idnits 2.17.1 draft-ietf-sidr-rpki-rtr-protocol-mib-07.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 11, 2013) is 4058 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Obsolete informational reference (is this intentional?): RFC 5246 (Obsoleted by RFC 8446) Summary: 0 errors (**), 0 flaws (~~), 1 warning (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group R. Bush 3 Internet-Draft Internet Initiative Japan 4 Intended status: Standards Track B. Wijnen 5 Expires: September 12, 2013 RIPE NCC 6 K. Patel 7 Cisco Systems 8 M. Baer 9 SPARTA 10 March 11, 2013 12 Definitions of Managed Objects for the RPKI-Router Protocol 13 draft-ietf-sidr-rpki-rtr-protocol-mib-07 15 Abstract 17 This document defines a portion of the Management Information Base 18 (MIB) for use with network management protocols in the Internet 19 community. In particular, it describes objects used for monitoring 20 the RPKI Router protocol. 22 Status of this Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at http://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on September 12, 2013. 39 Copyright Notice 41 Copyright (c) 2013 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (http://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 57 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 58 2. Internet-Standard Management Framework . . . . . . . . . . . . 3 59 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 60 4. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 61 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 62 6. Security Considerations . . . . . . . . . . . . . . . . . . . 22 63 7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 23 64 7.1. Normative References . . . . . . . . . . . . . . . . . . . 23 65 7.2. Informative References . . . . . . . . . . . . . . . . . . 24 66 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 25 68 1. Introduction 70 This document defines a portion of the Management Information Base 71 (MIB) for use with network management protocols in the Internet 72 community. In particular, it defines objects used for monitoring the 73 RPKI Router protocol [RFC6810]. 75 1.1. Requirements Language 77 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 78 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 79 "OPTIONAL" in this document are to be interpreted as described in RFC 80 2119 [RFC2119]. 82 2. Internet-Standard Management Framework 84 For a detailed overview of the documents that describe the current 85 Internet-Standard Management Framework, please refer to section 7 of 86 [RFC3410]. Managed objects are accessed via a virtual information 87 store, termed the Management Information Base or MIB. MIB objects 88 are generally accessed through the Simple Network Management Protocol 89 (SNMP). Objects in the MIB are defined using the mechanisms defined 90 in the Structure of Management Information (SMI). This document 91 specifies a MIB module that is compliant to the SMIv2, which is 92 described in STD 58, [RFC2578], STD 58, [RFC2579] and STD 58, 93 [RFC2580]. 95 3. Overview 97 The objects defined in this document are used to monitor the RPKI 98 Router protocol [RFC6810]. The MIB module defined in this is broken 99 into these tables: the RPKI Router Cache Server (connection) Table, 100 the RPKI Router Cache Server Errors Table, and the RPKI Router Prefix 101 Origin Table. 103 The RPKI Router Cache Server Table contains information about state 104 and current activity of connections with the RPKI Router Cache 105 Servers. It also contains counters for the number of messages 106 received and sent plus the number of announcements, withdrawals and 107 active records. The RPKI Router Cache Server Errors Table contains 108 counters of occurrences of errors on the connections (if any). The 109 RPKI Router Prefix Origin Table contains IP prefixes with their 110 minimum and maximum prefix lengths and the Origin AS. This data is 111 the collective set of information received from all RPKI Cache 112 Servers that the router is connected with. The Cache Servers are 113 running the RPKI Router protocol. 115 Two Notifications have been defined to inform a Network Management 116 Station (NMS) or operators about changes in the connection state of 117 the connections listed in the RPKI Cache Server (Connection) Table. 119 4. Definitions 121 The Following MIB module imports definitions from [RFC2578], STD 58, 122 [RFC2579] STD 58, [RFC2580], [RFC4001], [RFC2287]. That means we 123 have a normative reference to those documents. 125 The MIB module also has a normative reference to the RPKI Router 126 protocol [RFC6810]. Furthermore, for background and informative 127 information, the MIB module refers to [RFC1982], [RFC5925], 128 [RFC4252], [RFC5246], [RFC5925]. 