IPSEC-SA-MON-MIB
AI MIB Summary
The IPSEC-SA-MON-MIB enables monitoring of IPsec Security Association states, including tunnel establishment, cryptographic algorithm usage, and packet/byte counters, alongside entity-level events and status for IPsec implementations. This module provides the necessary SNMP objects to track the operational health and traffic volume of IPsec tunnels across network devices supporting the IPsec protocol suite.
The MIB module to describe generic IPsec objects, and entity level objects and events for those types.
Main OID:
ipsecSaMonModule.1.3.6.1.3.98
188
Objects
Active
Status
5
Dependencies
Imported Objects
Objects
188 total| Object Name |
|---|
ipsecSaMonModuleThe MIB module to describe generic IPsec objects, and
entity level objects and events for those types. MODULE-IDENTITY .1.3.6.1.3.98 |
ipsecSaMonitorMIBThis is the base object identifier for all IPsec branches. OBJECT IDENTIFIER .1.3.6.1.3.98.1 |
saTablesThis is the base object identifier for all SA tables. OBJECT IDENTIFIER .1.3.6.1.3.98.1.1 |
ipsecSaEspInTableThe (conceptual) table containing information on IPsec
inbound ESP SAs.
There should be one row for every inbound ESP security
association that exists in the entity. The maximum number of
rows is implementation dependent. SEQUENCE OF IpsecSaEspInEntry .1.3.6.1.3.98.1.1.1 |
ipsecSaEspInEntryAn entry (conceptual row) containing the information on a
particular IPsec inbound ESP SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table. IpsecSaEspInEntry .1.3.6.1.3.98.1.1.1.1 |
ipsecSaEspInAddressThe destination address of the SA.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.1.1.1.1 |
ipsecSaEspInSpiThe security parameters index of the SA.ro Unsigned32 .1.3.6.1.3.98.1.1.1.1.2 |
ipsecSaEspInDestIdThe destination identifier of the SA. It may be 0 if
unknown or if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during SA creation negotiation.ro IpsecRawId .1.3.6.1.3.98.1.1.1.1.3 |
ipsecSaEspInDestIdTypeThe type of identifier presented by 'ipsecSaEspInDestId'.
It may be 0 if unknown or if the SA uses transport mode
encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.1.1.4 |
ipsecSaEspInSourceIdThe source identifier of the SA. It may be 0 if unknown or
if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during SA creation negotiation.ro IpsecRawId .1.3.6.1.3.98.1.1.1.1.5 |
ipsecSaEspInSourceIdTypeThe type of identifier presented by 'ipsecSaEspInSourceId'.
It may be 0 if unknown or if the SA uses transport mode
encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.1.1.6 |
ipsecSaEspInProtocolThe transport-layer protocol number that this SA carries,
or 0 if it carries any protocol.ro Integer32 .1.3.6.1.3.98.1.1.1.1.7 |
ipsecSaEspInDestPortThe destination port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.1.1.8 |
ipsecSaEspInSourcePortThe source port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.1.1.9 |
ipsecSaEspInCreatorThe creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method.ro IpsecSaCreatorIdent .1.3.6.1.3.98.1.1.1.1.10 |
ipsecSaEspInEncapsulationThe type of encapsulation used by this SA.ro IpsecDoiEncapsulationMode (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.1.1.11 |
ipsecSaEspInEncAlgA unique value representing the encryption algorithm
applied to traffic or 0 if there is no encryption used.ro IpsecDoiEspTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.1.1.12 |
ipsecSaEspInEncKeyLengthThe length of the encryption key in bits used for the
algorithm specified in the 'ipsecSaEspInEncAlg' object. It
may be 0 if the key length is implicit in the specified
algorithm or there is no encryption specified.ro Unsigned32 .1.3.6.1.3.98.1.1.1.1.13 |
ipsecSaEspInAuthAlgA unique value representing the hash algorithm applied to
traffic or 0 if there is no authentication used.ro IpsecDoiAuthAlgorithm (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.1.1.14 |
ipsecSaEspInAuthKeyLengthThe length of the authentication key in bits used for the
algorithm specified in the 'ipsecSaEspInAuthAlg'. It may be
0 if the key length is implicit in the specified algorithm
or there is no authentication specified.ro Unsigned32 .1.3.6.1.3.98.1.1.1.1.15 |
ipsecSaEspInRepWinSizeThe size of the anti-replay window used by this SA, or 0 if
anti-replay checking is not being done.ro Unsigned32 .1.3.6.1.3.98.1.1.1.1.16 |
ipsecSaEspInLimitSecondsThe maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated.ro Unsigned32 UNITS "seconds" .1.3.6.1.3.98.1.1.1.1.17 |
ipsecSaEspInLimitKbytesThe maximum traffic in kilobytes that the SA is allowed to
process, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated.ro Unsigned32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.1.1.18 |
ipsecSaEspInAccSecondsThe number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed.ro Counter32 UNITS "seconds" .1.3.6.1.3.98.1.1.1.1.19 |
ipsecSaEspInAccKbytesThe amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in
kilobytes.
