mibs/nortel/RAPID-IPSEC-SA-MON-MIB-EXT
RAPID-IPSEC-SA-MON-MIB-EXT DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE, Counter32, Gauge32,
Integer32, Integer32, NOTIFICATION-TYPE,
OBJECT-IDENTITY, enterprises
FROM SNMPv2-SMI
TEXTUAL-CONVENTION, TruthValue
FROM SNMPv2-TC
ifIndex FROM RFC1213-MIB
IpsecDoiIdentType,
IpsecDoiEncapsulationMode,
IpsecDoiEspTransform,
IpsecDoiAhTransform,
IpsecDoiAuthAlgorithm,
IpsecDoiIpcompTransform,
IpsecDoiSecProtocolId
FROM IPSEC-ISAKMP-IKE-DOI-TC
rapidstream
FROM RAPID-MIB;
rsIpsecSaMonModule MODULE-IDENTITY
LAST-UPDATED "200003211200Z"
ORGANIZATION "WatchGuard Technologies, Inc."
CONTACT-INFO
" Ella Yu
WatchGuard Technologies, Inc.
1841 Zanker Road
San Jose, CA 95112
USA
408-519-4888
ella.yu@watchguard.com "
DESCRIPTION
"The MIB module describes generic IPSec objects
defined in IETF working draft
'draft-ieft-ipsec-monitor-mib-01' and RapidStream's
extension."
REVISION "200003211200Z"
DESCRIPTION
"Initial revision."
REVISION "200211011200Z"
DESCRIPTION
"Changed CONTACT-INFO."
::= { rapidstream 3 }
IpsecSaCreatorIdent ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"A value indicating how an SA was created."
SYNTAX INTEGER {
unknown(0),
static(1), -- statically created
ike(2), -- IKE
other(3)
}
IpsecIpv6Address ::= TEXTUAL-CONVENTION
DISPLAY-HINT "2x:2x:2x:2x:2x:2x:1d.1d.1d.1d"
STATUS current
DESCRIPTION
"This data type is used to model IPv6 address prefixes. This
is a binary string of 16 octets in network byte-order."
SYNTAX OCTET STRING (SIZE (16))
rsIpsecSaMonitorMIB OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all IPSec branches."
::= { rsIpsecSaMonModule 1 }
-- significant branches
rsSaTables OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all SA tables."
::= { rsIpsecSaMonitorMIB 1 }
rsSaStatistics OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all objects which
are global counters for IPSec security associations."
::= { rsIpsecSaMonitorMIB 2 }
rsSaErrors OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all objects which
are global error counters for IPSec security associations."
::= { rsIpsecSaMonitorMIB 3 }
rsSaTraps OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all objects which
are traps for IPSec security associations."
::= { rsIpsecSaMonitorMIB 4 }
rsSaTrapObjects OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for objects which are
used as part of traps."
::= { rsIpsecSaMonitorMIB 5 }
rsSaTrapControl OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all objects which
are trap controls for IPSec security associations."
::= { rsIpsecSaMonitorMIB 6 }
rsSaGroups OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all objects which
describe the groups in this MIB."
::= { rsIpsecSaMonitorMIB 7 }
rsSaConformance OBJECT-IDENTITY
STATUS current
DESCRIPTION
"This is the base object identifier for all objects which
describe the conformance for this MIB."
::= { rsIpsecSaMonitorMIB 8 }
-- the IPSec Inbound ESP MIB-Group
--
-- a collection of objects providing information about
-- IPSec Inbound ESP SAs
rsIpsecSaEspInTable OBJECT-TYPE
SYNTAX SEQUENCE OF RSIpsecSaEspInEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The (conceptual) table containing information on IPSec
inbound ESP SAs.
There should be one row for every inbound ESP security
association that exists in the entity. The maximum number of
rows is implementation dependent."
::= { rsSaTables 1 }
rsIpsecSaEspInEntry OBJECT-TYPE
SYNTAX RSIpsecSaEspInEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry (conceptual row) containing the information on a
particular IPSec inbound ESP SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table."
INDEX{ rsIpsecSaEspInAddress, rsIpsecSaEspInSpi }
::= { rsIpsecSaEspInTable 1 }
RSIpsecSaEspInEntry ::= SEQUENCE {
rsIpsecSaEspInAddress IpAddress,
rsIpsecSaEspInSpi Integer32,
rsIpsecSaEspInDestId OCTET STRING,
rsIpsecSaEspInDestIdType IpsecDoiIdentType,
rsIpsecSaEspInSourceId OCTET STRING,
rsIpsecSaEspInSourceIdType IpsecDoiIdentType,
rsIpsecSaEspInProtocol Integer32,
rsIpsecSaEspInDestPort Integer32,
rsIpsecSaEspInSourcePort Integer32,
rsIpsecSaEspInCreator IpsecSaCreatorIdent,
rsIpsecSaEspInEncapsulation IpsecDoiEncapsulationMode,
rsIpsecSaEspInEncAlg IpsecDoiEspTransform,
rsIpsecSaEspInEncKeyLength Integer32,
rsIpsecSaEspInAuthAlg IpsecDoiAuthAlgorithm,
rsIpsecSaEspInLimitSeconds Integer32,
rsIpsecSaEspInLimitKbytes Integer32,
rsIpsecSaEspInAccSeconds Counter32,
rsIpsecSaEspInAccKbytes Counter32,
rsIpsecSaEspInUserOctets Counter32,
rsIpsecSaEspInPackets Counter32,
rsIpsecSaEspInDecryptErrors Counter32,
rsIpsecSaEspInAuthErrors Counter32,
rsIpsecSaEspInReplayErrors Counter32,
rsIpsecSaEspInPolicyErrors Counter32,
rsIpsecSaEspInPadErrors Counter32,
rsIpsecSaEspInOtherReceiveErrors Counter32
}
rsIpsecSaEspInAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination address of the SA.
For implementations that do not support IPv6, this address
should appear as one of the IPv4-mapped IPv6 addresses as
defined in Section 2.5.4 of [IPV6AA].
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
used for IPv4 only nodes, while the prefix
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
nodes."