130 RPKI-RTR-MIB DEFINITIONS ::= BEGIN 132 IMPORTS 134 MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, 135 Integer32, Unsigned32, mib-2, Gauge32, Counter32 136 FROM SNMPv2-SMI -- RFC2578 138 InetAddressType, InetAddress, InetPortNumber, 139 InetAddressPrefixLength, InetAutonomousSystemNumber 140 FROM INET-ADDRESS-MIB -- RFC4001 142 TEXTUAL-CONVENTION, TimeStamp 143 FROM SNMPv2-TC -- RFC2579 145 MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP 146 FROM SNMPv2-CONF -- RFC2580 148 LongUtf8String FROM SYSAPPL-MIB -- RFC2287 150 ; 152 rpkiRtrMIB MODULE-IDENTITY 153 LAST-UPDATED "201303050000Z" 154 ORGANIZATION "IETF Secure Inter-Domain Routing (SIDR) 155 Working Group 156 " 157 CONTACT-INFO "Working Group Email: sidr@ietf.org 159 Randy Bush 160 Internet Initiative Japan 161 5147 Crystal Springs 162 Bainbridge Island, Washington, 98110 163 USA 164 Email: randy@psg.com 166 Bert Wijnen 167 RIPE NCC 168 Schagen 33 169 3461 GL Linschoten 170 Netherlands 171 Email: bertietf@bwijnen.net 173 Keyur Patel 174 Cisco Systems 175 170 W. Tasman Drive 176 San Jose, CA 95134 177 USA 178 Email: keyupate@cisco.com 180 Michael Baer 181 SPARTA 182 P.O. Box 72682 183 Davis, CA 95617 184 USA 185 Email: michael.baer@sparta.com 186 " 188 DESCRIPTION "This MIB module contains management objects to 189 support monitoring of the Resource Public Key 190 Infrastructure (RPKI) protocol on routers. 192 Copyright (c) 2013 IETF Trust and the persons 193 identified as authors of the code. All rights 194 reserved. 196 Redistribution and use in source and binary 197 forms, with or without modification, is 198 permitted pursuant to, and subject to the 199 license terms contained in, the Simplified BSD 200 License set forth in Section 4.c of the IETF 201 Trust's Legal Provisions Relating to IETF 202 Documents 203 (http://trustee.ietf.org/license-info). 205 This version of this MIB module is part of 206 RFCxxxx; see the RFC itself for full legal 207 notices. 209 " 211 REVISION "201303050000Z" 212 DESCRIPTION "Initial version, published as RFCxxxx." 213 -- Note to RFC Editor: pls fill in above (2 times) RFC 214 -- number for xxxx and delete these 2 lines. 215 ::= { mib-2 XXX } -- XXX to be assigned by IANA 217 rpkiRtrNotifications OBJECT IDENTIFIER ::= { rpkiRtrMIB 0 } 218 rpkiRtrObjects OBJECT IDENTIFIER ::= { rpkiRtrMIB 1 } 219 rpkiRtrConformance OBJECT IDENTIFIER ::= { rpkiRtrMIB 2 } 221 -- ============================================================== 222 -- Textual Conventions used in this MIB module 223 -- ============================================================== 225 RpkiRtrConnectionType ::= TEXTUAL-CONVENTION 226 STATUS current 227 DESCRIPTION "The connection type used between a router (as a 228 client) and a cache server. 230 The following types have been defined in RFC6810: 231 ssh(1) - sect 7.1, see also RFC4252. 232 tls(2) - sect 7.2, see also RFC5246. 233 tcpMD5(3) - sect 7.3, see also RFC2385. 234 tcpAO(4) - sect 7.4, see also RFC5925. 235 tcp(5) - sect 7. 236 ipsec(6) - sect 7, see also RFC4301. 237 other(7) - none of the above 238 " 239 REFERENCE "The RPKI/Router Protocol, RFC6810 - section 7" 240 SYNTAX INTEGER { 241 ssh(1), 242 tls(2), 243 tcpMD5(3), 244 tcpAO(4), 245 tcp(5), 246 ipsec(6), 247 other(7) 248 } 250 -- ============================================================== 251 -- Scalar objects 252 -- ============================================================== 253 rpkiRtrDiscontinuityTimer OBJECT-TYPE 254 SYNTAX TimeStamp 255 MAX-ACCESS read-only 256 STATUS current 257 DESCRIPTION "This timer represents the timestamp (value 258 of sysUpTime) at which time any of the 259 Counter32 objects in this MIB module 260 encountered a discontinuity. 262 For objects that use rpkiRtrDiscontinuityTimer to 263 indicate discontinuity, only values received since 264 the time indicated by rpkiRtrDiscontinuityTimer are 265 comparable to each other. A manager should take the 266 possibility of rollover into account when 267 calculating difference values. 269 In principle that should only happen if the 270 SNMP agent or the instrumentation for this 271 MIB module (re-)starts." 272 ::= { rpkiRtrObjects 1 } 274 -- ============================================================== 275 -- RPKI Router Cache Server Connection Table 276 -- ============================================================== 278 rpkiRtrCacheServerTable OBJECT-TYPE 279 SYNTAX SEQUENCE OF RpkiRtrCacheServerTableEntry 280 MAX-ACCESS not-accessible 281 STATUS current 282 DESCRIPTION "This table lists the RPKI cache servers 283 known to this router/system." 284 ::= { rpkiRtrObjects 2 } 286 rpkiRtrCacheServerTableEntry OBJECT-TYPE 287 SYNTAX RpkiRtrCacheServerTableEntry 288 MAX-ACCESS not-accessible 289 STATUS current 290 DESCRIPTION "An entry in the rpkiRtrCacheServerTable. 291 It holds management attributes associated 292 with one connection to a RPKI cache server. 294 Implementers should be aware that if the 295 rpkiRtrCacheServerRemoteAddress object exceeds 114 296 octets, the index values will exceed the 128 297 sub-identifier limit and cannot be accessed using 298 SNMPv1, SNMPv2c, or SNMPv3." 