Internet Engineering Task Force C. Madson, Cisco Systems Inc. IPsec Working Group L. Temoshenko, Cisco Systems. INTERNET-DRAFT: C. Pellecuru, Cisco Systems. Expires in six months B. Harrison, Tivoli Systems. S. Ramakrishnan, Cisco Systems. 21 April 2001 IPsec Flow Monitoring MIB Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. This document is a submission to the IETF Internet Protocol Security Working Group. Comments are solicited and should be addressed to the working group mailing list (ipsec@lists.tislabs.com) or to the editor(s). Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/1id-abstracts.html The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. To learn the current status of any Internet-Draft, please check the "id- abstracts.txt" listing contained in the Internet-Drafts Shadow Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe), munnari.oz.au (Pacific Rim), ftp.ietf.org (US East Coast), or ftp.isi.edu (US West Coast). Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2001). All Rights Reserved. Abstract IPsec Working Group Expires October 2001 [Page 1] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 This document describes a high-level MIB for monitoring, accounting trending and failure detection for IPsec-based VPNs. Optional features of the MIB include trending of IPsec-related metrics and archiving of VPN failures. Table of Contents 1. Introduction ..............................................2 1.1 Overview ..................................................2 1.2 The SNMPv2 Network Management Framework ...................3 2. Architecture of the MIB ...................................4 3. MIB Group Definitions .....................................5 3.1 IPsec Levels Group ........................................5 3.2 IPsec Phase-1 Group .......................................5 3.3 IPsec Phase-2 Group .......................................6 3.4 IPsec History Group .......................................8 3.4.1 Journaling Active Tunnels ................................9 3.5 IPsec Failure Group .......................................9 3.6 IPsec Trap Control Group .................................10 4. Elements Relegated to Future Versions ....................10 5. MIB Definitions ..........................................11 6. Intellectual Property ...................................138 7. Acknowledgments .........................................139 8. Security Considerations .................................139 9. References ..............................................139 10. Editors' Addresses ......................................142 11. Expiration ..............................................142 12. Full Copyright Statement ................................142 IPsec Working Group Expires October 2001 [Page 2] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 1. Introduction 1.1. Overview As VPN technology in the shape of IPsec is deployed, customers, particularly large enterprise and Service Providers, are requiring a standard way to monitor their VPNs. Service Providers in particular are often required to maintain service level agreements (SLAs) that guarantee quality and performance to their customers. In addition to this the provider must be able to accurately bill customers. Both enterprise customers and providers collect usage statistics for capacity planning and to ensure sufficient resources are available for redundancy and high availability. This document defines a high level MIB for monitoring, trending and troubleshooting IPsec connections. The metrics defined by this MIB may be used to identify trends and enforce service level agreements. The troubleshooting functionality is in the form of records of failure events and traps sent as a result of operational failures during the setting up, tearing down and normal lifetime of IPsec flows. It is meant as an indication of failure to the personnel of a Network Operation Center. This MIB does not present in-depth low level debugging and diagnostic support that may be used by implementers of IPsec, but rather, it may be seen as complementary to such a MIB. This MIB does not provide support for the configuration of IPsec-capable devices. The definition presented is driven by customer requirements for a MIB encompassing statistics collection that may be used for accounting purposes, trending as well as status monitoring, error collection and real-time alerting via traps. The MIB has been designed based on specific requirements from service providers that want to offer an outsourced VPN service to customers, with the main focuses being: provision of services in such a way that satisfies Service Level Agreements, support for a multi-vendor environment, and incorporation with existing network management software. The MIB was designed in 1999 and has since evolved with the experience in its deployment in the field. Section 2 describes the architecture and abstractions defined by the MIB. This section is important for understanding the remaining sections. Section 3 describes various object groups defined in the MIB. These include the Levels group, the IPsec Phase-1 group, IPsec Phase-2 IPsec Working Group Expires October 2001 [Page 3] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 group, the history group, the VPN failure group and finally the notifications group. Important relationships between the groups have also been highlighted. Section 4 lists the items that are planned to be included in the MIB in the next revision. Section 5 defines a collection of managed objects used to instrument IPsec structures and activities in the managed entity. Sections 6, 7, 8, 9, 10 and 11 are administrative in nature. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 1.2. The SNMPv2 Network Management Framework The SNMP Management Framework presently consists of five major components: 1) An overall architecture, described in RFC 2271 [2271]. 2) Mechanisms for describing and naming objects and events for the purpose of management. The first version of this Structure of Management Information (SMI) is called SMIv1 and described in RFC 1155 [1155], RFC 1212 [1212] and RFC 1215 [1215]. The second version, called SMIv2, is described in RFC 1902 [1902],RFC 1903 [1903] and RFC 1904 [1904]. 3) Message protocols for transferring management information. The first version of the SNMP message protocol is called SNMPv1 and described in RFC 1157 [1157]. A second version of the SNMP message protocol, which is not an Internet standards track protocol, is called SNMPv2c and described in RFC 1901 [1901] and RFC 1906 [1906]. The third version of the message protocol is called SNMPv3 and described in RFC 1906 [1906], RFC 2272 [2272] and RFC 2274 [2274]. 4) Protocol operations for accessing management information. The first set of protocol operations and associated PDU formats is described in RFC 1157 [1157]. A second set of protocol operations and associated PDU formats is described in RFC 1905 [1905]. 5) A set of fundamental applications described in RFC 2273 [2273] and the view-based access control mechanism described in RFC 2275 [2275]. IPsec Working Group Expires October 2001 [Page 4] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 2. Architecture of the MIB This section provides a view of the overall architecture, and describes the major MIB groups and table definitions. The MIB covers both Phase 1 or Internet key Exchange (IKE) Security Associations (SAs) and Phase 2 or IPsec SAs. The key component of this MIB is the abstraction of a traffic flow or a "tunnel". A tunnel signifies a sustained application traffic flow. A Phase 1 tunnel (IKE tunnel) is represented by a single ISAKMP SA which has been established after a successful completion of Phase 1. When the ISAKMP SA expires or is terminated, the tunnel is deemed to cease to exist as well. (ISAKMP SA (ISAKMP SA created) expires) |<----------------[ISAKMP SA]------------------>| |<--------------- Phase 1 Tunnel -------------->| In the context of Phase 2 SAs, an "IPsec tunnel" is defined as the virtual link formed by successsive Phase 2 SA bundles that share the same Phase 2 proxy identifiers. When the last SA budle expires and is not replaced by a new set of SA bundle, the tunnel is said to expire. (Start of application traffic) [SA bundle 1]----->| [SA bundle 2]----->| [SA bundle 3]----->| (End of application traffic) |<---------------- Phase 2 Tunnel ---------------->| Another key component of this MIB is the monitoring of large numbers of dynamic tunnels. In the case of clients initiating connections to a gateway, it is not usually possible for the gateway to have knowledge of all the attributes of the client, in particular the identity of the client, before the start of the session. The MIB must support these dynamic connections in addition to static tunnels that usually exist between gateway devices. The information provided in the MIB includes statistics on individual SAs as well as global totals which allows the provider to report on IPsec Working Group Expires October 2001 [Page 5] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 individual customer SLAs as well as monitoring the overall health of the VPN service. Statistics are provided on packet counts and drops, notify messages, failures, deletes and exchanges between peers. This information is presented in the form of groups that cover specific aspects of the VPN to facilitate accurate evaluation of performance and the generation of meaningful reports. 3. MIB Group Definitions This section outlines the major MIB groups and table definitions. The MIB covers both Phase 1 or Internet key Exchange SAs and Phase 2 or IPsec SAs. 3.1. IPsec Levels Group The Levels Group consists of global single instance objects accessed using an index of zero. Currently, the MIB Level object is the only object contained in this group. Initially the value of this object will be one (1) and incremented as changes are made to the MIB. 3.2. IPsec Phase-1 Group Provides global statistics for all phase 1 tunnels, active and previous. The Internet Key Exchange Peer Table defines the peers involved in any Phase 1 tunnel associated with active Phase 2 tunnels. Statistics for each active phase 1 tunnel (including policy attributes) are contained in the IKE Tunnel table, and the IKE Peer Association to Phase 2 Tunnel Correlation Table provides a link between each Phase 1 peer entry and any associated active Phase 2 tunnels. ikeGlobalStats All Phase 1 Tunnel Stats including statistics pertaining to IKE mode configuration. ikeTunnelTable IkeTunnelEntry -----> ikePeerEntryTable IkePeerEntry -----> ikePeerCorrTable IkePeerCorrEntry -----> ipSecTunnelTable IpSecTunnelEntry IPsec Working Group Expires October 2001 [Page 6] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 The relationships modeled in Phase-1 group are as follows: .