mibs/nokia/aos7/ALCATEL-IND1-IPSEC-MIB
ALCATEL-IND1-IPSEC-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE, Integer32, Unsigned32, Counter32
FROM SNMPv2-SMI
TEXTUAL-CONVENTION, RowStatus, TruthValue
FROM SNMPv2-TC
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB
MODULE-COMPLIANCE, OBJECT-GROUP
FROM SNMPv2-CONF
InetAddressType, InetAddress
FROM INET-ADDRESS-MIB
softentIND1IPsec
FROM ALCATEL-IND1-BASE;
alcatelIND1IPsecMIB MODULE-IDENTITY
LAST-UPDATED "201007200000Z"
ORGANIZATION "Alcatel - Architects Of An Internet World"
CONTACT-INFO
"Please consult with Customer Service to insure the most appropriate
version of this document is used with the products in question:
Alcatel-Lucent, Enterprise Solutions Division
(Formerly Alcatel Internetworking, Incorporated)
26801 West Agoura Road
Agoura Hills, CA 91301-5122
United States Of America
Telephone: North America +1 800 995 2696
Latin America +1 877 919 9526
Europe +31 23 556 0100
Asia +65 394 7933
All Other +1 818 878 4507
Electronic Mail: support@ind.alcatel.com
World Wide Web: http://alcatel-lucent.com/wps/portal/enterprise
File Transfer Protocol: ftp://ftp.ind.alcatel.com/pub/products/mibs"
DESCRIPTION
"This module describes an authoritative enterprise-specific Simple
Network Management Protocol (SNMP) Management Information Base (MIB):
Proprietary IPsec MIB definitions
The right to make changes in specification and other information
contained in this document without prior notice is reserved.
No liability shall be assumed for any incidental, indirect, special,
or consequential damages whatsoever arising from or related to this
document or the information contained herein.
Vendors, end-users, and other interested parties are granted
non-exclusive license to use this specification in connection with
management of the products for which it is intended to be used.
Copyright (C) 1995-2010 Alcatel-Lucent
ALL RIGHTS RESERVED WORLDWIDE"
REVISION "201007200000Z"
DESCRIPTION
"The latest version of this MIB Module."
::= { softentIND1IPsec 1 }
alcatelIND1IPsecMIBObjects OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIB 1 }
--
-- Textual Conventions
--
IPsecDescription ::= TEXTUAL-CONVENTION
DISPLAY-HINT "255a"
STATUS current
DESCRIPTION
"Optional description of a table entry."
SYNTAX OCTET STRING (SIZE(0..200))
IPsecPortNumber ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A port number value. 0 is the wildcard value to match any port."
SYNTAX Integer32 (0..65535)
IPsecPrefixLength ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Significant bits in an IPv6 address prefix. 0..32 is the valid range
for IPv4 addresses. 0..128 is valid for IPv6 addresses"
SYNTAX Integer32 (0..128)
IPsecULProtocol ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"An upper-layer protocol number. 255 is the wildcard value to match
any protocol."
SYNTAX Integer32 (0..255)
IPsecAdminState ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Administrative state."
SYNTAX INTEGER {
enabled(1),
disabled(2)
}
IPsecSAType ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"SA type."
SYNTAX INTEGER {
ah(2),
esp(3)
}
IPsecESPAlgorithm ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"ESP algorithms."
SYNTAX INTEGER {
none(0),
descbc(2),
des3cbc(3),
null(11),
aescbc(12),
aesctr(13)
}
IPsecAHAlgorithm ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"AH algorithms."
SYNTAX INTEGER {
none(0),
hmacmd5(2),
hmacsha1(3),
aesxcbcmac(9)
}
IPsecOperationalState ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Operational state.
enabled(1) - The entry is enabled.
disabled(2) - The entry is administratively disabled or
DNS resolution has experienced a permanent failure.
dnspending(3) - Awaiting DNS resolution before making
the entry active."
SYNTAX INTEGER {
enabled(1),
disabled(2),
dnspending(3)
}
--
-- Global IPsec Configuration
--
alaIPsecConfig OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIBObjects 1 }
alaIPsecSecurityKeyTable OBJECT-TYPE
SYNTAX SEQUENCE OF AlaIPsecSecurityKeyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table allowing the configuration of the switch's IPsec security key.
The security key is used to encrypt and IPsec related information
retained in permanent storage.
There is always a single row in this table with an index value of 1."
::= { alaIPsecConfig 1 }
alaIPsecSecurityKeyEntry OBJECT-TYPE
SYNTAX AlaIPsecSecurityKeyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The security key entry."
