CISCO-GDOI-MIB
AI MIB Summary
The CISCO-GDOI-MIB facilitates the monitoring and management of Group Domain of Interpretation (GDOI) protocol sessions, specifically tracking key metrics such as group membership states, key server associations, and cryptographic key distribution parameters on Cisco IOS and IOS-XE platforms.
This MIB module defines objects for managing the GDOI protocol.
Copyright (c) The IETF Trust (2010). This version of this MIB module is based on RFC 6407; see the RFC itself for full legal notices.
Main OID:
ciscoGdoiMIB.1.3.6.1.4.1.9.9.759
184
Objects
Active
Status
5
Dependencies
Imported Objects
Objects
184 total| Object Name |
|---|
ciscoGdoiMIBThis MIB module defines objects for managing the GDOI protocol.
Copyright (c) The IETF Trust (2010). This version of this MIB
module is based on RFC 6407; see the RFC itself for full legal
notices. MODULE-IDENTITY .1.3.6.1.4.1.9.9.759 |
cgmGdoiMIBNotifications OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.0 |
cgmGdoiKeyServerNewRegistrationA notification from a Key Server sent when a new Group
Member registers to a GDOI Group. This is equivalent to a
Key Server receiving the first message of a GROUPKEY-PULL
exchange from a Group Member. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.1 |
cgmGdoiKeyServerRegistrationCompleteA notification from a Key Server sent when a Group Member
has successfully registered to itself. This is equivalent
to a Key Server sending the last message of a GROUPKEY-PULL
exchange to the Group Member currently registering
containing KEKs, TEKs, and their associated policies. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.2 |
cgmGdoiKeyServerRekeyPushedA notification from a Key Server sent when a GROUPKEY-PUSH
message is sent to refresh KEK(s) and or TEK(s). A rekey
is sent periodically by a Key Server based on a configured
time to the Group Members registered to its GDOI Group. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.3 |
cgmGdoiKeyServerNoRsaKeysAn error notification from a Key Server sent when an RSA key
is not setup. Each Key Server and Group Member needs to have
an RSA key established. The Key Server signs the TEK rekeys
using this RSA key, also called a Key Encryption Key (KEK).
The Group Member verifies the authenticity of the TEK rekey
using this RSA key. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.4 |
cgmGdoiGmRegisterA notification from a Group Member when it is starting to
register with its GDOI Group's Key Server. Registration
includes downloading keying & security association material.
This is equivalent to a Group Member or Initiator sending the
first message of a GROUPKEY-PULL exchange to its Group's Key
Server. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.5 |
cgmGdoiGmRegistrationCompleteA notification from a Group Member when it has successfully
registered with a Key Server in its GDOI Group. This is
equivalent to a Group Member receiving the last message of
a GROUPKEY-PULL exchange from the Key Server containing
KEKs, TEKs, and their associated policies. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.6 |
cgmGdoiGmReRegisterA notification from a Group Member when it is starting to
re-register with a Key Server in its GDOI Group. A Group
Member needs to re-register to the key server if its keying &
security association material has expired and it has not
received a rekey from the key server to refresh the material.
This is equivalent to a Group Member sending the first
message of a GROUPKEY-PULL exchange to the Key Server of a
Group it is already registered with. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.7 |
cgmGdoiGmRekeyReceivedA notification from a Group Member when it has successfully
received and processed a rekey from a Key Server in its GDOI
Group. Periodically the key server sends a rekey to refresh
the keying & security association material. This is
equivalent to a Group Member receiving a GROUPKEY-PUSH
message from the Key Server of the Group it is already
registered with. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.8 |
cgmGdoiGmIncompleteCfgAn error notification from a Group Member when there is
necessary information missing from the policy/configuration
of a Group Member on an interface when it tries to register
with a Key Server in its GDOI Group. If the GDOI Group
configuration is not complete on a Group Member, it will not
be able to register to the Key Server. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.9 |
cgmGdoiGmNoIpSecFlowsAn error notification from a Group Member when no more
security associations can be installed after receiving its
keying & security association material. When the Group
Member receives the security association materials, it has
to install the cryptographic keys and policies. If there
is not enough memory to install these materials, there will
be an error thrown. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.10 |
cgmGdoiGmRekeyFailureAn error notification from a Group Member when it is unable
to successfully process and install a rekey (GROUPKEY-PUSH
message) sent by the Key Server in its Group that it is
registered with. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.11 |
cgmGdoiKeyServerRoleChangeThis notification is generated when a Key Server changes it's
role from Primary to Secondary or vice-versa. The varbinds
encapsulate the Group information, the Key Server identifier and
the role it has moved to. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.12 |
cgmGdoiKeyServerGmDeletedThis notification is generated when a Group Member is deleted
from a Key Server. The varbinds encapsulate the Group
information, the Key Server identifier and the Group Member
identifier which is deleted. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.13 |
cgmGdoiKeyServerPeerReachableThis notification is generated from a Key Server when an
unreachable peer Key Server becomes reachable. The varbinds
encapsulate the Group information, the Key Server identifier and
the peer Key Server identifier. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.14 |
cgmGdoiKeyServerPeerUnreachableThis notification is generated from a Key Server when a
reachable peer Key Server becomes unreachable. The varbinds
encapsulate the Group information, the Key Server identifier and
the peer Key Server identifier. NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.759.0.15 |
cgmGdoiMIBObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.1 |
cgmGdoiGroupTableA table of information regarding GDOI Groups in use on
the network device being queried. SEQUENCE OF CgmGdoiGroupEntry .1.3.6.1.4.1.9.9.759.1.1 |
cgmGdoiGroupEntryAn entry containing GDOI Group information, uniquely
identified by the GDOI Group ID. CgmGdoiGroupEntry .1.3.6.1.4.1.9.9.759.1.1.1 |
cgmGdoiGroupIdTypeThe Identification Type Value used to parse a GDOI Group ID.
The GDOI RFC 3547 defines the types that can be used as a
GDOI Group ID, and RFC 4306 defines all valid types that can
be used as an identifier. This Group ID type is sent as the
'ID Type' field of the Identification Payload for a GDOI
GROUPKEY-PULL exchange. CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.1.1.1 |
cgmGdoiGroupIdLengthThe length (i.e. number of octets) of a Group ID. If no
length is given (i.e. it has a value of 0), the default
length of its cgmGdoiGroupIdType should be used as long as it
is not reprsented by an ASCII string. If the value has a
type that is represented by an ASCII string, a length MUST
be included. If the length given is not 0, it should match
the 'Payload Length' (subtracting the generic header length)
of the Identification Payload for a GDOI GROUPKEY-PULL
exchange.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.1.1.2 |
cgmGdoiGroupIdValueThe value of a Group ID with its type indicated by the
cgmGdoiGroupIdType. Use the cgmGdoiGroupIdType to parse the
Group ID correctly. This Group ID value is sent as the
'Identification Data' field of the Identification Payload
for a GDOI GROUPKEY-PULL exchange. CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.1.1.3 |
cgmGdoiGroupNameThe string-readable name configured for or given to a GDOI
Group.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.1.1.4 |
cgmGdoiGroupMemberCountThe count of registered Group Members to this group, on a Key
Server.ro Unsigned32 .1.3.6.1.4.1.9.9.759.1.1.1.5 |
cgmGdoiGroupActivePeerKeyServerCountThe count of the active Key Server sessions between the local
Key Server and peer Key Servers for this group.ro Unsigned32 .1.3.6.1.4.1.9.9.759.1.1.1.6 |
cgmGdoiGroupLastRekeyRetransmitsThis variable returns the cummulative count of number of rekey
messages and retransmits during the last cycle of rekey. This
count displays the information pertaining to Group Members only
(and is not related to any sync operation pertaining to peer Key
Servers). This information is a reflection of rekey operation on
a Primary Key Server, and is not available for Secondary Key
Server(s), because they do not perform rekeys and do not receive
any ACKs. While a rekey is in progress, this variable will give
information of the last rekey operation.ro Unsigned32 .1.3.6.1.4.1.9.9.759.1.1.1.7 |
cgmGdoiGroupLastRekeyTimeTakenThis variable returns the duration (in milliseconds) of the
last rekey operation. This information is valid for a Primary
Key Server, and is not available with Secondary Key Server(s),
because they do not perform rekeys and do not receive any ACKs.