--------------. .--------------. | IKE | | IKE | | Peer |---------->> | Tunnel | | Table | | Table | `--------------' `--------------' ^ ^ ^ ^ | . | . .--------------. .--------------. | IKE Peer | | IPsec | | Correlation |-----------> | Tunnel | | Table | | Table | `--------------' `--------------' Single arrow (>) represents a 1:1 relation. Double arrow represents a 1:n relationship. Dotted arrow (...) represents a relationship that is defined as a "softlink", i.e., a relationship that is implemented in the software but which is not enforced by SMI. The relationship between an IPsec tunnel and the IKE tunnel that negotiated that IPsec tunnel is implemented using a softlink in order to facilitate "dangling" IPsec implementations (i.e., implementations where an ISAKMP SA may expire prior to the expiry of the Phase-2 SAs that were negotiated using the ISAKMP SA). As the diagram above illustrates, there can be one or more IKE tunnels between an IKE peer pair. There can be one or more IPsec tunnels between a given IKE peer pair. When there are no IKE or IPsec tunnels to a peer, the peer entry corresponding to that peer is removed from the IKE Peer table. 3.3. IPsec Phase-2 Group This group defines siz subgroups. The first is a Global Statistics table that accumulates statistics pertaining to various Phase-2 activities and tunnel statistics from all active and previous Phase 2 tunnels. The second group defines the active Phase 2 IPsec tunnel table. Each entry in this table corresponds to a single active Phase-2 IPsec flow on the managed entity and includes the algorithms used and counts of activities such as number of packets successfully encrypted or number of encryption failures. The tunnel endpoint table forms the third subgroup under Phase 2 group. This table identifies the clients using the active IPsec flows and the protocols riding on the flows. The clients are subnets, hosts or collection of IP IPsec Working Group Expires October 2001 [Page 7] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 addresses. The protocol for which the flow as setup is identified using the id of the protocol and the port number (eg: SMTP = TCP/25). Since endpoints are associated with active IPsec tunnels, each entry in te endpoint table refers to an entry in the active IPsec tunnel table. The fourth subgroup under Phase-2 group is the IPsec security association table (ipSecSaTable). This table identifies the structure of each active IPsec tunnel by mapping the active IPsec tunnel into its component security associations. This table deprecates the previously defined ipSecSpiTable. ipSecGlobalStats All Phase 2 Tunnel Stats IpSecTunnelTable IpSecTunnelEntry -----> ipSecEndptTable IpSecEntptEntry -----> ipSecSaTable IpSecSaEntry (Inbound) IpSecSaEntry (Outbound) The relationships modeled in Phase-1 group are as follows: -------------- | IKE | | Tunnel | | Table | -------------- ^ ^ . . .--------------. -------------- | IPsec | | End Point | | Tunnel |<----------- | Table | | Table | | | -------------- -------------- ^ ^ | | IPsec Working Group Expires October 2001 [Page 8] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 .--------------. | IPsec | | SA | | Table | `--------------' As the diagram above illustrates, for every entry in the End Point table, there is a unique entry in the active IPsec tunnel table. A number of entries in the IPsec SA table map to a specific entry in t he IPsec tunnel table. This is because an IPsec tunnel is composed of at least two Phase-2 security associations. Note also, that th relationshop between Phase-2 IPsec tunnels and Phase 2 IKE tunnels is n:1 and is implemented as a softlink, to accomodate dangling IPsec implementations. 3.4. IPsec History Group This group includes tables for Phase-1 Tunnel History, Phase-2 Tunnel History, and Phase-2 Endpoint History. The number of entries in each table defined by the value of ipSecHistTablSize. The tables cover phase 1 and phase 2 statistics based on accumulating packet and octet counts and failures based on security policy parameters and tunnel lifetimes. Examples are a count of the total number of octets encrypted using 3DES, or the number of authentication failures when the algorithm used was MD5. The relationships modeled in Phase-1 group are as follows: -------------- | IKE Tunnel | | History | | Table | -------------- ^ ^ . . . -------------- -------------- | IPsec Tunnel | | Phase 2 | | History | <---------- | EndPoint | | Table | | History Table| -------------- -------------- For every entry in the End Point History table, there is a unique IPsec Working Group Expires October 2001 [Page 9] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 entry in the IPsec Tunnel History table. This is because when an IPsec tunnel expires, the end point entry associated with the tunnel expires also. Also note that the IKE tunnel that negotiated an expired instance of IPsec tunnel may not be present in the IKE Tunnel History table; the IKE tunnel may instead be still in the active IKE tunnel table. Implementation Hint: The failure group may be implemented using ring buffers of the prescribed maximum size. This will automatically cause the oldest entry to be phased out to accomodate a new entry, should the buffer be full. 3.4.1. Journaling Active Tunnels The history group also allows for journaling active Phase 1 and Phase 2 sessions by taking a snapshot of the active tunnels into the respective history tables whenever required. By setting an appropriate value in the MIB object ipSecHistCheckPoint, the operator may initiate a snapshot operation. 3.5. IPsec Failure Group This group includes tables for phase 1 and phase 2 failures. Failures include 1) tunnel setup failures (the failure of a tunnel to be setup) 2) tunnel operational failures (the tunnel was setip, but was terminated abnormally). The size of each table is dependent on the value of the ipSecFailTa- bleSize object. Each failure entry for either phase 1 or 2 includes the specific reason for the failure, for example a CRL failure, and the time of the failure. There are two tables in the failure group - one corresponding to failure of Phase-1 operations (IKE failures) and the second correspondign to Phase-2 failures. There is no specific relationship between the two tables modeled in this group. Note, however, that for every tunnel failure recorded in the failure group, there is an entry in the corresponding (IKE or IPsec) Tunnel History table (unless such an entry has been phased out to accomodate a new entry). Implementation Hint: The failure group may be implemented using ring buffers of the prescribed maximum size. This will automatically cause the oldest entry to be phased out to accomodate a new entry, should IPsec Working Group Expires October 2001 [Page 10] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 the buffer be full. 3.6. IPsec Trap Control Group This group controls the sending of IPsec traps. Traps are considered to include both error conditions, and any events that cause a change in state on the device. Events that trigger traps include normal events such as tunnel starts and stops and failure events such as early tunnel terminations, receipt of an invalid SPI, system errors, failure to establish tunnels, certificate failures and protocol errors. 4. Elements Relegated to Future Versions A number of information elements relevant to the management of IPsec-based VPNs have been postponed to the next revision of this document. These include the following. 1) Support for Stream Control Transmission Protocol Apart from the inclusion of a new IKE ID type, SCTP requires that an IKE/IPsec tunnel be able to support multiple endpoint entries (selectors). Hence the mapping between IPsec tunnel table and the End Point table must be made 1:n. 2) Support for KINK As details pertaining to KINK are resolved, Phase 1 group in the MIB will be redefined to support multiple key management protocols. 3) Multicast/GDOI A future version if this MIB will include support for group key-negotiations and multicast over IPsec. 4) NAT with IPsec Many implementations use UDP encapsulation to support NAT with IPsec. The Phase-1 and Phase-2 tunnel tables will be expanded to include attributes pertaining to this configuration. IPsec Working Group Expires October 2001 [Page 11] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 5. Managed Object Definitions for IPsec Framework IPSEC-FLOW-MONITOR-MIB DEFINITIONS ::= BEGIN -- PREFACE: -- IPSEC-FLOW-MONITOR-MIB Module models -- the standard, dynamic aspects of IPsec. -- These include counters and objects that are of -- management interest in a standard IPSec -- implementation. The MIB does not define -- vendor-specific IPSec attributes. IMPORTS MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Counter32, Counter64, Gauge32, Integer32 FROM SNMPv2-SMI TEXTUAL-CONVENTION, DisplayString, TimeStamp, TimeInterval, TruthValue FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF; ipSecFlowMonitorMIB MODULE-IDENTITY LAST-UPDATED "200103131800Z" ORGANIZATION "Tivoli Systems and Cisco Systems" CONTACT-INFO "Tivoli Systems Research Triangle Park, NC Cisco Systems 170 W Tasman Drive San Jose, CA 95134 USA Tel: +1 800 553-NETS E-mail: cmadson@cisco.com bret_harrison@tivoli.com" DESCRIPTION "This is a MIB Module for monitoring the structures in IPSec-based Virtual Private Networks. The MIB has been designed to be adopted as an IETF standard. Hence vendor-specific features of IPSec protocol are excluded from this MIB. Acronyms The following acronyms are used in this document: IPsec Working Group Expires October 2001 [Page 12] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 IPSec: Secure IP Protocol VPN: Virtual Private Network ISAKMP: Internet Security Association and Key Exchange Protocol IKE: Internet Key Exchange Protocol SA: Security Association MM: Main Mode - the process of setting up a Phase 1 SA to secure the exchanges required to setup Phase 2 SAs QM: Quick Mode - the process of setting up Phase 2 Security Associations using a Phase 1 SA. Phase 1 Tunnel: An ISAKMP SA can be regarded as representing a flow of ISAKMP/IKE traffic. Hence an ISAKMP is referred to as a 'Phase 1 Tunnel' in this document. Phase 2 Tunnel: AN instance of a non-ISAKMP SA bundle in which all the SA share the same proxy identifiers (IDii,IDir) protect the same stream of application traffic. Such an SA bundle is termed a 'Phase 2 Tunnel'. Note that a Phase 2 tunnel may comprise different SA bundles and different number of SA bundles at different times (due to key refresh). Overview of IPsec MIB The MIB contains six major groups of objects which are used to manage the IPSec Protocol. These groups include a Levels Group, a Phase-1 Group, a Phase-2 Group, a History Group, a Failure Group