INDEX { alaIPsecSecurityKeyID }
::= { alaIPsecSecurityKeyTable 1 }
AlaIPsecSecurityKeyEntry ::= SEQUENCE {
alaIPsecSecurityKeyID Unsigned32,
alaIPsecSecurityKeyCurrent OCTET STRING,
alaIPsecSecurityKeyNew OCTET STRING
}
alaIPsecSecurityKeyID OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The row's identifier. Only one entry is ever present, with an
ID value of 1."
::= { alaIPsecSecurityKeyEntry 1 }
alaIPsecSecurityKeyCurrent OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..16))
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The current value of the 16-byte IPsec security key. If an attempt
is made to read the value of this object, a zero-length octet
string will be returned."
::= { alaIPsecSecurityKeyEntry 2 }
alaIPsecSecurityKeyNew OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..16))
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Used to set a new 16-byte value for the IPsec security key.
Both alaIPsecSecurityKeyCurrent (with its correct value) and
alaIPsecSecurityKeyNew must be specified in the same SNMP SET
message. If alaIPsecSecurityKeyCurrent is not present, or if
its value is incorrect, the attempt to set a new key will fail.
If an attempt is made to read the value of this object, a zero-length
octet string will be returned."
::= { alaIPsecSecurityKeyEntry 3 }
--
-- IPsec Statistics Table
--
-- The IPsec statistics table was based on the counters kept by a specific
-- IPsec implementation. Other implementations do not keep all all the
-- counters or have them with less specificity. Thus the IPsec
-- statistics table has been superseded by the IPsec errors table.
alaIPsecStatisticsTable OBJECT-TYPE
SYNTAX SEQUENCE OF AlaIPsecStatisticsEntry
MAX-ACCESS not-accessible
STATUS deprecated
DESCRIPTION
"Table allowing the IPv6 statistics to be retrieved."
::= { alaIPsecConfig 2 }
alaIPsecStatisticsEntry OBJECT-TYPE
SYNTAX AlaIPsecStatisticsEntry
MAX-ACCESS not-accessible
STATUS deprecated
DESCRIPTION
"The statistics entry."
INDEX { alaIPsecStatisticsProtocol }
::= { alaIPsecStatisticsTable 1 }
AlaIPsecStatisticsEntry ::= SEQUENCE {
alaIPsecStatisticsProtocol INTEGER,
alaIPsecStatisticsInSuccessful Counter32,
alaIPsecStatisticsInPolicyViolation Counter32,
alaIPsecStatisticsInNoSA Counter32,
alaIPsecStatisticsInUnknownSPI Counter32,
alaIPsecStatisticsInAHReplay Counter32,
alaIPsecStatisticsInESPReplay Counter32,
alaIPsecStatisticsInAHAuthenticationSuccess Counter32,
alaIPsecStatisticsInAHAuthenticationFail Counter32,
alaIPsecStatisticsInESPAuthenticationSuccess Counter32,
alaIPsecStatisticsInESPAuthenticationFail Counter32,
alaIPsecStatisticsInBadPacket Counter32,
alaIPsecStatisticsInNoMemory Counter32,
alaIPsecStatisticsOutSuccessful Counter32,
alaIPsecStatisticsOutPolicyViolation Counter32,
alaIPsecStatisticsOutNoSA Counter32,
alaIPsecStatisticsOutBadPacket Counter32,
alaIPsecStatisticsOutNoMemory Counter32,
alaIPsecStatisticsInDiscarded Counter32,
alaIPsecStatisticsOutDiscarded Counter32
}
alaIPsecStatisticsProtocol OBJECT-TYPE
SYNTAX INTEGER {
ipv6(6)
}
MAX-ACCESS not-accessible
STATUS deprecated
DESCRIPTION
"IP protocol version covered by the IPsec statistics."
::= { alaIPsecStatisticsEntry 1 }
alaIPsecStatisticsInSuccessful OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets requiring IPsec processing
that were successfully handled."
::= { alaIPsecStatisticsEntry 2 }
alaIPsecStatisticsInPolicyViolation OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets that were dropped because
of policy violations."
::= { alaIPsecStatisticsEntry 3 }
alaIPsecStatisticsInNoSA OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets dropped because no
matching SA was found."
::= { alaIPsecStatisticsEntry 4 }
alaIPsecStatisticsInUnknownSPI OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets dropped because the SPI was
unknown."
::= { alaIPsecStatisticsEntry 5 }
alaIPsecStatisticsInAHReplay OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets that failed the AH replay
check."
::= { alaIPsecStatisticsEntry 6 }
alaIPsecStatisticsInESPReplay OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets taht failed the ESP
replay check."
