Home/Catalog/CISCO-TRUSTSEC-POLICY-MIB

CISCO-TRUSTSEC-POLICY-MIB

AI MIB Summary

The CISCO-TRUSTSEC-POLICY-MIB enables monitoring and configuration of Cisco TrustSec infrastructure by exposing Security Group Tag (SGT) propagation states, SGACL enforcement policies, and peer device policy relationships. It provides granular visibility into interface-level SGT tagging, SXP protocol operations, and traffic statistics counters for access control list enforcement across Layer 2 and Layer 3 networks.

This MIB module defines managed objects that facilitate the management of various policies within the Cisco Trusted Security (TrustSec) infrastructure. The information available through this MIB includes: o Device and interface level configuration for enabling SGACL (Security Group Access Control List) enforcement on Layer2/3 traffic. o Administrative and operational SGACL mapping to Security Group Tag (SGT). o Various statistics counters for traffic subject to SGACL enforcement. o TrustSec policies with respect to peer device. o Interface level configuration for enabling the propagation of SGT along with the Layer 3 traffic in portions of network which does not have the capability to support TrustSec feature. o TrustSec policies with respect to SGT propagation with Layer 3 traffic. The following terms are used throughout this MIB: VRF: Virtual Routing and Forwarding. SGACL: Security Group Access Control List. ACE: Access Control Entries. SXP: SGT Propagation Protocol. SVI: Switch Virtual Interface. IPM: Identity Port Mapping. SGT (Security Group Tag) is a unique 16 bits value assigned to every security group and used by network devices to enforce SGACL. Peer is another device connected to the local device on the other side of a TrustSec link. Default Policy: Policy applied to traffic when there is no explicit policy between the SGT associated with the originator of the traffic and the SGT associated with the destination of the traffic.
Main OID:
ciscoTrustSecPolicyMIB.1.3.6.1.4.1.9.9.713
171
Objects
Active
Status
10
Dependencies

Imported Objects

SNMPv2-SMI
SNMPv2-CONF
SNMPv2-TC
IF-MIB
CISCO-TRUSTSEC-TC-MIB
INET-ADDRESS-MIB
SNMP-FRAMEWORK-MIB
Q-BRIDGE-MIB
CISCO-TC
CISCO-SMI

Objects

171 total
Object Name
ciscoTrustSecPolicyMIBThis MIB module defines managed objects that facilitate the management of various policies within the Cisco Trusted Security (TrustSec) infrastructure. The information available through this MIB includes: o Device and interface level configuration for enabling SGACL (Security Group Access Control List) enforcement on Layer2/3 traffic. o Administrative and operational SGACL mapping to Security Group Tag (SGT). o Various statistics counters for traffic subject to SGACL enforcement. o TrustSec policies with respect to peer device. o Interface level configuration for enabling the propagation of SGT along with the Layer 3 traffic in portions of network which does not have the capability to support TrustSec feature. o TrustSec policies with respect to SGT propagation with Layer 3 traffic. The following terms are used throughout this MIB: VRF: Virtual Routing and Forwarding. SGACL: Security Group Access Control List. ACE: Access Control Entries. SXP: SGT Propagation Protocol. SVI: Switch Virtual Interface. IPM: Identity Port Mapping. SGT (Security Group Tag) is a unique 16 bits value assigned to every security group and used by network devices to enforce SGACL. Peer is another device connected to the local device on the other side of a TrustSec link. Default Policy: Policy applied to traffic when there is no explicit policy between the SGT associated with the originator of the traffic and the SGT associated with the destination of the traffic.
MODULE-IDENTITY
.1.3.6.1.4.1.9.9.713
ciscoTrustSecPolicyMIBNotifs
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.0
ctspPeerPolicyUpdatedNotifA ctspPeerPolicyUpdatedNotif is generated when the SGT value of a peer device has been updated.
NOTIFICATION-TYPE
.1.3.6.1.4.1.9.9.713.0.1
ctspAuthorizationSgaclFailNotifA ctspAuthorizationSgaclFailNotif is generated when the authorization of SGACL fails.
NOTIFICATION-TYPE
.1.3.6.1.4.1.9.9.713.0.2
ciscoTrustSecPolicyMIBObjects
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1
ctspSgacl
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.1
ctspSgaclGlobals
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.1.1
ctspSgaclEnforcementEnableThis object specifies whether SGACL enforcement for all Layer 3 interfaces (excluding SVIs) is enabled at the managed system. 'none' indicates that SGACL enforcement for all Layer 3 interfaces (excluding SVIs) is disabled. 'l3Only' indicates that SGACL enforcement is enabled on every TrustSec capable Layer3 interface (excluding SVIs) in the device.rw
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.1.1
ctspSgaclIpv4DropNetflowMonitorThis object specifies an existing flexible netflow monitor name used to collect and export the IPv4 traffic dropped packets statistics due to SGACL enforcement. The zero-length string indicates that no such netflow monitor is configured in the device.rw
SnmpAdminString (SNMP-FRAMEWORK-MIB)
.1.3.6.1.4.1.9.9.713.1.1.1.2
ctspSgaclIpv6DropNetflowMonitorThis object specifies an existing flexible netflow monitor name used to collect and export the IPv6 traffic dropped packets statistics due to SGACL enforcement. The zero-length string indicates that no such netflow monitor is configured in the device.rw
SnmpAdminString (SNMP-FRAMEWORK-MIB)
.1.3.6.1.4.1.9.9.713.1.1.1.3
ctspVlanConfigTableThis table lists the SGACL enforcement for Layer 2 and Layer 3 switched packet in a VLAN as well as VRF information for VLANs in the device.