300 INDEX { rpkiRtrCacheServerRemoteAddressType, 301 rpkiRtrCacheServerRemoteAddress, 302 rpkiRtrCacheServerRemotePort 303 } 304 ::= { rpkiRtrCacheServerTable 1 } 306 RpkiRtrCacheServerTableEntry ::= SEQUENCE { 307 rpkiRtrCacheServerRemoteAddressType InetAddressType, 308 rpkiRtrCacheServerRemoteAddress InetAddress, 309 rpkiRtrCacheServerRemotePort InetPortNumber, 310 rpkiRtrCacheServerLocalAddressType InetAddressType, 311 rpkiRtrCacheServerLocalAddress InetAddress, 312 rpkiRtrCacheServerLocalPort InetPortNumber, 313 rpkiRtrCacheServerPreference Unsigned32, 314 rpkiRtrCacheServerConnectionType RpkiRtrConnectionType, 315 rpkiRtrCacheServerConnectionStatus INTEGER, 316 rpkiRtrCacheServerDescription LongUtf8String, 317 rpkiRtrCacheServerMsgsReceived Counter32, 318 rpkiRtrCacheServerMsgsSent Counter32, 319 rpkiRtrCacheServerV4ActiveRecords Gauge32, 320 rpkiRtrCacheServerV4Announcements Counter32, 321 rpkiRtrCacheServerV4Withdrawals Counter32, 322 rpkiRtrCacheServerV6ActiveRecords Gauge32, 323 rpkiRtrCacheServerV6Announcements Counter32, 324 rpkiRtrCacheServerV6Withdrawals Counter32, 325 rpkiRtrCacheServerLatestSerial Unsigned32, 326 rpkiRtrCacheServerSessionID Unsigned32, 327 rpkiRtrCacheServerRefreshTimer Unsigned32, 328 rpkiRtrCacheServerTimeToRefresh Integer32, 329 rpkiRtrCacheServerId Unsigned32 330 } 332 rpkiRtrCacheServerRemoteAddressType OBJECT-TYPE 333 SYNTAX InetAddressType 334 MAX-ACCESS not-accessible 335 STATUS current 336 DESCRIPTION "The network address type of the connection 337 to this RPKI cache server. 339 Note: Only IPv4, IPv6 and DNS support are required 340 for RFCxxxx read only compliance." 341 ::= { rpkiRtrCacheServerTableEntry 1 } 343 rpkiRtrCacheServerRemoteAddress OBJECT-TYPE 344 SYNTAX InetAddress 345 MAX-ACCESS not-accessible 346 STATUS current 347 DESCRIPTION "The remote network address for this connection 348 to this RPKI cache server. 350 The format of the address is defined by the 351 value of the corresponding instance of 352 rpkiRtrCacheServerRemoteAddressType. 354 This object matches the address type used within 355 the local router configuration. If the address is 356 of type dns (fqdn), then the router will resolve it 357 at the time it connects to the cache server." 358 ::= { rpkiRtrCacheServerTableEntry 2 } 360 rpkiRtrCacheServerRemotePort OBJECT-TYPE 361 SYNTAX InetPortNumber (1..65535) 362 MAX-ACCESS not-accessible 363 STATUS current 364 DESCRIPTION "The remote port number for this connection 365 to this RPKI cache server." 366 ::= { rpkiRtrCacheServerTableEntry 3 } 368 rpkiRtrCacheServerLocalAddressType OBJECT-TYPE 369 SYNTAX InetAddressType 370 MAX-ACCESS read-only 371 STATUS current 372 DESCRIPTION "The network address type of the connection 373 to this RPKI cache server. 375 Note: Only IPv4, IPv6 and DNS support are required 376 for RFCxxxx read only compliance." 377 ::= { rpkiRtrCacheServerTableEntry 4 } 379 rpkiRtrCacheServerLocalAddress OBJECT-TYPE 380 SYNTAX InetAddress 381 MAX-ACCESS read-only 382 STATUS current 383 DESCRIPTION "The local network address for this connection 384 to this RPKI cache server. 386 The format of the address is defined by the 387 value of the corresponding instance of 388 rpkiRtrCacheServerLocalAddressType. 390 This object matches the address type used within 391 the local router configuration. If the address is 392 of type dns (fqdn), then the router will resolve it 393 at the time it connects to the cache server." 394 ::= { rpkiRtrCacheServerTableEntry 5 } 396 rpkiRtrCacheServerLocalPort OBJECT-TYPE 397 SYNTAX InetPortNumber (1..65535) 398 MAX-ACCESS read-only 399 STATUS current 400 DESCRIPTION "The local port number for this connection 401 to this RPKI cache server." 403 ::= { rpkiRtrCacheServerTableEntry 6 } 405 rpkiRtrCacheServerPreference OBJECT-TYPE 406 SYNTAX Unsigned32 407 MAX-ACCESS read-only 408 STATUS current 409 DESCRIPTION "The routers' preference for this RPKI cache server. 411 A lower value means more preferred. If two entries 412 have the same preference, then the order is 413 arbitrary. 415 In two cases the maximum value for an Unsigned32 416 object should be returned for this object: 417 - If no order is specified in the RPKI Router 418 configuration. 419 - If a preference value is configured that is 420 larger than the max value for an Unsigned32 421 object." 423 REFERENCE "The RPKI/Rtr Protocol, RFC6810 - section 8." 424 DEFVAL { 4294967295 } 425 ::= { rpkiRtrCacheServerTableEntry 7 } 427 rpkiRtrCacheServerConnectionType OBJECT-TYPE 428 SYNTAX RpkiRtrConnectionType 429 MAX-ACCESS read-only 430 STATUS current 431 DESCRIPTION "The connection type or transport security suite 432 in use for this RPKI cache server." 433 ::= { rpkiRtrCacheServerTableEntry 8 } 435 rpkiRtrCacheServerConnectionStatus OBJECT-TYPE 436 SYNTAX INTEGER { up(1), down(2) } 437 MAX-ACCESS read-only 438 STATUS current 439 DESCRIPTION "The connection status for this entry 440 (connection to this RPKI cache server)." 