::= { rsIpsecSaEspInEntry 1 }
rsIpsecSaEspInSpi OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The security parameters index of the SA."
REFERENCE "RFC 2406 Section 2.1"
::= { rsIpsecSaEspInEntry 2 }
rsIpsecSaEspInDestId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination identifier of the SA, or 0 if unknown or if
the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during SA creation negotiation."
::= { rsIpsecSaEspInEntry 3 }
rsIpsecSaEspInDestIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by 'rsIpsecSaEspInDestId',
or 0 if unknown or if the SA uses transport mode
encapsulation."
::= { rsIpsecSaEspInEntry 4 }
rsIpsecSaEspInSourceId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source identifier of the SA, or 0 if unknown or if the
SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchange during SA creation negotiation."
::= { rsIpsecSaEspInEntry 5 }
rsIpsecSaEspInSourceIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by 'rsIpsecSaEspInSourceId',
or 0 if unknown or if the SA uses transport mode
encapsulation."
::= { rsIpsecSaEspInEntry 6 }
rsIpsecSaEspInProtocol OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The transport-layer protocol number that this SA carries,
or 0 if it carries any protocol."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaEspInEntry 7 }
rsIpsecSaEspInDestPort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaEspInEntry 8 }
rsIpsecSaEspInSourcePort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaEspInEntry 9 }
rsIpsecSaEspInCreator OBJECT-TYPE
SYNTAX IpsecSaCreatorIdent
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method."
::= { rsIpsecSaEspInEntry 10 }
rsIpsecSaEspInEncapsulation OBJECT-TYPE
SYNTAX IpsecDoiEncapsulationMode
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of encapsulation used by this SA."
::= { rsIpsecSaEspInEntry 11 }
rsIpsecSaEspInEncAlg OBJECT-TYPE
SYNTAX IpsecDoiEspTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the encryption algorithm
applied to traffic or 0 if there is no encryption used."
::= { rsIpsecSaEspInEntry 12 }
rsIpsecSaEspInEncKeyLength OBJECT-TYPE
SYNTAX Integer32 (0..65531)
UNITS "bits"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The length of the encryption key in bits used for the
algorithm specified in the 'rsIpsecSaEspInEncAlg' object, or 0
if the key length is implicit in the specified algorithm or
there is no encryption specified."
::= { rsIpsecSaEspInEntry 13 }
rsIpsecSaEspInAuthAlg OBJECT-TYPE
SYNTAX IpsecDoiAuthAlgorithm
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the hash algorithm applied to
traffic or 0 if there is no authentication used."
::= { rsIpsecSaEspInEntry 14 }
rsIpsecSaEspInLimitSeconds OBJECT-TYPE
SYNTAX Integer32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated."
::= { rsIpsecSaEspInEntry 15 }
rsIpsecSaEspInLimitKbytes OBJECT-TYPE
SYNTAX Integer32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum traffic in kilobytes that the SA is allowed to
support, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated."
::= { rsIpsecSaEspInEntry 16 }
rsIpsecSaEspInAccSeconds OBJECT-TYPE
SYNTAX Counter32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed."
::= { rsIpsecSaEspInEntry 17 }
rsIpsecSaEspInAccKbytes OBJECT-TYPE
SYNTAX Counter32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in Kbytes.
This value may be 0 if the SA does not expire based on
traffic."
::= { rsIpsecSaEspInEntry 18 }
rsIpsecSaEspInUserOctets OBJECT-TYPE
SYNTAX Counter32
UNITS "bytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of user level traffic measured in bytes handled
by the SA.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit."
::= { rsIpsecSaEspInEntry 19 }
rsIpsecSaEspInPackets OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets handled by the SA."
::= { rsIpsecSaEspInEntry 20 }
rsIpsecSaEspInDecryptErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to decryption
errors."
::= { rsIpsecSaEspInEntry 21 }
rsIpsecSaEspInAuthErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to
authentication errors."
::= { rsIpsecSaEspInEntry 22 }
rsIpsecSaEspInReplayErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to replay
errors."
::= { rsIpsecSaEspInEntry 23 }
rsIpsecSaEspInPolicyErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to policy
errors. This includes packets where the next protocol is
invalid."
::= { rsIpsecSaEspInEntry 24 }
rsIpsecSaEspInPadErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to pad value
errors.
Implementations that do not check this must not support this
object."
REFERENCE "RFC 2406 section 2.4"
::= { rsIpsecSaEspInEntry 25 }
rsIpsecSaEspInOtherReceiveErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to errors
other than decryption, authentication or replay errors. This
may include packets dropped due to a lack of receive
buffers, and may include packets dropped due to congestion
at the decryption element."
::= { rsIpsecSaEspInEntry 26 }
-- the IPSec Inbound AH MIB-Group
--
-- a collection of objects providing information about
-- IPSec Inbound AH SAs
rsIpsecSaAhInTable OBJECT-TYPE
SYNTAX SEQUENCE OF RSIpsecSaAhInEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The (conceptual) table containing information on IPSec
inbound AH SAs.
There should be one row for every inbound AH security
association that exists in the entity. The maximum number of
rows is implementation dependent."
::= { rsSaTables 2 }
rsIpsecSaAhInEntry OBJECT-TYPE
SYNTAX RSIpsecSaAhInEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry (conceptual row) containing the information on a
particular IPSec inbound AH SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table."
INDEX{ rsIpsecSaAhInAddress, rsIpsecSaAhInSpi }
::= { rsIpsecSaAhInTable 1 }
RSIpsecSaAhInEntry ::= SEQUENCE {
rsIpsecSaAhInAddress IpAddress,
rsIpsecSaAhInSpi Integer32,
rsIpsecSaAhInDestId OCTET STRING,
rsIpsecSaAhInDestIdType IpsecDoiIdentType,
rsIpsecSaAhInSourceId OCTET STRING,
rsIpsecSaAhInSourceIdType IpsecDoiIdentType,
rsIpsecSaAhInProtocol Integer32,
rsIpsecSaAhInDestPort Integer32,
rsIpsecSaAhInSourcePort Integer32,
rsIpsecSaAhInCreator IpsecSaCreatorIdent,
rsIpsecSaAhInEncapsulation IpsecDoiEncapsulationMode,
rsIpsecSaAhInAuthAlg IpsecDoiAhTransform,
rsIpsecSaAhInLimitSeconds Integer32,
rsIpsecSaAhInLimitKbytes Integer32,
rsIpsecSaAhInAccSeconds Counter32,
rsIpsecSaAhInAccKbytes Counter32,
rsIpsecSaAhInUserOctets Counter32,
rsIpsecSaAhInPackets Counter32,
-- error statistics
rsIpsecSaAhInAuthErrors Counter32,
rsIpsecSaAhInReplayErrors Counter32,
rsIpsecSaAhInPolicyErrors Counter32,
rsIpsecSaAhInOtherReceiveErrors Counter32
}
rsIpsecSaAhInAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination address of the SA.