This value may be 0 if the SA does not expire based on
traffic.ro Counter32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.1.1.20 |
ipsecSaEspInUserOctetsThe amount of user level traffic measured in bytes handled
by the SA. This is the number of bytes of the decrypted IP
packet, including the original IP header of that decrypted
packet.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit due to padding
or other protocol specific overhead.ro Counter64 UNITS "bytes" .1.3.6.1.3.98.1.1.1.1.21 |
ipsecSaEspInPacketsThe number of packets handled by the SA.ro Counter64 .1.3.6.1.3.98.1.1.1.1.22 |
ipsecSaEspInDecryptErrorsThe number of packets discarded by the SA due to detectable
decryption errors. Not all decryption errors are detectable
within SA processing, so this count should not be considered
definitive.ro Counter32 .1.3.6.1.3.98.1.1.1.1.23 |
ipsecSaEspInAuthErrorsThe number of packets discarded by the SA due to
authentication errors.ro Counter32 .1.3.6.1.3.98.1.1.1.1.24 |
ipsecSaEspInReplayErrorsThe number of packets discarded by the SA due to replay
errors.ro Counter32 .1.3.6.1.3.98.1.1.1.1.25 |
ipsecSaEspInPolicyErrorsThe number of packets discarded by the SA due to policy
errors. This includes packets where the next protocol is
invalid.ro Counter32 .1.3.6.1.3.98.1.1.1.1.26 |
ipsecSaEspInPadErrorsThe number of packets discarded by the SA due to pad value
errors.
Implementations that do not check this must not support this
object.ro Counter32 .1.3.6.1.3.98.1.1.1.1.27 |
ipsecSaEspInOtherReceiveErrorsThe number of packets discarded by the SA due to errors
other than decryption, authentication, replay errors or,
when supported, invalid padding errors. This may include
packets dropped due to a lack of receive buffers, and may
include packets dropped due to congestion at the decryption
element.ro Counter32 .1.3.6.1.3.98.1.1.1.1.28 |
ipsecSaAhInTableThe (conceptual) table containing information on IPsec
inbound AH SAs.
There should be one row for every inbound AH security
association that exists in the entity. The maximum number of
rows is implementation dependent. SEQUENCE OF IpsecSaAhInEntry .1.3.6.1.3.98.1.1.2 |
ipsecSaAhInEntryAn entry (conceptual row) containing the information on a
particular IPsec inbound AH SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table. IpsecSaAhInEntry .1.3.6.1.3.98.1.1.2.1 |
ipsecSaAhInAddressThe destination address of the SA.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.1.2.1.1 |
ipsecSaAhInSpiThe security parameters index of the SA.ro Unsigned32 .1.3.6.1.3.98.1.1.2.1.2 |
ipsecSaAhInDestIdThe destination identifier of the SA. It may be 0 if
unknown or if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during SA creation negotiation, or the
equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.2.1.3 |
ipsecSaAhInDestIdTypeThe type of identifier presented by 'ipsecSaAhInDestId'. It
may be 0 if unknown or if the SA uses transport mode
encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.2.1.4 |
ipsecSaAhInSourceIdThe source identifier of the SA. It may be 0 if unknown or
if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during SA creation negotiation or the
equivelant process.ro IpsecRawId .1.3.6.1.3.98.1.1.2.1.5 |
ipsecSaAhInSourceIdTypeThe type of identifier presented by 'ipsecSaAhInSourceId'.