441 ::= { rpkiRtrCacheServerTableEntry 9 } 443 rpkiRtrCacheServerDescription OBJECT-TYPE 444 SYNTAX LongUtf8String 445 MAX-ACCESS read-only 446 STATUS current 447 DESCRIPTION "Free form description/information for this 448 connection to this RPKI cache server." 449 ::= { rpkiRtrCacheServerTableEntry 10 } 451 rpkiRtrCacheServerMsgsReceived OBJECT-TYPE 452 SYNTAX Counter32 453 MAX-ACCESS read-only 454 STATUS current 455 DESCRIPTION "Number of messages received from this 456 RPKI cache server via this connection. 458 Discontinuities are indicated by the value 459 of rpkiRtrDiscontinuityTimer." 460 ::= { rpkiRtrCacheServerTableEntry 11 } 462 rpkiRtrCacheServerMsgsSent OBJECT-TYPE 463 SYNTAX Counter32 464 MAX-ACCESS read-only 465 STATUS current 466 DESCRIPTION "Number of messages sent to this 467 RPKI cache server via this connection. 469 Discontinuities are indicated by the value 470 of rpkiRtrDiscontinuityTimer." 471 ::= { rpkiRtrCacheServerTableEntry 12 } 473 rpkiRtrCacheServerV4ActiveRecords OBJECT-TYPE 474 SYNTAX Gauge32 475 MAX-ACCESS read-only 476 STATUS current 477 DESCRIPTION "Number of active IPv4 records received from 478 this RPKI cache server via this connection." 479 ::= { rpkiRtrCacheServerTableEntry 13 } 481 rpkiRtrCacheServerV4Announcements OBJECT-TYPE 482 SYNTAX Counter32 483 MAX-ACCESS read-only 484 STATUS current 485 DESCRIPTION "The number of IPv4 records announced by the 486 RPKI cache Server via this connection. 488 Discontinuities are indicated by the value 489 of rpkiRtrDiscontinuityTimer." 490 ::= { rpkiRtrCacheServerTableEntry 14 } 492 rpkiRtrCacheServerV4Withdrawals OBJECT-TYPE 493 SYNTAX Counter32 494 MAX-ACCESS read-only 495 STATUS current 496 DESCRIPTION "The number of IPv4 records withdrawn by the 497 RPKI cache Server via this connection. 499 Discontinuities are indicated by the value 500 of rpkiRtrDiscontinuityTimer." 501 ::= { rpkiRtrCacheServerTableEntry 15 } 503 rpkiRtrCacheServerV6ActiveRecords OBJECT-TYPE 504 SYNTAX Gauge32 505 MAX-ACCESS read-only 506 STATUS current 507 DESCRIPTION "Number of active IPv6 records received from 508 this RPKI cache server via this connection." 509 ::= { rpkiRtrCacheServerTableEntry 16 } 511 rpkiRtrCacheServerV6Announcements OBJECT-TYPE 512 SYNTAX Counter32 513 MAX-ACCESS read-only 514 STATUS current 515 DESCRIPTION "The number of IPv6 records announced by the 516 RPKI cache Server via this connection. 518 Discontinuities are indicated by the value 519 of rpkiRtrDiscontinuityTimer." 520 ::= { rpkiRtrCacheServerTableEntry 17 } 522 rpkiRtrCacheServerV6Withdrawals OBJECT-TYPE 523 SYNTAX Counter32 524 MAX-ACCESS read-only 525 STATUS current 526 DESCRIPTION "The number of IPv6 records withdrawn by the 527 RPKI cache Server via this connection. 529 Discontinuities are indicated by the value 530 of rpkiRtrDiscontinuityTimer." 531 ::= { rpkiRtrCacheServerTableEntry 18 } 533 rpkiRtrCacheServerLatestSerial OBJECT-TYPE 534 SYNTAX Unsigned32 535 MAX-ACCESS read-only 536 STATUS current 537 DESCRIPTION "The latest serial number of data received from 538 this RPKI server on this connection. 540 Note: this value wraps back to zero when it 541 reaches its maximum value." 542 REFERENCE "RFC6810 section 2 and RFC1982" 543 -- RFC-Editor: please fill out nnnn with the RFC number assigned 544 -- to draft-ietf-sidr-rpki-rtr-nn.txt 545 ::= { rpkiRtrCacheServerTableEntry 19 } 547 rpkiRtrCacheServerSessionID OBJECT-TYPE 548 SYNTAX Unsigned32 (0..65535) 549 MAX-ACCESS read-only 550 STATUS current 551 DESCRIPTION "The Session ID associated with the RPKI cache 552 server at the other end of this connection." 553 REFERENCE "RFC6810 section 2" 554 ::= { rpkiRtrCacheServerTableEntry 20 } 556 rpkiRtrCacheServerRefreshTimer OBJECT-TYPE 557 SYNTAX Unsigned32 (60..7200) 558 UNITS "seconds" 559 MAX-ACCESS read-only 560 STATUS current 561 DESCRIPTION "The number of seconds configured for the refresh 562 timer for this connection to this RPKI cache 563 server." 564 REFERENCE "RFC6810 section 8, section 6.1" 565 ::= { rpkiRtrCacheServerTableEntry 21 } 567 rpkiRtrCacheServerTimeToRefresh OBJECT-TYPE 568 SYNTAX Integer32 569 UNITS "seconds" 570 MAX-ACCESS read-only 571 STATUS current 572 DESCRIPTION "The number of seconds remaining before a new 573 refresh is performed via a Serial Query to 574 this cache server over this connection. 576 A negative value means that the refresh time has 577 passed this many seconds and the refresh has not 578 yet been completed. It will stop decrementing at 579 the maximum negative value. 581 Upon a completed refresh (i.e. a successful 582 and complete response to a Serial Query) the 583 value of this attribute will be re-initialized 584 with the value of the corresponding 585 rpkiRtrCacheServerRefreshTimer attribute." 586 REFERENCE "RFC6810 section 8" 587 ::= { rpkiRtrCacheServerTableEntry 22 } 589 rpkiRtrCacheServerId OBJECT-TYPE 590 SYNTAX Unsigned32 (1..4294967295) 591 MAX-ACCESS read-only 592 STATUS current 593 DESCRIPTION "The unique ID for this connection. 