Network Working Group Thomas D. Nadeau Internet Draft Subrahmanya Hegde Expires: February 2005 Cisco Systems, Inc. August 2004 Multiprotocol Label Switching (MPLS) Label-Controlled ATM and Frame-Relay Management Interface Definition draft-ietf-mpls-lc-if-mib-03.txt Status of this Memo Abstract This memo defines two MIB modules and corresponding MIB Object Definitions that describe how label switching controlled Frame-Relay and ATM interfaces can be managed given the interface stacking as defined in the MPLS-LSR-STD-MIB and MPLS-TE-STD-MIB. Table of Contents 1. Introduction .............................................. 3 2. Terminology ............................................... 3 3. The SNMP Management Framework ............................. 3 4. Interface Stacking of LC-ATM and LC-FR .................... 5 5. MPLS Label Controlled ATM MIB Definitions ................. 13 6. MPLS Label Controlled Frame Relay MIB Definitions ......... 13 7. Security Considerations ................................... 51 8. References ................................................ 52 9.1 Normative References...................................... 52 9.2 Informative References.................................... 52 10. Authors' Addresses ....................................... 54 11. Full Copyright Statement ................................. 55 12. Intellectual Property Notice ............................ 52 13. IANA Considerations ..................................... 52 14.1. IANA Considerations for MPLS-LC-ATM-STD-MIB ............... 52 14.2. IANA Considerations for MPLS-LC-FR-STD-MIB ................ 52 15 Acknowledgments............................................ 52 1. Introduction This memo defines how label switching controlled Frame-Relay [RFC3034] and ATM [RFC3035] interfaces can be realized given the interface stacking as defined in the MPLS-LSR-STD [LSRMIB] and MPLS-TE-STD [TEMIB] MIBs. This document also contains a MIB module that sparsely augments the MPLS-LSR-STD MIB's MPLS Working Group Expires February 2005 [Page 1] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 mplsInterfaceConfTable in such a way as to identify which MPLS-type interfaces have LC-ATM or LC-FR capabilities. Comments should be made directly to the MPLS mailing list at mpls@uu.net. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119, reference [RFC2119]. 2. Terminology This document uses terminology from the document describing the MPLS architecture [RFC3031], as well as RFC3035 and RFC3034. Specifically, the following terms will be used in this document. LC-FR RFC3034 defines a label switching controlled Frame Relay (LC-FR) interface a Frame-Relay interface controlled by the label switching control component. Packets traversing such an interface carry labels in the DLCI field LC-ATM RFC3035 defines a label switching controlled ATM (LC-ATM) interface as an ATM interface controlled by the label switching control component. When a packet traversing such an interface is received, it is treated as a labeled packet. The packet's top label is inferred either from the contents of the VCI field or the combined contents of the VPI and VCI fields. Any two LDP peers which are connected via an LC-ATM interface will use LDP negotiations to determine which of these cases is applicable to that interface. Static configuration of labels is also possible. When LDP is used to distribute labels for use on label-controlled interfaces, label configuration information may be available in the MPLS-LDP-ATM-STD-MIB [LDPMIB] when LC-ATM interfaces are used, or the MPLS-LDP-FRAME-RELAY-STD-MIB [LDPMIB] when LC-FR interfaces are used. Specifically, 4. The SNMP Management Framework For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 [RFC3410]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB MPLS Working Group Expires February 2005 [Page 2] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. 5. Interface Stacking of LC-ATM Since LC-ATM interfaces [RFC2863] can carry labeled MPLS traffic, they too are considered MPLS subinterfaces with ifType = mpls(166). They differ slightly in their capability from a packet-oriented MPLS interface in that they may carry ATM or Frame-Relay encapsulated traffic. It is thus beneficial to identify them as such. To identify them as such, two tables are defined which extend the MPLS-LSR-STD MIB's mplsInterfaceTable (see section 6 for LC-ATM or 7 for LC-FR). 