and a TRAP Control Group. The following table illustrates the structure of the IPSec MIB. The Phase 1 group models objects pertaining to IKE negotiations and Phase 1 tunnels. The Phase 2 group models objects pertaining to IPsec Working Group Expires October 2001 [Page 13] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 IPSec data Phase 1 tunnels. The History group is to aid applications that do trending analysis. The Failure group is to enable an operator to do troubleshooting and debugging of the VPN Router. Further, counters are supported to aid detection of potential security violations. In addition to the five major MIB Groups, there are a number of Notifications. The following table illustrates the name and description of the IPSec TRAPs. For a detailed discussion, please refer to the IETF draft draft-ietf-ipsec-flow-monitoring-mib-01.txt. " REVISION "9911041800Z" DESCRIPTION "Initial version of this MIB module proposed to IETF." REVISION "2001031200Z" DESCRIPTION "Phase-1 group updated with mode config metrics in globals as well as IKE peer table. Phase-2 group updated with new group metrics. New group failures added to Failure group. Notifications pertaining to new group added. SPI table deprecated and an updated IPsec SA table added. Compliance clauses updated." -- Placeholder anchor ::= { xxx 171 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++ -- Local Textual Conventions -- +++++++++++++++++++++++++++++++++++++++++++++++++++ IPSIpAddress ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "An IP V4 or V6 Address." SYNTAX OCTET STRING(SIZE(4 | 16)) -- IP V4 or V6 Address IkePeerType ::= TEXTUAL-CONVENTION IPsec Working Group Expires October 2001 [Page 14] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The type of IPsec Phase-1 IKE peer identity. The IKE peer may be identified by one of the ID types defined in IPSEC DOI." SYNTAX INTEGER { reserved(0), id_ipv4_addr(1), id_fqdn(2), id_dn(3), id_ipv6_addr(4) } IkeNegoMode ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The IPsec Phase-1 IKE negotiation mode." SYNTAX INTEGER { reserved(0), main(1), aggressive(2) } IkeHashAlgo ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The hash algorithm used in IPsec Phase-1 IKE negotiations." SYNTAX INTEGER { reserved(0), md5(1), sha(2), tiger(3), sha256(4), sha384(5), sha512(6) } IkeAuthMethod ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The authentication method used in IPsec Phase-1 IKE negotiations." SYNTAX INTEGER { reserved(0), preSharedKey(1), dssSignature(2), IPsec Working Group Expires October 2001 [Page 15] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 rsaSignature(3), rsaEncryption(4), revRsaEncryption(5), elGamalEncryption(6), revElGamalEncryption(7), ecsdaSignature(8), gssApiV1(9), gssApiV2(10) } DiffHellmanGrp ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The Diffie Hellman Group used in negotiations. reserved -- reserved groups modp768 -- 768-bit MODP modp1024 -- 1024-bit MODP ec2nGP155 -- EC2N group on GP[2^155] ec2nGP185 -- EC2N group on GP[2^185] ec2nGF163 -- EC2N group over GF[2^163] ec2nGF283 -- EC2N group over GF[2^283] ec2nGF409 -- EC2N group over GF[2^409] ec2nGF571 -- EC2N group over GF[2^571] " SYNTAX INTEGER { reserved(0), modp768(1), modp1024(2), ec2nGP155(3), ec2nGP185(4), ec2nGF163(6), ec2nGF283(8), ec2nGF409(10), ec2nGF571(12) } KeyType ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The type of key used by an IPsec Phase-2 Tunnel." SYNTAX INTEGER{ reserved(0), key_ike(1), key_manual(2), key_kink(3) } EncapMode ::= TEXTUAL-CONVENTION IPsec Working Group Expires October 2001 [Page 16] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The encapsulation mode used by an IPsec Phase-2 Tunnel." SYNTAX INTEGER{ reserved(0), tunnel(1), transport(2) } EncryptAlgo ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The encryption algorithm used in negotiations." SYNTAX INTEGER { reserved(0), esp_des(1), esp_3des(2), esp_rc5(3), esp_idea(4), esp_cast(5), esp_blowfish(6), esp_3idea(7), esp_rc4(8), esp_null(9), esp_aes(10) } Spi ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The type of the SPI associated with IPsec Phase-2 security associations." SYNTAX INTEGER (256..4294967295) AuthAlgo ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The authentication algorithm used by a security association of an IPsec Phase-2 Tunnel." SYNTAX INTEGER{ reserved(0), hmacMd5(2), hmacSha(3), desMac(4), hmacSha256(5), hmacSha384(6), hmacSha512(7), IPsec Working Group Expires October 2001 [Page 17] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ripemd(8) } CompAlgo ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The compression algorithm used by a security association of an IPsec Phase-2 Tunnel." SYNTAX INTEGER{ reserved(0), comp_oui(1), comp_deflate(2), comp_lzs(3), comp_lzjh(4) } EndPtType ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The type of identity use to specify an IPsec End Point." SYNTAX INTEGER { reserved(0), id_ipv4_addr(1), id_fqdn(2), id_user_fqdn(3), id_ipv4_addr_subnet(4), id_ipv6_addr(5), id_ipv6_addr_subnet(6), id_ipv4_addr_range(7), id_ipv6_addr_range(8), id_der_asn1_dn(9), id_der_asn1_gn(10), id_key_id(11) } TunnelStatus ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The status of a Tunnel. Objects of this type may be used to bring the tunnel down by setting value of this object to destroy(2). Objects of this type cannot be used to create a Tunnel." SYNTAX INTEGER { reserved(0), awaitXauth(1), -- in Phase 1.5 awaitCommit(2), -- waiting for commit bit active(3), -- ready for QM destroy(4) IPsec Working Group Expires October 2001 [Page 18] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 } TrapStatus ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The administrative status for sending a TRAP." SYNTAX INTEGER { reserved(0), enabled(1), disabled(2) } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- IPsec MIB Object Groups -- -- This MIB module contains the following groups: -- 1) IPsec Levels Group -- 2) IPsec Phase-1 Group -- 3) IPsec Phase-2 Group -- 4) IPsec History Group -- 5) IPsec Failure Group -- 6) IPsec TRAP Control Group -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ipSecMIBObjects OBJECT IDENTIFIER ::= {ipSecFlowMonitorMIB 1} ipSecLevels OBJECT IDENTIFIER ::= { ipSecMIBObjects 1 } ipSecPhaseOne OBJECT IDENTIFIER ::= { ipSecMIBObjects 2 } ipSecPhaseTwo OBJECT IDENTIFIER ::= { ipSecMIBObjects 3 } ipSecHistory OBJECT IDENTIFIER ::= { ipSecMIBObjects 4 } ipSecFailures OBJECT IDENTIFIER ::= { ipSecMIBObjects 5 } ipSecTrapCntl OBJECT IDENTIFIER ::= { ipSecMIBObjects 6 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- IPsec Levels Group -- -- This group consists of a: -- 1) IPsec MIB Level -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ipSecMibLevel OBJECT-TYPE IPsec Working Group Expires October 2001 [Page 19] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 SYNTAX Integer32 (1..4096) MAX-ACCESS read-only STATUS current DESCRIPTION "The version of the IPsec MIB." ::= { ipSecLevels 1 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The IPsec Phase-1 Internet Key Exchange (IKE) Group -- -- This group consists of: -- 1) IPsec Phase-1 Global Statistics -- 2) IPsec Phase-1 Peer Table -- 3) IPsec Phase-1 Tunnel Table -- 4) IPsec Phase-1 Correlation Table -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The IPsec Phase-1 Global Statistics -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ikeGlobalStats OBJECT IDENTIFIER ::= { ipSecPhaseOne 1 } ikeGlobalActiveTunnels OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of currently active IPsec Phase-1 IKE Tunnels. This is equal to the number of ISAKMP SAs currently active." ::= { ikeGlobalStats 1 } ikeGlobalPreviousTunnels OBJECT-TYPE SYNTAX Counter32 UNITS "SAs" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of previously active IPsec Phase-1 IKE Tunnels. This is equal to the total number of ISAKMP SAs that were active since the bootup of the device but which have since expired." ::= { ikeGlobalStats 2 } ikeGlobalInOctets OBJECT-TYPE SYNTAX Counter32 IPsec Working Group Expires October 2001 [Page 20] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of octets received by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 3 } ikeGlobalInPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 4 } ikeGlobalInDropPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets which were dropped during receive processing by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 5 } ikeGlobalInNotifys OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of notifys received by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 6 } ikeGlobalInP2Exchgs OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION IPsec Working Group Expires October 2001 [Page 21] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 "The total number of IPsec Phase-2 exchanges received by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 7 } ikeGlobalInP2ExchgInvalids OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges which were received and found to be contain references to unrecognized security parameters. This value is accumulated across all currently and previously active IPsec ISAKMP SAs." ::= { ikeGlobalStats 8 } ikeGlobalInP2ExchgRejects OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges which were received and validated but were rejected by the local policy. This value is accumulated across all currently and previously active IPsec ISAKMP SAs." ::= { ikeGlobalStats 9 } ikeGlobalInP2SaDelRequests OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 security association delete requests received by all currently and previously active and IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 10 } ikeGlobalOutOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current IPsec Working Group Expires October 2001 [Page 22] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 DESCRIPTION "The total number of octets sent by all currently and previously active and IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 11 } ikeGlobalOutPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets sent by all currently and previously active and IPsec Phase-1 Tunnels." ::= { ikeGlobalStats 12 } ikeGlobalOutDropPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets which were dropped during send processing by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 13 } ikeGlobalOutNotifys OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of notifys sent by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 14 } ikeGlobalOutP2Exchgs OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges which were sent by all currently and previously active IPsec Phase-1 IKE Tunnels." IPsec Working Group Expires October 2001 [Page 23] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ::= { ikeGlobalStats 