While a rekey is in progress, this variable will give
information of the last rekey operation.ro CiscoMilliSeconds (CISCO-TC) .1.3.6.1.4.1.9.9.759.1.1.1.8 |
cgmGdoiPeers OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.1.2 |
cgmGdoiKeyServerTableA table of information for the GDOI group from the perspective
of the Key Servers (GCKSs) on the network device being
queried. SEQUENCE OF CgmGdoiKeyServerEntry .1.3.6.1.4.1.9.9.759.1.2.1 |
cgmGdoiKeyServerEntryAn entry containing GDOI Key Server (KS) information,
uniquely identified by the Group & Key Server IDs. CgmGdoiKeyServerEntry .1.3.6.1.4.1.9.9.759.1.2.1.1 |
cgmGdoiKeyServerIdTypeThe Identification Type Value used to parse the identity
information for a Key Server. RFC 4306 defines all valid
types that can be used as an identifier. These
identification types are sent as the 'SRC ID Type' and 'DST
ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL
and GROUPKEY-PUSH exchanges. CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.2.1.1.1 |
cgmGdoiKeyServerIdLengthThe length (i.e. number of octets) of a Key Server ID. If no
length is given (i.e. it has a value of 0), the default
length of its cgmGdoiKeyServerIdType should be used as long as
it is not reprsented by an ASCII string. If the value has a
type that is represented by an ASCII string, a length MUST
be included. If the length given is not 0, it should match
the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in
the KEK and TEK payloads for GDOI GROUPKEY-PULL and
GROUPKEY-PUSH exchanges.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.2.1.1.2 |
cgmGdoiKeyServerIdValueThe value of the identity information for a Key Server with
its type indicated by the cgmGdoiKeyServerIdType. Use the
cgmGdoiKeyServerIdType to parse the Key Server ID correctly.
This Key Server ID value is sent as the 'SRC
Identification Data' and 'DST Identification Data' of the
KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
exchanges. CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.2.1.1.3 |
cgmGdoiKeyServerActiveKEKThe SPI of the Key Encryption Key (KEK) that is currently
being used by the Key Server to encrypt the GROUPKEY-PUSH
keying & security association material sent to the Key
Server's registered Group Members.ro CgmGdoiKekSPI .1.3.6.1.4.1.9.9.759.1.2.1.1.4 |
cgmGdoiKeyServerRekeysPushedThe sequence number of the last rekey sent from the Key
Server to its registered Group Members for this GDOI group.ro Counter32 UNITS "GROUPKEY-PUSH Messages" .1.3.6.1.4.1.9.9.759.1.2.1.1.5 |
cgmGdoiKeyServerRoleThe current role of the queried Key Server for the Group.ro CgmGdoiKsRole .1.3.6.1.4.1.9.9.759.1.2.1.1.6 |
cgmGdoiKeyServerRegisteredGMsThe count of registered Group Members to the Key Server
identified by the index.ro Unsigned32 .1.3.6.1.4.1.9.9.759.1.2.1.1.7 |
cgmGdoiGmTableA table of information regarding GDOI Group Members (GMs)
locally configured on the network device being queried. Note
that Local Group Members may or may not be registered to a
Key Server in its GDOI Group on the same network device being
queried. SEQUENCE OF CgmGdoiGmEntry .1.3.6.1.4.1.9.9.759.1.2.2 |
cgmGdoiGmEntryAn entry containing Local GDOI Group Member information,
uniquely identified by Group & GM IDs. Because the Group
Member is Local to the network device being queried, TEKs
installed for this Group Member can be queried as well. CgmGdoiGmEntry .1.3.6.1.4.1.9.9.759.1.2.2.1 |
cgmGdoiGmIdTypeThe Identification Type Value used to parse the identity
information for a Initiator or Group Member. RFC 4306
defines all valid types that can be used as an identifier.
These identification types are sent as the 'SRC ID Type' and
'DST ID Type' of the KEK and TEK payloads for GDOI
GROUPKEY-PULL and GROUPKEY-PUSH exchanges. CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.2.2.1.1 |
cgmGdoiGmIdLengthThe length (i.e. number of octets) of a Group Member ID. If
no length is given (i.e. it has a value of 0), the default
length of its cgmGdoiGmIdType should be used as long as
it is not reprsented by an ASCII string. If the value has a
type that is represented by an ASCII string, a length MUST
be included. If the length given is not 0, it should match
the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in
the KEK and TEK payloads for GDOI GROUPKEY-PULL and
GROUPKEY-PUSH exchanges.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.2.2.1.2 |
cgmGdoiGmIdValueThe value of the identity information for a Group Member with
its type indicated by the cgmGdoiGmIdType. Use the
cgmGdoiGmIdType to parse the Group Member ID correctly.
This Group Member ID value is sent as the 'SRC
Identification Data' and 'DST Identification Data' of the
KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
exchanges. CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.2.2.1.3 |
cgmGdoiGmRegKeyServerIdTypeThe Identification Type Value used to parse the identity
information of this Group Member's registered Key Server.
RFC 4306 defines all valid types that can be used as an
identifier. These identification types are sent as the 'SRC
ID Type' and 'DST ID Type' of the KEK and TEK payloads for
GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.2.2.1.4 |
cgmGdoiGmRegKeyServerIdLengthThe length (i.e. number of octets) of the registered Key
Server's ID. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiGmRegKeyServerIdType
should be used as long as it is not reprsented by an ASCII
string. If the value has a type that is represented by an
ASCII string, a length MUST be included. If the length given
is not 0, it should match the 'SRC ID Data Len' and 'DST ID
Data Len' fields sent in the KEK and TEK payloads for GDOI
GROUPKEY-PULL and GROUPKEY-PUSH exchanges.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.2.2.1.5 |
cgmGdoiGmRegKeyServerIdValueThe value of the identity information for this Group Member's
registered Key Server with its type indicated by the
cgmGdoiGmRegKeyServerIdType. Use the
cgmGdoiGmRegKeyServerIdType to parse the registered Key
Server's ID correctly. This Key Server ID value is sent as
the 'SRC Identification Data' and 'DST Identification Data'
of the KEK and TEK payloads for GDOI GROUPKEY-PULL and
GROUPKEY-PUSH exchanges.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.2.2.1.6 |
cgmGdoiGmActiveKEKThe SPI of the Key Encryption Key (KEK) that is currently
being used by the Group Member to authenticate & decrypt a
rekey from a GROUPKEY-PUSH message.ro CgmGdoiKekSPI .1.3.6.1.4.1.9.9.759.1.2.2.1.7 |
cgmGdoiGmRekeysReceivedThe sequence number of the last rekey successfully received
from this Group Member's registered Key Server.ro Counter32 UNITS "GROUPKEY-PUSH Messages" .1.3.6.1.4.1.9.9.759.1.2.2.1.8 |
cgmGdoiGmActiveTEKNumThe number of active traffic encryption keys (TEKS) currently
being used by the Group Member to encrypt/decrypt/authenticate
dataplane traffic.ro Counter32 UNITS "Number of traffic encryption keys" .1.3.6.1.4.1.9.9.759.1.2.2.1.9 |
cgmGdoiCoopPeerTableA table of information for the COOP peer(s). The information
populated in this table, is extracted from the COOP messages
exchanged between the local KS (device being queried) and the
COOP Peer(s). SEQUENCE OF CgmGdoiCoopPeerEntry .1.3.6.1.4.1.9.9.759.1.2.3 |
cgmGdoiCoopPeerEntryAn entry containing COOP Peer Key Server's (KS) information,
uniquely identified by the Group & Peer Key Server IDs. CgmGdoiCoopPeerEntry .1.3.6.1.4.1.9.9.759.1.2.3.1 |
cgmGdoiCoopPeerIdTypeThe Identification Type Value used to parse the identity
information for a Key Server. RFC 4306 defines all valid types
that can be used as an identifier. These identification types
are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and
TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
exchanges. CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.2.3.1.1 |
cgmGdoiCoopPeerIdLengthThe length (i.e. number of octets) of a Peer (Key Server) ID.