::= { alaIPsecStatisticsEntry 7 }
alaIPsecStatisticsInAHAuthenticationSuccess OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets that successfully passed
AH authentication."
::= { alaIPsecStatisticsEntry 8 }
alaIPsecStatisticsInAHAuthenticationFail OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets that failed AH
authentication."
::= { alaIPsecStatisticsEntry 9 }
alaIPsecStatisticsInESPAuthenticationSuccess OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets that successfully passed
ESP authentication."
::= { alaIPsecStatisticsEntry 10 }
alaIPsecStatisticsInESPAuthenticationFail OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets that failed ESP
authentication."
::= { alaIPsecStatisticsEntry 11 }
alaIPsecStatisticsInBadPacket OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets requiring IPsec
processing that were not valid."
::= { alaIPsecStatisticsEntry 12 }
alaIPsecStatisticsInNoMemory OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming IPsec packets dropped because
no memory was available."
::= { alaIPsecStatisticsEntry 13 }
alaIPsecStatisticsOutSuccessful OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of outgoing packets requiring IPsec processing
that were successfully handled."
::= { alaIPsecStatisticsEntry 14 }
alaIPsecStatisticsOutPolicyViolation OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of outgoing packets dropped because of a
policy violation."
::= { alaIPsecStatisticsEntry 15 }
alaIPsecStatisticsOutNoSA OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of outgoing packets dropped because no matching
SA was found."
::= { alaIPsecStatisticsEntry 16 }
alaIPsecStatisticsOutBadPacket OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of outgoing packets requiring IPsec processing
that were not valid."
::= { alaIPsecStatisticsEntry 17 }
alaIPsecStatisticsOutNoMemory OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of outgoing IPsec packets dropped because no
memory was available."
::= { alaIPsecStatisticsEntry 18 }
alaIPsecStatisticsInDiscarded OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of incoming packets dropped because they matched
a discard policy."
::= { alaIPsecStatisticsEntry 19 }
alaIPsecStatisticsOutDiscarded OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Number of outgoing packets dropped because they matched
a discard policy."
::= { alaIPsecStatisticsEntry 20 }
--
-- Security Policy Table
--
alaIPsecSecurityPolicyTable OBJECT-TYPE
SYNTAX SEQUENCE OF AlaIPsecSecurityPolicyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table allowing the configuration of IPsec security policies."
::= { alcatelIND1IPsecMIBObjects 2 }
alaIPsecSecurityPolicyEntry OBJECT-TYPE
SYNTAX AlaIPsecSecurityPolicyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A security policy entry."
INDEX { alaIPsecSecurityPolicyID }
::= { alaIPsecSecurityPolicyTable 1 }
AlaIPsecSecurityPolicyEntry ::= SEQUENCE {
alaIPsecSecurityPolicyID Unsigned32,
alaIPsecSecurityPolicySourceType InetAddressType,
alaIPsecSecurityPolicySource InetAddress,
alaIPsecSecurityPolicySourcePrefixLength IPsecPrefixLength,
alaIPsecSecurityPolicySourcePort IPsecPortNumber,
alaIPsecSecurityPolicyDestinationType InetAddressType,
alaIPsecSecurityPolicyDestination InetAddress,
alaIPsecSecurityPolicyDestinationPrefixLength IPsecPrefixLength,
alaIPsecSecurityPolicyDestinationPort IPsecPortNumber,
alaIPsecSecurityPolicyULProtocol IPsecULProtocol,
alaIPsecSecurityPolicyICMPv6Type Integer32,
alaIPsecSecurityPolicyDirection INTEGER,
alaIPsecSecurityPolicyName SnmpAdminString,
alaIPsecSecurityPolicyDescription IPsecDescription,
alaIPsecSecurityPolicyAction INTEGER,
alaIPsecSecurityPolicyAdminState IPsecAdminState,
alaIPsecSecurityPolicyOperationalState IPsecOperationalState,
alaIPsecSecurityPolicyPriority Integer32,
alaIPsecSecurityPolicyRowStatus RowStatus
}
alaIPsecSecurityPolicyID OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A unique identifier for this security policy. When creating a
new policy, a zero value must be specified. An available
policy ID will then be automatically assigned to the policy."
::= { alaIPsecSecurityPolicyEntry 1 }
alaIPsecSecurityPolicySourceType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of source address specified. Currently only ipv6(2) is allowed."
::= { alaIPsecSecurityPolicyEntry 2 }
alaIPsecSecurityPolicySource OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The source of packets covered by this policy."