It may be 0 if unknown or if the SA uses transport mode
encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.2.1.6 |
ipsecSaAhInProtocolThe transport-layer protocol number that this SA carries,
or 0 if it carries any protocol.ro Integer32 .1.3.6.1.3.98.1.1.2.1.7 |
ipsecSaAhInDestPortThe destination port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.2.1.8 |
ipsecSaAhInSourcePortThe source port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.2.1.9 |
ipsecSaAhInCreatorThe creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method.ro IpsecSaCreatorIdent .1.3.6.1.3.98.1.1.2.1.10 |
ipsecSaAhInEncapsulationThe type of encapsulation used by this SA.ro IpsecDoiEncapsulationMode (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.2.1.11 |
ipsecSaAhInAuthAlgA unique value representing the hash algorithm applied to
traffic carried by this SA.ro IpsecDoiAhTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.2.1.12 |
ipsecSaAhInAuthKeyLengthThe length of the authentication key in bits used for the
algorithm specified in the 'ipsecSaAhInAuthAlg' object. It
may be 0 if the key length is implicit in the specified
algorithm.ro Unsigned32 .1.3.6.1.3.98.1.1.2.1.13 |
ipsecSaAhInRepWinSizeThe size of the anti-replay window used by this SA, or 0 if
anti-replay checking is not being done.ro Unsigned32 .1.3.6.1.3.98.1.1.2.1.14 |
ipsecSaAhInLimitSecondsThe maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated.ro Unsigned32 UNITS "seconds" .1.3.6.1.3.98.1.1.2.1.15 |
ipsecSaAhInLimitKbytesThe maximum traffic in bytes that the SA is allowed to
process, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated.ro Unsigned32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.2.1.16 |
ipsecSaAhInAccSecondsThe number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed.ro Counter32 UNITS "seconds" .1.3.6.1.3.98.1.1.2.1.17 |
ipsecSaAhInAccKbytesThe amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in
kilobytes.
This value may be 0 if the SA does not expire based on
traffic.ro Counter32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.2.1.18 |
ipsecSaAhInUserOctetsThe amount of user level traffic measured in bytes handled
by the SA. This is the number of bytes of the de-processed
IP packet, including the original IP header of that de-
processed packet.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit due to padding
or other protocol specific overhead.ro Counter64 UNITS "bytes" .1.3.6.1.3.98.1.1.2.1.19 |
ipsecSaAhInPacketsThe number of packets handled by the SA.ro Counter64 .1.3.6.1.3.98.1.1.2.1.20 |
ipsecSaAhInAuthErrorsThe number of packets discarded by the SA due to
authentication errors.ro Counter32 .1.3.6.1.3.98.1.1.2.1.21 |
ipsecSaAhInReplayErrorsThe number of packets discarded by the SA due to replay
errors.ro Counter32 .1.3.6.1.3.98.1.1.2.1.22 |
ipsecSaAhInPolicyErrorsThe number of packets discarded by the SA due to policy
errors. This includes packets where the next protocol is
invalid.ro Counter32 .1.3.6.1.3.98.1.1.2.1.23 |
ipsecSaAhInOtherReceiveErrorsThe number of packets discarded by the SA due to errors
other than decryption, authentication or replay errors. This
may include packets dropped due to a lack of receive
buffers, and may include packets dropped due to congestion
at the authentication element.ro Counter32 .1.3.6.1.3.98.1.1.2.1.24 |
ipsecSaIpcompInTableThe (conceptual) table containing information on IPsec
inbound IPcomp SAs.