If no length is given (i.e. it has a value of 0), the default
length of its cgmGdoiCoopPeerIdType should be used as long as it
is not reprsented by an ASCII string. If the value has a type
that is represented by an ASCII string, a length MUST be
included. If the length given is not 0, it should match the
'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK
and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
exchanges.ro Unsigned32 .1.3.6.1.4.1.9.9.759.1.2.3.1.2 |
cgmGdoiCoopPeerIdValueThe value of the identity information for a COOP Key Server
with its type indicated by the cgmGdoiCoopPeerIdType. Use the
cgmGdoiCoopPeerIdType to parse the COOP Peer (Key Server) ID
correctly. This COOP Peer (Key Server) ID value is sent as the
'SRC Identification Data' and 'DST Identification Data' of the
KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
exchanges. CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.2.3.1.3 |
cgmGdoiCoopPeerRoleThe current role of the COOP Peer (Key Server) for the Group.ro CgmGdoiKsRole .1.3.6.1.4.1.9.9.759.1.2.3.1.4 |
cgmGdoiCoopPeerStatusThe current status of the COOP Peer (Key Server) as seen from
the local Key Server.ro CgmGdoiKsStatus .1.3.6.1.4.1.9.9.759.1.2.3.1.5 |
cgmGdoiCoopPeerRegisteredGMsThe count of registered Group Members to the COOP Peer (Key
Server) identified by the index.ro Unsigned32 .1.3.6.1.4.1.9.9.759.1.2.3.1.6 |
cgmGdoiSecAssociations OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.1.3 |
cgmGdoiKsKekTableA table of information regarding GDOI Key Encryption Key
(KEK) Policies & Security Associations (SAs) currently
configured/installed for GDOI entities acting as Key Servers
on the network device being queried. There is one entry in
this table for each KEK Policy/SA that has been
configured/installed. Each KEK Policy/SA is uniquely
identified by a SPI at any given time. SEQUENCE OF CgmGdoiKsKekEntry .1.3.6.1.4.1.9.9.759.1.3.1 |
cgmGdoiKsKekEntryAn entry containing the attributes associated with a GDOI KEK
Policy/SA, uniquely identified by the Group ID, Key Server
ID, & SPI value assigned by the given Key Server to the KEK.
There will be at least one KEK Policy/SA entry for each Key
Server & two KEK Policy/SA entries for a given Key Server
only during a KEK rekey when a new KEK is created/installed.
The KEK SPI is unique for every KEK for a given Key Server. CgmGdoiKsKekEntry .1.3.6.1.4.1.9.9.759.1.3.1.1 |
cgmGdoiKsKekIndexThe index of the KS KEK.The value of the index is a number
which begins at one and is incremented with each KS KEK that
is to be created by the KS for that GDOI group. Unsigned32 .1.3.6.1.4.1.9.9.759.1.3.1.1.1 |
cgmGdoiKsKekSPIThe value of the Security Parameter Index (SPI) of a KEK
Policy/SA. The SPI must be the ISAKMP Header cookie pair
where the first 8 octets become the 'Initiator Cookie' field
of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8
octets become the 'Responder Cookie' in the same HDR. As
described above, these cookies are assigned by the GCKS.ro CgmGdoiKekSPI .1.3.6.1.4.1.9.9.759.1.3.1.1.2 |
cgmGdoiKsKekSrcIdTypeThe Identification Type Value used to parse the identity
information for the source of a KEK Policy/SA. RFC 4306
defines all valid types that can be used as an identifier.
This identification type is sent as the 'SRC ID Type' of
the KEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.1.1.3 |
cgmGdoiKsKekSrcIdLengthThe length (i.e. number of octets) of the source ID of
a KEK Policy/SA. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiKsKekSrcIdType should be
used as long as it is not reprsented by an ASCII string. If
the value has a type that is represented by an ASCII string,
a length MUST be included. If the length given is not 0, it
should match the 'SRC ID Data Len' field sent in the KEK
payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.1.1.4 |
cgmGdoiKsKekSrcIdValueThe value of the identity information for the source of
a KEK Policy/SA with its type indicated by the
cgmGdoiKsKekSrcIdType. Use the cgmGdoiKsKekSrcIdType to parse
the KEK Source ID correctly. This ID value is sent as the 'SRC
Identification Data' of a KEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.1.1.5 |
cgmGdoiKsKekSrcIdPortThe value specifying a port associated with the source ID of
a KEK Policy/SA. A value of zero means that the port should
be ignored. This port value is sent as the `SRC ID Port`
field of a KEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.1.1.6 |
cgmGdoiKsKekDstIdTypeThe Identification Type Value used to parse the identity
information for the dest. of a KEK Policy/SA (multicast
rekey address). RFC 4306 defines all valid types that can
be used as an identifier. This identification type is sent as
the 'DST ID Type' of the KEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.1.1.7 |
cgmGdoiKsKekDstIdLengthThe length (i.e. number of octets) of the destination ID of
a KEK Policy/SA (multicast rekey address). If no length is
given (i.e. it has a valueof 0), the default length of its
cgmGdoiKsKekDstIdType should be used as long as it is not
reprsented by an ASCII string. If the value has a type that
is represented by an ASCII string, a length MUST be included.
If the length given is not 0, it should match the 'DST ID Data
Len' field sent in the KEK payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.1.1.8 |
cgmGdoiKsKekDstIdValueThe value of the identity information for the destination of
a KEK Policy/SA (multicast rekey address) with its type
indicated by the cgmGdoiKsKekDstIdType. Use the
cgmGdoiKsKekDstIdType to parse the KEK Dest. ID correctly.
This ID value is sent as the 'DST Identification Data' of a
KEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.1.1.9 |
cgmGdoiKsKekDstIdPortThe value specifying a port associated with the dest. ID of
a KEK Policy/SA. A value of zero means that the port should
be ignored. This port value is sent as the `DST ID Port`
field of a KEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.1.1.10 |
cgmGdoiKsKekIpProtocolThe value of the IP protocol ID (e.g. UDP/TCP) being used
for the rekey datagram.ro CgmGdoiIpProtocolId .1.3.6.1.4.1.9.9.759.1.3.1.1.11 |
cgmGdoiKsKekMgmtAlgThe value of the KEK_MANAGEMENT_ALGORITHM which specifies
the group KEK management algorithm used to provide forward
or backward access control (i.e. used to exclude group
members).