For implementations that do not support IPv6, this address
should appear as one of the IPv4-mapped IPv6 addresses as
defined in Section 2.5.4 of [IPV6AA].
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
used for IPv4 only nodes, while the prefix
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
nodes."
::= { rsIpsecSaAhInEntry 1 }
rsIpsecSaAhInSpi OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The security parameters index of the SA."
REFERENCE "RFC 2402 Section 2.4"
::= { rsIpsecSaAhInEntry 2 }
rsIpsecSaAhInDestId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination identifier of the SA, or 0 if unknown or if
the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchange during SA creation negotiation."
::= { rsIpsecSaAhInEntry 3 }
rsIpsecSaAhInDestIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by 'rsIpsecSaAhInDestId', or
0 if unknown or if the SA uses transport mode
encapsulation."
::= { rsIpsecSaAhInEntry 4 }
rsIpsecSaAhInSourceId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source identifier of the SA, or 0 if unknown or if the
SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchange during SA creation negotiation."
::= { rsIpsecSaAhInEntry 5 }
rsIpsecSaAhInSourceIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by 'rsIpsecSaAhInSourceId',
or 0 if unknown or if the SA uses transport mode
encapsulation."
::= { rsIpsecSaAhInEntry 6 }
rsIpsecSaAhInProtocol OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The transport-layer protocol number that this SA carries,
or 0 if it carries any protocol."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaAhInEntry 7 }
rsIpsecSaAhInDestPort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaAhInEntry 8 }
rsIpsecSaAhInSourcePort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaAhInEntry 9 }
rsIpsecSaAhInCreator OBJECT-TYPE
SYNTAX IpsecSaCreatorIdent
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method."
::= { rsIpsecSaAhInEntry 10 }
rsIpsecSaAhInEncapsulation OBJECT-TYPE
SYNTAX IpsecDoiEncapsulationMode
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of encapsulation used by this SA."
::= { rsIpsecSaAhInEntry 11 }
rsIpsecSaAhInAuthAlg OBJECT-TYPE
SYNTAX IpsecDoiAhTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the hash algorithm applied to
traffic carried by this SA if it uses ESP or 0 if there is
no authentication applied by ESP."
::= { rsIpsecSaAhInEntry 12 }
rsIpsecSaAhInLimitSeconds OBJECT-TYPE
SYNTAX Integer32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated."
::= { rsIpsecSaAhInEntry 13 }
rsIpsecSaAhInLimitKbytes OBJECT-TYPE
SYNTAX Integer32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum traffic in Kbytes that the SA is allowed to
support, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated."
::= { rsIpsecSaAhInEntry 14 }
rsIpsecSaAhInAccSeconds OBJECT-TYPE
SYNTAX Counter32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed."
::= { rsIpsecSaAhInEntry 15 }
rsIpsecSaAhInAccKbytes OBJECT-TYPE
SYNTAX Counter32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in Kbytes.
This value may be 0 if the SA does not expire based on
traffic."
::= { rsIpsecSaAhInEntry 16 }
rsIpsecSaAhInUserOctets OBJECT-TYPE
SYNTAX Counter32
UNITS "bytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of user level traffic measured in bytes handled
by the SA.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit."
::= { rsIpsecSaAhInEntry 17 }
rsIpsecSaAhInPackets OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets handled by the SA."
::= { rsIpsecSaAhInEntry 18 }
rsIpsecSaAhInAuthErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to
authentication errors."
::= { rsIpsecSaAhInEntry 19 }
rsIpsecSaAhInReplayErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to replay
errors."
::= { rsIpsecSaAhInEntry 20 }
rsIpsecSaAhInPolicyErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to policy
errors. This includes packets where the next protocol is
invalid."
::= { rsIpsecSaAhInEntry 21 }
rsIpsecSaAhInOtherReceiveErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to errors
other than decryption, authentication or replay errors. This
may include packets dropped due to a lack of receive
buffers, and may include packets dropped due to congestion
at the authentication element."
::= { rsIpsecSaAhInEntry 22 }
-- the IPSec Inbound IPCOMP MIB-Group
--
-- a collection of objects providing information about
-- IPSec Inbound IPCOMP SAs
rsIpsecSaIpcompInTable OBJECT-TYPE
SYNTAX SEQUENCE OF RSIpsecSaIpcompInEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The (conceptual) table containing information on IPSec
inbound IPCOMP SAs.
There should be one row for every inbound IPCOMP (security)
association that exists in the entity. The maximum number of
rows is implementation dependent."
::= { rsSaTables 3 }
rsIpsecSaIpcompInEntry OBJECT-TYPE
SYNTAX RSIpsecSaIpcompInEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry (conceptual row) containing the information on a
particular IPSec inbound IPCOMP SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table."