There should be one row for every inbound IPcomp (security)
association that exists in the entity. The maximum number of
rows is implementation dependent. SEQUENCE OF IpsecSaIpcompInEntry .1.3.6.1.3.98.1.1.3 |
ipsecSaIpcompInEntryAn entry (conceptual row) containing the information on a
particular IPsec inbound IPcomp SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table. IpsecSaIpcompInEntry .1.3.6.1.3.98.1.1.3.1 |
ipsecSaIpcompInAddressThe destination address of the SA.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.1.3.1.1 |
ipsecSaIpcompInCpiThe CPI of the SA. Since the lower values of CPIs are
reserved to be the same as the algorithm, the syntax for
this object is the same as the transform.ro IpsecDoiIpcompTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.3.1.2 |
ipsecSaIpcompInDestIdThe destination identifier of the SA. It may be 0 if
unknown or if the SA uses transport mode, or 0 if this SA is
used with multiple SAs in security association suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchanged during SA creation
negotiation, or the equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.3.1.3 |
ipsecSaIpcompInDestIdTypeThe type of identifier presented by
'ipsecSaIpcompInDestId'. It may be 0 if unknown or if the SA
uses transport mode, or if this SA is used with multiple SAs
in security association suites.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.3.1.4 |
ipsecSaIpcompInSourceIdThe source identifier of the SA. It may be 0 if unknown or
if the SA uses transport mode encapsulation, or 0 if this SA
is used with multiple SAs in security association suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchanged during SA creation
negotiation, or the equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.3.1.5 |
ipsecSaIpcompInSourceIdTypeThe type of identifier presented by
'ipsecSaIpcompInSourceId'. It may be 0 if unknown or if the
SA uses transport mode encapsulation, or if this SA is used
with multiple SAs in security association suites.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.3.1.6 |
ipsecSaIpcompInProtocolThe transport-layer protocol number that this SA carries,
or 0 if it carries any protocol.ro Integer32 .1.3.6.1.3.98.1.1.3.1.7 |
ipsecSaIpcompInDestPortThe destination port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.3.1.8 |
ipsecSaIpcompInSourcePortThe source port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.3.1.9 |
ipsecSaIpcompInCreatorThe creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method.ro IpsecSaCreatorIdent .1.3.6.1.3.98.1.1.3.1.10 |
ipsecSaIpcompInEncapsulationThe type of encapsulation used by this SA.ro IpsecDoiEncapsulationMode (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.3.1.11 |
ipsecSaIpcompInDecompAlgA unique value representing the decompression algorithm
applied to traffic.ro IpsecDoiIpcompTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.3.1.12 |
ipsecSaIpcompInSecondsThe number of seconds that the SA has existed.ro Counter32 UNITS "seconds" .1.3.6.1.3.98.1.1.3.1.13 |
ipsecSaIpcompInUserOctetsThe amount of user level traffic measured in bytes handled
by the SA. This is the number of bytes of the uncompressed
IP packet, including the original IP header of that
uncompressed packet.
Packets which are not decompressed by the SA are not counted
in this total.ro Counter64 UNITS "bytes" .1.3.6.1.3.98.1.1.3.1.14 |
ipsecSaIpcompInPacketsThe number of packets handled by the SA.ro Counter64 .1.3.6.1.3.98.1.1.3.1.15 |
ipsecSaIpcompInDecompErrorsThe number of packets discarded by the SA due to
decompression errors.ro Counter32 .1.3.6.1.3.98.1.1.3.1.16 |
ipsecSaIpcompInOtherReceiveErrorsThe number of packets discarded by the SA due to errors
other than decompression errors. This may include packets
dropped due to a lack of receive buffers, and packets
dropped due to congestion at the decompression element.ro Counter32 .1.3.6.1.3.98.1.1.3.1.17 |
ipsecSaEspOutTableThe (conceptual) table containing information on IPsec
Outbound ESP SAs.
There should be one row for every outbound ESP security
association that exists in the entity. The maximum number of
rows is implementation dependent. SEQUENCE OF IpsecSaEspOutEntry .1.3.6.1.3.98.1.1.4 |
ipsecSaEspOutEntryAn entry (conceptual row) containing the information on a
particular IPsec Outbound ESP SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table. IpsecSaEspOutEntry .1.3.6.1.3.98.1.1.4.1 |
ipsecSaEspOutAddressThe destination address of the SA.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.1.4.1.1 |
ipsecSaEspOutSpiThe security parameters index of the SA.ro Unsigned32 .1.3.6.1.3.98.1.1.4.1.2 |
ipsecSaEspOutSourceIdThe source identifier of the SA. It may be 0 if unknown or
if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during phase 2 negotiations, or the
equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.4.1.3 |
ipsecSaEspOutSourceIdTypeThe type of identifier presented by
'ipsecSaEspOutSourceId'. It may be 0 if unknown or if the SA
uses transport mode encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.4.1.4 |
ipsecSaEspOutDestIdThe destination identifier of the SA. It may be 0 if
unknown or if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during phase 2 negotiations or the
equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.4.1.5 |
ipsecSaEspOutDestIdTypeThe type of identifier presented by 'ipsecSaEspOutDestId'.