KEK Management Type Value
RESERVED 0
LKH 1
RESERVED 2-127
Private Use 128-255ro CgmGdoiKeyManagementAlgorithm .1.3.6.1.4.1.9.9.759.1.3.1.1.12 |
cgmGdoiKsKekEncryptAlgThe value of the KEK_ALGORITHM which specifies the
encryption algorithm used with the KEK Policy/SA. A GDOI
implementaiton must support KEK_ALG_3DES.
Following are the KEK encryption algoritm values defined in
the GDOI RFC 3547, however the CgmGdoiEncryptionAlgorithm TC
defines all possible values.
Algorithm Type Value
RESERVED 0
KEK_ALG_DES 1
KEK_ALG_3DES 2
KEK_ALG_AES 3
RESERVED 4-127
Private Use 128-255ro CgmGdoiEncryptionAlgorithm .1.3.6.1.4.1.9.9.759.1.3.1.1.13 |
cgmGdoiKsKekEncryptKeyLengthThe value of the KEK_KEY_LENGTH which specifies the KEK
Algorithm key length (in bits).ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.1.1.14 |
cgmGdoiKsKekSigHashAlgThe value of the SIG_HASH_ALGORITHM which specifies the SIG
payload hash algorithm. This is not required (i.e. could
have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or
SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a
value of zero or SIG_HASH_SHA1).
Following are the Signature Hash Algorithm values defined in
the GDOI RFC 3547, however the CgmGdoiPseudoRandomFunction TC
defines all possible values.
Algorithm Type Value
RESERVED 0
SIG_HASH_MD5 1
SIG_HASH_SHA1 2
RESERVED 3-127
Private Use 128-255ro CgmGdoiPseudoRandomFunction .1.3.6.1.4.1.9.9.759.1.3.1.1.15 |
cgmGdoiKsKekSigAlgThe value of the SIG_ALGORITHM which specifies the SIG
payload signature algorithm. A GDOI implementation must
support SIG_ALG_RSA.
Following are the Signature Algorithm values defined in
the GDOI RFC 3547, however the CgmGdoiSignatureMethod TC
defines all possible values.
Algorithm Type Value
RESERVED 0
SIG_ALG_RSA 1
SIG_ALG_DSS 2
SIG_ALG_ECDSS 3
RESERVED 4-127
Private Use 128-255ro CgmGdoiSignatureMethod .1.3.6.1.4.1.9.9.759.1.3.1.1.16 |
cgmGdoiKsKekSigKeyLengthThe value of the SIG_KEY_LENGTH which specifies the length
of the SIG payload key.ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.1.1.17 |
cgmGdoiKsKekOakleyGroupThe value of the KE_OAKLEY_GROUP which specifies the OAKLEY
or Diffie-Hellman Group used to compute the PFS secret in the
optional KE payload of the GDOI GROUPKEY-PULL exchange.ro CgmGdoiDiffieHellmanGroup .1.3.6.1.4.1.9.9.759.1.3.1.1.18 |
cgmGdoiKsKekOriginalLifetimeThe value of the KEK_KEY_LIFETIME which specifies the maximum
time for which a KEK is valid. The GCKS may refresh the KEK
at any time before the end of the valid period. The value is
a four (4) octet (32-bit) number defining a valid time period
in seconds.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.1.1.19 |
cgmGdoiKsKekRemainingLifetimeThe value of the remaining time for which a KEK is valid.
The value is a four (4) octet (32-bit) number which begins at
the value of cgmGdoiKsKekOriginalLifetime when the KEK is sent
and counts down to zero in seconds. If the lifetime has
already expired, this value should remain at zero (0) until
the Key Server refreshes the KEK.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.1.1.20 |
cgmGdoiKsKekStatusThe status of the KEK Policy/SA. When this status value is
queried, one of the following is returned:
inUse(1), new(2), old(3).ro CgmGdoiKekStatus .1.3.6.1.4.1.9.9.759.1.3.1.1.21 |
cgmGdoiGmKekTableA table of information regarding GDOI Key Encryption Key
(KEK) Security Associations (SAs) currently installed for
GDOI entities acting as Group Members on the network device
being queried. There is one entry in this table for each
KEK SA that has been installed and not yet deleted. Each
KEK SA is uniquely identified by a SPI at any given time. SEQUENCE OF CgmGdoiGmKekEntry .1.3.6.1.4.1.9.9.759.1.3.2 |
cgmGdoiGmKekEntryAn entry containing the attributes associated with a GDOI KEK
SA, uniquely identified by the Group ID, Group Member (GM)
ID, & SPI value assigned by the GM's registered Key Server to
the KEK. There will be at least one KEK SA entry for each GM
& two KEK SA entries for a given GM only during a KEK rekey
when a new KEK is received & installed. The KEK SPI is
unique for every KEK for a given Group Member. CgmGdoiGmKekEntry .1.3.6.1.4.1.9.9.759.1.3.2.1 |
cgmGdoiGmKekIndexThe index of the GM KEK in table.The value of the index is a
number which begins at one and is incremented with each
KEK that is used by the GM for that GDOI group. Unsigned32 .1.3.6.1.4.1.9.9.759.1.3.2.1.1 |
cgmGdoiGmKekSPIThe value of the Security Parameter Index (SPI) of a KEK
SA. The SPI must be the ISAKMP Header cookie pair
where the first 8 octets become the 'Initiator Cookie' field
of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8
octets become the 'Responder Cookie' in the same HDR. As
described above, these cookies are assigned by the GCKS.ro CgmGdoiKekSPI .1.3.6.1.4.1.9.9.759.1.3.2.1.2 |
cgmGdoiGmKekSrcIdTypeThe Identification Type Value used to parse the identity
information for the source of a KEK SA. RFC 4306
defines all valid types that can be used as an identifier.
This identification type is sent as the 'SRC ID Type' of
the KEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.2.1.3 |
cgmGdoiGmKekSrcIdLengthThe length (i.e. number of octets) of the source ID of
a KEK SA. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiGmKekSrcIdType should be
used as long as it is not reprsented by an ASCII string. If
the value has a type that is represented by an ASCII string,
a length MUST be included. If the length given is not 0, it
should match the 'SRC ID Data Len' field sent in the KEK
payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.2.1.4 |
cgmGdoiGmKekSrcIdValueThe value of the identity information for the source of
a KEK SA with its type indicated by the
cgmGdoiGmKekSrcIdType. Use the cgmGdoiGmKekSrcIdType to parse
the KEK Source ID correctly. This ID value is sent as the 'SRC
Identification Data' of a KEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.2.1.5 |
cgmGdoiGmKekSrcIdPortThe value specifying a port associated with the source ID of
a KEK SA. A value of zero means that the port should
be ignored. This port value is sent as the `SRC ID Port`
field of a KEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.2.1.6 |
cgmGdoiGmKekDstIdTypeThe Identification Type Value used to parse the identity
information for the dest. (multicast rekey address) of a
KEK SA. RFC 4306 defines all valid types that can be used
as an identifier. This identification type is sent as the
'DST ID Type' of the KEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.2.1.7 |
cgmGdoiGmKekDstIdLengthThe length (i.e. number of octets) of the destination ID of
a KEK SA. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiGmKekDstIdType should be
used as long as it is not reprsented by an ASCII string. If
the value has a type that is represented by an ASCII string,
a length MUST be included. If the length given is not 0, it
should match the 'DST ID Data Len' field sent in the KEK
payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.2.1.8 |
cgmGdoiGmKekDstIdValueThe value of the identity information for the destination of
a KEK SA (multicast rekey address) with its type indicated by
cgmGdoiGmKekDstIdType. Use the cgmGdoiGmKekDstIdType to parse
the KEK Dest. ID correctly. This ID value is sent as the 'DST
Identification Data' of a KEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.2.1.9 |
cgmGdoiGmKekDstIdPortThe value specifying a port associated with the dest. ID of
a KEK SA. A value of zero means that the port should
be ignored. This port value is sent as the `DST ID Port`
field of a KEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.2.1.10 |
cgmGdoiGmKekIpProtocolThe value of the IP protocol ID (e.g. UDP/TCP) being used
for the rekey datagram.ro CgmGdoiIpProtocolId .1.3.6.1.4.1.9.9.759.1.3.2.1.11 |
cgmGdoiGmKekMgmtAlgThe value of the KEK_MANAGEMENT_ALGORITHM which specifies
the group KEK management algorithm used to provide forward
or backward access control (i.e. used to exclude group
members).