SEQUENCE OF CtspVlanConfigEntry
.1.3.6.1.4.1.9.9.713.1.1.1.4
ctspVlanConfigEntryEach row contains the SGACL enforcement information for Layer 2 and Layer 3 switched packets in a VLAN identified by its VlanIndex value. Entry in this table is populated for VLANs which contains SGACL enforcement or VRF configuration.
CtspVlanConfigEntry
.1.3.6.1.4.1.9.9.713.1.1.1.4.1
ctspVlanConfigIndexThis object indicates the VLAN-ID of this VLAN.
VlanIndex (Q-BRIDGE-MIB)
.1.3.6.1.4.1.9.9.713.1.1.1.4.1.1
ctspVlanConfigSgaclEnforcementThis object specifies the configured SGACL enforcement status for this VLAN i.e., 'true' = enabled and 'false' = disabled.rw
TruthValue (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.1.1.4.1.2
ctspVlanSviActiveThis object indicates if there is an active SVI associated with this VLAN. 'true' indicates that there is an active SVI associated with this VLAN. and SGACL is enforced for both Layer 2 and Layer 3 switched packets within that VLAN. 'false' indicates that there is no active SVI associated with this VLAN, and SGACL is only enforced for Layer 2 switched packets within that VLAN.ro
TruthValue (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.1.1.4.1.3
ctspVlanConfigVrfNameThis object specifies an existing VRF where this VLAN belongs to. The zero length value indicates this VLAN belongs to the default VRF.rw
CiscoVrfName (CISCO-TC)
.1.3.6.1.4.1.9.9.713.1.1.1.4.1.4
ctspVlanConfigStorageTypeThe objects specifies the storage type for this conceptual row.rw
StorageType (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.1.1.4.1.5
ctspVlanConfigRowStatusThe status of this conceptual row entry. This object is used to manage creation and deletion of rows in this table. When this object value is 'active', other writable objects in the same row cannot be modified.rw
RowStatus (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.1.1.4.1.6
ctspSgaclMappings
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.1.2
ctspConfigSgaclMappingTableThis table contains the SGACLs information which is applied to unicast IP traffic which carries a source SGT and travels to a destination SGT.
SEQUENCE OF CtspConfigSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.1
ctspConfigSgaclMappingEntryEach row contains the SGACL mapping to source and destination SGT for a certain traffic type as well as status of this instance. A row instance can be created or removed by setting the appropriate value of its RowStatus object.
CtspConfigSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.1.1
ctspConfigSgaclMappingIpTrafficTypeThis object indicates the type of the unicast IP traffic carrying the source SGT and travelling to destination SGT and subjected to SGACL enforcement.
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.2.1.1.1
ctspConfigSgaclMappingDestSgtThis object indicates the destination SGT value. Value of zero indicates that the destination SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.1.1.2
ctspConfigSgaclMappingSourceSgtThis object indicates the source SGT value. Value of zero indicates that the source SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.1.1.3
ctspConfigSgaclMappingSgaclNameThis object specifies the list of existing SGACLs which is administratively configured to apply to unicast IP traffic carrying the source SGT to the destination SGT.rw
CtsAclList (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.1.1.4
ctspConfigSgaclMappingStorageTypeThe storage type for this conceptual row.rw
StorageType (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.1.2.1.1.5
ctspConfigSgaclMappingRowStatusThis object is used to manage the creation and deletion of rows in this table. ctspConfigSgaclName may be modified at any time.rw
RowStatus (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.1.2.1.1.6
ctspConfigSgaclMonitorThis object specifies whether SGACL monitor mode is turned on for the configured SGACL enforced traffic.rw
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.1.1.7
ctspDefConfigIpv4SgaclsThis object specifies the SGACLs of the unicast default policy for IPv4 traffic. If there is no SGACL configured for unicast default policy for IPv4 traffic, the value of this object is the zero-length string.rw
CtsAclListOrEmpty (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.2
ctspDefConfigIpv6SgaclsThis object specifies the SGACLs of the unicast default policy for IPv6 traffic. If there is no SGACL configured for unicast default policy for IPv6 traffic, the value of this object is the zero-length string.rw
CtsAclListOrEmpty (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.3
ctspDownloadedSgaclMappingTableThis table contains the downloaded SGACLs information applied to unicast IP traffic which carries a source SGT and travels to a destination SGT.