INDEX{ rsIpsecSaIpcompInAddress, rsIpsecSaIpcompInCpi }
::= { rsIpsecSaIpcompInTable 1 }
RSIpsecSaIpcompInEntry ::= SEQUENCE {
rsIpsecSaIpcompInAddress IpAddress,
rsIpsecSaIpcompInCpi IpsecDoiIpcompTransform,
rsIpsecSaIpcompInDestId OCTET STRING,
rsIpsecSaIpcompInDestIdType IpsecDoiIdentType,
rsIpsecSaIpcompInSourceId OCTET STRING,
rsIpsecSaIpcompInSourceIdType IpsecDoiIdentType,
rsIpsecSaIpcompInProtocol Integer32,
rsIpsecSaIpcompInDestPort Integer32,
rsIpsecSaIpcompInSourcePort Integer32,
rsIpsecSaIpcompInCreator IpsecSaCreatorIdent,
rsIpsecSaIpcompInEncapsulation IpsecDoiEncapsulationMode,
rsIpsecSaIpcompInDecompAlg IpsecDoiIpcompTransform,
rsIpsecSaIpcompInSeconds Counter32,
rsIpsecSaIpcompInUserOctets Counter32,
rsIpsecSaIpcompInPackets Counter32,
rsIpsecSaIpcompInDecompErrors Counter32,
rsIpsecSaIpcompInOtherReceiveErrors Counter32
}
rsIpsecSaIpcompInAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination address of the SA.
For implementations that do not support IPv6, this address
should appear as one of the IPv4-mapped IPv6 addresses as
defined in Section 2.5.4 of [IPV6AA].
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
used for IPv4 only nodes, while the prefix
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
nodes."
::= { rsIpsecSaIpcompInEntry 1 }
rsIpsecSaIpcompInCpi OBJECT-TYPE
SYNTAX IpsecDoiIpcompTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The CPI of the SA. Since the lower values of CPIs are
reserved to be the same as the algorithm, the syntax for
this object is the same as the transform."
REFERENCE "RFC 2393 Section 3.3"
::= { rsIpsecSaIpcompInEntry 2 }
rsIpsecSaIpcompInDestId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination identifier of the SA, or 0 if unknown or if
the SA uses transport mode, or 0 if this SA is used with
multiple SAs in protection suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchange during SA creation
negotiation."
::= { rsIpsecSaIpcompInEntry 3 }
rsIpsecSaIpcompInDestIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by
'rsIpsecSaIpcompInDestId', or 0 if unknown or if the SA uses
transport mode, or 0 if this SA is used with multiple SAs in
protection suites."
::= { rsIpsecSaIpcompInEntry 4 }
rsIpsecSaIpcompInSourceId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source identifier of the SA, or 0 if unknown or if the
SA uses transport mode encapsulation, or 0 if this SA is
used with multiple SAs in protection suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchange during SA creation
negotiation."
::= { rsIpsecSaIpcompInEntry 5 }
rsIpsecSaIpcompInSourceIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by
'rsIpsecSaIpcompInSourceId', or 0 if unknown or if the SA uses
transport mode encapsulation, or 0 if this SA is used with
multiple SAs in protection suites."
::= { rsIpsecSaIpcompInEntry 6 }
rsIpsecSaIpcompInProtocol OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The transport-layer protocol number that this SA carries,
or 0 if it carries any protocol."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaIpcompInEntry 7 }
rsIpsecSaIpcompInDestPort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaIpcompInEntry 8 }
rsIpsecSaIpcompInSourcePort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaIpcompInEntry 9 }
rsIpsecSaIpcompInCreator OBJECT-TYPE
SYNTAX IpsecSaCreatorIdent
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method."
::= { rsIpsecSaIpcompInEntry 10 }
rsIpsecSaIpcompInEncapsulation OBJECT-TYPE
SYNTAX IpsecDoiEncapsulationMode
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of encapsulation used by this SA."
::= { rsIpsecSaIpcompInEntry 11 }
rsIpsecSaIpcompInDecompAlg OBJECT-TYPE
SYNTAX IpsecDoiIpcompTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the decompression algorithm
applied to traffic."
::= { rsIpsecSaIpcompInEntry 12 }
rsIpsecSaIpcompInSeconds OBJECT-TYPE
SYNTAX Counter32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of seconds that the SA has existed."
::= { rsIpsecSaIpcompInEntry 13 }
rsIpsecSaIpcompInUserOctets OBJECT-TYPE
SYNTAX Counter32
UNITS "bytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of user level traffic measured in bytes handled
by the SA."
::= { rsIpsecSaIpcompInEntry 14 }
rsIpsecSaIpcompInPackets OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets handled by the SA."
::= { rsIpsecSaIpcompInEntry 15 }
rsIpsecSaIpcompInDecompErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to
decompression errors."
::= { rsIpsecSaIpcompInEntry 16 }
rsIpsecSaIpcompInOtherReceiveErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to errors
other than decompression errors. This may include packets
dropped due to a lack of receive buffers, and packets
dropped due to congestion at the decompression element."
::= { rsIpsecSaIpcompInEntry 17 }
-- the IPSec Outbound ESP MIB-Group
--
-- a collection of objects providing information about
-- IPSec Outbound ESP SAs
rsIpsecSaEspOutTable OBJECT-TYPE
SYNTAX SEQUENCE OF RSIpsecSaEspOutEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The (conceptual) table containing information on IPSec
Outbound ESP SAs.
There should be one row for every outbound ESP security
association that exists in the entity. The maximum number of
rows is implementation dependent."
::= { rsSaTables 4 }
rsIpsecSaEspOutEntry OBJECT-TYPE
SYNTAX RSIpsecSaEspOutEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry (conceptual row) containing the information on a
particular IPSec Outbound ESP SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table."
INDEX{ rsIpsecSaEspOutAddress, rsIpsecSaEspOutSpi }
::= { rsIpsecSaEspOutTable 1 }
RSIpsecSaEspOutEntry ::= SEQUENCE {
rsIpsecSaEspOutAddress IpAddress,
rsIpsecSaEspOutSpi Integer32,
rsIpsecSaEspOutSourceId OCTET STRING,
rsIpsecSaEspOutSourceIdType IpsecDoiIdentType,
rsIpsecSaEspOutDestId OCTET STRING,
rsIpsecSaEspOutDestIdType IpsecDoiIdentType,
rsIpsecSaEspOutProtocol Integer32,
rsIpsecSaEspOutSourcePort Integer32,
rsIpsecSaEspOutDestPort Integer32,
rsIpsecSaEspOutCreator IpsecSaCreatorIdent,
rsIpsecSaEspOutEncapsulation IpsecDoiEncapsulationMode,
rsIpsecSaEspOutEncAlg IpsecDoiEspTransform,
rsIpsecSaEspOutEncKeyLength Integer32,
rsIpsecSaEspOutAuthAlg IpsecDoiAuthAlgorithm,
rsIpsecSaEspOutLimitSeconds Integer32,
rsIpsecSaEspOutLimitKbytes Integer32,
rsIpsecSaEspOutAccSeconds Counter32,
rsIpsecSaEspOutAccKbytes Counter32,
rsIpsecSaEspOutUserOctets Counter32,
rsIpsecSaEspOutPackets Counter32,
rsIpsecSaEspOutSendErrors Counter32
}
rsIpsecSaEspOutAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination address of the SA.