It may be 0 if unknown or if the SA uses transport mode
encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.4.1.6 |
ipsecSaEspOutProtocolThe transport-layer protocol number that this SA carries,
or 0 if it carries any protocol.ro Integer32 .1.3.6.1.3.98.1.1.4.1.7 |
ipsecSaEspOutSourcePortThe source port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.4.1.8 |
ipsecSaEspOutDestPortThe destination port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.4.1.9 |
ipsecSaEspOutCreatorThe creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method.ro IpsecSaCreatorIdent .1.3.6.1.3.98.1.1.4.1.10 |
ipsecSaEspOutEncapsulationThe type of encapsulation used by this SA.ro IpsecDoiEncapsulationMode (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.4.1.11 |
ipsecSaEspOutEncAlgA unique value representing the encryption algorithm
applied to traffic or 0 if there is no encryption used.ro IpsecDoiEspTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.4.1.12 |
ipsecSaEspOutEncKeyLengthThe length of the encryption key in bits used for the
algorithm specified in the 'ipsecSaEspOutEncAlg' object. It
may be 0 if the key length is implicit in the specified
algorithm or there is no encryption specified.ro Unsigned32 .1.3.6.1.3.98.1.1.4.1.13 |
ipsecSaEspOutAuthAlgA unique value representing the hash algorithm applied to
traffic or 0 if there is no authentication used.ro IpsecDoiAuthAlgorithm (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.4.1.14 |
ipsecSaEspOutAuthKeyLengthThe length of the authentication key in bits used for the
algorithm specified in the 'ipsecSaEspOutAuthAlg' object. It
may be 0 if the key length is implicit in the specified
algorithm or there is no authentication specified.ro Unsigned32 .1.3.6.1.3.98.1.1.4.1.15 |
ipsecSaEspOutLimitSecondsThe maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated.ro Unsigned32 UNITS "seconds" .1.3.6.1.3.98.1.1.4.1.16 |
ipsecSaEspOutLimitKbytesThe maximum traffic in bytes that the SA is allowed to
process, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated.ro Unsigned32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.4.1.17 |
ipsecSaEspOutAccSecondsThe number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed.ro Counter32 UNITS "seconds" .1.3.6.1.3.98.1.1.4.1.18 |
ipsecSaEspOutAccKbytesThe amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in
kilobytes.
This value may be 0 if the SA does not expire based on
traffic.ro Counter32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.4.1.19 |
ipsecSaEspOutUserOctetsThe amount of user level traffic measured in bytes handled
by the SA. This is the number of bytes of the unencrypted IP
packet, including the original IP header of that unencrypted
packet.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit due to padding
or other protocol specific overhead.ro Counter64 UNITS "bytes" .1.3.6.1.3.98.1.1.4.1.20 |
ipsecSaEspOutPacketsThe number of packets handled by the SA.ro Counter64 .1.3.6.1.3.98.1.1.4.1.21 |
ipsecSaEspOutSendErrorsThe number of packets discarded by the SA due to any error.
This may include errors due to a lack of transmit buffers.ro Counter32 .1.3.6.1.3.98.1.1.4.1.22 |
ipsecSaAhOutTableThe (conceptual) table containing information on IPsec
Outbound AH SAs.
There should be one row for every outbound AH security
association that exists in the entity. The maximum number of
rows is implementation dependent. SEQUENCE OF IpsecSaAhOutEntry .1.3.6.1.3.98.1.1.5 |
ipsecSaAhOutEntryAn entry (conceptual row) containing the information on a
particular IPsec Outbound AH SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table. IpsecSaAhOutEntry .1.3.6.1.3.98.1.1.5.1 |
ipsecSaAhOutAddressThe destination address of the SA.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.1.5.1.1 |
ipsecSaAhOutSpiThe security parameters index of the SA.ro Unsigned32 .1.3.6.1.3.98.1.1.5.1.2 |
ipsecSaAhOutSourceIdThe source identifier of the SA. It may be 0 if unknown or
if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during phase 2 negotiations, or the
equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.5.1.3 |
ipsecSaAhOutSourceIdTypeThe type of identifier presented by 'ipsecSaAhOutSourceId'.