KEK Management Type Value
RESERVED 0
LKH 1
RESERVED 2-127
Private Use 128-255ro CgmGdoiKeyManagementAlgorithm .1.3.6.1.4.1.9.9.759.1.3.2.1.12 |
cgmGdoiGmKekEncryptAlgThe value of the KEK_ALGORITHM which specifies the
encryption algorithm used with the KEK SA. A GDOI
implementaiton must support KEK_ALG_3DES.
Following are the KEK encryption algoritm values defined in
the GDOI RFC 3547, however the CgmGdoiEncryptionAlgorithm TC
defines all possible values.
Algorithm Type Value
RESERVED 0
KEK_ALG_DES 1
KEK_ALG_3DES 2
KEK_ALG_AES 3
RESERVED 4-127
Private Use 128-255ro CgmGdoiEncryptionAlgorithm .1.3.6.1.4.1.9.9.759.1.3.2.1.13 |
cgmGdoiGmKekEncryptKeyLengthThe value of the KEK_KEY_LENGTH which specifies the KEK
Algorithm key length (in bits).ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.2.1.14 |
cgmGdoiGmKekSigHashAlgThe value of the SIG_HASH_ALGORITHM which specifies the SIG
payload hash algorithm. This is not required (i.e. could
have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or
SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a
value of zero or SIG_HASH_SHA1).
Following are the Signature Hash Algorithm values defined in
the GDOI RFC 3547, however the CgmGdoiPseudoRandomFunction TC
defines all possible values.
Algorithm Type Value
RESERVED 0
SIG_HASH_MD5 1
SIG_HASH_SHA1 2
RESERVED 3-127
Private Use 128-255ro CgmGdoiPseudoRandomFunction .1.3.6.1.4.1.9.9.759.1.3.2.1.15 |
cgmGdoiGmKekSigAlgThe value of the SIG_ALGORITHM which specifies the SIG
payload signature algorithm. A GDOI implementation must
support SIG_ALG_RSA.
Following are the Signature Algorithm values defined in
the GDOI RFC 3547, however the CgmGdoiSignatureMethod TC
defines all possible values.
Algorithm Type Value
RESERVED 0
SIG_ALG_RSA 1
SIG_ALG_DSS 2
SIG_ALG_ECDSS 3
RESERVED 4-127
Private Use 128-255ro CgmGdoiSignatureMethod .1.3.6.1.4.1.9.9.759.1.3.2.1.16 |
cgmGdoiGmKekSigKeyLengthThe value of the SIG_KEY_LENGTH which specifies the length
of the SIG payload key.ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.2.1.17 |
cgmGdoiGmKekOakleyGroupThe value of the KE_OAKLEY_GROUP which specifies the OAKLEY
or Diffie-Hellman Group used to compute the PFS secret in the
optional KE payload of the GDOI GROUPKEY-PULL exchange.ro CgmGdoiDiffieHellmanGroup .1.3.6.1.4.1.9.9.759.1.3.2.1.18 |
cgmGdoiGmKekOriginalLifetimeThe value of the KEK_KEY_LIFETIME which specifies the maximum
time for which a KEK is valid. The GCKS may refresh the KEK
at any time before the end of the valid period. The value is
a four (4) octet (32-bit) number defining a valid time period
in seconds.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.2.1.19 |
cgmGdoiGmKekRemainingLifetimeThe value of the remaining time for which a KEK is valid.
The value is a four (4) octet (32-bit) number which begins at
the value of cgmGdoiGmKekOriginalLifetime and counts down to 0
in seconds. If the lifetime has already expired, this value
should remain at zero (0) until the GCKS refreshes the KEK.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.2.1.20 |
cgmGdoiGmKekStatusThe status of the KEK SA. When this status value is
queried, one of the following is returned:
inUse(1), new(2), old(3).ro CgmGdoiKekStatus .1.3.6.1.4.1.9.9.759.1.3.2.1.21 |
cgmGdoiKsTekSelectorTableA table of information regarding GDOI Traffic Encryption Key
(TEK) Selectors (source, destination, protocol information)
that is currently configured/pushed for GDOI entities
acting as Key Servers on the network device being queried.
There is one entry in this table for each TEK that has been
configured & pushed to Group Members registered to the given
Key Server. SEQUENCE OF CgmGdoiKsTekSelectorEntry .1.3.6.1.4.1.9.9.759.1.3.3 |
cgmGdoiKsTekSelectorEntryAn entry containing the Source/Destination attributes
associated with a GDOI TEK Policy, uniquely identified by the
Group ID, Key Server ID and TEK Selector index. There will be
one entry for each Source/Destination Policy sent by the given
Key Server to its registered Group Members, each with
a unique <SRC-ID, SRC-PORT, DST-ID, DST-PORT, SPI> 5-tuple.
However, due to the 255-octet constraint placed on an OID,
the <SRC-ID, SRC-PORT, DST-ID, DST-PORT> 4-tuple cannot be
used to INDEX a TEK entry for a given Group ID & Key Server
ID. Therefore, the TEK Selector index for a given Group ID &
Key Server ID MUST be unique. The TEK SPI is part of the TEK
Policy Table. CgmGdoiKsTekSelectorEntry .1.3.6.1.4.1.9.9.759.1.3.3.1 |
cgmGdoiKsTekSelectorIndexThe index of the Source/Destination tuple to be secured by the
KS TEK.The value of the index is a number which begins at
one and is incremented with each Source/Destination pair that
is to be secured by the KS TEK policy for that GDOI group. Unsigned32 .1.3.6.1.4.1.9.9.759.1.3.3.1.1 |
cgmGdoiKsTekSrcIdTypeThe Identification Type Value used to parse the identity
information for the source of a TEK Policy. RFC 4306
defines all valid types that can be used as an identifier.