For implementations that do not support IPv6, this address
should appear as one of the IPv4-mapped IPv6 addresses as
defined in Section 2.5.4 of [IPV6AA].
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
used for IPv4 only nodes, while the prefix
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
nodes."
::= { rsIpsecSaEspOutEntry 1 }
rsIpsecSaEspOutSpi OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The security parameters index of the SA."
REFERENCE "RFC 2406 Section 2.1"
::= { rsIpsecSaEspOutEntry 2 }
rsIpsecSaEspOutSourceId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source identifier of the SA, or 0 if unknown or if the
SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchange during phase 2 negotiations."
::= { rsIpsecSaEspOutEntry 3 }
rsIpsecSaEspOutSourceIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by
'rsIpsecSaEspOutSourceId', or 0 if unknown or if the SA uses
transport mode encapsulation."
::= { rsIpsecSaEspOutEntry 4 }
rsIpsecSaEspOutDestId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination identifier of the SA, or 0 if unknown or if
the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchange during phase 2 negotiations."
::= { rsIpsecSaEspOutEntry 5 }
rsIpsecSaEspOutDestIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by 'rsIpsecSaEspOutDestId',
or 0 if unknown or if the SA uses transport mode
encapsulation."
::= { rsIpsecSaEspOutEntry 6 }
rsIpsecSaEspOutProtocol OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The transport-layer protocol number that this SA carries,
or 0 if it carries any protocol."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaEspOutEntry 7 }
rsIpsecSaEspOutSourcePort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaEspOutEntry 8 }
rsIpsecSaEspOutDestPort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaEspOutEntry 9 }
rsIpsecSaEspOutCreator OBJECT-TYPE
SYNTAX IpsecSaCreatorIdent
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method."
::= { rsIpsecSaEspOutEntry 10 }
rsIpsecSaEspOutEncapsulation OBJECT-TYPE
SYNTAX IpsecDoiEncapsulationMode
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of encapsulation used by this SA."
::= { rsIpsecSaEspOutEntry 11 }
rsIpsecSaEspOutEncAlg OBJECT-TYPE
SYNTAX IpsecDoiEspTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the encryption algorithm
applied to traffic or 0 if there is no encryption used."
::= { rsIpsecSaEspOutEntry 12 }
rsIpsecSaEspOutEncKeyLength OBJECT-TYPE
SYNTAX Integer32 (0..65531)
UNITS "bits"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The length of the encryption key in bits used for the
algorithm specified in the 'rsIpsecSaEspOutEncAlg' object, or
0 if the key length is implicit in the specified algorithm
or there is no encryption specified."
::= { rsIpsecSaEspOutEntry 13 }
rsIpsecSaEspOutAuthAlg OBJECT-TYPE
SYNTAX IpsecDoiAuthAlgorithm
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the hash algorithm applied to
traffic or 0 if there is no authentication used."
::= { rsIpsecSaEspOutEntry 14 }
rsIpsecSaEspOutLimitSeconds OBJECT-TYPE
SYNTAX Integer32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated."
::= { rsIpsecSaEspOutEntry 15 }
rsIpsecSaEspOutLimitKbytes OBJECT-TYPE
SYNTAX Integer32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum traffic in kbytes that the SA is allowed to
support, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated."
::= { rsIpsecSaEspOutEntry 16 }
rsIpsecSaEspOutAccSeconds OBJECT-TYPE
SYNTAX Counter32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed."
::= { rsIpsecSaEspOutEntry 17 }
rsIpsecSaEspOutAccKbytes OBJECT-TYPE
SYNTAX Counter32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in Kbytes.
This value may be 0 if the SA does not expire based on
traffic."
::= { rsIpsecSaEspOutEntry 18 }
rsIpsecSaEspOutUserOctets OBJECT-TYPE
SYNTAX Counter32
UNITS "bytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of user level traffic measured in bytes handled
by the SA.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit."
::= { rsIpsecSaEspOutEntry 19 }
rsIpsecSaEspOutPackets OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets handled by the SA."
::= { rsIpsecSaEspOutEntry 20 }
rsIpsecSaEspOutSendErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to any error.
This may include errors due to a lack of transmit buffers."
::= { rsIpsecSaEspOutEntry 21 }
-- the IPSec Outbound AH MIB-Group
--
-- a collection of objects providing information about
-- IPSec Outbound AH SAs
rsIpsecSaAhOutTable OBJECT-TYPE
SYNTAX SEQUENCE OF RSIpsecSaAhOutEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The (conceptual) table containing information on IPSec
Outbound AH SAs.
There should be one row for every outbound AH security
association that exists in the entity. The maximum number of
rows is implementation dependent."
::= { rsSaTables 5 }
rsIpsecSaAhOutEntry OBJECT-TYPE
SYNTAX RSIpsecSaAhOutEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry (conceptual row) containing the information on a
particular IPSec Outbound AH SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table."
