpsecSaEspInTable' table for the SA; this provides the
|
|
identity of the SA in which the error occurred.
|
|
|
|
Implementations SHOULD send one trap per SA (within a
|
|
reasonable time period), rather than sending one trap per
|
|
packet."
|
|
::= { rsSaTraps 0 5 }
|
|
|
|
rsAhPolicyFailureTrap NOTIFICATION-TYPE
|
|
OBJECTS {
|
|
rsIpsecSaAhInPolicyErrors
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"IPSec packets carrying packets with invalid selectors for
|
|
the specified AH SA were found. The total number of policy
|
|
errors accumulated is sent for the specific row of the
|
|
'rsIpsecSaAhInTable' table for the SA; this provides the
|
|
identity of the SA in which the error occurred.
|
|
|
|
Implementations SHOULD send one trap per SA (within a
|
|
reasonable time period), rather than sending one trap per
|
|
packet."
|
|
::= { rsSaTraps 0 6 }
|
|
|
|
rsInvalidSpiTrap NOTIFICATION-TYPE
|
|
OBJECTS {
|
|
rsIpsecLocalAddress,
|
|
rsIpsecSecurityProtocol,
|
|
rsIpsecPeerAddress,
|
|
rsIpsecSPI,
|
|
ifIndex
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A packet with an unknown SPI was detected from the
|
|
specified peer with the specified SPI using the specified
|
|
protocol. The destination address of the received packet is
|
|
specified by 'ipsecLocalAddress'.
|
|
|
|
The value 'ifIndex' may be 0 if this optional linkage is
|
|
unsupported.
|
|
|
|
If the object 'ipsecSecurityProtocol' has the value for
|
|
IPCOMP, then the 'ipsecSPI' object is the CPI of the packet.
|
|
Implementations SHOULD send one trap per peer (within a
|
|
reasonable time period), rather than sending one trap per
|
|
packet."
|
|
::= { rsSaTraps 0 7 }
|
|
|
|
|
|
END
|
|
|