::= { alaIPsecSecurityPolicyEntry 3 }
alaIPsecSecurityPolicySourcePrefixLength OBJECT-TYPE
SYNTAX IPsecPrefixLength
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The number of bits of the source address used to determine
which packets are covered by this policy.
The default value varies depending upon the type of
source address specified:
IPv4 - 32
IPv6 - 128
DNS name - 0 (any other value is ignored)"
::= { alaIPsecSecurityPolicyEntry 4 }
alaIPsecSecurityPolicySourcePort OBJECT-TYPE
SYNTAX IPsecPortNumber
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The source port of packets covered by this policy. To
match packets from any port, specify the 0 wildcard value. A
wildcard policy will only be used when there is no exact match
to a destination port in another entry."
DEFVAL { 0 }
::= { alaIPsecSecurityPolicyEntry 5 }
alaIPsecSecurityPolicyDestinationType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of destination address specified. Currently only ipv6(2) is allowed."
::= { alaIPsecSecurityPolicyEntry 6 }
alaIPsecSecurityPolicyDestination OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The destination of packets covered by this policy."
::= { alaIPsecSecurityPolicyEntry 7 }
alaIPsecSecurityPolicyDestinationPrefixLength OBJECT-TYPE
SYNTAX IPsecPrefixLength
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The number of bits of the destination prefix used to determine
which packets are covered by this policy.
The default value varies depending upon the type of
destination address specified:
IPv4 - 32
IPv6 - 128
DNS name - 0 (any other value is ignored)"
::= { alaIPsecSecurityPolicyEntry 8 }
alaIPsecSecurityPolicyDestinationPort OBJECT-TYPE
SYNTAX IPsecPortNumber
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The destination port of packets covered by this policy. To
match packets from any port, specify the 0 wildcard value. A
wildcard policy will only be used when there is no exact match
to a destination port in another entry."
DEFVAL { 0 }
::= { alaIPsecSecurityPolicyEntry 9 }
alaIPsecSecurityPolicyULProtocol OBJECT-TYPE
SYNTAX IPsecULProtocol
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The upper-layer protocol of packets covered by this policy.
To match all protocols, specify the 255 wildcard value. A wildcard
policy will only be used when there is no exact match to the protocol
value specified in another entry."
DEFVAL { 255 }
::= { alaIPsecSecurityPolicyEntry 10 }
alaIPsecSecurityPolicyICMPv6Type OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"If the upper-layer protocol is ICMPv6, an ICMPv6 type value may
be specified to restrict the policy to a specific packet type.
To match all ICMPv6 packets, the 0 wildcard value should be
specified."
DEFVAL { 0 }
::= { alaIPsecSecurityPolicyEntry 11 }
alaIPsecSecurityPolicyDirection OBJECT-TYPE
SYNTAX INTEGER {
in(1),
out(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The direction of traffic covered by this policy."
::= { alaIPsecSecurityPolicyEntry 12 }
alaIPsecSecurityPolicyName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..20))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A name for this policy."
::= { alaIPsecSecurityPolicyEntry 13 }
alaIPsecSecurityPolicyDescription OBJECT-TYPE
SYNTAX IPsecDescription
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A detailed description of this policy."
DEFVAL { "" }
::= { alaIPsecSecurityPolicyEntry 14 }
alaIPsecSecurityPolicyAction OBJECT-TYPE
SYNTAX INTEGER {
discard(0),
none(1),
ipsec(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The action to take on traffic covered by this policy.
discard(0) means that all traffic covered by the policy
will be discarded.
none(1) means that no IPsec processing will be done on
the traffic covered by this policy.
ipsec(2) means that IPsec processing will take place on
the traffic. One or more rules should be defined in the
IPsec Rule Table. If no rules are defined processing
is identical to none(0) being specified."
DEFVAL { ipsec }
::= { alaIPsecSecurityPolicyEntry 15 }
alaIPsecSecurityPolicyAdminState OBJECT-TYPE
SYNTAX IPsecAdminState
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Allows a policy to be administratively enabled or
disabled."
DEFVAL { enabled }
::= { alaIPsecSecurityPolicyEntry 16 }
alaIPsecSecurityPolicyOperationalState OBJECT-TYPE
SYNTAX IPsecOperationalState
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The operational state of this policy."
::= { alaIPsecSecurityPolicyEntry 17 }
alaIPsecSecurityPolicyPriority OBJECT-TYPE
SYNTAX Integer32 (1..1000)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The priority for this policy. When traffic would be covered by
multiple policies the policy with the highest priority value is
used. If two policies have the same priority, the one configured
first has precedence."
DEFVAL { 100 }
::= { alaIPsecSecurityPolicyEntry 18 }
alaIPsecSecurityPolicyRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Used to control the addition and removal of security
policy entries."