INDEX{ rsIpsecSaAhOutAddress, rsIpsecSaAhOutSpi }
::= { rsIpsecSaAhOutTable 1 }
RSIpsecSaAhOutEntry ::= SEQUENCE {
rsIpsecSaAhOutAddress IpAddress,
rsIpsecSaAhOutSpi Integer32,
rsIpsecSaAhOutSourceId OCTET STRING,
rsIpsecSaAhOutSourceIdType IpsecDoiIdentType,
rsIpsecSaAhOutDestId OCTET STRING,
rsIpsecSaAhOutDestIdType IpsecDoiIdentType,
rsIpsecSaAhOutProtocol Integer32,
rsIpsecSaAhOutSourcePort Integer32,
rsIpsecSaAhOutDestPort Integer32,
rsIpsecSaAhOutCreator IpsecSaCreatorIdent,
rsIpsecSaAhOutEncapsulation IpsecDoiEncapsulationMode,
rsIpsecSaAhOutAuthAlg IpsecDoiAhTransform,
rsIpsecSaAhOutLimitSeconds Integer32,
rsIpsecSaAhOutLimitKbytes Integer32,
rsIpsecSaAhOutAccSeconds Counter32,
rsIpsecSaAhOutAccKbytes Counter32,
rsIpsecSaAhOutUserOctets Counter32,
rsIpsecSaAhOutPackets Counter32,
rsIpsecSaAhOutSendErrors Counter32
}
rsIpsecSaAhOutAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination address of the SA.
For implementations that do not support IPv6, this address
should appear as one of the IPv4-mapped IPv6 addresses as
defined in Section 2.5.4 of [IPV6AA].
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
used for IPv4 only nodes, while the prefix
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
nodes."
::= { rsIpsecSaAhOutEntry 1 }
rsIpsecSaAhOutSpi OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The security parameters index of the SA."
REFERENCE "RFC 2402 Section 2.4"
::= { rsIpsecSaAhOutEntry 2 }
rsIpsecSaAhOutSourceId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source identifier of the SA, or 0 if unknown or if the
SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchange during phase 2 negotiations."
::= { rsIpsecSaAhOutEntry 3 }
rsIpsecSaAhOutSourceIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by 'rsIpsecSaAhOutSourceId',
or 0 if unknown or if the SA uses transport mode
encapsulation."
::= { rsIpsecSaAhOutEntry 4 }
rsIpsecSaAhOutDestId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination identifier of the SA, or 0 if unknown or if
the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchange during phase 2 negotiations."
::= { rsIpsecSaAhOutEntry 5 }
rsIpsecSaAhOutDestIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by 'rsIpsecSaAhOutDestId',
or 0 if unknown or if the SA uses transport mode
encapsulation."
::= { rsIpsecSaAhOutEntry 6 }
rsIpsecSaAhOutProtocol OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The transport-layer protocol number that this SA carries,
or 0 if it carries any protocol."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaAhOutEntry 7 }
rsIpsecSaAhOutSourcePort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaAhOutEntry 8 }
rsIpsecSaAhOutDestPort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaAhOutEntry 9 }
rsIpsecSaAhOutCreator OBJECT-TYPE
SYNTAX IpsecSaCreatorIdent
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method."
::= { rsIpsecSaAhOutEntry 10 }
rsIpsecSaAhOutEncapsulation OBJECT-TYPE
SYNTAX IpsecDoiEncapsulationMode
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of encapsulation used by this SA."
::= { rsIpsecSaAhOutEntry 11 }
rsIpsecSaAhOutAuthAlg OBJECT-TYPE
SYNTAX IpsecDoiAhTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the hash algorithm applied to
traffic or 0 if there is no authentication used."
::= { rsIpsecSaAhOutEntry 12 }
rsIpsecSaAhOutLimitSeconds OBJECT-TYPE
SYNTAX Integer32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated."
::= { rsIpsecSaAhOutEntry 13 }
rsIpsecSaAhOutLimitKbytes OBJECT-TYPE
SYNTAX Integer32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum traffic in Kbytes that the SA is allowed to
support, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated."
::= { rsIpsecSaAhOutEntry 14 }
rsIpsecSaAhOutAccSeconds OBJECT-TYPE
SYNTAX Counter32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed."
::= { rsIpsecSaAhOutEntry 15 }
rsIpsecSaAhOutAccKbytes OBJECT-TYPE
SYNTAX Counter32
UNITS "kilobytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in Kbytes.
This value may be 0 if the SA does not expire based on
traffic."
::= { rsIpsecSaAhOutEntry 16 }
rsIpsecSaAhOutUserOctets OBJECT-TYPE
SYNTAX Counter32
UNITS "bytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of user level traffic measured in bytes handled
by the SA.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit."
::= { rsIpsecSaAhOutEntry 17 }
rsIpsecSaAhOutPackets OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets handled by the SA."
::= { rsIpsecSaAhOutEntry 18 }
rsIpsecSaAhOutSendErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets discarded by the SA due to any error.
This may include errors due to a lack of transmit buffers."
::= { rsIpsecSaAhOutEntry 19 }
-- the IPSec Outbound IPCOMP MIB-Group
--
-- a collection of objects providing information about
-- IPSec Outbound IPCOMP SAs
rsIpsecSaIpcompOutTable OBJECT-TYPE
SYNTAX SEQUENCE OF RSIpsecSaIpcompOutEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The (conceptual) table containing information on IPSec
Outbound IPCOMP SAs.
There should be one row for every outbound IPCOMP (security)
association that exists in the entity. The maximum number of
rows is implementation dependent."
::= { rsSaTables 6 }
rsIpsecSaIpcompOutEntry OBJECT-TYPE
SYNTAX RSIpsecSaIpcompOutEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry (conceptual row) containing the information on a
particular IPSec Outbound IPCOMP SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table."
INDEX{ rsIpsecSaIpcompOutAddress, rsIpsecSaIpcompOutCpi }
::= { rsIpsecSaIpcompOutTable 1 }
RSIpsecSaIpcompOutEntry ::= SEQUENCE {
rsIpsecSaIpcompOutAddress IpAddress,
rsIpsecSaIpcompOutCpi IpsecDoiIpcompTransform,
rsIpsecSaIpcompOutSourceId OCTET STRING,
rsIpsecSaIpcompOutSourceIdType IpsecDoiIdentType,
rsIpsecSaIpcompOutDestId OCTET STRING,
rsIpsecSaIpcompOutDestIdType IpsecDoiIdentType,
rsIpsecSaIpcompOutProtocol Integer32,
rsIpsecSaIpcompOutSourcePort Integer32,
rsIpsecSaIpcompOutDestPort Integer32,
rsIpsecSaIpcompOutCreator IpsecSaCreatorIdent,
rsIpsecSaIpcompOutEncapsulation IpsecDoiEncapsulationMode,
rsIpsecSaIpcompOutCompAlg IpsecDoiIpcompTransform,
rsIpsecSaIpcompOutSeconds Counter32,
rsIpsecSaIpcompOutUserOctets Counter32,
rsIpsecSaIpcompOutPackets Counter32
}
rsIpsecSaIpcompOutAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination address of the SA.