6. MPLS Label Controlled ATM MIB Definitions MPLS-LC-ATM-STD-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE FROM SNMPv2-SMI MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF RowStatus, StorageType, TruthValue FROM SNMPv2-TC AtmVpIdentifier FROM ATM-TC-MIB -- RFC2514 mplsStdMIB, MplsAtmVcIdentifier FROM MPLS-TC-STD-MIB mplsInterfaceIndex FROM MPLS-LSR-STD-MIB ; mplsLcAtmStdMIB MODULE-IDENTITY LAST-UPDATED "200405011200Z" -- 01 May 2004 12:00:00 GMT ORGANIZATION "Multiprotocol Label Switching (MPLS) Working Group" CONTACT-INFO " Thomas D. Nadeau Postal: Cisco Systems, Inc. 250 Apollo Drive Chelmsford, MA 01824 Tel: +1-978-244-3051 Email: tnadeau@cisco.com Subrahmanya Hegde Postal: Cisco Systems, Inc. 225 East Tazman Drive Tel: +1-408-525-6562 Email: subrah@cisco.com MPLS Working Group Expires February 2005 [Page 3] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 General comments should be sent to mpls@uu.net " DESCRIPTION "This MIB contains managed object definitions for MPLS Label Controlled ATM interfaces as defined in RFC3035. Copyright (C) The Internet Society (2004). This version of this MIB module is part of RFCXXXX; see the RFC itself for full legal notices." -- RFC Editor please fill in XXXX -- Revision history. REVISION "200405011200Z" -- 01 May 2004 12:00:00 GMT DESCRIPTION "Initial revision, published as part of RFC XXXX." ::= { mplsStdMIB 999 } -- To Be Assigned by IANA -- Top level components of this MIB. -- Tables, Scalars, Notifications, Conformance mplsLcAtmStdNotifications OBJECT IDENTIFIER ::= { mplsLcAtmStdMIB 0 } mplsLcAtmStdObjects OBJECT IDENTIFIER ::= { mplsLcAtmStdMIB 1 } mplsLcAtmStdConformance OBJECT IDENTIFIER ::= { mplsLcAtmStdMIB 2 } -- MPLS LC-ATM Interface Configuration Table. mplsLcAtmStdInterfaceConfTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsLcAtmStdInterfaceConfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per-interface MPLS LC-ATM capability and associated information. In particular, this table sparsely augments the MPLS-LSR-STD-MIB's mplsInterfaceConfTable." ::= { mplsLcAtmStdObjects 1 } mplsLcAtmStdInterfaceConfEntry OBJECT-TYPE SYNTAX MplsLcAtmStdInterfaceConfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in this table is created by an LSR for every interface capable of supporting MPLS LC-ATM. Each entry in this table will exist only if a corresponding entry in ifTable and mplsInterfaceConfTable MPLS Working Group Expires February 2005 [Page 4] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 exist. If the associated entries in ifTable and mplsInterfaceConfTable are deleted, the corresponding entry in this table must also be deleted shortly thereafter. " INDEX { mplsInterfaceIndex } ::= { mplsLcAtmStdInterfaceConfTable 1 } MplsLcAtmStdInterfaceConfEntry ::= SEQUENCE { mplsLcAtmStdCtrlVpi AtmVpIdentifier, mplsLcAtmStdCtrlVci MplsAtmVcIdentifier, mplsLcAtmStdUnlabTrafVpi AtmVpIdentifier, mplsLcAtmStdUnlabTrafVci MplsAtmVcIdentifier, mplsLcAtmStdVcMerge TruthValue, mplsLcAtmVcDirectlyConnected TruthValue, mplsLcAtmLcAtmVPI AtmVpIdentifier, mplsLcAtmStdIfConfRowStatus RowStatus, mplsLcAtmStdIfConfStoreType StorageType } mplsLcAtmStdCtrlVpi OBJECT-TYPE SYNTAX AtmVpIdentifier MAX-ACCESS read-create STATUS current DESCRIPTION "This is the VPI value over which this LSR is willing to accept control traffic on this interface." ::= { mplsLcAtmStdInterfaceConfEntry 1 } mplsLcAtmStdCtrlVci OBJECT-TYPE SYNTAX MplsAtmVcIdentifier MAX-ACCESS read-create STATUS current DESCRIPTION "This is the VCI value over which this LSR is willing to accept control traffic on this interface." ::= { mplsLcAtmStdInterfaceConfEntry 2 } mplsLcAtmStdUnlabTrafVpi OBJECT-TYPE SYNTAX AtmVpIdentifier MAX-ACCESS read-create STATUS current DESCRIPTION "This is the max VPI value over which this LSR is willing to accept unlabeled traffic on this interface." ::= { mplsLcAtmStdInterfaceConfEntry 3 } mplsLcAtmStdUnlabTrafVci OBJECT-TYPE MPLS Working Group Expires February 2005 [Page 5] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 SYNTAX MplsAtmVcIdentifier MAX-ACCESS read-create STATUS current DESCRIPTION "This is the VCI value over which this LSR is willing to accept unlabled traffic on this interface." ::= { mplsLcAtmStdInterfaceConfEntry 4 } mplsLcAtmStdVcMerge OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION "If set to true(1), indicates that this interface is capabile of ATM VC merge, otherwise it MUST be set to false(2)." DEFVAL { false } ::= { mplsLcAtmStdInterfaceConfEntry 5 } mplsLcAtmVcDirectlyConnected OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION "This value indicates whether an LC-ATM is directly or indirectly (by means of a VP) connected. If set to true(0), indicates that this interface is directly connected LC-ATM, otherwise it MUST be set to false(1)." DEFVAL { true } ::= { mplsLcAtmStdInterfaceConfEntry 6 } mplsLcAtmLcAtmVPI OBJECT-TYPE SYNTAX AtmVpIdentifier MAX-ACCESS read-create STATUS current DESCRIPTION "This is the VPI value used for indirectly connected LC-ATM interfaces For indirectly connected interfaces, the VPI field is not available to MPLS, and the label MUST be encoded entirely within the VCI field. (see RFC 3035). If the interface is directly connected, this value MUST be set to zero." DEFVAL { 0 } ::= { mplsLcAtmStdInterfaceConfEntry 7 } mplsLcAtmStdIfConfRowStatus OBJECT-TYPE SYNTAX RowStatus MPLS Working Group Expires February 2005 [Page 6] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 MAX-ACCESS read-create STATUS current DESCRIPTION "This is object is used to create and delete entries in this table. When configuring entries in this table, the corresponding ifEntry and mplsInterfaceConfEntry MUST exist before hand. If an entry is attempted to be created by a manager for a corresponding mplsInterfaceConfEntry that does not support LC-ATM, the agent MUST return an inconsistentValue error. If this table is implemented read-only, then the agent must set this object to active(1) when this row is made active. If this table is implemented writable, then an agent MUST not allow modification to its objects once this value is set to active(1)." ::= { mplsLcAtmStdInterfaceConfEntry 8 } mplsLcAtmStdIfConfStoreType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "This SNMP storage type for this entry. All objects are writable for permanent objects." ::= { mplsLcAtmStdInterfaceConfEntry 9 } -- End of mplsLcAtmStdInterfaceConfTable -- Module compliance. mplsLcAtmStdCompliances OBJECT IDENTIFIER ::= { mplsLcAtmStdConformance 1 } mplsLcAtmStdGroups OBJECT IDENTIFIER ::= { mplsLcAtmStdConformance 2 } -- Compliance requirement for full compliance mplsLcAtmStdModuleFullCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Compliance statement for agents that provide full support for MPLS-LC-ATM-STD-MIB. Such devices can be monitored and also be configured using this MIB module." MODULE -- this module MANDATORY-GROUPS { mplsLcAtmStdIfGroup } MPLS Working Group Expires February 2005 [Page 7] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 ::= { mplsLcAtmStdCompliances 1 } -- Compliance requirement for read-only implementations. mplsLcAtmStdModuleROCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Compliance requirement for implementations that only provide read-only support for MPLS-LC-ATM-STD-MIB. Such devices can be monitored but cannot be configured using this MIB module. " MODULE -- this module MANDATORY-GROUPS { mplsLcAtmStdIfGroup } -- mplsLcAtmStdInterfaceConfTable OBJECT mplsLcAtmStdCtrlVpi MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcAtmStdCtrlVci MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcAtmStdUnlabTrafVpi MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcAtmStdUnlabTrafVci MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcAtmStdVcMerge MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcAtmStdIfConfRowStatus MIN-ACCESS read-only DESCRIPTION "Write access is not required." MPLS Working Group Expires February 2005 [Page 8] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 OBJECT mplsLcAtmVcDirectlyConnected MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcAtmLcAtmVPI MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcAtmStdIfConfStoreType MIN-ACCESS read-only DESCRIPTION "Write access is not required." ::= { mplsLcAtmStdCompliances 2 } -- Units of conformance. mplsLcAtmStdIfGroup OBJECT-GROUP OBJECTS { mplsLcAtmStdCtrlVpi, mplsLcAtmStdCtrlVci, mplsLcAtmStdUnlabTrafVpi, mplsLcAtmStdUnlabTrafVci, mplsLcAtmStdVcMerge, mplsLcAtmVcDirectlyConnected, mplsLcAtmLcAtmVPI, mplsLcAtmStdIfConfRowStatus, mplsLcAtmStdIfConfStoreType } STATUS current DESCRIPTION "Collection of objects needed for MPLS LC-ATM interface configuration." ::= { mplsLcAtmStdGroups 1 } END 7. MPLS Label Controlled Frame-Relay MIB Definitions MPLS-LC-FR-STD-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE FROM SNMPv2-SMI MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF RowStatus, StorageType FROM SNMPv2-TC MPLS Working Group Expires February 2005 [Page 9] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 mplsInterfaceIndex FROM MPLS-LSR-STD-MIB DLCI FROM FRAME-RELAY-DTE-MIB -- RFC2115 mplsStdMIB FROM MPLS-TC-STD-MIB ; mplsLcFrStdMIB MODULE-IDENTITY LAST-UPDATED "200405011200Z" -- 01 May 2004 12:00:00 GMT ORGANIZATION "Multiprotocol Label Switching (MPLS) Working Group" CONTACT-INFO " Thomas D. Nadeau Cisco Systems, Inc. Email: tnadeau@cisco.com Subrahmanya Hegde Email: subrah@cisco.com General comments should be sent to mpls@uu.net " DESCRIPTION "This MIB contains managed object definitions for MPLS Label Controlled Frame-Relay interfaces as defined in RFC3034. Copyright (C) The Internet Society (2004). This version of this MIB module is part of RFCXXXX; see the RFC itself for full legal notices." -- RFC Editor please fill in XXXX -- Revision history. REVISION "200405011200Z" -- 01 May 2004 12:00:00 GMT DESCRIPTION "Initial draft revision." ::= { mplsStdMIB XXX } -- To Be Assigned by IANA -- Top level components of this MIB. -- Tables, Scalars, Notifications, Conformance mplsLcFrStdNotifications OBJECT IDENTIFIER ::= { mplsLcFrStdMIB 0 } mplsLcFrStdObjects OBJECT IDENTIFIER ::= { mplsLcFrStdMIB 1 } mplsLcFrStdConformance OBJECT IDENTIFIER ::= { mplsLcFrStdMIB 2 } -- MPLS LC-FR Interface Configuration Table. mplsLcFrStdInterfaceConfTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsLcFrStdInterfaceConfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per-interface MPLS LC-FR MPLS Working Group Expires February 2005 [Page 10] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 capability and associated information. In particular, this table sparsely augments the MPLS-LSR-STD-MIB's mplsInterfaceConfTable." ::= { mplsLcFrStdObjects 1 } mplsLcFrStdInterfaceConfEntry OBJECT-TYPE SYNTAX MplsLcFrStdInterfaceConfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in this table is created by an LSR for every interface capable of supporting MPLS LC-FR. Each entry in this table will exist only if a corresponding entry in ifTable and mplsInterfaceConfTable exist. If the associated entries in ifTable and mplsInterfaceConfTable are deleted, the corresponding entry in this table must also be deleted shortly thereafter. " INDEX { mplsInterfaceIndex } ::= { mplsLcFrStdInterfaceConfTable 1 } MplsLcFrStdInterfaceConfEntry ::= SEQUENCE { mplsLcFrStdTrafficMinDlci DLCI, mplsLcFrStdTrafficMaxDlci DLCI, mplsLcFrStdCtrlMinDlci DLCI, mplsLcFrStdCtrlMaxDlci DLCI, mplsLcFrStdInterfaceConfRowStatus RowStatus, mplsLcFrStdInterfaceConfStoreType StorageType } mplsLcFrStdTrafficMinDlci OBJECT-TYPE SYNTAX DLCI MAX-ACCESS read-create STATUS current DESCRIPTION "This is the minimum DLCI value over which this LSR is willing to accept traffic on this interface." ::= { mplsLcFrStdInterfaceConfEntry 1 } mplsLcFrStdTrafficMaxDlci OBJECT-TYPE SYNTAX DLCI MAX-ACCESS read-create STATUS current DESCRIPTION "This is the max DLCI value over which this LSR is willing to accept traffic on this interface." ::= { mplsLcFrStdInterfaceConfEntry 2 } MPLS Working Group Expires February 2005 [Page 11] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 mplsLcFrStdCtrlMinDlci OBJECT-TYPE SYNTAX DLCI MAX-ACCESS read-create STATUS current DESCRIPTION "This is the min DLCI value over which this LSR is willing to accept control traffic on this interface." ::= { mplsLcFrStdInterfaceConfEntry 3 } mplsLcFrStdCtrlMaxDlci OBJECT-TYPE SYNTAX DLCI MAX-ACCESS read-create STATUS current DESCRIPTION "This is the max DLCI value over which this LSR is willing to accept control traffic on this interface." ::= { mplsLcFrStdInterfaceConfEntry 4 } mplsLcFrStdInterfaceConfRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This is object is used to create and delete entries in this table. When configuring entries in this table, the corresponding corresponding ifEntry and mplsInterfaceConfEntry MUST exist before hand. If an entry is attempted to be created by a manager for a