This identification type is sent as the 'SRC ID Type' of
the TEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.3.1.2 |
cgmGdoiKsTekSrcIdLengthThe length (i.e. number of octets) of the source ID of
a TEK Policy. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiKsTekSrcIdType should be
used as long as it is not reprsented by an ASCII string. If
the value has a type that is represented by an ASCII string,
a length MUST be included. If the length given is not 0, it
should match the 'SRC ID Data Len' field sent in the TEK
payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.3.1.3 |
cgmGdoiKsTekSrcIdValueThe value of the identity information for the source of
a TEK Policy with its type indicated by the
cgmGdoiKsTekSrcIdType. Use the cgmGdoiKsTekSrcIdType to parse
the TEK Source ID correctly. This ID value is sent as the 'SRC
Identification Data' of a TEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.3.1.4 |
cgmGdoiKsTekSrcIdPortThe value specifying a port associated with the source ID of
a TEK Policy. A value of zero means that the port should
be ignored. This port value is sent as the `SRC ID Port`
field of a TEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.3.1.5 |
cgmGdoiKsTekDstIdTypeThe Identification Type Value used to parse the identity
information for the dest. of a TEK Policy. RFC 4306
defines all valid types that can be used as an identifier.
This identification type is sent as the 'DST ID Type' of
the TEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.3.1.6 |
cgmGdoiKsTekDstIdLengthThe length (i.e. number of octets) of the destination ID of
a TEK Policy. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiKsTekDstIdType should be
used as long as it is not reprsented by an ASCII string. If
the value has a type that is represented by an ASCII string,
a length MUST be included. If the length given is not 0, it
should match the 'DST ID Data Len' field sent in the TEK
payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.3.1.7 |
cgmGdoiKsTekDstIdValueThe value of the identity information for the destination of
a TEK Policy with its type indicated by the
cgmGdoiKsTekDstIdType. Use the cgmGdoiKsTekDstIdType to parse
the TEK Dest. ID correctly. This ID value is sent as the 'DST
Identification Data' of a TEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.3.1.8 |
cgmGdoiKsTekDstIdPortThe value specifying a port associated with the dest. ID of
a TEK Policy. A value of zero means that the port should
be ignored. This port value is sent as the `DST ID Port`
field of a TEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.3.1.9 |
cgmGdoiKsTekSecurityProtocolThe value of the Protocol-ID field of a SA TEK (SAT) payload
which specifies the Security Protocol for a TEK.
Following are the Security Protocol values defined in
the GDOI RFC 3547, however the CgmGdoiSecurityProtocol TC
defines all possible values.
Protocol ID Value
RESERVED 0
GDOI_PROTO_IPSEC_ESP 1
RESERVED 2-127
Private Use 128-255ro CgmGdoiSecurityProtocol .1.3.6.1.4.1.9.9.759.1.3.3.1.10 |
cgmGdoiKsTekPolicyTableA table of information regarding GDOI Traffic Encryption Key
(TEK) Policies currently configured/pushed for GDOI entities
acting as Key Servers on the network device being queried.
There is one entry in this table for each TEK that has been
configured & pushed to Group Members registered to the given
Key Server. SEQUENCE OF CgmGdoiKsTekPolicyEntry .1.3.6.1.4.1.9.9.759.1.3.4 |
cgmGdoiKsTekPolicyEntryAn entry containing the attributes associated with a GDOI TEK
Policy, uniquely identified by the Group ID, Key Server ID,
TEK Selector Index (Source/Destination IDs & Ports), and TEK
Policy Index (TEK SPI and direction). There will be one or
more TEK entries for each TEK Policy sent by the given Key
Server to its registered Group Members, each with a unique
<SRC-ID, SRC-PORT, DST-ID, DST-PORT, SPI> 5-tuple. CgmGdoiKsTekPolicyEntry .1.3.6.1.4.1.9.9.759.1.3.4.1 |
cgmGdoiKsTekPolicyIndexThe index of the policy that is used to secure the KS TEK.
The value of the index is a number which begins at
one and is incremented with each row in this table. Unsigned32 .1.3.6.1.4.1.9.9.759.1.3.4.1.1 |
cgmGdoiKsTekSPIThe value of the Security Parameter Index (SPI) of a TEK
Policy. The SPI must be the SPI for ESP.ro CgmGdoiTekSPI .1.3.6.1.4.1.9.9.759.1.3.4.1.2 |
cgmGdoiKsTekEncapsulationModeThe value of the Encapsulation Mode of a TEK (IPsec SA).
Following are the Encapsulation Mode values defined in
RFC 2407, however the CgmGdoiEncapsulationMode TC defines all
possible values.
Encapsulation Mode Value
RESERVED 0
Tunnel 1
Transport 2ro CgmGdoiEncapsulationMode .1.3.6.1.4.1.9.9.759.1.3.4.1.3 |
cgmGdoiKsTekEncryptionAlgorithmThe value of the Transform ID field of a PROTO_IPSEC_ESP
payload which specifies the ESP transform to be used. If
no encryption is used, this value will be zero (0).
Following are the ESP Transform values defined in RFC 2407,
however the CgmGdoiEncryptionAlgorithm TC defines all possible
values.
IPsec ESP Transform ID Value
-
RESERVED 0
ESP_DES_IV64 1
ESP_DES 2
ESP_3DES 3
ESP_RC5 4
ESP_IDEA 5
ESP_CAST 6
ESP_BLOWFISH 7
ESP_3IDEA 8
ESP_DES_IV32 9
ESP_RC4 10
ESP_NULL 11ro CgmGdoiEncryptionAlgorithm .1.3.6.1.4.1.9.9.759.1.3.4.1.4 |
cgmGdoiKsTekEncryptionKeyLengthThe length of the key used for encryption in a TEK
(in bits).ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.4.1.5 |
cgmGdoiKsTekIntegrityAlgorithmThe value of the Authentication Algorithm for a TEK IPsec
ESP SA. If no authentication is used, this value will be
zero (0).
Following are the Authentication Algorithm values defined in
RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all
possible values.
Algorithm Type Value
HMAC-MD5 1
HMAC-SHA 2
DES-MAC 3
KPDK 4ro CgmGdoiIntegrityAlgorithm .1.3.6.1.4.1.9.9.759.1.3.4.1.6 |
cgmGdoiKsTekIntegrityKeyLengthThe length of the key used for integrity/authentication in a
TEK (in bits).ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.4.1.7 |
cgmGdoiKsTekWindowSizeThe size of the Time Based Anti-Replay (TBAR) window used by
this TEK Policy.ro Unsigned32 UNITS "GROUPKEY-PUSH Messages" .1.3.6.1.4.1.9.9.759.1.3.4.1.8 |
cgmGdoiKsTekOriginalLifetimeThe value of the SA Life Type defined in RFC 2407 which
specifies the maximum time for which a TEK IPsec SA is valid.
The GCKS may refresh the TEK at any time before the end of
the valid period. The value is a four (4) octet (32-bit)
number defining a valid time period in seconds.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.4.1.9 |
cgmGdoiKsTekRemainingLifetimeThe value of the remaining time for which a TEK is valid.