15 } ikeGlobalOutP2ExchgInvalids OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges which were sent and were flagged by the peer to contain references to unrecognized security parameters. This value is accumulated across all currently and previously active IPsec ISAKMP SAs." ::= { ikeGlobalStats 16 } ikeGlobalOutP2ExchgRejects OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges which were sent, validated by the peer but were rejected by the peer's policy. This value is accumulated across all currently and previously active IPsec ISAKMP SAs." ::= { ikeGlobalStats 17 } ikeGlobalOutP2SaDelRequests OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 SA delete requests sent by all currently and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 18 } ikeGlobalInitTunnels OBJECT-TYPE SYNTAX Counter32 UNITS "SAs" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-1 IKE Tunnels which were locally initiated." ::= { ikeGlobalStats 19 } IPsec Working Group Expires October 2001 [Page 24] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikeGlobalInitTunnelFails OBJECT-TYPE SYNTAX Counter32 UNITS "SAs" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-1 IKE Tunnels which were locally initiated and failed to activate." ::= { ikeGlobalStats 20 } ikeGlobalRespTunnelFails OBJECT-TYPE SYNTAX Counter32 UNITS "SAs" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-1 IKE Tunnels which were remotely initiated and failed to activate." ::= { ikeGlobalStats 21 } ikeGlobalSysCapFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of system capcity failures which occurred during processing of all current and previously active IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 22 } ikeGlobalAuthFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of authentications which ended in failure by all current and previous IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 23 } ikeGlobalDecryptFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION IPsec Working Group Expires October 2001 [Page 25] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 "The total number of decryptions which ended in failure by all current and previous IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 24 } ikeGlobalHashValidFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of hash validations which ended in failure by all current and previous IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 25 } ikeGlobalNoSaFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of non-existent Security Association in failures which occurred during processing of all current and previous IPsec Phase-1 IKE Tunnels." ::= { ikeGlobalStats 26 } ikeGlobalRespTunnels OBJECT-TYPE SYNTAX Counter32 UNITS "SAs" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-1 IKE Tunnels which were remotely initiated." ::= { ikeGlobalStats 27 } ikeGlobalInXauthFailures OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the extended authentication information supplied by an IKE peer was found to be invalid by the local entity." ::= { ikeGlobalStats 28 } IPsec Working Group Expires October 2001 [Page 26] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikeGlobalOutXauthFailures OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the extended authentication information supplied by the managed entity to an IKE peer was found to be invalid by the remote peer." ::= { ikeGlobalStats 29 } ikeGlobalInP1SaDelRequests OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of ISAKMP security association delete requests received by all currently and previously active and ISAKMP security associations." ::= { ikeGlobalStats 30 } ikeGlobalOutP1SaDelRequests OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of ISAKMP security association delete requests sent by all currently and previously active and ISAKMP security associations." ::= { ikeGlobalStats 31 } ikeGlobalInConfigs OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of Mode Configuration settings received (either CFG_REPLY or CFG_SET payloads) by this entity." ::= { ikeGlobalStats 32 } ikeGlobalOutConfigs OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Payloads" MAX-ACCESS read-only IPsec Working Group Expires October 2001 [Page 27] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The total number of Mode Configuration settings dispatched (either CFG_REPLY or CFG_SET payloads) by this entity." ::= { ikeGlobalStats 33 } ikeGlobalInConfigsRejects OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Acknowledgements" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of Mode Configuration settings which were received (either CFG_REPLY or CFG_SET payloads) by this entity and which were rejected by the local entity." ::= { ikeGlobalStats 34 } ikeGlobalOutConfigsRejects OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Acknowledgements" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of Mode Configuration settings which were dispatched (either CFG_REPLY or CFG_SET payloads) by this entity and which were rejected by the client peer." ::= { ikeGlobalStats 35 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The IPsec Phase-1 Internet Key Exchange Peer Table -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ikePeerTable OBJECT-TYPE SYNTAX SEQUENCE OF IkePeerEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The IPsec Phase-1 Internet Key Exchange Peer Table. There is one entry in this table for each IPsec Phase-1 IKE peer association which is currently associated with an active IPsec Phase-1 Tunnel. A peer has an entry in this stable, if and only if thjere is at least one Phase-1 or Phase-2 tunnel terminating on the managed entity from the peer. When all Phase-1 and Phase-2 tunnels to a peer have expired, the entry for the peer is deleted off this IPsec Working Group Expires October 2001 [Page 28] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 table." ::= { ipSecPhaseOne 2 } ikePeerEntry OBJECT-TYPE SYNTAX IkePeerEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains the attributes associated with an IPsec Phase-1 IKE peer association." INDEX { ikePeerLocalType, ikePeerLocalValue, ikePeerRemoteType, ikePeerRemoteValue, ikePeerIntIndex } ::= { ikePeerTable 1} IkePeerEntry ::= SEQUENCE { ikePeerLocalType IkePeerType, ikePeerLocalValue DisplayString, ikePeerRemoteType IkePeerType, ikePeerRemoteValue DisplayString, ikePeerIntIndex Integer32, ikePeerLocalAddr IPSIpAddress, ikePeerRemoteAddr IPSIpAddress, ikePeerActiveTime TimeInterval, ikePeerActiveTunnelIndex Integer32, ikePeerConfigAppVersion DisplayString, ikePeerConfigAddress IPSIpAddress, ikePeerConfigNetmask IPSIpAddress, ikePeerConfigDns IPSIpAddress, ikePeerConfigNbns IPSIpAddress, ikePeerConfigDhcp IPSIpAddress } ikePeerLocalType OBJECT-TYPE SYNTAX IkePeerType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The type of local peer identity. The local peer may be identified by: 1. an IP address, or 2. or a fully qualified domain name. 3. or a distinguished name." ::= { ikePeerEntry 1 } ikePeerLocalValue OBJECT-TYPE IPsec Working Group Expires October 2001 [Page 29] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 SYNTAX DisplayString MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of the local peer identity. If the local peer type is an IP Address, then this is the IP Address used to identify the local peer. If the local peer type is a id_fqdn, then this is the FQDN of the local peer. If the local peer type is id_dn, then this is the DN string of the local peer." ::= { ikePeerEntry 2 } ikePeerRemoteType OBJECT-TYPE SYNTAX IkePeerType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The type of remote peer identity. The remote peer may be identified by: 1. an IP address, or 2. or a fully qualified domain name. 3. or a distinguished name." ::= { ikePeerEntry 3 } ikePeerRemoteValue OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of the remote peer identity. If the remote peer type is an IP Address, then this is the IP Address used to identify the remote peer. If the remote peer type is id_fqdn, then this is the FQDN of the remote peer. If the remote peer type is a id_dn, then this is the DN string of the remote peer." ::= { ikePeerEntry 4 } ikePeerIntIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS not-accessible IPsec Working Group Expires October 2001 [Page 30] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The internal index of the local-remote peer association. This internal index is used to uniquely identify multiple associations between the local and remote peer." ::= { ikePeerEntry 5 } ikePeerLocalAddr OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The IP address of the local peer." ::= { ikePeerEntry 6 } ikePeerRemoteAddr OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The IP address of the remote peer." ::= { ikePeerEntry 7 } ikePeerActiveTime OBJECT-TYPE SYNTAX TimeInterval MAX-ACCESS read-only STATUS current DESCRIPTION "The length of time that the peer association has existed in hundredths of a second." ::= { ikePeerEntry 8 } ikePeerActiveTunnelIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS read-only STATUS current DESCRIPTION "The index of the active IPsec Phase-1 IKE Tunnel (ikeTunIndex in the ikeTunnelTable) for this peer association. If an IPsec Phase-1 IKE Tunnel is not currently active, then the value of this object will be zero." ::= { ikePeerEntry 9 } ikePeerConfigAppVersion OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-only IPsec Working Group Expires October 2001 [Page 31] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The NULL terminated printable application version of the peer. If the peer did not issue the APPLICATION_VERSION attribute, this field is NULL." ::= { ikePeerEntry 10 } ikePeerConfigAddress OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The IP address configured by the peer on this entity. If the local entity did not receive either INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS from the peer, this field should have the NULL IP address." ::= { ikePeerEntry 11 } ikePeerConfigNetmask OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The netmask configured by the peer on this entity. If the local entity did not receive either INTERNAL_V4_MASK or INTERNAL_IP6_MASK from the peer, this field should have the NULL IP address." ::= { ikePeerEntry 12 } ikePeerConfigDns OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The address of the DNS server configured by the peer on the local entity using CFG_SET or CFG_REPLY. If the local entity did not receive either INTERNAL_V4_DNS or INTERNAL_IP6_DNS from the peer, this field should have the NULL IP address." ::= { ikePeerEntry 13 } ikePeerConfigNbns OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The address of the NetBios Name Server configured