595 An implementation must make sure this ID is unique 596 within this table. It is this ID that can be used 597 to find entries in the rpkiRtrPrefixOriginTable 598 that were created by announcements received on 599 this connection from this cache server." 600 REFERENCE "RFC6810 section 4" 601 ::= { rpkiRtrCacheServerTableEntry 23 } 603 -- ============================================================== 604 -- Errors Table 605 -- ============================================================== 607 rpkiRtrCacheServerErrorsTable OBJECT-TYPE 608 SYNTAX SEQUENCE OF RpkiRtrCacheServerErrorsTableEntry 609 MAX-ACCESS not-accessible 610 STATUS current 611 DESCRIPTION "This table provides statistics on errors per 612 RPKI peer connection. These can be used for 613 debugging." 614 ::= { rpkiRtrObjects 3 } 616 rpkiRtrCacheServerErrorsTableEntry OBJECT-TYPE 617 SYNTAX RpkiRtrCacheServerErrorsTableEntry 618 MAX-ACCESS not-accessible 619 STATUS current 620 DESCRIPTION "An entry in the rpkiCacheServerErrorTable. It 621 holds management objects associated with errors 622 codes that were received on the specified 623 connection to a specific cache server." 624 REFERENCE "RFC6810 section 10" 625 AUGMENTS { rpkiRtrCacheServerTableEntry } 626 ::= { rpkiRtrCacheServerErrorsTable 1 } 628 RpkiRtrCacheServerErrorsTableEntry ::= SEQUENCE { 629 rpkiRtrCacheServerErrorsCorruptData Counter32, 630 rpkiRtrCacheServerErrorsInternalError Counter32, 631 rpkiRtrCacheServerErrorsNoData Counter32, 632 rpkiRtrCacheServerErrorsInvalidRequest Counter32, 633 rpkiRtrCacheServerErrorsUnsupportedVersion Counter32, 634 rpkiRtrCacheServerErrorsUnsupportedPdu Counter32, 635 rpkiRtrCacheServerErrorsWithdrawalUnknown Counter32, 636 rpkiRtrCacheServerErrorsDuplicateAnnounce Counter32 637 } 639 rpkiRtrCacheServerErrorsCorruptData OBJECT-TYPE 640 SYNTAX Counter32 641 MAX-ACCESS read-only 642 STATUS current 643 DESCRIPTION "The number of 'Corrupt Data' errors received 644 from the RPKI cache server at the other end 645 of this connection. 647 Discontinuities are indicated by the value 648 of rpkiRtrDiscontinuityTimer." 649 ::= { rpkiRtrCacheServerErrorsTableEntry 1 } 651 rpkiRtrCacheServerErrorsInternalError OBJECT-TYPE 652 SYNTAX Counter32 653 MAX-ACCESS read-only 654 STATUS current 655 DESCRIPTION "The number of 'Internal Error' errors received 656 from the RPKI cache server at the other end 657 of this connection. 659 Discontinuities are indicated by the value 660 of rpkiRtrDiscontinuityTimer." 661 ::= { rpkiRtrCacheServerErrorsTableEntry 2 } 663 rpkiRtrCacheServerErrorsNoData OBJECT-TYPE 664 SYNTAX Counter32 665 MAX-ACCESS read-only 666 STATUS current 667 DESCRIPTION "The number of 'No Data Available' errors received 668 from the RPKI cache server at the other end 669 of this connection. 671 Discontinuities are indicated by the value 672 of rpkiRtrDiscontinuityTimer." 673 ::= { rpkiRtrCacheServerErrorsTableEntry 3 } 675 rpkiRtrCacheServerErrorsInvalidRequest OBJECT-TYPE 676 SYNTAX Counter32 677 MAX-ACCESS read-only 678 STATUS current 679 DESCRIPTION "The number of 'Invalid Request' errors received 680 from the RPKI cache server at the other end 681 of this connection. 683 Discontinuities are indicated by the value 684 of rpkiRtrDiscontinuityTimer." 685 ::= { rpkiRtrCacheServerErrorsTableEntry 4 } 687 rpkiRtrCacheServerErrorsUnsupportedVersion OBJECT-TYPE 688 SYNTAX Counter32 689 MAX-ACCESS read-only 690 STATUS current 691 DESCRIPTION "The number of 'Unsupported Protocol Version' 692 errors received from the RPKI cache server at 693 the other end of this connection. 695 Discontinuities are indicated by the value 696 of rpkiRtrDiscontinuityTimer." 697 ::= { rpkiRtrCacheServerErrorsTableEntry 5 } 699 rpkiRtrCacheServerErrorsUnsupportedPdu OBJECT-TYPE 700 SYNTAX Counter32 701 MAX-ACCESS read-only 702 STATUS current 703 DESCRIPTION "The number of 'Unsupported PDU Type' errors 704 received from the RPKI cache server at the 705 other end of this connection. 707 Discontinuities are indicated by the value 708 of rpkiRtrDiscontinuityTimer." 709 ::= { rpkiRtrCacheServerErrorsTableEntry 6 } 711 rpkiRtrCacheServerErrorsWithdrawalUnknown OBJECT-TYPE 712 SYNTAX Counter32 713 MAX-ACCESS read-only 714 STATUS current 715 DESCRIPTION "The number of 'Withdrawal of Unknown Record' 716 errors received from the RPKI cache server at 717 the other end of this connection. 719 Discontinuities are indicated by the value 720 of rpkiRtrDiscontinuityTimer." 721 ::= { rpkiRtrCacheServerErrorsTableEntry 7 } 723 rpkiRtrCacheServerErrorsDuplicateAnnounce OBJECT-TYPE 724 SYNTAX Counter32 725 MAX-ACCESS read-only 726 STATUS current 727 DESCRIPTION "The number of 'Duplicate Announcement Received' 728 errors received from the RPKI cache server at 729 the other end of this connection. 731 Discontinuities are indicated by the value 732 of rpkiRtrDiscontinuityTimer." 