If the IPCOMP SA is shared across multiple SAs in protection
suites, this value may be 0.
For implementations that do not support IPv6, this address
should appear as one of the IPv4-mapped IPv6 addresses as
defined in Section 2.5.4 of [IPV6AA].
Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is
used for IPv4 only nodes, while the prefix
'0000:0000:0000:0000:0000:0000:' is used for bi-lingual
nodes."
::= { rsIpsecSaIpcompOutEntry 1 }
rsIpsecSaIpcompOutCpi OBJECT-TYPE
SYNTAX IpsecDoiIpcompTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The CPI of the SA. Since the lower values of CPIs are
reserved to be the same as the algorithm, the syntax for
this object is the same as the transform."
REFERENCE "RFC 2393 Section 3.3"
::= { rsIpsecSaIpcompOutEntry 2 }
rsIpsecSaIpcompOutSourceId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source identifier of the SA, or 0 if unknown or if the
SA uses transport mode encapsulation, or 0 if this SA is
used with multiple SAs in protection suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchange during phase 2 negotiations."
::= { rsIpsecSaIpcompOutEntry 3 }
rsIpsecSaIpcompOutSourceIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by
'rsIpsecSaIpcompOutSourceId', or 0 if unknown or if the SA
uses transport mode encapsulation, or 0 if this SA is used
with multiple SAs in protection suites."
::= { rsIpsecSaIpcompOutEntry 4 }
rsIpsecSaIpcompOutDestId OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination identifier of the SA, or 0 if unknown or if
the SA uses transport mode encapsulation, or 0 if this SA is
used with multiple SAs in protection suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchange during phase 2 negotiations."
::= { rsIpsecSaIpcompOutEntry 5 }
rsIpsecSaIpcompOutDestIdType OBJECT-TYPE
SYNTAX IpsecDoiIdentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of identifier presented by
'rsIpsecSaIpcompOutDestId', or 0 if unknown or if the SA uses
transport mode encapsulation, or 0 if this SA is used with
multiple SAs in protection suites."
::= { rsIpsecSaIpcompOutEntry 6 }
rsIpsecSaIpcompOutProtocol OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The transport-layer protocol number that this SA carries,
or 0 if it carries any protocol."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaIpcompOutEntry 7 }
rsIpsecSaIpcompOutSourcePort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The source port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaIpcompOutEntry 8 }
rsIpsecSaIpcompOutDestPort OBJECT-TYPE
SYNTAX Integer32 (0.. 65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The destination port number of the protocol that this SA
carries, or 0 if it carries any port number."
REFERENCE "RFC2401 section 4.4.2"
::= { rsIpsecSaIpcompOutEntry 9 }
rsIpsecSaIpcompOutCreator OBJECT-TYPE
SYNTAX IpsecSaCreatorIdent
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method."
::= { rsIpsecSaIpcompOutEntry 10 }
rsIpsecSaIpcompOutEncapsulation OBJECT-TYPE
SYNTAX IpsecDoiEncapsulationMode
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of encapsulation used by this SA."
::= { rsIpsecSaIpcompOutEntry 11 }
rsIpsecSaIpcompOutCompAlg OBJECT-TYPE
SYNTAX IpsecDoiIpcompTransform
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A unique value representing the compression algorithm
applied to traffic."
::= { rsIpsecSaIpcompOutEntry 12 }
rsIpsecSaIpcompOutSeconds OBJECT-TYPE
SYNTAX Counter32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of seconds that the SA has existed."
::= { rsIpsecSaIpcompOutEntry 13 }
rsIpsecSaIpcompOutUserOctets OBJECT-TYPE
SYNTAX Counter32
UNITS "bytes"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The amount of user level traffic measured in bytes handled
by the SA.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit."
::= { rsIpsecSaIpcompOutEntry 14 }
rsIpsecSaIpcompOutPackets OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets handled by the SA."
::= { rsIpsecSaIpcompOutEntry 15 }
--
-- entity IPSec statistics
--
rsIpsecEspCurrentInboundSAs OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of inbound ESP SAs in the entity."
::= { rsSaStatistics 1 }
rsIpsecEspTotalInboundSAs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of inbound ESP SAs created in the entity
since boot time."
::= { rsSaStatistics 2 }
rsIpsecEspCurrentOutboundSAs OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of outbound ESP SAs in the entity."
::= { rsSaStatistics 3 }
rsIpsecEspTotalOutboundSAs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of outbound ESP SAs created in the entity
since boot time."
::= { rsSaStatistics 4 }
rsIpsecAhCurrentInboundSAs OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of inbound AH SAs in the entity."
::= { rsSaStatistics 5 }
rsIpsecAhTotalInboundSAs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of inbound AH SAs created in the entity
since boot time."
::= { rsSaStatistics 6 }
rsIpsecAhCurrentOutboundSAs OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of outbound AH SAs in the entity."
::= { rsSaStatistics 7 }
rsIpsecAhTotalOutboundSAs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of outbound AH SAs created in the entity
since boot time."
::= { rsSaStatistics 8 }
rsIpsecIpcompCurrentInboundSAs OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of inbound IPCOMP SAs in the entity."
::= { rsSaStatistics 9 }
rsIpsecIpcompTotalInboundSAs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of inbound IPCOMP SAs created in the
entity since boot time."
::= { rsSaStatistics 10 }
rsIpsecIpcompCurrentOutboundSAs OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of outbound IPCOMP SAs in the entity."
::= { rsSaStatistics 11 }
rsIpsecIpcompTotalOutboundSAs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of outbound IPCOMP SAs created in the
entity since boot time."
::= { rsSaStatistics 12 }
--
-- IPSec error counts
--
rsIpsecDecryptionErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the entity in SAs
since boot time with decryption errors."
::= { rsSaErrors 1 }
rsIpsecAuthenticationErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the entity in SAs
since boot time with authentication errors.