SEQUENCE OF CtspDownloadedSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.4
ctspDownloadedSgaclMappingEntryEach row contains the downloaded SGACLs mapping. A row instance is added for each pair of <source SGT, destination SGT> which contains SGACL that is dynamically downloaded from ACS server.
CtspDownloadedSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.4.1
ctspDownloadedSgaclDestSgtThis object indicates the destination SGT value. Value of zero indicates that the destination SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.4.1.1
ctspDownloadedSgaclSourceSgtThis object indicates the source SGT value. Value of zero indicates that the source SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.4.1.2
ctspDownloadedSgaclIndexThis object identifies the downloaded SGACL which is applied to unicast IP traffic carrying the source SGT to the destination SGT.
Unsigned32
.1.3.6.1.4.1.9.9.713.1.1.2.4.1.3
ctspDownloadedSgaclNameThis object indicates the name of downloaded SGACL which is applied to unicast IP traffic carrying the source SGT to the destination SGT.ro
CtsAclName (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.4.1.4
ctspDownloadedSgaclGenIdThis object indicates the generation identification of downloaded SGACL which is applied to unicast IP traffic carrying the source SGT to the destination SGT.ro
CtsGenerationId (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.4.1.5
ctspDownloadedIpTrafficTypeThis object indicates the type of the unicast IP traffic carrying the source SGT and travelling to destination SGT and subjected to SGACL enforcement by this downloaded default policy.ro
Bits
.1.3.6.1.4.1.9.9.713.1.1.2.4.1.6
ctspDownloadedSgaclMonitorThis object indicates whether SGACL monitor mode is turned on for the downloaded SGACL enforced traffic.ro
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.4.1.7
ctspDefDownloadedSgaclMappingTableThis table contains the downloaded SGACLs information of the default policy applied to unicast IP traffic.
SEQUENCE OF CtspDefDownloadedSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.5
ctspDefDownloadedSgaclMappingEntryEach row contains the downloaded SGACLs mapping. A row instance contains the SGACL information of the default policy dynamically downloaded from ACS server for unicast IP traffic.
CtspDefDownloadedSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.5.1
ctspDefDownloadedSgaclIndexThis object identifies the SGACL of downloaded default policy applied to unicast IP traffic.
Unsigned32
.1.3.6.1.4.1.9.9.713.1.1.2.5.1.1
ctspDefDownloadedSgaclNameThis object indicates the name of the SGACL of downloaded default policy applied to unicast IP traffic.ro
CtsAclName (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.5.1.2
ctspDefDownloadedSgaclGenIdThis object indicates the generation identification of the SGACL of downloaded default policy applied to unicast IP traffic.ro
CtsGenerationId (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.5.1.3
ctspDefDownloadedIpTrafficTypeThis object indicates the type of the IP traffic subjected to SGACL enforcement by this downloaded default policy.ro
Bits
.1.3.6.1.4.1.9.9.713.1.1.2.5.1.4
ctspDefDownloadedSgaclMonitorThis object indicates whether SGACL monitor mode is turned on for the default downloaded SGACL enforced traffic.ro
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.5.1.5
ctspOperSgaclMappingTableThis table contains the operational SGACLs information applied to unicast IP traffic which carries a source SGT and travels to a destination SGT.
SEQUENCE OF CtspOperSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.6
ctspOperSgaclMappingEntryEach row contains the operational SGACLs mapping. A row instance is added for each pair of <source SGT, destination SGT> which contains the SGACL that either statically configured at the device or dynamically downloaded from ACS server.
CtspOperSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.6.1
ctspOperIpTrafficTypeThis object indicates the type of the unicast IP traffic carrying the source SGT and travelling to destination SGT and subjected to SGACL enforcement.
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.1
ctspOperSgaclDestSgtThis object indicates the destination SGT value. Value of zero indicates that the destination SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.2
ctspOperSgaclSourceSgtThis object indicates the source SGT value. Value of zero indicates that the source SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.3
ctspOperSgaclIndexThis object identifies the SGACL operationally applied to unicast IP traffic carrying the source SGT to the destination SGT.
Unsigned32
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.4
ctspOperationalSgaclNameThis object indicates the name of the SGACL operationally applied to unicast IP traffic carrying the source SGT to the destination SGT.ro
CtsAclName (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.5
ctspOperationalSgaclGenIdThis object indicates the generation identification of the SGACL operationally applied to unicast IP traffic carrying the source SGT to the destination SGT.ro
CtsGenerationId (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.6
ctspOperSgaclMappingSourceThis object indicates the source of SGACL mapping for the SGACL operationally applied to unicast IP traffic carrying the source SGT to the destination SGT. 'downloaded' indicates that the mapping is downloaded from ACS server. 'configured' indicates that the mapping is locally configured in the device.ro
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.7
ctspOperSgaclConfigSourceThis object indicates the source of SGACL creation for this SGACL. 'configured' indicates that the SGACL is locally configured in the local device. 'downloaded' indicates that the SGACL is created at ACS server and downloaded to the local device.ro
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.8
ctspOperSgaclMonitorThis object indicates whether SGACL monitor mode is turned on for the SGACL enforced traffic.ro
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.6.1.9
ctspDefOperSgaclMappingTableThis table contains the operational SGACLs information of the default policy applied to unicast IP traffic.