by the peer on the local entity using CFG_SET or CFG_REPLY. IPsec Working Group Expires October 2001 [Page 32] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 If the local entity did not receive either INTERNAL_V4_NBNS INTERNAL_IP6_NBNS from the peer, this field should have the NULL IP address." ::= { ikePeerEntry 14 } ikePeerConfigDhcp OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The address of the DHCP Server configured by the peer on the local entity using CFG_SET or CFG_REPLY. If the local entity did not receive either INTERNAL_V4_DHCP INTERNAL_IP6_DHCP from the peer, this field should have the NULL IP address." ::= { ikePeerEntry 15 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The IPsec Phase-1 Internet Key Exchange Tunnel Table -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ikeTunnelTable OBJECT-TYPE SYNTAX SEQUENCE OF IkeTunnelEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The IPsec Phase-1 Internet Key Exchange Tunnel Table. There is one entry in this table for each active IPsec Phase-1 IKE Tunnel." ::= { ipSecPhaseOne 3 } ikeTunnelEntry OBJECT-TYPE SYNTAX IkeTunnelEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains the attributes associated with an active IPsec Phase-1 IKE Tunnel." INDEX { ikeTunIndex } ::= { ikeTunnelTable 1} IkeTunnelEntry ::= SEQUENCE { ikeTunIndex Integer32, ikeTunLocalType IkePeerType, ikeTunLocalValue DisplayString, ikeTunLocalAddr IPSIpAddress, ikeTunLocalName DisplayString, ikeTunRemoteType IkePeerType, ikeTunRemoteValue DisplayString, IPsec Working Group Expires October 2001 [Page 33] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikeTunRemoteAddr IPSIpAddress, ikeTunRemoteName DisplayString, ikeTunNegoMode IkeNegoMode, ikeTunDiffHellmanGrp DiffHellmanGrp, ikeTunEncryptAlgo EncryptAlgo, ikeTunHashAlgo IkeHashAlgo, ikeTunAuthMethod IkeAuthMethod, ikeTunLifeTime Integer32, ikeTunActiveTime TimeInterval, ikeTunSaRefreshThreshold Integer32, ikeTunTotalRefreshes Counter32, ikeTunInOctets Counter32, ikeTunInPkts Counter32, ikeTunInDropPkts Counter32, ikeTunInNotifys Counter32, ikeTunInP2Exchgs Counter32, ikeTunInP2ExchgInvalids Counter32, ikeTunInP2ExchgRejects Counter32, ikeTunInP2SaDelRequests Counter32, ikeTunOutOctets Counter32, ikeTunOutPkts Counter32, ikeTunOutDropPkts Counter32, ikeTunOutNotifys Counter32, ikeTunOutP2Exchgs Counter32, ikeTunOutP2ExchgInvalids Counter32, ikeTunOutP2ExchgRejects Counter32, ikeTunOutP2SaDelRequests Counter32, ikeTunStatus TunnelStatus, ikeTunInNewGrpReqs Counter32, ikeTunOutNewGrpReqs Counter32, ikeTunInNewGrpReqsRejected Counter32, ikeTunOutNewGrpReqsRejected Counter32, ikeTunInConfigs Counter32, ikeTunOutConfigs Counter32, ikeTunInConfigsRejects Counter32, ikeTunOutConfigsRejects Counter32 } ikeTunIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of the IPsec Phase-1 IKE Tunnel Table. The value of the index is a number which begins at one and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647." IPsec Working Group Expires October 2001 [Page 34] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ::= { ikeTunnelEntry 1 } ikeTunLocalType OBJECT-TYPE SYNTAX IkePeerType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of local peer identity. The local peer may be identified by: 1. an IP address, or 2. or a fully qualified domain name string. 3. or a distinguished name string." ::= { ikeTunnelEntry 2 } ikeTunLocalValue OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of the local peer identity. If the local peer type is an IP Address, then this is the IP Address used to identify the local peer. If the local peer type is id_fqdn, then this is the FQDN of the remote peer. If the local peer type is a id_dn, then this is the distinguished name string of the local peer." ::= { ikeTunnelEntry 3 } ikeTunLocalAddr OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The IP address of the local endpoint for the IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 4 } ikeTunLocalName OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-only STATUS current DESCRIPTION "The DNS name of the local IP address for the IPsec Phase-1 IKE Tunnel. If the DNS name associated with the local tunnel endpoint IPsec Working Group Expires October 2001 [Page 35] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 is not known, then the value of this object will be a NULL string." ::= { ikeTunnelEntry 5 } ikeTunRemoteType OBJECT-TYPE SYNTAX IkePeerType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of remote peer identity. The remote peer may be identified by: 1. an IP address, or 2. or a fully qualified domain name string. 3. or a distinguished name string." ::= { ikeTunnelEntry 6 } ikeTunRemoteValue OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of the remote peer identity. If the remote peer type is an IP Address, then this is the IP Address used to identify the remote peer. If the remote peer type is id_fqdn, then this is the FQDN of the remote peer. If the remote peer type is a id_dn, then this is the distinguished named string of the remote peer." ::= { ikeTunnelEntry 7 } ikeTunRemoteAddr OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The IP address of the remote endpoint for the IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 8 } ikeTunRemoteName OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-only STATUS current DESCRIPTION "The DNS name of the remote IP address of IPsec Phase-1 IPsec Working Group Expires October 2001 [Page 36] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 IKE Tunnel. If the DNS name associated with the remote tunnel endpoint is not known, then the value of this object will be a NULL string." ::= { ikeTunnelEntry 9 } ikeTunNegoMode OBJECT-TYPE SYNTAX IkeNegoMode MAX-ACCESS read-only STATUS current DESCRIPTION "The negotiation mode of the IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 10 } ikeTunDiffHellmanGrp OBJECT-TYPE SYNTAX DiffHellmanGrp MAX-ACCESS read-only STATUS current DESCRIPTION "The Diffie Hellman Group used in IPsec Phase-1 IKE negotiations." ::= { ikeTunnelEntry 11 } ikeTunEncryptAlgo OBJECT-TYPE SYNTAX EncryptAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The encryption algorithm used in IPsec Phase-1 IKE negotiations." ::= { ikeTunnelEntry 12 } ikeTunHashAlgo OBJECT-TYPE SYNTAX IkeHashAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The hash algorithm used in IPsec Phase-1 IKE negotiations." ::= { ikeTunnelEntry 13 } ikeTunAuthMethod OBJECT-TYPE SYNTAX IkeAuthMethod MAX-ACCESS read-only STATUS current DESCRIPTION "The authentication method used in IPsec Phase-1 IKE negotiations." ::= { ikeTunnelEntry 14 } IPsec Working Group Expires October 2001 [Page 37] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikeTunLifeTime OBJECT-TYPE SYNTAX Integer32 (1..2147483647) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The negotiated LifeTime of the IPsec Phase-1 IKE Tunnel in seconds." ::= { ikeTunnelEntry 15 } ikeTunActiveTime OBJECT-TYPE SYNTAX TimeInterval MAX-ACCESS read-only STATUS current DESCRIPTION "The length of time the IPsec Phase-1 IKE tunnel has been active in hundredths of seconds." ::= { ikeTunnelEntry 16 } ikeTunSaRefreshThreshold OBJECT-TYPE SYNTAX Integer32 (1..2147483647) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The security assoication refresh threshold in seconds." ::= { ikeTunnelEntry 17 } ikeTunTotalRefreshes OBJECT-TYPE SYNTAX Counter32 UNITS "QM Exchanges" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of security associations refreshes performed." ::= { ikeTunnelEntry 18 } ikeTunInOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of octets received by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 19 } IPsec Working Group Expires October 2001 [Page 38] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikeTunInPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 20 } ikeTunInDropPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped by this IPsec Phase-1 IKE Tunnel during receive processing." ::= { ikeTunnelEntry 21 } ikeTunInNotifys OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of notifys received by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 22 } ikeTunInP2Exchgs OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges received by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 23 } ikeTunInP2ExchgInvalids OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION IPsec Working Group Expires October 2001 [Page 39] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 "The total number of IPsec Phase-2 exchanges received on this tunnel that were found to contain references to unrecognized security parameters." ::= { ikeTunnelEntry 24 } ikeTunInP2ExchgRejects OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges received on this tunnel that were validated but were rejected by the local policy." ::= { ikeTunnelEntry 25 } ikeTunInP2SaDelRequests OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 security association delete requests received by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 26 } ikeTunOutOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of octets sent by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 27 } ikeTunOutPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets sent by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 28 } IPsec Working Group Expires October 2001 [Page 40] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikeTunOutDropPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped by this IPsec Phase-1 IKE Tunnel during send processing." ::= { ikeTunnelEntry 29 } ikeTunOutNotifys OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of notifys sent by this IPsec Phase-1 Tunnel." ::= { ikeTunnelEntry 30 } ikeTunOutP2Exchgs OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges sent by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 31 } ikeTunOutP2ExchgInvalids OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 exchanges sent on this tunnel that were found by the peer to contain references to security parameters not recognized by the peer." ::= { ikeTunnelEntry 32 } ikeTunOutP2ExchgRejects OBJECT-TYPE SYNTAX Counter32 UNITS "SA Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION IPsec Working Group Expires October 2001 [Page 41] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 "The total number of IPsec Phase-2 exchanges sent on this tunnel that were validated by the peer but were rejected by the peer's policy." ::= { ikeTunnelEntry 33 } ikeTunOutP2SaDelRequests OBJECT-TYPE SYNTAX Counter32 UNITS "Notification Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of IPsec Phase-2 security association delete requests sent by this IPsec Phase-1 IKE Tunnel." ::= { ikeTunnelEntry 34 } ikeTunStatus OBJECT-TYPE SYNTAX TunnelStatus MAX-ACCESS read-write STATUS current DESCRIPTION "The status of