This includes all packets in which the hash value is
determined to be invalid, for both ESP and AH SAs."
::= { rsSaErrors 2 }
rsIpsecReplayErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the entity in SAs
since boot time with replay errors."
::= { rsSaErrors 3 }
rsIpsecPolicyErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the entity in SAs
since boot time and discarded due to policy errors. This
includes packets that had selectors that were invalid for
the SA that carried them."
::= { rsSaErrors 4 }
rsIpsecOtherReceiveErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the entity in SAs
since boot time and discarded due to errors not due to
decryption, authentication, replay or policy."
::= { rsSaErrors 5 }
rsIpsecSendErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets to be sent by the entity in SAs
since boot time and discarded due to errors."
::= { rsSaErrors 6 }
rsIpsecUnknownSpiErrors OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the entity since
boot time with SPIs or CPIs that were not valid."
::= { rsSaErrors 7 }
--
-- traps
--
--
-- some objects used in trap reporting
--
-- NOTE: A MAX-ACCESS value of 'accessible-for-notify' was wanted
-- for these objects; this would not compile with smicng 2.2.07
--
rsIpsecSecurityProtocol OBJECT-TYPE
SYNTAX IpsecDoiSecProtocolId
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A security protocol associated with the trap."
::= { rsSaTrapObjects 1 }
rsIpsecSPI OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"An SPI associated with a trap. Where the security protocol
associated with the trap is IPCOMP, this value has a maximum
of 65535."
::= { rsSaTrapObjects 2 }
rsIpsecLocalAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A local IP address associated with the trap."
::= { rsSaTrapObjects 3 }
rsIpsecPeerAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A peer IP address associated with the trap."
::= { rsSaTrapObjects 4 }
--
-- trap control
--
rsEspAuthFailureTrapEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates whether espAuthFailureTrap traps should be
generated."
DEFVAL { false }
::= { rsSaTrapControl 1 }
rsAhAuthFailureTrapEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates whether ahAuthFailureTrap traps should be
generated."
DEFVAL { false }
::= { rsSaTrapControl 2 }
rsEspReplayFailureTrapEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates whether espReplayFailureTrap traps should be
generated."
DEFVAL { false }
::= { rsSaTrapControl 3 }
rsAhReplayFailureTrapEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates whether ahReplayFailureTrap traps should be
generated."
DEFVAL { false }
::= { rsSaTrapControl 4 }
rsEspPolicyFailureTrapEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates whether espPolicyFailureTrap traps should be
generated."
DEFVAL { false }
::= { rsSaTrapControl 5 }
rsAhPolicyFailureTrapEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates whether ahPolicyFailureTrap traps should be
generated."
DEFVAL { false }
::= { rsSaTrapControl 6 }
rsInvalidSpiTrapEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates whether invalidSpiTrap traps should be
generated."
DEFVAL { false }
::= { rsSaTrapControl 7 }
--
-- the traps themselves
--
rsEspAuthFailureTrap NOTIFICATION-TYPE
OBJECTS {
rsIpsecSaEspInAuthErrors
}
STATUS current
DESCRIPTION
"IPSec packets with invalid hashes were found in an inbound
ESP SA. The total number of authentication errors
accumulated is sent for the specific row of the
'rsIpsecSaEspInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet."
::= { rsSaTraps 0 1 }
rsAhAuthFailureTrap NOTIFICATION-TYPE
OBJECTS {
rsIpsecSaAhInAuthErrors
}
STATUS current
DESCRIPTION
"IPSec packets with invalid hashes were found in an inbound
AH SA. The total number of authentication errors accumulated
is sent for the specific row of the 'rsIpsecSaAhInTable' table
for the SA; this provides the identity of the SA in which
the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet."
::= { rsSaTraps 0 2 }
rsEspReplayFailureTrap NOTIFICATION-TYPE
OBJECTS {
rsIpsecSaEspInReplayErrors
}
STATUS current
DESCRIPTION
"IPSec packets with invalid sequence numbers were found in
an inbound ESP SA. The total number of replay errors
accumulated is sent for the specific row of the
'rsIpsecSaEspInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet."
::= { rsSaTraps 0 3 }
rsAhReplayFailureTrap NOTIFICATION-TYPE
OBJECTS {
rsIpsecSaAhInReplayErrors
}
STATUS current
DESCRIPTION
"IPSec packets with invalid sequence numbers were found in
the specified AH SA. The total number of replay errors
accumulated is sent for the specific row of the
'rsIpsecSaAhInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet."
::= { rsSaTraps 0 4 }
rsEspPolicyFailureTrap NOTIFICATION-TYPE
OBJECTS {
rsIpsecSaEspInPolicyErrors
}
STATUS current
DESCRIPTION
"IPSec packets carrying packets with invalid selectors for
the specified ESP SA were found. The total number of policy
errors accumulated is sent for the specific row of the
'rsIpsecSaEspInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet."
::= { rsSaTraps 0 5 }
rsAhPolicyFailureTrap NOTIFICATION-TYPE
OBJECTS {
rsIpsecSaAhInPolicyErrors
}
STATUS current
DESCRIPTION
"IPSec packets carrying packets with invalid selectors for
the specified AH SA were found. The total number of policy
errors accumulated is sent for the specific row of the
'rsIpsecSaAhInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet."
::= { rsSaTraps 0 6 }
rsInvalidSpiTrap NOTIFICATION-TYPE
OBJECTS {
rsIpsecLocalAddress,
rsIpsecSecurityProtocol,
rsIpsecPeerAddress,
rsIpsecSPI,
ifIndex
}
STATUS current
DESCRIPTION
"A packet with an unknown SPI was detected from the
specified peer with the specified SPI using the specified
protocol. The destination address of the received packet is
specified by 'ipsecLocalAddress'.
The value 'ifIndex' may be 0 if this optional linkage is
unsupported.
If the object 'ipsecSecurityProtocol' has the value for
IPCOMP, then the 'ipsecSPI' object is the CPI of the packet.
Implementations SHOULD send one trap per peer (within a
reasonable time period), rather than sending one trap per
packet."
::= { rsSaTraps 0 7 }
END