SEQUENCE OF CtspDefOperSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.7
ctspDefOperSgaclMappingEntryA row instance contains the SGACL information of the default policy which is either statically configured at the device or dynamically downloaded from ACS server for unicast IP traffic.
CtspDefOperSgaclMappingEntry
.1.3.6.1.4.1.9.9.713.1.1.2.7.1
ctspDefOperIpTrafficTypeThis object indicates the type of the unicast IP traffic subjected to default policy enforcement.
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.2.7.1.1
ctspDefOperSgaclIndexThis object identifies the SGACL of default policy operationally applied to unicast IP traffic.
Unsigned32
.1.3.6.1.4.1.9.9.713.1.1.2.7.1.2
ctspDefOperationalSgaclNameThis object indicates the name of the SGACL of default policy operationally applied to unicast IP traffic.ro
CtsAclName (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.7.1.3
ctspDefOperationalSgaclGenIdThis object indicates the generation identification of the SGACL of default policy operationally applied to unicast IP traffic.ro
CtsGenerationId (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.7.1.4
ctspDefOperSgaclMappingSourceThis object indicates the source of SGACL mapping for the SGACL of default policy operationally applied to unicast IP traffic. 'downloaded' indicates that the mapping is downloaded from ACS server. 'configured' indicates that the mapping is locally configured in the device.ro
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.2.7.1.5
ctspDefOperSgaclConfigSourceThis object indicates the source of SGACL creation for the SGACL of default policy operationally applied to unicast IP traffic. 'downloaded' indicates that the SGACL is created at ACS server and downloaded to the local device. 'configured' indicates that the SGACL is locally configured in the local device.ro
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.2.7.1.6
ctspDefOperSgaclMonitorThis object indicates whether SGACL monitor mode is turned on for the SGACL of default policy enforced traffic.ro
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.7.1.7
ctspDefConfigIpv4SgaclsMonitorThis object specifies whether SGACL monitor mode is turned on for the default configured SGACL enforced Ipv4 traffic.rw
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.8
ctspDefConfigIpv6SgaclsMonitorThis object specifies whether SGACL monitor mode is turned on for the default configured SGACL enforced Ipv6 traffic.rw
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.9
ctspSgaclMonitorEnableThis object specifies whether SGACL monitor mode is turned on for the entire system. It has precedence than the per SGACL ctspConfigSgaclMonitor control. It could act as safety mechanism to turn off monitor in case the monitor feature impact system performance.rw
CtsSgaclMonitorMode (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.2.10
ctspSgaclStatistics
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.1.3
ctspSgtStatsTableThis table describes SGACL statistics counters per a pair of <source SGT, destination SGT> that is capable of providing this information.
SEQUENCE OF CtspSgtStatsEntry
.1.3.6.1.4.1.9.9.713.1.1.3.1
ctspSgtStatsEntryEach row contains the SGACL statistics related to IPv4 or IPv6 packets carrying the source SGT travelling to the destination SGT and subjected to SGACL enforcement.
CtspSgtStatsEntry
.1.3.6.1.4.1.9.9.713.1.1.3.1.1
ctspStatsIpTrafficTypeThis object indicates the type of the unicast IP traffic carrying the source SGT and travelling to destination SGT and subjected to SGACL enforcement.
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.1
ctspStatsDestSgtThis object indicates the destination SGT value. Value of zero indicates that the destination SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.2
ctspStatsSourceSgtThis object indicates the source SGT value. Value of zero indicates that the source SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.3
ctspStatsIpSwDropPktsThis object indicates the number of software-forwarded IP packets which are dropped by SGACL.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.4
ctspStatsIpHwDropPktsThis object indicates the number of hardware-forwarded IP packets which are dropped by SGACL.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.5
ctspStatsIpSwPermitPktsThis object indicates the number of software-forwarded IP packets which are permitted by SGACL.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.6
ctspStatsIpHwPermitPktsThis object indicates the number of hardware-forwarded IP packets which are permitted by SGACL.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.7
ctspStatsIpSwMonitorPktsThis object indicates the number of software-forwarded IP packets which are SGACL enforced & monitored.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.8
ctspStatsIpHwMonitorPktsThis object indicates the number of hardware-forwarded IP packets which are SGACL enforced & monitored.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.1.1.9
ctspDefStatsTableThis table describes statistics counters for unicast IP traffic subjected to default unicast policy.
SEQUENCE OF CtspDefStatsEntry
.1.3.6.1.4.1.9.9.713.1.1.3.2
ctspDefStatsEntryEach row contains the statistics counter for each IP traffic type.