It may be 0 if unknown or if the SA uses transport mode
encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.5.1.4 |
ipsecSaAhOutDestIdThe destination identifier of the SA. It may be 0 if
unknown or if the SA uses transport mode encapsulation.
This value is taken directly from the optional ID payloads
that are exchanged during phase 2 negotiations, or the
equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.5.1.5 |
ipsecSaAhOutDestIdTypeThe type of identifier presented by 'ipsecSaAhOutDestId'.
It may be 0 if unknown or if the SA uses transport mode
encapsulation.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.5.1.6 |
ipsecSaAhOutProtocolThe transport-layer protocol number that this SA carries,
or 0 if it carries any protocol.ro Integer32 .1.3.6.1.3.98.1.1.5.1.7 |
ipsecSaAhOutSourcePortThe source port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.5.1.8 |
ipsecSaAhOutDestPortThe destination port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.5.1.9 |
ipsecSaAhOutCreatorThe creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method.ro IpsecSaCreatorIdent .1.3.6.1.3.98.1.1.5.1.10 |
ipsecSaAhOutEncapsulationThe type of encapsulation used by this SA.ro IpsecDoiEncapsulationMode (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.5.1.11 |
ipsecSaAhOutAuthAlgA unique value representing the hash algorithm applied to
traffic carried by this SA.ro IpsecDoiAhTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.5.1.12 |
ipsecSaAhOutAuthKeyLengthThe length of the authentication key in bits used for the
algorithm specified in the 'ipsecSaAhOutAuthAlg' object. It
may be 0 if the key length is implicit in the specified
algorithm.ro Unsigned32 .1.3.6.1.3.98.1.1.5.1.13 |
ipsecSaAhOutLimitSecondsThe maximum lifetime in seconds of the SA, or 0 if there is
no time constraint on its expiration.
The display value is limited to 4294967295 seconds (more
than 136 years); values greater than that value will be
truncated.ro Unsigned32 UNITS "seconds" .1.3.6.1.3.98.1.1.5.1.14 |
ipsecSaAhOutLimitKbytesThe maximum traffic in bytes that the SA is allowed to
process, or 0 if there is no traffic constraint on its
expiration.
The display value is limited to 4294967295 kilobytes; values
greater than that value will be truncated.ro Unsigned32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.5.1.15 |
ipsecSaAhOutAccSecondsThe number of seconds accumulated against the SA's
expiration by time.
This is also the number of seconds that the SA has existed.ro Counter32 UNITS "seconds" .1.3.6.1.3.98.1.1.5.1.16 |
ipsecSaAhOutAccKbytesThe amount of traffic accumulated that counts against the
SA's expiration by traffic limitation, measured in
kilobytes.
This value may be 0 if the SA does not expire based on
traffic.ro Counter32 UNITS "kilobytes" .1.3.6.1.3.98.1.1.5.1.17 |
ipsecSaAhOutUserOctetsThe amount of user level traffic measured in bytes handled
by the SA. This is the number of bytes of the unprocessed IP
packet, including the original IP header of that unprocessed
packet.
This is not necessarily the same as the amount of traffic
applied against the traffic expiration limit due to padding
or other protocol specific overhead.ro Counter64 UNITS "bytes" .1.3.6.1.3.98.1.1.5.1.18 |
ipsecSaAhOutPacketsThe number of packets handled by the SA.ro Counter64 .1.3.6.1.3.98.1.1.5.1.19 |
ipsecSaAhOutSendErrorsThe number of packets discarded by the SA due to any error.
This may include errors due to a lack of transmit buffers.ro Counter32 .1.3.6.1.3.98.1.1.5.1.20 |
ipsecSaIpcompOutTableThe (conceptual) table containing information on IPsec
Outbound IPcomp SAs.
There should be one row for every outbound IPcomp (security)
association that exists in the entity. The maximum number of
rows is implementation dependent. SEQUENCE OF IpsecSaIpcompOutEntry .1.3.6.1.3.98.1.1.6 |
ipsecSaIpcompOutEntryAn entry (conceptual row) containing the information on a
particular IPsec Outbound IPcomp SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table. IpsecSaIpcompOutEntry .1.3.6.1.3.98.1.1.6.1 |
ipsecSaIpcompOutAddressThe destination address of the SA.