733 ::= { rpkiRtrCacheServerErrorsTableEntry 8 } 735 -- ============================================================== 736 -- The rpkiRtrPrefixOriginTable 737 -- ============================================================== 738 rpkiRtrPrefixOriginTable OBJECT-TYPE 739 SYNTAX SEQUENCE OF RpkiRtrPrefixOriginTableEntry 740 MAX-ACCESS not-accessible 741 STATUS current 742 DESCRIPTION "This table lists the prefixes that were 743 announced by RPKI cache servers to this system. 744 That is the prefixes and their Origin ASN 745 as received by announcements via the 746 rpki-rtr protocol." 747 ::= { rpkiRtrObjects 4 } 749 rpkiRtrPrefixOriginTableEntry OBJECT-TYPE 750 SYNTAX RpkiRtrPrefixOriginTableEntry 751 MAX-ACCESS not-accessible 752 STATUS current 753 DESCRIPTION "An entry in the rpkiRtrPrefixOriginTable. This 754 represents one announced prefix. If a Cache Server 755 is removed from the local configuration, any table 756 rows associated with that server (indicated by 757 rpkiRtrPrefixOriginCacheServerId) are also removed 758 from this table. 760 Implementers should be aware that if the 761 rpkiRtrPrefixOriginAddress object exceeds 111 762 octets, the index values will exceed the 128 763 sub-identifier limit and cannot be accessed using 764 SNMPv1, SNMPv2c, or SNMPv3." 766 INDEX { rpkiRtrPrefixOriginAddressType, 767 rpkiRtrPrefixOriginAddress, 768 rpkiRtrPrefixOriginMinLength, 769 rpkiRtrPrefixOriginMaxLength, 770 rpkiRtrPrefixOriginASN, 771 rpkiRtrPrefixOriginCacheServerId 772 } 773 ::= { rpkiRtrPrefixOriginTable 1 } 775 RpkiRtrPrefixOriginTableEntry ::= SEQUENCE { 776 rpkiRtrPrefixOriginAddressType InetAddressType, 777 rpkiRtrPrefixOriginAddress InetAddress, 778 rpkiRtrPrefixOriginMinLength InetAddressPrefixLength, 779 rpkiRtrPrefixOriginMaxLength InetAddressPrefixLength, 780 rpkiRtrPrefixOriginASN InetAutonomousSystemNumber, 781 rpkiRtrPrefixOriginCacheServerId Unsigned32 782 } 784 rpkiRtrPrefixOriginAddressType OBJECT-TYPE 785 SYNTAX InetAddressType 786 MAX-ACCESS not-accessible 787 STATUS current 788 DESCRIPTION "The network Address Type for this prefix. 790 Note: Only IPv4 and IPv6 support are required 791 for RFCxxxx read only compliance." 792 ::= { rpkiRtrPrefixOriginTableEntry 1 } 794 rpkiRtrPrefixOriginAddress OBJECT-TYPE 795 SYNTAX InetAddress 796 MAX-ACCESS not-accessible 797 STATUS current 798 DESCRIPTION "The network Address for this prefix. 800 The format of the address is defined by the 801 value of the corresponding instance of 802 rpkiRtrPrefixOriginAddressType." 803 ::= { rpkiRtrPrefixOriginTableEntry 2 } 805 rpkiRtrPrefixOriginMinLength OBJECT-TYPE 806 SYNTAX InetAddressPrefixLength 807 MAX-ACCESS not-accessible 808 STATUS current 809 DESCRIPTION "The minimum prefix length allowed for this prefix." 810 ::= { rpkiRtrPrefixOriginTableEntry 3 } 812 rpkiRtrPrefixOriginMaxLength OBJECT-TYPE 813 SYNTAX InetAddressPrefixLength 814 MAX-ACCESS not-accessible 815 STATUS current 816 DESCRIPTION "The maximum prefix length allowed for this prefix. 818 Note, this value must be greater or equal to the 819 value of rpkiRtrPrefixOriginMinLength." 820 ::= { rpkiRtrPrefixOriginTableEntry 4 } 822 rpkiRtrPrefixOriginASN OBJECT-TYPE 823 SYNTAX InetAutonomousSystemNumber (0..4294967295) 824 MAX-ACCESS not-accessible 825 STATUS current 826 DESCRIPTION "The ASN that is authorized to announce the 827 prefix or sub-prefixes covered by this entry." 828 ::= { rpkiRtrPrefixOriginTableEntry 5 } 830 rpkiRtrPrefixOriginCacheServerId OBJECT-TYPE 831 SYNTAX Unsigned32 (1..4294967295) 832 MAX-ACCESS read-only 833 STATUS current 834 DESCRIPTION "The unique ID of the connection to the cache 835 server from which this announcement was received. 836 That connection is identified/found by a matching 837 value in attribute rpkiRtrCacheServerId." 838 ::= { rpkiRtrPrefixOriginTableEntry 6 } 840 -- ============================================================== 841 -- Notifications 842 -- ============================================================== 844 rpkiRtrCacheServerConnectionStateChange NOTIFICATION-TYPE 845 OBJECTS { rpkiRtrCacheServerConnectionStatus, 846 rpkiRtrCacheServerLatestSerial, 847 rpkiRtrCacheServerSessionID 848 } 849 STATUS current 850 DESCRIPTION "This notification signals a change in the status 851 of an rpkiRtrCacheServerConnection. 853 The management agent MUST throttle the generation of 854 consecutive rpkiRtrCacheServerConnectionStateChange 855 notifications such that there is at least a 5 second 856 gap between them. 858 If more than one notification has occurred locally 859 during that time, the most recent notification is 860 sent at the end of the 5 second gap and the others 861 are discarded." 862 ::= { rpkiRtrNotifications 1 } 864 rpkiRtrCacheServerConnectionToGoStale NOTIFICATION-TYPE 865 OBJECTS { rpkiRtrCacheServerV4ActiveRecords, 866 rpkiRtrCacheServerV6ActiveRecords, 867 rpkiRtrCacheServerLatestSerial, 868 rpkiRtrCacheServerSessionID, 869 rpkiRtrCacheServerRefreshTimer, 870 rpkiRtrCacheServerTimeToRefresh 871 } 872 STATUS current 873 DESCRIPTION "This notification signals that an RPKI cache 874 server connection is about to go stale. 