CtspDefStatsEntry
.1.3.6.1.4.1.9.9.713.1.1.3.2.1
ctspDefIpTrafficTypeThis object indicates the type of the IP traffic subjected to default unicast policy enforcement.
Enumeration
.1.3.6.1.4.1.9.9.713.1.1.3.2.1.1
ctspDefIpSwDropPktsThis object indicates the number of software-forwarded IP packets which are dropped by default unicast policy.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.2.1.2
ctspDefIpHwDropPktsThis object indicates the number of hardware-forwarded IP packets which are dropped by default unicast policy.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.2.1.3
ctspDefIpSwPermitPktsThis object indicates the number of software-forwarded IP packets which are permitted by default unicast policy.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.2.1.4
ctspDefIpHwPermitPktsThis object indicates the number of hardware-forwarded IP packets which are permitted by default unicast policy.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.2.1.5
ctspDefIpSwMonitorPktsThis object indicates the number of software-forwarded IP packets which are monitored by default unicast policy.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.2.1.6
ctspDefIpHwMonitorPktsThis object indicates the number of hardware-forwarded IP packets which are monitored by default unicast policy.ro
Counter64
.1.3.6.1.4.1.9.9.713.1.1.3.2.1.7
ctspPeerPolicy
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.2
ctspAllPeerPolicyActionThis object allows user to specify the action to be taken with respect to all peer policies in the device. When read, this object always returns the value 'none'. 'none' - No operation. 'refresh' - Refresh all peer policies in the device.rw
Enumeration
.1.3.6.1.4.1.9.9.713.1.2.1
ctspPeerPolicyTableThis table lists the peer policy information for each peer device.
SEQUENCE OF CtspPeerPolicyEntry
.1.3.6.1.4.1.9.9.713.1.2.2
ctspPeerPolicyEntryEach row contains the managed objects for peer policies for each peer device based on its name.
CtspPeerPolicyEntry
.1.3.6.1.4.1.9.9.713.1.2.2.1
ctspPeerNameThis object uniquely identifies a peer device.
SnmpAdminString
.1.3.6.1.4.1.9.9.713.1.2.2.1.1
ctspPeerSgtThis object indicates the SGT value of this peer device.ro
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.2.2.1.2
ctspPeerSgtGenIdThis object indicates the generation identification of the SGT value assigned to this peer device.ro
CtsGenerationId (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.2.2.1.3
ctspPeerTrustStateThis object indicates the TrustSec trust state of this peer device. 'trusted' indicates that this is a trusted peer device. 'noTrust' indicates that this peer device is not trusted.ro
Enumeration
.1.3.6.1.4.1.9.9.713.1.2.2.1.4
ctspPeerPolicyLifeTimeThis object indicates the policy life time which provides the time interval during which the peer policy is valid.ro
Unsigned32 UNITS "seconds"
.1.3.6.1.4.1.9.9.713.1.2.2.1.5
ctspPeerPolicyLastUpdateThis object indicates the time when this peer policy is last updated.ro
DateAndTime (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.2.2.1.6
ctspPeerPolicyActionThis object allows user to specify the action to be taken with this peer policy. When read, this object always returns the value 'none'. 'none' - No operation. 'refresh' - Refresh this peer policy.rw
Enumeration
.1.3.6.1.4.1.9.9.713.1.2.2.1.7
ctspLayer3Transport
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.3
ctspLayer3PolicyTableThis table describes Layer 3 transport policy for IP traffic regarding SGT propagation.
SEQUENCE OF CtspLayer3PolicyEntry
.1.3.6.1.4.1.9.9.713.1.3.1
ctspLayer3PolicyEntryEach row contains the Layer 3 transport policies per IP traffic type per policy type.
CtspLayer3PolicyEntry
.1.3.6.1.4.1.9.9.713.1.3.1.1
ctspLayer3PolicyIpTrafficTypeThis object indicates the type of the IP traffic affected by Layer-3 transport policy. 'ipv4' indicates that the affected traffic is IPv4 traffic. 'ipv6' indicates that the affected traffic is IPv6 traffic.
Enumeration
.1.3.6.1.4.1.9.9.713.1.3.1.1.1
ctspLayer3PolicyTypeThis object indicates the type of the Layer-3 transport policy affecting IP traffic regarding SGT propagation. 'permit' indicates that the transport policy is used to classify Layer-3 traffic which is subject to SGT propagation. 'exception' indicates that the transport policy is used to classify Layer-3 traffic which is NOT subject to SGT propagation.
Enumeration
.1.3.6.1.4.1.9.9.713.1.3.1.1.2
ctspLayer3PolicyLocalConfigThis object specifies the name of an ACL that is administratively configured to classify Layer3 traffic. Zero-length string indicates there is no such configured policy.rw
CtsAclNameOrEmpty (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.3.1.1.3
ctspLayer3PolicyDownloadedThis object specifies the name of an ACL that is downloaded from policy server to classify Layer3 traffic. Zero-length string indicates there is no such downloaded policy.ro
CtsAclNameOrEmpty (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.3.1.1.4
ctspLayer3PolicyOperationalThis object specifies the name of an operational ACL currently used to classify Layer3 traffic. Zero-length string indicates there is no such policy in effect.ro
CtsAclNameOrEmpty (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.3.1.1.5
ctspIfL3PolicyConfigTableThis table lists the interfaces which support Layer3 Transport policy.