If the IPcomp SA is shared across multiple SAs in security
association suites, this value may be 0.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.1.6.1.1 |
ipsecSaIpcompOutCpiThe CPI of the SA. Since the lower values of CPIs are
reserved to be the same as the algorithm, the syntax for
this object is the same as the transform.ro IpsecDoiIpcompTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.6.1.2 |
ipsecSaIpcompOutSourceIdThe source identifier of the SA. It may be 0 if unknown or
if the SA uses transport mode encapsulation, or if this SA
is used with multiple SAs in security association suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchange during phase 2 negotiations or
the equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.6.1.3 |
ipsecSaIpcompOutSourceIdTypeThe type of identifier presented by
'ipsecSaIpcompOutSourceId'. It may be 0 if unknown or if the
SA uses transport mode encapsulation, or if this SA is used
with multiple SAs in security association suites.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.6.1.4 |
ipsecSaIpcompOutDestIdThe destination identifier of the SA. It may be 0 if
unknown or if the SA uses transport mode encapsulation, or
if this SA is used with multiple SAs in security association
suites.
This value, if non-zero, is taken directly from the optional
ID payloads that are exchange during phase 2 negotiations or
the equivalent process.ro IpsecRawId .1.3.6.1.3.98.1.1.6.1.5 |
ipsecSaIpcompOutDestIdTypeThe type of identifier presented by
'ipsecSaIpcompOutDestId', or 0 if unknown or if the SA uses
transport mode encapsulation, or 0 if this SA is used with
multiple SAs in security association suites.ro IpsecDoiIdentType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.6.1.6 |
ipsecSaIpcompOutProtocolThe transport-layer protocol number that this SA carries,
or 0 if it carries any protocol.ro Integer32 .1.3.6.1.3.98.1.1.6.1.7 |
ipsecSaIpcompOutSourcePortThe source port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.6.1.8 |
ipsecSaIpcompOutDestPortThe destination port number of the protocol that this SA
carries, or 0 if it carries any port number.ro Integer32 (0.. 65535) .1.3.6.1.3.98.1.1.6.1.9 |
ipsecSaIpcompOutCreatorThe creator of this SA.
This MIB makes no assumptions about how the SAs are created.
They may be created statically, or by a key exchange
protocol such as IKE, or by some other method.ro IpsecSaCreatorIdent .1.3.6.1.3.98.1.1.6.1.10 |
ipsecSaIpcompOutEncapsulationThe type of encapsulation used by this SA.ro IpsecDoiEncapsulationMode (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.6.1.11 |
ipsecSaIpcompOutCompAlgA unique value representing the compression algorithm
applied to traffic.ro IpsecDoiIpcompTransform (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.1.6.1.12 |
ipsecSaIpcompOutSecondsThe number of seconds that the SA has existed.ro Counter32 UNITS "seconds" .1.3.6.1.3.98.1.1.6.1.13 |
ipsecSaIpcompOutUserOctetsThe amount of user level traffic measured in bytes handled
by the SA. This is the number of bytes of the decompressed
IP packet, including the original IP header of that
decompressed packet.ro Counter64 UNITS "bytes" .1.3.6.1.3.98.1.1.6.1.14 |
ipsecSaIpcompOutOutputOctetsThe amount of traffic measured in bytes output by the SA.
This includes byte counts from packets compressed by the SA
and also packets not modified by the SA.