875 It is suggested that this notification is 876 generated when the value of the 877 rpkiRtrCacheServerTimeToRefresh attribute 878 goes below 60 seconds. 880 The SNMP agent MUST throttle the generation of 881 consecutive rpkiRtrCacheServerConnectionToGoStale 882 notifications such that there is at least a 883 5 second gap between them. 884 " 885 ::= { rpkiRtrNotifications 2 } 887 -- ============================================================== 888 -- Module Compliance information 889 -- ============================================================== 891 rpkiRtrCompliances OBJECT IDENTIFIER ::= 892 {rpkiRtrConformance 1} 893 rpkiRtrGroups OBJECT IDENTIFIER ::= 894 {rpkiRtrConformance 2} 896 rpkiRtrRFCxxxxReadOnlyCompliance MODULE-COMPLIANCE 897 STATUS current 898 DESCRIPTION 899 "The compliance statement for the rpkiRtrMIB module. There 900 are only read-only objects in this MIB module, so the 901 'ReadOnly' in the name of this compliance statement is there 902 only for clarity and truth in advertising. 904 There are a number of INDEX objects that cannot be 905 represented in the form of OBJECT clauses in SMIv2, but for 906 which there are compliance requirements. Those requirements 907 and similar requirements for related objects are expressed 908 below, in pseudo-OBJECT clause form, in this description: 910 -- OBJECT rpkiRtrCacheServerRemoteAddressType 911 -- SYNTAX InetAddressType { ipv4(1), ipv6(2), dns(16) } 912 -- DESCRIPTION 913 -- The MIB requires support for the IPv4, IPv6 and DNS 914 -- InetAddressTypes's for this object. 916 -- OBJECT rpkiRtrCacheServerLocalAddressType 917 -- SYNTAX InetAddressType { ipv4(1), ipv6(2), dns(16) } 918 -- DESCRIPTION 919 -- The MIB requires support for the IPv4, IPv6 and DNS 920 -- InetAddressTypes's for this object. 922 -- OBJECT rpkiRtrPrefixOriginAddressType 923 -- SYNTAX InetAddressType { ipv4(1), ipv6(2) } 924 -- DESCRIPTION 925 -- The MIB requires support for the IPv4 and IPv6 926 -- InetAddressTypes's for this object. 927 " 929 MODULE -- This module 930 MANDATORY-GROUPS { rpkiRtrCacheServerGroup, 931 rpkiRtrPrefixOriginGroup, 932 rpkiRtrNotificationsGroup 933 } 935 GROUP rpkiRtrCacheServerErrorsGroup 936 DESCRIPTION "Implementation of this group is optional and 937 would be useful for debugging." 939 ::= { rpkiRtrCompliances 1 } 941 rpkiRtrCacheServerGroup OBJECT-GROUP 942 OBJECTS { 943 rpkiRtrDiscontinuityTimer, 944 rpkiRtrCacheServerLocalAddressType, 945 rpkiRtrCacheServerLocalAddress, 946 rpkiRtrCacheServerLocalPort, 947 rpkiRtrCacheServerPreference, 948 rpkiRtrCacheServerConnectionType, 949 rpkiRtrCacheServerConnectionStatus, 950 rpkiRtrCacheServerDescription, 951 rpkiRtrCacheServerMsgsReceived, 952 rpkiRtrCacheServerMsgsSent, 953 rpkiRtrCacheServerV4ActiveRecords, 954 rpkiRtrCacheServerV4Announcements, 955 rpkiRtrCacheServerV4Withdrawals, 956 rpkiRtrCacheServerV6ActiveRecords, 957 rpkiRtrCacheServerV6Announcements, 958 rpkiRtrCacheServerV6Withdrawals, 959 rpkiRtrCacheServerLatestSerial, 960 rpkiRtrCacheServerSessionID, 961 rpkiRtrCacheServerRefreshTimer, 962 rpkiRtrCacheServerTimeToRefresh, 963 rpkiRtrCacheServerId 964 } 965 STATUS current 966 DESCRIPTION "The collection of objects to monitor the RPKI peer 967 connections." 968 ::= { rpkiRtrGroups 1 } 970 rpkiRtrCacheServerErrorsGroup OBJECT-GROUP 971 OBJECTS { 972 rpkiRtrCacheServerErrorsCorruptData, 973 rpkiRtrCacheServerErrorsInternalError, 974 rpkiRtrCacheServerErrorsNoData, 975 rpkiRtrCacheServerErrorsInvalidRequest, 976 rpkiRtrCacheServerErrorsUnsupportedVersion, 977 rpkiRtrCacheServerErrorsUnsupportedPdu, 978 rpkiRtrCacheServerErrorsWithdrawalUnknown, 979 rpkiRtrCacheServerErrorsDuplicateAnnounce 980 } 981 STATUS current 982 DESCRIPTION "The collection of objects that may help in 983 debugging the communication between rpki 984 clients and cache servers." 985 ::= { rpkiRtrGroups 2 } 987 rpkiRtrPrefixOriginGroup OBJECT-GROUP 988 OBJECTS { 989 rpkiRtrPrefixOriginCacheServerId 990 } 991 STATUS current 992 DESCRIPTION "The collection of objects that represent 993 the prefix(es) and their validated origin 994 ASes." 995 ::= { rpkiRtrGroups 3 } 997 rpkiRtrNotificationsGroup NOTIFICATION-GROUP 998 NOTIFICATIONS { rpkiRtrCacheServerConnectionStateChange, 999 rpkiRtrCacheServerConnectionToGoStale 1000 } 1001 STATUS current 1002 DESCRIPTION "The set of notifications to alert an NMS of change 1003 in connections to RPKI cache servers." 1004 ::= { rpkiRtrGroups 4 } 1006 END 1008 5. IANA Considerations 1010 The MIB module in this document will required an IANA assigned OBJECT 1011 IDENTIFIER within the SMI Numbers registry. For example, replacing 1012 XXX below: 1014 Descriptor OBJECT IDENTIFIER value 1015 ---------- ----------------------- 1016 rpkiRouter { mib-2 XXX } 1018 6. Security Considerations 1020 There are no management objects defined in this MIB module that have 1021 a MAX-ACCESS clause of read-write and/or read-create. So, if this 1022 MIB module is implemented correctly, then there is no risk that an 1023 intruder can alter or create any management objects of this MIB 1024 module via direct SNMP SET operations. 