The value is a four (4) octet (32-bit) number which begins at
the value of cgmGdoiKsTekOriginalLifetime when the TEK is sent
and counts down to zero in seconds. If the lifetime has
already expired, this value should remain at zero (0) until
the Key Server refreshes the TEK.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.4.1.10 |
cgmGdoiKsTekStatusThe status of the TEK Policy. When this status value is
queried, one of the following is returned:
inbound(1), outbound(2), notInUse(3).ro CgmGdoiTekStatus .1.3.6.1.4.1.9.9.759.1.3.4.1.11 |
cgmGdoiGmTekSelectorTableA table of information regarding GDOI Traffic Encryption Key
(TEK) Security Associations (SAs/Policies) pushed by a
Key Server & installed for GDOI entities acting as Group
Members (GMs) on the network device being queried. There is
one entry in this table for each unique TEK traffic selector
(Source/Destination tuple) that has been downloaded from the
Key Server and installed on the Group Member. SEQUENCE OF CgmGdoiGmTekSelectorEntry .1.3.6.1.4.1.9.9.759.1.3.5 |
cgmGdoiGmTekSelectorEntryAn entry containing the attributes associated with a GDOI TEK
Policy/SA, uniquely identified by the Group ID, Group Member
ID, Source/Destination IDs & Ports, and TEK SPI. There will
be one or more TEK entries for each TEK Policy/SA received
and installed by the given Group Member from its registered
Key Server, each with a unique <SRC-ID, SRC-PORT, DST-ID,
DST-PORT, SPI> 5-tuple. This table does not contain the SPI
which is part of the TEK policy table. CgmGdoiGmTekSelectorEntry .1.3.6.1.4.1.9.9.759.1.3.5.1 |
cgmGdoiGmTekSelectorIndexThe index of the Source/Destination pair secured by the
GM TEK.The value of the index is a number which begins at
one and is incremented with each Source/Destination pair that
is secured by the GM TEK policy for that GDOI group. Unsigned32 .1.3.6.1.4.1.9.9.759.1.3.5.1.1 |
cgmGdoiGmTekSrcIdTypeThe Identification Type Value used to parse the identity
information for the source of a TEK Policy/SA. RFC 4306
defines all valid types that can be used as an identifier.
This identification type is sent as the 'SRC ID Type' of
the TEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.5.1.2 |
cgmGdoiGmTekSrcIdLengthThe length (i.e. number of octets) of the source ID of
a TEK Policy/SA. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiGmTekSrcIdType should be
used as long as it is not reprsented by an ASCII string. If
the value has a type that is represented by an ASCII string,
a length MUST be included. If the length given is not 0, it
should match the 'SRC ID Data Len' field sent in the TEK
payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.5.1.3 |
cgmGdoiGmTekSrcIdValueThe value of the identity information for the source of
a TEK Policy/SA with its type indicated by the
cgmGdoiGmTekSrcIdType. Use the cgmGdoiGmTekSrcIdType to parse
the TEK Source ID correctly. This ID value is sent as the 'SRC
Identification Data' of a TEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.5.1.4 |
cgmGdoiGmTekSrcIdPortThe value specifying a port associated with the source ID of
a TEK Policy/SA. A value of zero means that the port should
be ignored. This port value is sent as the `SRC ID Port`
field of a TEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.5.1.5 |
cgmGdoiGmTekDstIdTypeThe Identification Type Value used to parse the identity
information for the dest. of a TEK Policy/SA. RFC 4306
defines all valid types that can be used as an identifier.
This identification type is sent as the 'DST ID Type' of
the TEK payload.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.3.5.1.6 |
cgmGdoiGmTekDstIdLengthThe length (i.e. number of octets) of the destination ID of
a TEK Policy/SA. If no length is given (i.e. it has a value
of 0), the default length of its cgmGdoiGmTekDstIdType should be
used as long as it is not reprsented by an ASCII string. If
the value has a type that is represented by an ASCII string,
a length MUST be included. If the length given is not 0, it
should match the 'DST ID Data Len' field sent in the TEK
payload.ro Unsigned32 UNITS "Octets" .1.3.6.1.4.1.9.9.759.1.3.5.1.7 |
cgmGdoiGmTekDstIdValueThe value of the identity information for the destination of
a TEK Policy/SA with its type indicated by the
cgmGdoiGmTekDstIdType. Use the cgmGdoiGmTekDstIdType to parse
the TEK Dest. ID correctly. This ID value is sent as the 'DST
Identification Data' of a TEK payload.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.3.5.1.8 |
cgmGdoiGmTekDstIdPortThe value specifying a port associated with the dest. ID of
a TEK Policy/SA. A value of zero means that the port should
be ignored. This port value is sent as the `DST ID Port`
field of a TEK payload.ro CgmGdoiUnsigned16 .1.3.6.1.4.1.9.9.759.1.3.5.1.9 |
cgmGdoiGmTekSecurityProtocolThe value of the Protocol-ID field of a SA TEK (SAT) payload
which specifies the Security Protocol for a TEK.
Following are the Security Protocol values defined in
the GDOI RFC 3547, however the CgmGdoiSecurityProtocol TC
defines all possible values.
Protocol ID Value
RESERVED 0
GDOI_PROTO_IPSEC_ESP 1
RESERVED 2-127
Private Use 128-255ro CgmGdoiSecurityProtocol .1.3.6.1.4.1.9.9.759.1.3.5.1.10 |
cgmGdoiGmTekPolicyTableA table of information regarding GDOI Traffic Encryption Key
(TEK) Security Associations (SAs/Policies) received by a
Key Server & installed for GDOI entities acting as Group
Members (GMs) on the network device being queried. There is
one entry in this table for each TEK SA that has been
installed on the Group Member. SEQUENCE OF CgmGdoiGmTekPolicyEntry .1.3.6.1.4.1.9.9.759.1.3.6 |
cgmGdoiGmTekPolicyEntryAn entry containing the attributes associated with a GDOI TEK
Policy/SA, uniquely identified by the Group ID, Group Member
ID, TEK Selector (Source/Destination IDs & Ports), and TEK
Policy index (TEK SPI and direction). There will be one or
more TEK entries for each TEK Policy/SA received and installed
by the given Group Member from its registered Key Server, each
with a unique <SRC-ID, SRC-PORT, DST-ID, DST-PORT, SPI> tuple.
This table contains the SPI information corresponding to a TEK
Selector index. CgmGdoiGmTekPolicyEntry .1.3.6.1.4.1.9.9.759.1.3.6.1 |
cgmGdoiGmTekPolicyIndexThe index of the SPI used to secure the GM TEK.The value of
the index is a number which begins at one and is incremented
with each row of the GM TEK SPI table. Unsigned32 .1.3.6.1.4.1.9.9.759.1.3.6.1.1 |
cgmGdoiGmTekSPIThe value of the Security Parameter Index (SPI) of a TEK
Policy/SA. The SPI must be the SPI for ESP.ro CgmGdoiTekSPI .1.3.6.1.4.1.9.9.759.1.3.6.1.2 |
cgmGdoiGmTekEncapsulationModeThe value of the Encapsulation Mode of a TEK (IPsec SA).
Following are the Encapsulation Mode values defined in
RFC 2407, however the CgmGdoiEncapsulationMode TC defines all
possible values.
Encapsulation Mode Value
RESERVED 0
Tunnel 1
Transport 2ro CgmGdoiEncapsulationMode .1.3.6.1.4.1.9.9.759.1.3.6.1.3 |
cgmGdoiGmTekEncryptionAlgorithmThe value of the Transform ID field of a PROTO_IPSEC_ESP
payload which specifies the ESP transform to be used. If
no encryption is used, this value will be zero (0).
Following are the ESP Transform values defined in RFC 2407,
however the CgmGdoiEncryptionAlgorithm TC defines all possible
values.
IPsec ESP Transform ID Value
-
RESERVED 0
ESP_DES_IV64 1
ESP_DES 2
ESP_3DES 3
ESP_RC5 4
ESP_IDEA 5
ESP_CAST 6
ESP_BLOWFISH 7
ESP_3IDEA 8
ESP_DES_IV32 9
ESP_RC4 10
ESP_NULL 11ro CgmGdoiEncryptionAlgorithm .1.3.6.1.4.1.9.9.759.1.3.6.1.4 |
cgmGdoiGmTekEncryptionKeyLengthThe length of the key used for encryption in a TEK
(in bits).ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.6.1.5 |
cgmGdoiGmTekIntegrityAlgorithmThe value of the Authentication Algorithm for a TEK IPsec
ESP SA. If no authentication is used, this value will be
zero (0).