::= { alaIPsecSecurityPolicyEntry 19 }
--
-- Security Policy IPsec Rule Table
--
alaIPsecSecurityPolicyRuleTable OBJECT-TYPE
SYNTAX SEQUENCE OF AlaIPsecSecurityPolicyRuleEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table allowing the configuration of the IPsec rules for
a security policy."
::= { alcatelIND1IPsecMIBObjects 3 }
alaIPsecSecurityPolicyRuleEntry OBJECT-TYPE
SYNTAX AlaIPsecSecurityPolicyRuleEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A security policy entry."
INDEX {
alaIPsecSecurityPolicyID,
alaIPsecSecurityPolicyRuleIndex
}
::= { alaIPsecSecurityPolicyRuleTable 1 }
AlaIPsecSecurityPolicyRuleEntry ::= SEQUENCE {
alaIPsecSecurityPolicyRuleIndex Unsigned32,
alaIPsecSecurityPolicyRuleProtocol INTEGER,
alaIPsecSecurityPolicyRuleMode INTEGER,
alaIPsecSecurityPolicyRuleRowStatus RowStatus
}
alaIPsecSecurityPolicyRuleIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..10)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Index specifying the order in which multiple rules for
the same security policy will be applied. Rules are
indexed by the order in which they are applied to the
original payload.
For example, for a security policy where an IPv6 payload
should be protected by an ESP header, which should be protected
by an AH header, there would be two Rule Table entries.
The ESP entry would have an index of 1 (first rule applied
to the payload). The AH entry would have an index of 2
(second rule applied)."
::= { alaIPsecSecurityPolicyRuleEntry 1 }
alaIPsecSecurityPolicyRuleProtocol OBJECT-TYPE
SYNTAX INTEGER {
ah(1),
esp(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Indicates the type of header required by the rule."
::= { alaIPsecSecurityPolicyRuleEntry 2 }
alaIPsecSecurityPolicyRuleMode OBJECT-TYPE
SYNTAX INTEGER {
transport(1)
--tunnel(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The mode in which the rule's protocol is running. At present,
only transport(1) is allowed. Until tunnel mode is supported,
transport(1) will be treated as the default value."
::= { alaIPsecSecurityPolicyRuleEntry 3 }
alaIPsecSecurityPolicyRuleRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Used to control the addition and removal of security
policy IPsec rule entries."
::= { alaIPsecSecurityPolicyRuleEntry 4 }
--
-- IPsec Security Association Configuration Table
--
alaIPsecSAConfigTable OBJECT-TYPE
SYNTAX SEQUENCE OF AlaIPsecSAConfigEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table allowing the manual configuration of Security
Associations in the Security Association Database (SAD)."
::= { alcatelIND1IPsecMIBObjects 4 }
alaIPsecSAConfigEntry OBJECT-TYPE
SYNTAX AlaIPsecSAConfigEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Manually configured security association (SA) parameters."
INDEX { alaIPsecSAConfigID }
::= { alaIPsecSAConfigTable 1 }
AlaIPsecSAConfigEntry ::= SEQUENCE {
alaIPsecSAConfigID Unsigned32,
alaIPsecSAConfigType IPsecSAType,
alaIPsecSAConfigSourceType InetAddressType,
alaIPsecSAConfigSource InetAddress,
alaIPsecSAConfigDestinationType InetAddressType,
alaIPsecSAConfigDestination InetAddress,
alaIPsecSAConfigSPI Unsigned32,
alaIPsecSAConfigName SnmpAdminString,
alaIPsecSAConfigDescription IPsecDescription,
alaIPsecSAConfigEncryptionAlgorithm IPsecESPAlgorithm,
alaIPsecSAConfigEncryptionKeyLength Unsigned32,
alaIPsecSAConfigAuthenticationAlgorithm IPsecAHAlgorithm,
alaIPsecSAConfigAdminState IPsecAdminState,
alaIPsecSAConfigOperationalState IPsecOperationalState,
alaIPsecSAConfigRowStatus RowStatus
}
alaIPsecSAConfigID OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A unique identifier for this manually configured SA.
When creating a new SA, a zero value must be specified.
An available ID will then be automatically assigned to
the SA."
::= { alaIPsecSAConfigEntry 1 }
alaIPsecSAConfigType OBJECT-TYPE
SYNTAX IPsecSAType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of this SA: AH or ESP. Once set,
the type may not be changed."
::= { alaIPsecSAConfigEntry 2 }
alaIPsecSAConfigSourceType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of source address specified. Currently only ipv6(2) is allowed."