SEQUENCE OF CtspIfL3PolicyConfigEntry
.1.3.6.1.4.1.9.9.713.1.3.2
ctspIfL3PolicyConfigEntryEach row contains managed objects for Layer3 Transport on interface capable of providing this information.
CtspIfL3PolicyConfigEntry
.1.3.6.1.4.1.9.9.713.1.3.2.1
ctspIfL3Ipv4PolicyEnabledThis object specifies whether the Layer3 Transport policies will be applied on this interface for egress IPv4 traffic. 'true' indicates that Layer3 permit and exception policy will be applied at this interface for egress IPv4 traffic. 'false' indicates that Layer3 permit and exception policy will not be applied at this interface for egress IPv4 traffic.rw
TruthValue (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.3.2.1.1
ctspIfL3Ipv6PolicyEnabledThis object specifies whether the Layer3 Transport policies will be applied on this interface for egress IPv6 traffic. 'true' indicates that Layer3 permit and exception policy will be applied at this interface for egress IPv6 traffic. 'false' indicates that Layer3 permit and exception policy will not be applied at this interface for egress IPv6 traffic.rw
TruthValue (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.3.2.1.2
ctspIpSgtMappings
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.4
ctspIpSgtMappingTableThis table contains the IP-to-SGT mapping information in the device.
SEQUENCE OF CtspIpSgtMappingEntry
.1.3.6.1.4.1.9.9.713.1.4.1
ctspIpSgtMappingEntryEach row contains the IP-to-SGT mapping and status of this instance. Entry in this table is either populated automatically by the device or manually configured by a user. A manually configured row instance can be created or removed by setting the appropriate value of its RowStatus object.
CtspIpSgtMappingEntry
.1.3.6.1.4.1.9.9.713.1.4.1.1
ctspIpSgtVrfNameThis object indicates the VRF where IP-SGT mapping belongs to. The zero length value indicates the default VRF.
CiscoVrfName (CISCO-TC)
.1.3.6.1.4.1.9.9.713.1.4.1.1.1
ctspIpSgtAddressTypeThis object indicates the type of Internet address.
InetAddressType (INET-ADDRESS-MIB)
.1.3.6.1.4.1.9.9.713.1.4.1.1.2
ctspIpSgtIpAddressThis object indicates an Internet address. The type of this address is determined by the value of ctspIpSgtAddressType object.
InetAddress (INET-ADDRESS-MIB)
.1.3.6.1.4.1.9.9.713.1.4.1.1.3
ctspIpSgtAddressLengthThis object indicates the length of an Internet address prefix.
InetAddressPrefixLength (INET-ADDRESS-MIB)
.1.3.6.1.4.1.9.9.713.1.4.1.1.4
ctspIpSgtValueThis object specifies the SGT value assigned to an Internet address.rw
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.4.1.1.5
ctspIpSgtSourceThis object indicates the source of the mapping. 'configured' indicates that the mapping is manually configured by user. 'arp' indicates that the mapping is dynamically learnt from tagged ARP replies. 'localAuthenticated' indicates that the mapping is dynamically learnt from the device authentication of a host. 'sxp' indicates that the mapping is dynamically learnt from SXP (SGT Propagation Protocol). 'internal' indicates that the mapping is automatically created by the device between the device IP addresses and the device own SGT. 'l3if' indicates that Interface-SGT mapping is configured by user. 'vlan' indicates that Vlan-SGT mapping is configured by user. 'cached' indicates that sgt mapping is cached. Only 'configured' value is accepted when setting this object.rw
Enumeration
.1.3.6.1.4.1.9.9.713.1.4.1.1.6
ctspIpSgtStorageTypeThe storage type for this conceptual row.rw
StorageType (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.4.1.1.7
ctspIpSgtRowStatusThis object is used to manage the creation and deletion of rows in this table. If this object value is 'active', user cannot modify any writable object in this row. If value of ctspIpSgtSource object in an entry is not 'configured', user cannot change the value of this object.rw
RowStatus (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.4.1.1.8
ctspSgtPolicy
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.5
ctspAllSgtPolicyActionThis object allows user to specify the action to be taken with respect to all SGT policies in the device. When read, this object always returns the value 'none'. 'none' - No operation. 'refresh' - Refresh all SGT policies in the device.rw
Enumeration
.1.3.6.1.4.1.9.9.713.1.5.1
ctspDownloadedSgtPolicyTableThis table lists the SGT policy information downloaded by the device.
SEQUENCE OF CtspDownloadedSgtPolicyEntry
.1.3.6.1.4.1.9.9.713.1.5.2
ctspDownloadedSgtPolicyEntryEach row contains the managed objects for SGT policies downloaded by the device.