the MIB table row. This object can be used to bring the tunnel down by setting value of this object to destroy(2). This object cannot be used to create a MIB table row." ::= { ikeTunnelEntry 35 } ikeTunInNewGrpReqs OBJECT-TYPE SYNTAX Counter32 UNITS "Negotiations" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of New Group exchanges initiated remotely using this IKE tunnel." ::= { ikeTunnelEntry 36 } ikeTunOutNewGrpReqs OBJECT-TYPE SYNTAX Counter32 UNITS "Negotiations" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of New Group exchanges initiated locally using this IKE tunnel." ::= { ikeTunnelEntry 37 } IPsec Working Group Expires October 2001 [Page 42] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikeTunInNewGrpReqsRejected OBJECT-TYPE SYNTAX Counter32 UNITS "Negotiations" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of New Group exchanges initiated remotely using this IKE tunnel that ended in a failure." ::= { ikeTunnelEntry 38 } ikeTunOutNewGrpReqsRejected OBJECT-TYPE SYNTAX Counter32 UNITS "Negotiations" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of New Group exchanges initiated locally using this IKE tunnel that ended in a failure." ::= { ikeTunnelEntry 39 } ikeTunInConfigs OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of Mode Configuration settings received (either CFG_REPLY or CFG_SET payloads) by the local entity on the ISAKMP SA represented by this IKE tunnel." ::= { ikeTunnelEntry 40 } ikeTunOutConfigs OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of Mode Configuration settings dispatched (either CFG_REPLY or CFG_SET payloads) by the local entity on the ISAKMP SA represented by this IKE tunnel." ::= { ikeTunnelEntry 41 } ikeTunInConfigsRejects OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Payloads" MAX-ACCESS read-only IPsec Working Group Expires October 2001 [Page 43] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The total number of Mode Configuration settings which were received (either CFG_REPLY or CFG_SET payloads) and rejected by this entity using the ISAKMP SA represented by this IKE tunnel." ::= { ikeTunnelEntry 42 } ikeTunOutConfigsRejects OBJECT-TYPE SYNTAX Counter32 UNITS "Mode Configuration Setting Payloads" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of Mode Configuration settings which were dispatched (either CFG_REPLY or CFG_SET payloads) by this entity and were rejected by the peer (client) using the ISAKMP SA represented by this IKE tunnel." ::= { ikeTunnelEntry 43 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The Internet Key Exchange Peer Association to -- Phase-2 Tunnel Correlation Table -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ikePeerCorrTable OBJECT-TYPE SYNTAX SEQUENCE OF IkePeerCorrEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The IPsec Phase-1 Internet Key Exchange Peer Association to IPsec Phase-2 Tunnel Correlation Table. There is one entry in this table for each active IPsec Phase-2 Tunnel." ::= { ipSecPhaseOne 4 } ikePeerCorrEntry OBJECT-TYPE SYNTAX IkePeerCorrEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains the attributes of an IPsec Phase-1 IKE Peer Association to IPsec Phase-2 Tunnel Correlation." INDEX { ikePeerCorrLocalType, ikePeerCorrLocalValue, ikePeerCorrRemoteType, IPsec Working Group Expires October 2001 [Page 44] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikePeerCorrRemoteValue, ikePeerCorrIntIndex, ikePeerCorrSeqNum } ::= { ikePeerCorrTable 1} IkePeerCorrEntry ::= SEQUENCE { ikePeerCorrLocalType IkePeerType, ikePeerCorrLocalValue DisplayString, ikePeerCorrRemoteType IkePeerType, ikePeerCorrRemoteValue DisplayString, ikePeerCorrIntIndex Integer32, ikePeerCorrSeqNum Integer32, ikePeerCorrIpSecTunIndex Integer32 } ikePeerCorrLocalType OBJECT-TYPE SYNTAX IkePeerType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The type of local peer identity. The local peer may be identified by: 1. an IP address, or 2. or a fully qualified domain name. 3. or a distinguished name." ::= { ikePeerCorrEntry 1 } ikePeerCorrLocalValue OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of the local peer identity. If the local peer type is an IP Address, then this is the IP Address used to identify the local peer. If the local peer type is id_fqdn, then this is the FQDN of the local entity. If the local peer type is a id_dn, then this is the distinguished named string of the local peer." ::= { ikePeerCorrEntry 2 } ikePeerCorrRemoteType OBJECT-TYPE SYNTAX IkePeerType MAX-ACCESS not-accessible STATUS current IPsec Working Group Expires October 2001 [Page 45] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 DESCRIPTION "The type of remote peer identity. The remote peer may be identified by: 1. an IP address, or 2. or a fully qualified domain name. 3. or a distinguished name." ::= { ikePeerCorrEntry 3 } ikePeerCorrRemoteValue OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of the remote peer identity. If the remote peer type is an IP Address, then this is the IP Address used to identify the remote peer. If the remote peer type is id_fqdn, then this is the FQDN of the remote peer. If the remote peer type is a id_dn, then this is the distinguished named string of the remote peer." ::= { ikePeerCorrEntry 4 } ikePeerCorrIntIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The internal index of the local-remote peer association. This internal index is used to uniquely identify multiple associations between the local and remote peer." ::= { ikePeerCorrEntry 5 } ikePeerCorrSeqNum OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The sequence number of the local-remote peer association. This sequence number is used to uniquely identify multiple instances of an unique association between the local and remote peer." ::= { ikePeerCorrEntry 6 } IPsec Working Group Expires October 2001 [Page 46] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ikePeerCorrIpSecTunIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS read-only STATUS current DESCRIPTION "The index of the active IPsec Phase-2 Tunnel (ipSecTunIndex in the ipSecTunnelTable) for this IPsec Phase-1 IKE Peer Association." ::= { ikePeerCorrEntry 7 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- IPsec Phase-2 Group -- -- This group consists of: -- 1) IPsec Phase-2 Global Statistics -- 2) IPsec Phase-2 Tunnel Table -- 3) IPsec Phase-2 Endpoint Table -- 4) IPsec Phase-2 Security Protection Index Table -- 4) IPsec Phase-2 Security Protection Index Objects -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The IPsec Phase-2 Global Tunnel Statistics -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ipSecGlobalStats OBJECT IDENTIFIER ::= { ipSecPhaseTwo 1 } ipSecGlobalActiveTunnels OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of currently active IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 1 } ipSecGlobalPreviousTunnels OBJECT-TYPE SYNTAX Counter32 UNITS "Phase-2 Tunnels" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of previously active IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 2 } ipSecGlobalInOctets OBJECT-TYPE SYNTAX Counter32 IPsec Working Group Expires October 2001 [Page 47] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of octets received by all current and previous IPsec Phase-2 Tunnels. This value is accumulated BEFORE determining whether or not the packet should be decompressed. See also ipSecGlobalInOctWraps for the number of times this counter has wrapped." ::= { ipSecGlobalStats 3 } ipSecGlobalHcInOctets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "A high capacity count of the total number of octets received by all current and previous IPsec Phase-2 Tunnels. This value is accumulated BEFORE determining whether or not the packet should be decompressed." ::= { ipSecGlobalStats 4 } ipSecGlobalInOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the global octets received counter (ipSecGlobalInOctets) has wrapped." ::= { ipSecGlobalStats 5 } ipSecGlobalInDecompOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of decompressed octets received by all current and previous IPsec Phase-2 Tunnels. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of ipSecGlobalInOctets. See also ipSecGlobalInDecompOctWraps for the number of times this counter has wrapped." IPsec Working Group Expires October 2001 [Page 48] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ::= { ipSecGlobalStats 6 } ipSecGlobalHcInDecompOctets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "A high capacity count of the total number of decompressed octets received by all current and previous IPsec Phase-2 Tunnels. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of ipSecGlobalHcInOctets." ::= { ipSecGlobalStats 7 } ipSecGlobalInDecompOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the global decompressed octets received counter (ipSecGlobalInDecompOctets) has wrapped." ::= { ipSecGlobalStats 8 } ipSecGlobalInPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 9 } ipSecGlobalInDrops OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped during receive processing by all current and previous IPsec Phase-2 Tunnels. This count does NOT include packets dropped due to Anti-Replay processing." IPsec Working Group Expires October 2001 [Page 49] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ::= { ipSecGlobalStats 10 } ipSecGlobalInReplayDrops OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped during receive processing due to Anti-Replay processing by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 11 } ipSecGlobalInAuths OBJECT-TYPE SYNTAX Counter32 UNITS "Events" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound authentication's performed by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 12 } ipSecGlobalInAuthFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound authentication's which ended in failure by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 13 } ipSecGlobalInDecrypts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound decryption's performed by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 14 } ipSecGlobalInDecryptFails OBJECT-TYPE IPsec Working Group Expires October 2001 [Page 50] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound decryption's which ended in failure by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 15 } ipSecGlobalOutOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of octets sent by all current and previous IPsec Phase-2 Tunnels. This value is accumulated AFTER determining whether or not the packet should be compressed. See also ipSecGlobalOutOctWraps for the number of times this counter has wrapped." ::= { ipSecGlobalStats 16 } ipSecGlobalHcOutOctets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "A high capacity count of the total number of octets sent by all current and previous IPsec Phase-2 Tunnels. This value is accumulated AFTER determining whether or not the packet should be compressed." ::= { ipSecGlobalStats 17 } ipSecGlobalOutOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the global octets sent counter (ipSecGlobalOutOctets) has wrapped." ::= { ipSecGlobalStats 18 } ipSecGlobalOutUncompOctets OBJECT-TYPE SYNTAX Counter32 IPsec Working Group Expires October 2001 [Page 51] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of uncompressed octets sent by all current and previous IPsec Phase-2 Tunnels. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of ipSecGlobalOutOctets. See also ipSecGlobalOutDecompOctWraps for the number of times this counter has wrapped." ::= { ipSecGlobalStats 19 } ipSecGlobalHcOutUncompOctets OBJECT-TYPE SYNTAX Counter64 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "A high capacity count of the total number of uncompressed octets sent by all current and previous IPsec Phase-2 Tunnels. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of ipSecGlobalHcOutOctets." ::= { ipSecGlobalStats 20 } ipSecGlobalOutUncompOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the global uncompressed octets sent counter (ipSecGlobalOutUncompOctets) has wrapped." ::= { ipSecGlobalStats 21 } ipSecGlobalOutPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets sent by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 22 } IPsec Working Group Expires October 2001 [Page 52] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ipSecGlobalOutDrops OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped during send processing by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 23 } ipSecGlobalOutAuths OBJECT-TYPE SYNTAX Counter32 UNITS "Events" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound authentication's performed by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 24 } ipSecGlobalOutAuthFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound authentication's which ended in failure by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 25 } ipSecGlobalOutEncrypts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound encryption's performed by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 26 } ipSecGlobalOutEncryptFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current IPsec Working Group Expires October 2001 [Page 53] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 DESCRIPTION "The total number of outbound encryption's which ended in failure by all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 27 } ipSecGlobalOutCompressedPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The cumulative number of outbound packets across all IPsec flows terminating at this device which were successfully compressed. This number is cumulative since the last system start." ::= { ipSecGlobalStats 28 } ipSecGlobalOutCompSkippedPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound packets across all IPsec flows terminating at this devices that were to be compressed but which were skipped due to the compression hysteresis. This number is cumulative since the last system start." ::= { ipSecGlobalStats 29 } ipSecGlobalOutCompFailPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound packets across all IPsec flows terminating at this device that failed compression because they grew in size after compression. This number is cumulative since the last system start." ::= { ipSecGlobalStats 30 } ipSecGlobalOutCompTooSmallPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION IPsec Working Group Expires October 2001 [Page 54] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 "The total number of outbound packets across all IPsec flows terminating at this device that were to be compressed but were smaller than the compression threshold size. This number is cumulative since the last system start." ::= { ipSecGlobalStats 31 } ipSecGlobalProtocolUseFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of protocol use failures which occurred during processing of all current and previously active IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 32 } ipSecGlobalNoSaFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of non-existent Security Assocication in failures which occurred during processing of all current and previous IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 33 } ipSecGlobalSysCapFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of system capacity failures which occurred during processing of all current and previously active IPsec Phase-2 Tunnels." ::= { ipSecGlobalStats 34 } -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The IPsec Phase-2 Tunnel Table -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ipSecTunnelTable OBJECT-TYPE SYNTAX SEQUENCE OF IpSecTunnelEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The IPsec Phase-2 Tunnel Table. IPsec Working Group Expires October 2001 [Page 55] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 There is one entry in this table for each active IPsec Phase-2 Tunnel." ::= { ipSecPhaseTwo 2 } ipSecTunnelEntry OBJECT-TYPE SYNTAX IpSecTunnelEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains the attributes associated with an active IPsec Phase-2 Tunnel." INDEX { ipSecTunIndex } ::= { ipSecTunnelTable 1 } IpSecTunnelEntry ::= SEQUENCE { ipSecTunIndex Integer32, ipSecTunIkeTunnelIndex Integer32, ipSecTunIkeTunnelAlive TruthValue, ipSecTunLocalAddr IPSIpAddress, ipSecTunRemoteAddr IPSIpAddress, ipSecTunKeyType KeyType, ipSecTunEncapMode EncapMode, ipSecTunLifeSize Integer32, ipSecTunLifeTime Integer32, ipSecTunActiveTime TimeInterval, ipSecTunSaLifeSizeThreshold Integer32, ipSecTunSaLifeTimeThreshold Integer32, ipSecTunTotalRefreshes Counter32, ipSecTunExpiredSaInstances Counter32, ipSecTunCurrentSaInstances Gauge32, ipSecTunInSaDiffHellmanGrp DiffHellmanGrp, ipSecTunInSaEncryptAlgo EncryptAlgo, ipSecTunInSaAhAuthAlgo AuthAlgo, ipSecTunInSaEspAuthAlgo AuthAlgo, ipSecTunInSaDecompAlgo CompAlgo, ipSecTunOutSaDiffHellmanGrp DiffHellmanGrp, ipSecTunOutSaEncryptAlgo EncryptAlgo, ipSecTunOutSaAhAuthAlgo AuthAlgo, ipSecTunOutSaEspAuthAlgo AuthAlgo, ipSecTunOutSaCompAlgo CompAlgo, ipSecTunPmtu Integer32, ipSecTunInOctets Counter32, ipSecTunHcInOctets Counter64, ipSecTunInOctWraps Counter32, ipSecTunInDecompOctets Counter32, ipSecTunHcInDecompOctets Counter64, ipSecTunInDecompOctWraps Counter32, ipSecTunInPkts Counter32, IPsec Working Group Expires October 2001 [Page 56] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ipSecTunInDropPkts Counter32, ipSecTunInReplayDropPkts Counter32, ipSecTunInAuths Counter32, ipSecTunInAuthFails Counter32, ipSecTunInDecrypts Counter32, ipSecTunInDecryptFails Counter32, ipSecTunOutOctets Counter32, ipSecTunHcOutOctets Counter64, ipSecTunOutOctWraps Counter32, ipSecTunOutUncompOctets Counter32, ipSecTunHcOutUncompOctets Counter64, ipSecTunOutUncompOctWraps Counter32, ipSecTunOutPkts Counter32, ipSecTunOutDropPkts Counter32, ipSecTunOutAuths Counter32, ipSecTunOutAuthFails Counter32, ipSecTunOutEncrypts Counter32, ipSecTunOutEncryptFails Counter32, ipSecTunOutCompressedPkts Counter32, ipSecTunOutCompSkippedPkts Counter32, ipSecTunOutCompFailPkts Counter32, ipSecTunOutCompTooSmallPkts Counter32, ipSecTunStatus TunnelStatus } ipSecTunIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of the IPsec Phase-2 Tunnel Table. The value of the index is a number which begins at one and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647." ::= { ipSecTunnelEntry 1 } ipSecTunIkeTunnelIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS read-only STATUS current DESCRIPTION "The index of the associated IPsec Phase-1 IKE Tunnel. (ikeTunIndex in the ikeTunnelTable)" ::= { ipSecTunnelEntry 2 } IPsec Working Group Expires October 2001 [Page 57] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ipSecTunIkeTunnelAlive OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "An indicator which specifies whether or not the IPsec Phase-1 IKE Tunnel currently exists." ::= { ipSecTunnelEntry 3 } ipSecTunLocalAddr OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The IP address of the local endpoint for the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 4 } ipSecTunRemoteAddr OBJECT-TYPE SYNTAX IPSIpAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The IP address of the remote endpoint for the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 5 } ipSecTunKeyType OBJECT-TYPE SYNTAX KeyType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of key used by the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 6 } ipSecTunEncapMode OBJECT-TYPE SYNTAX EncapMode MAX-ACCESS read-only STATUS current DESCRIPTION "The encapsulation mode used by the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 7 } ipSecTunLifeSize OBJECT-TYPE SYNTAX Integer32 (1..2147483647) UNITS "KBytes" MAX-ACCESS read-only IPsec Working Group Expires October 2001 [Page 58] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The negotiated LifeSize of the IPsec Phase-2 Tunnel in kilobytes." ::= { ipSecTunnelEntry 8 } ipSecTunLifeTime OBJECT-TYPE SYNTAX Integer32 (1..2147483647) UNITS "Seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The negotiated LifeTime of the IPsec Phase-2 Tunnel in seconds." ::= { ipSecTunnelEntry 9 } ipSecTunActiveTime OBJECT-TYPE SYNTAX TimeInterval MAX-ACCESS read-only STATUS current DESCRIPTION "The length of time the IPsec Phase-2 Tunnel has been active in hundredths of seconds." ::= { ipSecTunnelEntry 10 } ipSecTunSaLifeSizeThreshold OBJECT-TYPE SYNTAX Integer32 (1..2147483647) UNITS "KBytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The security association LifeSize refresh threshold in kilobytes." ::= { ipSecTunnelEntry 11 } ipSecTunSaLifeTimeThreshold OBJECT-TYPE SYNTAX Integer32 (1..2147483647) UNITS "Seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The security association LifeTime refresh threshold in seconds." ::= { ipSecTunnelEntry 12 } ipSecTunTotalRefreshes OBJECT-TYPE SYNTAX Counter32 IPsec Working Group Expires October 2001 [Page 59] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 UNITS "QM Exchanges" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of security association refreshes performed." ::= { ipSecTunnelEntry 13 } ipSecTunExpiredSaInstances OBJECT-TYPE SYNTAX Counter32 UNITS "SAs" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of security associations which have expired." ::= { ipSecTunnelEntry 14 } ipSecTunCurrentSaInstances OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of security associations which are currently active or expiring." ::= { ipSecTunnelEntry 15 } ipSecTunInSaDiffHellmanGrp OBJECT-TYPE SYNTAX DiffHellmanGrp MAX-ACCESS read-only STATUS current DESCRIPTION "The Diffie Hellman Group used by the inbound security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 16 } ipSecTunInSaEncryptAlgo OBJECT-TYPE SYNTAX EncryptAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The encryption algorithm used by the inbound security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 17 } ipSecTunInSaAhAuthAlgo OBJECT-TYPE SYNTAX AuthAlgo IPsec Working Group Expires October 2001 [Page 60] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 MAX-ACCESS read-only STATUS current DESCRIPTION "The authentication algorithm used by the inbound authentication header (AH) security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 18 } ipSecTunInSaEspAuthAlgo OBJECT-TYPE SYNTAX AuthAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The authentication algorithm used by the inbound ecapsulation security protocol (ESP) security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 19 } ipSecTunInSaDecompAlgo OBJECT-TYPE SYNTAX CompAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The decompression algorithm used by the inbound security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 20 } ipSecTunOutSaDiffHellmanGrp OBJECT-TYPE SYNTAX DiffHellmanGrp MAX-ACCESS read-only STATUS current DESCRIPTION "The Diffie Hellman Group used by the outbound security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 21 } ipSecTunOutSaEncryptAlgo OBJECT-TYPE SYNTAX EncryptAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The encryption algorithm used by the outbound security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 22 } ipSecTunOutSaAhAuthAlgo OBJECT-TYPE SYNTAX AuthAlgo MAX-ACCESS read-only IPsec Working Group Expires October 2001 [Page 61] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "The authentication algorithm used by the outbound authentication header (AH) security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 23 } ipSecTunOutSaEspAuthAlgo OBJECT-TYPE SYNTAX AuthAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The authentication algorithm used by the inbound encapsulation security protocol (ESP) security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 24 } ipSecTunOutSaCompAlgo OBJECT-TYPE SYNTAX CompAlgo MAX-ACCESS read-only STATUS current DESCRIPTION "The compression algorithm used by the inbound security association of the IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 25 } ipSecTunPmtu OBJECT-TYPE SYNTAX Integer32 (68..1500) UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The Path MTU that has been determined for this IPsec Phase-2 tunnel. The lower end of the range is 68 which is the minimum MTU for IPv4." ::= { ipSecTunnelEntry 26 } ipSecTunInOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of octets received by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE determining whether or not the packet should be decompressed. See also ipSecTunInOctWraps for the number of times this counter has wrapped." IPsec Working Group Expires October 2001 [Page 62] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ::= { ipSecTunnelEntry 27 } ipSecTunHcInOctets OBJECT-TYPE SYNTAX Counter64 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "A high capacity count of the total number of octets received by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE determining whether or not the packet should be decompressed." ::= { ipSecTunnelEntry 28 } ipSecTunInOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the octets received counter (ipSecTunInOctets) has wrapped." ::= { ipSecTunnelEntry 29 } ipSecTunInDecompOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of decompressed octets received by this IPsec Phase-2 Tunnel. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of ipSecTunInOctets. See also ipSecTunInDecompOctWraps for the number of times this counter has wrapped." ::= { ipSecTunnelEntry 30 } ipSecTunHcInDecompOctets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "A high capacity count of the total number of decompressed octets received by this IPsec Phase-2 Tunnel. This value is accumulated AFTER the packet is decompressed. If IPsec Working Group Expires October 2001 [Page 63] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 compression is not being used, this value will match the value of ipSecTunHcInOctets." ::= { ipSecTunnelEntry 31 } ipSecTunInDecompOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the decompressed octets received counter (ipSecTunInDecompOctets) has wrapped." ::= { ipSecTunnelEntry 32 } ipSecTunInPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 33 } ipSecTunInDropPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped during receive processing by this IPsec Phase-2 Tunnel. This count does NOT include packets dropped due to Anti-Replay processing." ::= { ipSecTunnelEntry 34 } ipSecTunInReplayDropPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped during receive processing due to Anti-Replay processing by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 35 } IPsec Working Group Expires October 2001 [Page 64] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ipSecTunInAuths OBJECT-TYPE SYNTAX Counter32 UNITS "Events" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound authentication's performed by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 36 } ipSecTunInAuthFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound authentication's which ended in failure by this IPsec Phase-2 Tunnel ." ::= { ipSecTunnelEntry 37 } ipSecTunInDecrypts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound decryption's performed by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 38 } ipSecTunInDecryptFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of inbound decryption's which ended in failure by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 39 } ipSecTunOutOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current IPsec Working Group Expires October 2001 [Page 65] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 DESCRIPTION "The total number of octets sent by this IPsec Phase-2 Tunnel. This value is accumulated AFTER determining whether or not the packet should be compressed. See also ipSecTunOutOctWraps for the number of times this counter has wrapped." ::= { ipSecTunnelEntry 40 } ipSecTunHcOutOctets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "A high capacity count of the total number of octets sent by this IPsec Phase-2 Tunnel. This value is accumulated AFTER determining whether or not the packet should be compressed." ::= { ipSecTunnelEntry 41 } ipSecTunOutOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the out octets counter (ipSecTunOutOctets) has wrapped." ::= { ipSecTunnelEntry 42 } ipSecTunOutUncompOctets OBJECT-TYPE SYNTAX Counter32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of uncompressed octets sent by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of ipSecTunOutOctets. See also ipSecTunOutDecompOctWraps for the number of times this counter has wrapped." ::= { ipSecTunnelEntry 43 } ipSecTunHcOutUncompOctets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only IPsec Working Group Expires October 2001 [Page 66] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 STATUS current DESCRIPTION "A high capacity count of the total number of uncompressed octets sent by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of ipSecTunHcOutOctets." ::= { ipSecTunnelEntry 44 } ipSecTunOutUncompOctWraps OBJECT-TYPE SYNTAX Counter32 UNITS "Integral units" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of times the uncompressed octets sent counter (ipSecTunOutUncompOctets) has wrapped." ::= { ipSecTunnelEntry 45 } ipSecTunOutPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets sent by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 46 } ipSecTunOutDropPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets dropped during send processing by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 47 } ipSecTunOutAuths OBJECT-TYPE SYNTAX Counter32 UNITS "Events" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound authentication's performed by this IPsec Phase-2 Tunnel." IPsec Working Group Expires October 2001 [Page 67] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 ::= { ipSecTunnelEntry 48 } ipSecTunOutAuthFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound authentication's which ended in failure by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 49 } ipSecTunOutEncrypts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound encryption's performed by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 50 } ipSecTunOutEncryptFails OBJECT-TYPE SYNTAX Counter32 UNITS "Failures" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound encryption's which ended in failure by this IPsec Phase-2 Tunnel." ::= { ipSecTunnelEntry 51 } ipSecTunOutCompressedPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound packets which were successfully compressed." ::= { ipSecTunnelEntry 52 } ipSecTunOutCompSkippedPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current IPsec Working Group Expires October 2001 [Page 68] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 DESCRIPTION "The total number of outbound packets that were to be compressed but which were skipped due to the compression hysteresis." ::= { ipSecTunnelEntry 53 } ipSecTunOutCompFailPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound packets that failed compression because they grew in size after compression." ::= { ipSecTunnelEntry 54 } ipSecTunOutCompTooSmallPkts OBJECT-TYPE SYNTAX Counter32 UNITS "Packets" MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of outbound packets that were to be compressed but were smaller than the compression threshold size." ::= { ipSecTunnelEntry 55 } ipSecTunStatus OBJECT-TYPE SYNTAX TunnelStatus MAX-ACCESS read-write STATUS current DESCRIPTION "The status of the MIB table row. This object can be used to bring the tunnel down by setting value of this object to destroy(2). When the value is set to destroy(2), the SA bundle is destroyed and this row is deleted from this table. When this MIB value is queried, the value of active(1) is always returned, if the instance exists. This object cannot be used to create a MIB table row." ::= { ipSecTunnelEntry 56 } IPsec Working Group Expires October 2001 [Page 69] Internet Draft IPsec Flow Monitoring MIB 19 April 2001 -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- The IPsec Phase-2 Tunnel Endpoint Table -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ipSecEndPtTable OBJECT-TYPE SYNTAX SEQUENCE OF IpSecEndPtEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The IPsec Phase-2 Tunnel Endpoint Table. This table contains an entry for each active endpoint associated with an IPsec Phase-2 Tunnel." ::= { ipSecPhaseTwo 3 } ipSecEndPtEntry OBJECT-TYPE SYNTAX IpSecEndPtEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An IPsec Phase-2 Tunnel Endpoint entry." INDEX { ipSecTun