::= { alaIPsecSAConfigEntry 3 }
alaIPsecSAConfigSource OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The source of packets covered by this SA."
::= { alaIPsecSAConfigEntry 4 }
alaIPsecSAConfigDestinationType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of destination address specified. Currently only ipv6(2) is allowed."
::= { alaIPsecSAConfigEntry 5 }
alaIPsecSAConfigDestination OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The destination of packets covered by this SA."
::= { alaIPsecSAConfigEntry 6 }
alaIPsecSAConfigSPI OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The Security Parameters Index (SPI) of this SA."
::= { alaIPsecSAConfigEntry 7 }
alaIPsecSAConfigName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..20))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The name of this manually configured SA."
::= { alaIPsecSAConfigEntry 8 }
alaIPsecSAConfigDescription OBJECT-TYPE
SYNTAX IPsecDescription
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A detailed description for the manually created IPsec SA."
DEFVAL { "" }
::= { alaIPsecSAConfigEntry 9 }
alaIPsecSAConfigEncryptionAlgorithm OBJECT-TYPE
SYNTAX IPsecESPAlgorithm
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"For an ESP SA, defines the encryption algorithm to be used.
null(11) should be specified if ESP is being used for integrity
only. If null(11) is specified,
alaIPsecSAConfigAuthenticationAlgorithm may not be none(0).
aesctr(13) is not valid for manually configured SAs.
The value of this object is none(0) for AH SAs."
DEFVAL { none }
::= { alaIPsecSAConfigEntry 10 }
alaIPsecSAConfigEncryptionKeyLength OBJECT-TYPE
SYNTAX Unsigned32
UNITS "bits"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"For those algorithms where multiple key lengths are supported,
specifies the key length to be used. Zero may be specified to
use the default key length."
DEFVAL { 0 }
::= { alaIPsecSAConfigEntry 11 }
alaIPsecSAConfigAuthenticationAlgorithm OBJECT-TYPE
SYNTAX IPsecAHAlgorithm
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Defines the authentication algorithm to be used.
For ESP SAs, none(0) may be specified for encryption-only ESP.
For ESP integrity-only, ESP integrity and encryption, or for
AH SAs, hmacmd5(2), hmacsha1(3), or aesxcbcmac(9) must
be specified."
DEFVAL { none }
::= { alaIPsecSAConfigEntry 12 }
alaIPsecSAConfigAdminState OBJECT-TYPE
SYNTAX IPsecAdminState
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Allows a manually configured SA to be administratively enabled
or disabled."
DEFVAL { enabled }
::= { alaIPsecSAConfigEntry 13 }
alaIPsecSAConfigOperationalState OBJECT-TYPE
SYNTAX IPsecOperationalState
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The operational state of the manually configured SA."
::= { alaIPsecSAConfigEntry 14 }
alaIPsecSAConfigRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Used to control the addition and removal of manually configured
IPsec SAs."
::= { alaIPsecSAConfigEntry 15 }
--
-- IPsec Key Configuration Table
--
alaIPsecKeyTable OBJECT-TYPE
SYNTAX SEQUENCE OF AlaIPsecKeyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table used to configure the keys used by manually
configured Security Associations in the IPsec Security
Association Configuration table."
::= { alcatelIND1IPsecMIBObjects 5 }
alaIPsecKeyEntry OBJECT-TYPE
SYNTAX AlaIPsecKeyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An IPsec key. Keys in the table must be uniquely
identified by the combination of key type and key name.
However, since the key name can be up to 255 characters,
beyond the 128-element size limit for SNMP index objects,
the key ID is used to uniquely identify a key for SNMP
access."
INDEX { alaIPsecKeyID }
::= { alaIPsecKeyTable 1 }
AlaIPsecKeyEntry ::= SEQUENCE {
alaIPsecKeyID Unsigned32,
alaIPsecKeyType INTEGER,
alaIPsecKeyName OCTET STRING,
alaIPsecKey OCTET STRING,
alaIPsecKeyEncrypted TruthValue,
alaIPsecKeyRowStatus RowStatus
}
alaIPsecKeyID OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A unique identifier for this key. When creating a
new key, a zero value must be specified. An available
ID will then be automatically assigned to the key."
::= { alaIPsecKeyEntry 1 }
alaIPsecKeyType OBJECT-TYPE
SYNTAX INTEGER {
saAuthentication(1),
saEncryption(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Indicates if the key is to be used for encryption or
authentication by a SA. Once a key is created, its type
may not be changed."
::= { alaIPsecKeyEntry 2 }
alaIPsecKeyName OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(1..255))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The name of the key.
For manually-configured SA keys, the name is limited to
a maximum length of 20 characters and should correspond
to an entry in the alaIPsecSAConfigTable.