CtspDownloadedSgtPolicyEntry
.1.3.6.1.4.1.9.9.713.1.5.2.1
ctspDownloadedSgtPolicySgtThis object indicates the SGT value for which the downloaded policy is applied to. Value of zero indicates that the SGT is unknown.
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.5.2.1.1
ctspDownloadedSgtPolicySgtGenIdThis object indicates the generation identification of the SGT value denoted by ctspDownloadedSgtPolicySgt object.ro
CtsGenerationId (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.5.2.1.2
ctspDownloadedSgtPolicyLifeTimeThis object indicates the policy life time which provides the time interval during which this downloaded policy is valid.ro
Unsigned32 UNITS "seconds"
.1.3.6.1.4.1.9.9.713.1.5.2.1.3
ctspDownloadedSgtPolicyLastUpdateThis object indicates the time when this downloaded SGT policy is last updated.ro
DateAndTime (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.5.2.1.4
ctspDownloadedSgtPolicyActionThis object allows user to specify the action to be taken with this downloaded SGT policy. When read, this object always returns the value 'none'. 'none' - No operation. 'refresh' - Refresh this SGT policy.rw
Enumeration
.1.3.6.1.4.1.9.9.713.1.5.2.1.5
ctspDownloadedDefSgtPolicyTableThis table lists the default SGT policy information downloaded by the device.
SEQUENCE OF CtspDownloadedDefSgtPolicyEntry
.1.3.6.1.4.1.9.9.713.1.5.3
ctspDownloadedDefSgtPolicyEntryEach row contains the managed objects for default SGT policies downloaded by the device.
CtspDownloadedDefSgtPolicyEntry
.1.3.6.1.4.1.9.9.713.1.5.3.1
ctspDownloadedDefSgtPolicyTypeThis object indicates the downloaded default SGT policy type. 'unicastDefault' indicates the SGT policy applied to traffic which carries the default unicast SGT.
Enumeration
.1.3.6.1.4.1.9.9.713.1.5.3.1.1
ctspDownloadedDefSgtPolicySgtGenIdThis object indicates the generation identification of the downloaded default SGT policy.ro
CtsGenerationId (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.5.3.1.2
ctspDownloadedDefSgtPolicyLifeTimeThis object indicates the policy life time which provides the time interval during which this download default policy is valid.ro
Unsigned32 UNITS "seconds"
.1.3.6.1.4.1.9.9.713.1.5.3.1.3
ctspDownloadedDefSgtPolicyLastUpdateThis object indicates the time when this downloaded SGT policy is last updated.ro
DateAndTime (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.5.3.1.4
ctspDownloadedDefSgtPolicyActionThis object allows user to specify the action to be taken with this default downloaded SGT policy. When read, this object always returns the value 'none'. 'none' - No operation. 'refresh' - Refresh this default SGT policy.rw
Enumeration
.1.3.6.1.4.1.9.9.713.1.5.3.1.5
ctspIfSgtMappings
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.6
ctspIfSgtMappingTableThis table contains the Interface-to-SGT mapping configuration information in the device.
SEQUENCE OF CtspIfSgtMappingEntry
.1.3.6.1.4.1.9.9.713.1.6.1
ctspIfSgtMappingEntryEach row contains the SGT mapping configuration of a particular interface. A row instance can be created or removed by setting ctspIfSgtRowStatus.
CtspIfSgtMappingEntry
.1.3.6.1.4.1.9.9.713.1.6.1.1
ctspIfSgtValueThis object specifies the SGT value assigned to the interface.rw
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.6.1.1.1
ctspIfSgNameThis object specifies the Security Group Name assigned to the interface.rw
SnmpAdminString (SNMP-FRAMEWORK-MIB)
.1.3.6.1.4.1.9.9.713.1.6.1.1.2
ctspIfSgtStorageTypeThe storage type for this conceptual row.rw
StorageType (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.6.1.1.3
ctspIfSgtRowStatusThis object is used to manage the creation and deletion of rows in this table.rw
RowStatus (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.6.1.1.4
ctspIfSgtMappingInfoTableThis table contains the Interface-to-SGT mapping status information in the device.
SEQUENCE OF CtspIfSgtMappingInfoEntry
.1.3.6.1.4.1.9.9.713.1.6.2
ctspIfSgtMappingInfoEntryContaining the Interface-to-SGT mapping status of the specified interface.
CtspIfSgtMappingInfoEntry
.1.3.6.1.4.1.9.9.713.1.6.2.1
ctspL3IPMStatusThis object indicates the Layer 3 Identity Port Mapping(IPM) operational mode. disabled - The L3 IPM is not configured. active - The L3 IPM is configured for this interface, and SGT is available. inactive - The L3 IPM is configured for this interface, and SGT is unavailable.ro
Enumeration
.1.3.6.1.4.1.9.9.713.1.6.2.1.1
ctspVlanSgtMappings
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.7
ctspVlanSgtMappingTableThis table contains the Vlan-SGT mapping information in the device.