Following are the Authentication Algorithm values defined in
RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all
possible values.
Algorithm Type Value
HMAC-MD5 1
HMAC-SHA 2
DES-MAC 3
KPDK 4ro CgmGdoiIntegrityAlgorithm .1.3.6.1.4.1.9.9.759.1.3.6.1.6 |
cgmGdoiGmTekIntegrityKeyLengthThe length of the key used for integrity/authentication in a
TEK (in bits).ro Unsigned32 UNITS "Bits" .1.3.6.1.4.1.9.9.759.1.3.6.1.7 |
cgmGdoiGmTekWindowSizeThe size of the Time Based Anti-Replay (TBAR) window used by
this TEK Policy/SA.ro Unsigned32 UNITS "GROUPKEY-PUSH Messages" .1.3.6.1.4.1.9.9.759.1.3.6.1.8 |
cgmGdoiGmTekOriginalLifetimeThe value of the SA Life Type defined in RFC 2407 which
specifies the maximum time for which a TEK IPsec SA is valid.
The GCKS may refresh the TEK at any time before the end of
the valid period. The value is a four (4) octet (32-bit)
number defining a valid time period in seconds.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.6.1.9 |
cgmGdoiGmTekRemainingLifetimeThe value of the remaining time for which a TEK is valid.
The value is a four (4) octet (32-bit) number which begins at
the value of cgmGdoiGmTekOriginalLifetime and counts down to 0
in seconds. If the lifetime has already expired, this value
should remain at zero (0) until the GCKS refreshes the TEK.ro Unsigned32 UNITS "Seconds" .1.3.6.1.4.1.9.9.759.1.3.6.1.10 |
cgmGdoiGmTekStatusThe status of the TEK Policy/SA. When this status value is
queried, one of the following is returned:
inbound(1), outbound(2), notInUse(3).ro CgmGdoiTekStatus .1.3.6.1.4.1.9.9.759.1.3.6.1.11 |
cgmGdoiNotifCntl OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.1.4 |
cgmGdoiKSNewRegNotifEnableIndicates whether or not a notification should be
generated on a Key Server when a new Group
Member begins registration to a GDOI group.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.1 |
cgmGdoiKSRegCompNotifEnableIndicates whether or not a notification should be
generated on a Key Server when a new Group
Member successfully registers to a GDOI group.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.2 |
cgmGdoiKSRekeyPushNotifEnableIndicates whether or not a notification should be
generated on a Key Server when a rekey is sent
to a GDOI group.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.3 |
cgmGdoiKSNoRSANotifEnableIndicates whether or not an error notification should
be generated on a Key Server when an RSA
key is not set up.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.4 |
cgmGdoiGMRegNotifEnableIndicates whether or not a notification should be
generated on a Group Member when it starts
registration to a Key Server in a GDOI group.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.5 |
cgmGdoiGmRegCompNotifEnableIndicates whether or not a notification should be
generated on a Group Member when it
successfully registers to a Key Server in
a GDOI group.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.6 |
cgmGdoiGmReRegNotifEnableIndicates whether or not a notification should be
generated on a Group Member when it starts
to re-register to a Key Server in a GDOI group.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.7 |
cgmGdoiGmRekeyRecNotifEnableIndicates whether or not a notification should be
generated on a Group Member when it receives
and processes a rekey sent by a Key Server in
a GDOI group.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.8 |
cgmGdoiGmIncompCfgNotifEnableIndicates whether or not an error notification should
be generated on a Group Member when there is
missing information for configuring a GDOI group.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.9 |
cgmGdoiGmNoIpSecFlowsNotifEnableIndicates whether or not an error notification should
be generated on a Group Member when no more
security associations can be installed after receiving
a rekey from a Key Server in a GDOI group.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.10 |
cgmGdoiGmRekeyFailNotifEnableIndicates whether or not an error notification should
be generated on a Group Member when it is unable
to successfully process and install a rekey.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.11 |
cgmGdoiKsRoleChangeNotifEnableIndicates whether or not cgmGdoiKeyServerRoleChange
notification should be generated on a Key Server when its role
changes from Primary to Secondary or vice-versa.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.12 |
cgmGdoiKsGmDeletedNotifEnableIndicates whether or not cgmGdoiKeyServerGmDeleted notification
should be generated on a Key Server when a Group Member is
deleted from the group database.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.13 |
cgmGdoiKsPeerReachNotifEnableIndicates whether or not cgmGdoiKeyServerPeerReachable
notification should be generated on a Key Server when
unreachable peer Key Server becomes reachable.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.14 |
cgmGdoiKsPeerUnreachNotifEnableIndicates whether or not cgmGdoiKeyServerPeerUnreachable
notification should be generated on a Key Server when reachable
peer Key Server becomes unreachable.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.4.15 |
cgmGdoiNotifVars OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.1.5 |
cgmGdoiNotifGroupIdTypeVariable used only for notifications. This variable captures
the identification type of the GDOI group.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.5.1 |
cgmGdoiNotifGroupIdValueVariable used only for notifications. The value of a Group ID
with its type indicated by the cgmGdoiNotifGroupIdType. Use the
cgmGdoiNotifGroupIdType to parse the value of this field
correctly.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.5.2 |
cgmGdoiNotifGroupNameVariable used only for notifications. The string-readable name
configured for or given to a GDOI Group.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.9.9.759.1.5.3 |
cgmGdoiNotifKeyServerIdTypeVariable used only for notifications. The Identification Type
Value used to parse the identity information of a Key Server.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.5.4 |
cgmGdoiNotifKeyServerIdValueVariable used only for notifications. The value of the identity
information for a Key Server with its type indicated by the
cgmGdoiNotifKeyServerIdType. Use the cgmGdoiNotifKeyServerIdType
to parse the Key Server ID correctly.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.5.5 |
cgmGdoiNotifKeyServerRoleVariable used only for notifications. The current role of the
Key Server for the Group.ro CgmGdoiKsRole .1.3.6.1.4.1.9.9.759.1.5.6 |
cgmGdoiNotifGmIdTypeVariable used only for notifications. The Identification Type
Value used to parse the identity information for a Initiator or
Group Member.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.5.7 |
cgmGdoiNotifGmIdValueVariable used only for notifications. The value of the identity
information for a Group Member with its type indicated by the
cgmGdoiNotifGmIdType. Use the cgmGdoiNotifGmIdType to parse the
Group Member ID's value correctly.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.5.8 |
cgmGdoiNotifPeerKsIdTypeVariable used only for notifications. The Identification Type
Value used to parse the identity information of a Key Server.ro CgmGdoiIdentificationType .1.3.6.1.4.1.9.9.759.1.5.9 |
cgmGdoiNotifPeerKsIdValueVariable used only for notifications. The value of the identity
information for a Peer Key Server with its type indicated by the
cgmGdoiNotifPeerKsIdType. Use the cgmGdoiNotifPeerKsIdType to
parse the Peer Key Server ID correctly.ro CgmGdoiIdentificationValue .1.3.6.1.4.1.9.9.759.1.5.10 |
cgmGdoiMIBConformance OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.2 |
cgmGdoiMIBGroups OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.2.1 |
cgmGdoiMIBCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.759.2.2 |