The key name may not be changed once a key is created."
::= { alaIPsecKeyEntry 3 }
alaIPsecKey OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The key value. The value specified must match the required
key length for the algorithm using the key. If
an attempt is made to read the value of this object a
zero-length octet string will be returned."
::= { alaIPsecKeyEntry 4 }
alaIPsecKeyEncrypted OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"If true, the key value is specified in AOS encrypted form.
For example, keys being restored from the configuration file."
DEFVAL { false }
::= { alaIPsecKeyEntry 5 }
alaIPsecKeyRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Used to control the addition and removal of keys."
::= { alaIPsecKeyEntry 6 }
--
-- IPsec Errors Table
--
alaIPsecErrorsTable OBJECT-TYPE
SYNTAX SEQUENCE OF AlaIPsecErrorsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table allowing retrieval of the IPsec error counters."
::= { alcatelIND1IPsecMIBObjects 6 }
alaIPsecErrorsEntry OBJECT-TYPE
SYNTAX AlaIPsecErrorsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The error counters entry."
INDEX { alaIPsecErrorsProtocol }
::= { alaIPsecErrorsTable 1 }
AlaIPsecErrorsEntry ::= SEQUENCE {
alaIPsecErrorsProtocol INTEGER,
alaIPsecErrorsInPolicyViolation Counter32,
alaIPsecErrorsInNoSA Counter32,
alaIPsecErrorsInReplay Counter32,
alaIPsecErrorsInAuthenticationFail Counter32,
alaIPsecErrorsInDiscarded Counter32,
alaIPsecErrorsInOther Counter32,
alaIPsecErrorsOutNoSA Counter32,
alaIPsecErrorsOutDiscarded Counter32,
alaIPsecErrorsOutOther Counter32
}
alaIPsecErrorsProtocol OBJECT-TYPE
SYNTAX INTEGER {
ipv6(6)
}
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"IP protocol version covered by the IPsec error counters."
::= { alaIPsecErrorsEntry 1 }
alaIPsecErrorsInPolicyViolation OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of incoming packets that were dropped because
of policy violations."
::= { alaIPsecErrorsEntry 2 }
alaIPsecErrorsInNoSA OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of incoming packets dropped because no
matching SA was found."
::= { alaIPsecErrorsEntry 3 }
alaIPsecErrorsInReplay OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of incoming packets that failed a replay check."
::= { alaIPsecErrorsEntry 4 }
alaIPsecErrorsInAuthenticationFail OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of incoming packets that failed authentication."
::= { alaIPsecErrorsEntry 5 }
alaIPsecErrorsInDiscarded OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of incoming packets dropped because they matched
a discard policy."
::= { alaIPsecErrorsEntry 6 }
alaIPsecErrorsInOther OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of incoming packets dropped for a reason not
otherwise counted."
::= { alaIPsecErrorsEntry 7 }
alaIPsecErrorsOutNoSA OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of outgoing packets dropped because no matching
SA was found."
::= { alaIPsecErrorsEntry 8 }
alaIPsecErrorsOutDiscarded OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of outgoing packets dropped because they matched
a discard policy."
::= { alaIPsecErrorsEntry 9 }
alaIPsecErrorsOutOther OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of outgoing packets dropped for a reason not
otherwise counted."
::= { alaIPsecErrorsEntry 10 }
--
-- conformance information
--
alcatelIND1IPsecMIBConformance OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIB 2 }
alcatelIND1IPsecMIBCompliances OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIBConformance 1 }
alcatelIND1IPsecMIBGroups OBJECT IDENTIFIER ::= { alcatelIND1IPsecMIBConformance 2 }
alaIPsecCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for Alcatel switches
implementing ALCATEL-IND1-IPSEC-MIB."
MODULE
MANDATORY-GROUPS {
alaIPsecConfigGroup,
alaIPsecSecurityPolicyGroup,
alaIPsecSAConfigGroup,
alaIPsecKeyGroup,
alaIPsecCountersGroup
}
::= { alcatelIND1IPsecMIBCompliances 1 }
--
-- units of conformance
--
alaIPsecConfigGroup OBJECT-GROUP
OBJECTS {
-- alaIPsecSecurityKeyID,
alaIPsecSecurityKeyCurrent,
alaIPsecSecurityKeyNew
}
STATUS current
DESCRIPTION
"A collection of objects to support global configuration
of IPsec."