1026 Most of the readable objects in this MIB module (i.e., objects with a 1027 MAX-ACCESS other than not-accessible) may be considered sensitive or 1028 vulnerable in some network environments. They are vulnerable in the 1029 sense that when an intruder sees the information in this MIB module, 1030 then it might help him/her to setup a an attack on the router or 1031 cache server. It is thus important to control even GET and/or NOTIFY 1032 access to these objects and possibly to even encrypt the values of 1033 these objects when sending them over the network via SNMP. 1035 SNMP versions prior to SNMPv3 did not include adequate security. 1036 Even if the network itself is secure (for example by using IPsec), 1037 even then, there is no control as to who on the secure network is 1038 allowed to access and GET/SET (read/change/create/delete) the objects 1039 in this MIB module. 1041 Implementations MUST provide the security features described by the 1042 SNMPv3 framework (see [RFC3410]), including full support for 1043 authentication and privacy via the User-based Security Model (USM) 1044 [RFC3414] with the AES cipher algorithm [RFC3826]. Implementations 1045 MAY also provide support for the Transport Security Model (TSM) 1046 [RFC3591] in combination with a secure transport such as SSH 1047 [RFC3592] or TLS/DTLS [RFC3593] 1049 Further, deployment of SNMP versions prior to SNMPv3 is NOT 1050 RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to 1051 enable cryptographic security. It is then a customer/operator 1052 responsibility to ensure that the SNMP entity giving access to an 1053 instance of this MIB module is properly configured to give access to 1054 the objects only to those principals (users) that have legitimate 1055 rights to indeed GET or SET (change/create/delete) them. 1057 7. References 1059 7.1. Normative References 1061 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1062 Requirement Levels", BCP 14, RFC 2119, March 1997. 1064 [RFC2287] Krupczak, C. and J. Saperia, "Definitions of System-Level 1065 Managed Objects for Applications", RFC 2287, 1066 February 1998. 1068 [RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder, 1069 "Structure of Management Information Version 2 (SMIv2)", 1070 RFC 2578, April 1999. 1072 [RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder, 1073 "Textual Conventions for SMIv2", RFC 2579, April 1999. 1075 [RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, 1076 "Conformance Statements for SMIv2", RFC 2580, April 1999. 1078 [RFC4001] Daniele, M., Haberman, B., Routhier, S., and J. 1079 Schoenwaelder, "Textual Conventions for Internet Network 1080 Addresses", RFC 4001, February 2005. 1082 [RFC6810] Bush, R. and R. Austein, "The Resource Public Key 1083 Infrastructure (RPKI) to Router Protocol", RFC 6810, 1084 January 2013. 1086 7.2. Informative References 1088 [RFC1982] Elz, R. and R. Bush, "Serial Number Arithmetic", RFC 1982, 1089 August 1996. 1091 [RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, 1092 "Introduction and Applicability Statements for Internet- 1093 Standard Management Framework", RFC 3410, December 2002. 1095 [RFC3414] Blumenthal, U. and B. Wijnen, "User-based Security Model 1096 (USM) for version 3 of the Simple Network Management 1097 Protocol (SNMPv3)", RFC 3414, December 2002. 1099 [RFC3591] Lam, H-K., Stewart, M., and A. Huynh, "Definitions of 1100 Managed Objects for the Optical Interface Type", RFC 3591, 1101 September 2003. 1103 [RFC3592] Tesink, K., "Definitions of Managed Objects for the 1104 Synchronous Optical Network/Synchronous Digital Hierarchy 1105 (SONET/SDH) Interface Type", RFC 3592, September 2003. 1107 [RFC3593] Tesink, K., "Textual Conventions for MIB Modules Using 1108 Performance History Based on 15 Minute Intervals", 1109 RFC 3593, September 2003. 1111 [RFC3826] Blumenthal, U., Maino, F., and K. McCloghrie, "The 1112 Advanced Encryption Standard (AES) Cipher Algorithm in the 1113 SNMP User-based Security Model", RFC 3826, June 2004. 1115 [RFC4252] Ylonen, T. and C. Lonvick, "The Secure Shell (SSH) 1116 Authentication Protocol", RFC 4252, January 2006. 1118 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 1119 (TLS) Protocol Version 1.2", RFC 5246, August 2008. 1121 [RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP 1122 Authentication Option", RFC 5925, June 2010. 1124 Authors' Addresses 1126 Randy Bush 1127 Internet Initiative Japan 1128 5147 Crystal Springs 1129 Bainbridge Island, Washington 98110 1130 US 1132 Email: randy@psg.com 1134 Bert Wijnen 1135 RIPE NCC 1136 Schagen 33 1137 3461 GL Linschoten 1138 Netherlands 1140 Email: bertietf@bwijnen.net 1142 Keyur Patel 1143 Cisco Systems 1144 170 W. Tasman Drive 1145 San Jose, CA 95134 1146 USA 1148 Email: keyupate@cisco.com 1150 Michael Baer 1151 SPARTA 1152 P.O. Box 72682 1153 Davis, CA 95617 1154 USA 1156 Email: michael.baer@sparta.com