SEQUENCE OF CtspVlanSgtMappingEntry
.1.3.6.1.4.1.9.9.713.1.7.1
ctspVlanSgtMappingEntryEach row contains the SGT mapping configuration of a particular VLAN. A row instance can be created or removed by setting ctspVlanSgtRowStatus.
CtspVlanSgtMappingEntry
.1.3.6.1.4.1.9.9.713.1.7.1.1
ctspVlanSgtMappingIndexThis object specifies the VLAN-ID which is used as index.
VlanIndex (Q-BRIDGE-MIB)
.1.3.6.1.4.1.9.9.713.1.7.1.1.1
ctspVlanSgtMapValueThis object specifies the SGT value assigned to the vlan.rw
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.7.1.1.2
ctspVlanSgtStorageTypeThe storage type for this conceptual row.rw
StorageType (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.7.1.1.3
ctspVlanSgtRowStatusThis object is used to manage the creation and deletion of rows in this table.rw
RowStatus (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.7.1.1.4
ctspSgtCaching
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.8
ctspSgtCachingModeThis object specifies which SGT-caching mode is configured for SGT caching capable interfaces at the managed system. 'none' indicates that sgt-caching for all Layer 3 interfaces (excluding SVIs) is disabled. 'standAlone' indicates that SGT-caching is enabled on every TrustSec capable Layer3 interface (excluding SVIs) in the device. 'withEnforcement' indicates that SGT-caching is enabled on interfaces that have RBAC enforcement enabled. 'vlan' indicates that SGT-caching is enabled on the VLANs specified by ctspSgtCachingVlansfFirst2K & ctspSgtCachingVlansSecond2Krw
Enumeration
.1.3.6.1.4.1.9.9.713.1.8.1
ctspSgtCachingVlansFirst2KA string of octets containing one bit per VLAN for VLANs 0 to 2047. If the bit corresponding to a VLAN is set to 1, it indicates SGT-caching is enabled on the VLAN. If the bit corresponding to a VLAN is set to 0, it indicates SGT-caching is disabled on the VLAN.rw
Cisco2KVlanList (CISCO-TC)
.1.3.6.1.4.1.9.9.713.1.8.2
ctspSgtCachingVlansSecond2KA string of octets containing one bit per VLAN for VLANs 2048 to 4095. If the bit corresponding to a VLAN is set to 1, it indicates SGT-caching is enabled on the VLAN. If the bit corresponding to a VLAN is set to 0, it indicates SGT-caching is disabled on the VLAN.rw
Cisco2KVlanList (CISCO-TC)
.1.3.6.1.4.1.9.9.713.1.8.3
ctspNotifsControl
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.9
ctspPeerPolicyUpdatedNotifEnableThis object specifies whether the system generates ctspPeerPolicyUpdatedNotif. A value of 'false' will prevent ctspPeerPolicyUpdatedNotif notifications from being generated by this system.rw
TruthValue (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.9.1
ctspAuthorizationSgaclFailNotifEnableThis object specifies whether this system generates the ctspAuthorizationSgaclFailNotif. A value of 'false' will prevent ctspAuthorizationSgaclFailNotif notifications from being generated by this system.rw
TruthValue (SNMPv2-TC)
.1.3.6.1.4.1.9.9.713.1.9.2
ctspNotifsOnlyInfo
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.1.10
ctspOldPeerSgtThis object provides the old sgt value for ctspPeerPolicyUpdatedNotif, i.e., the sgt value before the policy is updated.ro
CtsSecurityGroupTag (CISCO-TRUSTSEC-TC-MIB)
.1.3.6.1.4.1.9.9.713.1.10.1
ctspAuthorizationSgaclFailReasonThis object indicates the reason of failure during SGACL acquisitions, installations and uninstallations, which is associated with ctspAuthorizationSgaclFailNotif; 'downloadACE' - Failure during downloading ACE in SGACL acquisition. 'downloadSrc' - Failure during downloading source list in SGACL acquisition. 'downloadDst' - Failure during downloading destination list in SGACL acquisition. 'installPolicy' - Failure during SGACL policy installation 'installPolicyStandby' - Failure during SGACL policy installation on standby 'installForIP' - Failure during SGACL installation for specific IP type. 'uninstall' - Failure during SGACL uninstallation.ro
Enumeration
.1.3.6.1.4.1.9.9.713.1.10.2
ctspAuthorizationSgaclFailInfoThis object provides additional information about authorization SGACL failure, which is associated with ctspAuthorizationSgaclFailNotif.ro
SnmpAdminString (SNMP-FRAMEWORK-MIB)
.1.3.6.1.4.1.9.9.713.1.10.3
ciscoTrustSecPolicyMIBConformance
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.2
ciscoTrustSecPolicyMIBCompliances
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.2.1
ciscoTrustSecPolicyMIBGroups
OBJECT IDENTIFIER
.1.3.6.1.4.1.9.9.713.2.2
CISCO-TRUSTSEC-POLICY-MIB - SNMP MIB Reference | MIBs Explorer