::= { alcatelIND1IPsecMIBGroups 1 }
alaIPsecSecurityPolicyGroup OBJECT-GROUP
OBJECTS {
-- alaIPsecSecurityPolicyID
alaIPsecSecurityPolicySource,
alaIPsecSecurityPolicySourceType,
alaIPsecSecurityPolicySourcePrefixLength,
alaIPsecSecurityPolicySourcePort,
alaIPsecSecurityPolicyDestination,
alaIPsecSecurityPolicyDestinationType,
alaIPsecSecurityPolicyDestinationPrefixLength,
alaIPsecSecurityPolicyDestinationPort,
alaIPsecSecurityPolicyULProtocol,
alaIPsecSecurityPolicyICMPv6Type,
alaIPsecSecurityPolicyDirection,
alaIPsecSecurityPolicyName,
alaIPsecSecurityPolicyDescription,
alaIPsecSecurityPolicyAction,
alaIPsecSecurityPolicyAdminState,
alaIPsecSecurityPolicyOperationalState,
alaIPsecSecurityPolicyPriority,
alaIPsecSecurityPolicyRowStatus,
-- alaIPsecSecurityPolicyRuleIndex,
alaIPsecSecurityPolicyRuleProtocol,
alaIPsecSecurityPolicyRuleMode,
alaIPsecSecurityPolicyRuleRowStatus
}
STATUS current
DESCRIPTION
"A collection of objects to support management of IPsec
security policies."
::= { alcatelIND1IPsecMIBGroups 2 }
alaIPsecSAConfigGroup OBJECT-GROUP
OBJECTS {
-- alaIPsecSAConfigID,
alaIPsecSAConfigType,
alaIPsecSAConfigSource,
alaIPsecSAConfigSourceType,
alaIPsecSAConfigDestination,
alaIPsecSAConfigDestinationType,
alaIPsecSAConfigSPI,
alaIPsecSAConfigName,
alaIPsecSAConfigDescription,
alaIPsecSAConfigEncryptionAlgorithm,
alaIPsecSAConfigEncryptionKeyLength,
alaIPsecSAConfigAuthenticationAlgorithm,
alaIPsecSAConfigAdminState,
alaIPsecSAConfigOperationalState,
alaIPsecSAConfigRowStatus
}
STATUS current
DESCRIPTION
"A collection of objects to support management of manually
configured IPsec SAs."
::= { alcatelIND1IPsecMIBGroups 3 }
alaIPsecKeyGroup OBJECT-GROUP
OBJECTS {
-- alaIPsecKeyID,
alaIPsecKeyType,
alaIPsecKeyName,
alaIPsecKey,
alaIPsecKeyEncrypted,
alaIPsecKeyRowStatus
}
STATUS current
DESCRIPTION
"A collection of objects to support management of keys."
::= { alcatelIND1IPsecMIBGroups 4 }
alaIPsecCountersGroup OBJECT-GROUP
OBJECTS {
-- alaIPsecErrorsProtocol,
alaIPsecErrorsInPolicyViolation,
alaIPsecErrorsInNoSA,
alaIPsecErrorsInReplay,
alaIPsecErrorsInAuthenticationFail,
alaIPsecErrorsInDiscarded,
alaIPsecErrorsInOther,
alaIPsecErrorsOutNoSA,
alaIPsecErrorsOutDiscarded,
alaIPsecErrorsOutOther
}
STATUS current
DESCRIPTION
"A collection of objects to support management of IPsec
counters."
::= { alcatelIND1IPsecMIBGroups 5 }
alaIPsecStatisticsGroup OBJECT-GROUP
OBJECTS {
-- alaIPsecStatisticsProtocol,
alaIPsecStatisticsInSuccessful,
alaIPsecStatisticsInPolicyViolation,
alaIPsecStatisticsInNoSA,
alaIPsecStatisticsInUnknownSPI,
alaIPsecStatisticsInAHReplay,
alaIPsecStatisticsInESPReplay,
alaIPsecStatisticsInAHAuthenticationSuccess,
alaIPsecStatisticsInAHAuthenticationFail,
alaIPsecStatisticsInESPAuthenticationSuccess,
alaIPsecStatisticsInESPAuthenticationFail,
alaIPsecStatisticsInBadPacket,
alaIPsecStatisticsInNoMemory,
alaIPsecStatisticsOutSuccessful,
alaIPsecStatisticsOutPolicyViolation,
alaIPsecStatisticsOutNoSA,
alaIPsecStatisticsOutBadPacket,
alaIPsecStatisticsOutNoMemory,
alaIPsecStatisticsInDiscarded,
alaIPsecStatisticsOutDiscarded
}
STATUS deprecated
DESCRIPTION
"A collection of objects to support management of IPsec
statistics."
::= { alcatelIND1IPsecMIBGroups 6 }
END