corresponding mplsInterfaceConfEntry that does not support LC-FR, the agent MUST return an inconsistentValue error. If this table is implemented read-only, then the agent must set this object to active(1) when this row is made active. If this table is implemented writable, then an agent MUST not allow modification to its objects once this value is set to active(1)." ::= { mplsLcFrStdInterfaceConfEntry 5 } mplsLcFrStdInterfaceConfStoreType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "This SNMP storage type for this entry. All objects are writable for permanent entries." ::= { mplsLcFrStdInterfaceConfEntry 6 } -- End of mplsLcFrStdInterfaceConfTable MPLS Working Group Expires February 2005 [Page 12] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 -- Module compliance. mplsLcFrStdCompliances OBJECT IDENTIFIER ::= { mplsLcFrStdConformance 1 } mplsLcFrStdGroups OBJECT IDENTIFIER ::= { mplsLcFrStdConformance 2 } -- Compliance requirement for full compliance mplsLcFrStdModuleFullCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Compliance statement for agents that provide full support for MPLS-LC-FR-STD-MIB. Such devices can be monitored and also be configured using this MIB module." MODULE -- this module MANDATORY-GROUPS { mplsLcFrStdIfGroup } ::= { mplsLcFrStdCompliances 1 } -- Compliance requirement for read-only implementations. mplsLcFrStdModuleReadOnlyCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Compliance requirement for implementations that only provide read-only support for MPLS-LC-FR-STD-MIB. Such devices can be monitored but cannot be configured using this MIB module. " MODULE -- this module -- The mandatory groups have to be implemented -- by all LSRs. However, they may all be supported -- as read-only objects in the case where manual -- configuration is unsupported. MANDATORY-GROUPS { mplsLcFrStdIfGroup } -- mplsLcFrStdInterfaceConfTable OBJECT mplsLcFrStdTrafficMinDlci MIN-ACCESS read-only MPLS Working Group Expires February 2005 [Page 13] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 DESCRIPTION "Write access is not required." OBJECT mplsLcFrStdTrafficMaxDlci MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcFrStdCtrlMinDlci MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcFrStdCtrlMaxDlci MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcFrStdInterfaceConfRowStatus MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsLcFrStdInterfaceConfStoreType MIN-ACCESS read-only DESCRIPTION "Write access is not required." ::= { mplsLcFrStdCompliances 2 } -- Units of conformance. mplsLcFrStdIfGroup OBJECT-GROUP OBJECTS { mplsLcFrStdTrafficMinDlci, mplsLcFrStdTrafficMaxDlci, mplsLcFrStdCtrlMinDlci, mplsLcFrStdCtrlMaxDlci, mplsLcFrStdInterfaceConfRowStatus, mplsLcFrStdInterfaceConfStoreType } STATUS current DESCRIPTION "Collection of objects needed for MPLS LC-FR interface configuration." ::= { mplsLcFrStdGroups 1 } END 8. Security Considerations MPLS Working Group Expires February 2005 [Page 14] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 It is clear that these MIB modules are potentially useful for monitoring of MPLS LSRs supporting LC-ATM and/or LC-FR. These MIB can also be used for configuration of certain objects, and anything that can be configured can be incorrectly configured, with potentially disastrous results. There are a number of management objects defined in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. These are the tables and objects and their sensitivity/vulnerability: o the MplsLcAtmStdInterfaceConfTable and mplsLcFrStdInterfaceConfTable collectively contain objects which may be used to provision MPLS LC or FR-enabled interfaces. Unauthorized access to objects in these tables, could result in disruption of traffic on the network. This is especially true if traffic has been established over these interfaces. The use of stronger mechanisms such as SNMPv3 security should be considered where possible. Specifically, SNMPv3 VACM and USM MUST be used with any v3 agent which implements this MIB module. Administrators should consider whether read access to these objects should be allowed, since read access may be undesirable under certain circumstances. Some of the readable objects in this MIB module "i.e., objects with a MAX-ACCESS other than not-accessible" may be considered sensitive or vulnerable in some network environments. It is thus important to control even GET and/or NOTIFY access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP. These are the tables and objects and their sensitivity/vulnerability: o the MplsLcAtmStdInterfaceConfTable and mplsLcFrStdInterfaceConfTable collectively collectively show the LC-ATM and/or LC-FR interfaces, their associated configurations and their linkages to other MPLS-related configuration and/or performanc statistics. Administrators not wishing to reveal this information should consider these objects sensitive/vulnerable and take precautions so they are not revealed. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure "for example by using IPSec", even then, there is no control as to who on the secure network is allowed to access and GET/SET "read/change/create/delete" the objects MPLS Working Group Expires February 2005 [Page 15] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework "see [RFC3410], section 8", including full support for the SNMPv3 cryptographic mechanisms "for authentication and privacy". Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module, is properly configured to give access to the objects only to those principals "users" that have legitimate rights to indeed GET or SET "change/create/delete" them. 9. References 9.1 Normative References [RFC2115] [RFC2514] [RFC2119] S. Bradner, "Key Words for use in RFCs to Indicate Requirement Levels", RFC 2119, BCP 14, March 1997. [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M., and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M., and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M., and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB", RFC 2863, June 2000. [RFC3031] Rosen, E., Viswanathan, A., and R. Callon, "Multiprotocol Label Switching Architecture", RFC 3031, January 2001. [TEMIB] Srinivasan, C., Viswanathan, A. and Nadeau, T., "MPLS Traffic Engineering Management Information Base ", RFC3812, June 2004. MPLS Working Group Expires February 2005 [Page 16] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 [LSRMIB] Srinivasan, C., Viswanathan, A. and T. Nadeau, "MPLS Multiprotocol Label Switching (MPLS) Label Switch Router Management Information Base ", RFC3813, June 2004. [TCMIB] Nadeau, T., Cucchiara, J., Editors, "Definition of Textual Conventions and OBJECT- IDENTITIES for Multi-Protocol Label Switching (MPLS) Management", RFC3811, June 2004. 9.2 Informative References [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002. [LDPMIB] J. Cucchiara, et al., "Definitions of Managed Objects for the Multiprotocol Label Switching, Label Distribution Protocol (LDP)", , November 2003. 10. Authors' Addresses Thomas D. Nadeau Cisco Systems, Inc. 300 Beaver Brook Road Boxboro, MA 01719 Phone: +1-978-936-1470 Email: tnadeau@cisco.com Subrahmanya Hegde Cisco Systems, Inc. 225 East Tazman Drive San Jose, CA Phone: +1-408-525-6562 Email: subrah@cisco.com 11. Full Copyright Statement Copyright (C) The Internet Society (2004). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without MPLS Working Group Expires February 2005 [Page 17] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 12. Intellectual Property Notice The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11 [RFC2028]. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director. 13. IANA Considerations As described in and as requested in the MPLS-TC-STD-MIB [TCMIB], MPLS related standards track MIB modules should be rooted under the mplsStdMIB subtree. There are 2 MPLS MIB Modules contained in this document, each of the following "IANA Considerations" subsections requests IANA for a new assignment under the mplsStdMIB subtree. New assignments can only be made via a Standards Action as specified in [RFC2434]. MPLS Working Group Expires February 2005 [Page 18] Internet Draft MPLS-LC-ATM/MPLS-LC-FR-MIB August 17, 2004 14.1. IANA Considerations for MPLS-LC-ATM-STD-MIB The IANA is requested to assign { mplsStdMIB 9 } to the MPLS-LC-ATM-STD-MIB module specified in this document. 14.2. IANA Considerations for MPLS-LC-FR-STD-MIB The IANA is requested to assign { mplsStdMIB 10 } to the MPLS-LC-FR-STD-MIB module specified in this document. 15. Acknowledgments We wish to thank Joan Cucchiara for her comments on this document. MPLS Working Group Expires February 2005 [Page 19]