This object can be divided into the
'ipsecSaIpcompOutUserOctets' object to get a compression
performance metric for the SA.ro Counter64 UNITS "bytes" .1.3.6.1.3.98.1.1.6.1.15 |
ipsecSaIpcompOutPacketsThe number of packets handled by the SA. This includes
packets that were both compressed and not compressed.ro Counter64 .1.3.6.1.3.98.1.1.6.1.16 |
saStatisticsThis is the base object identifier for all objects which
are global counters for IPsec security associations. OBJECT IDENTIFIER .1.3.6.1.3.98.1.2 |
ipsecEspCurrentInboundSAsThe current number of inbound ESP SAs in the entity.ro Gauge32 .1.3.6.1.3.98.1.2.1 |
ipsecEspTotalInboundSAsThe total number of inbound ESP SAs created in the entity
since boot time.ro Counter32 .1.3.6.1.3.98.1.2.2 |
ipsecEspCurrentOutboundSAsThe current number of outbound ESP SAs in the entity.ro Gauge32 .1.3.6.1.3.98.1.2.3 |
ipsecEspTotalOutboundSAsThe total number of outbound ESP SAs created in the entity
since boot time.ro Counter32 .1.3.6.1.3.98.1.2.4 |
ipsecAhCurrentInboundSAsThe current number of inbound AH SAs in the entity.ro Gauge32 .1.3.6.1.3.98.1.2.5 |
ipsecAhTotalInboundSAsThe total number of inbound AH SAs created in the entity
since boot time.ro Counter32 .1.3.6.1.3.98.1.2.6 |
ipsecAhCurrentOutboundSAsThe current number of outbound AH SAs in the entity.ro Gauge32 .1.3.6.1.3.98.1.2.7 |
ipsecAhTotalOutboundSAsThe total number of outbound AH SAs created in the entity
since boot time.ro Counter32 .1.3.6.1.3.98.1.2.8 |
ipsecIpcompCurrentInboundSAsThe current number of inbound IPcomp SAs in the entity.ro Gauge32 .1.3.6.1.3.98.1.2.9 |
ipsecIpcompTotalInboundSAsThe total number of inbound IPcomp SAs created in the
entity since boot time.ro Counter32 .1.3.6.1.3.98.1.2.10 |
ipsecIpcompCurrentOutboundSAsThe current number of outbound IPcomp SAs in the entity.ro Gauge32 .1.3.6.1.3.98.1.2.11 |
ipsecIpcompTotalOutboundSAsThe total number of outbound IPcomp SAs created in the
entity since boot time.ro Counter32 .1.3.6.1.3.98.1.2.12 |
saErrorsThis is the base object identifier for all objects which
are global error counters for IPsec security associations. OBJECT IDENTIFIER .1.3.6.1.3.98.1.3 |
ipsecDecryptionErrorsThe total number of packets received by the entity in SAs
since boot time with detectable decryption errors. Not all
decryption errors are detectable within SA processing, so
this count should not be considered definitive.ro Counter32 .1.3.6.1.3.98.1.3.1 |
ipsecAuthenticationErrorsThe total number of packets received by the entity in SAs
since boot time with authentication errors.
This includes all packets in which the hash value is
determined to be invalid, for both ESP and AH SAs.ro Counter32 .1.3.6.1.3.98.1.3.2 |
ipsecReplayErrorsThe total number of packets received by the entity in SAs
since boot time with replay errors.ro Counter32 .1.3.6.1.3.98.1.3.3 |
ipsecPolicyErrorsThe total number of packets received by the entity in SAs
since boot time and discarded due to policy errors. This
includes packets that had selectors that were invalid for
the SA that carried them, and also includes packets that
arrived at the entity in the clear and that should have been
protected by IPsec or should have been dropped.ro Counter32 .1.3.6.1.3.98.1.3.4 |
ipsecOtherReceiveErrorsThe total number of packets received by the entity in SAs
since boot time and discarded due to errors not due to
decryption, authentication, replay or policy.ro Counter32 .1.3.6.1.3.98.1.3.5 |
ipsecSendErrorsThe total number of packets to be sent by the entity in SAs
since boot time and discarded due to errors.ro Counter32 .1.3.6.1.3.98.1.3.6 |
ipsecUnknownSpiErrorsThe total number of packets received by the entity since
boot time with SPIs or CPIs that were not valid.ro Counter32 .1.3.6.1.3.98.1.3.7 |
saTrapsThis is the base object identifier for all objects which
are traps for IPsec security associations. OBJECT IDENTIFIER .1.3.6.1.3.98.1.4 |
espAuthFailureTrapIPsec packets with invalid hashes were found in an inbound
ESP SA. The total number of authentication errors
accumulated is sent for the specific row of the
'ipsecSaEspInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.1 |
ahAuthFailureTrapIPsec packets with invalid hashes were found in an inbound
AH SA. The total number of authentication errors accumulated
is sent for the specific row of the 'ipsecSaAhInTable' table
for the SA; this provides the identity of the SA in which
the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.2 |
espReplayFailureTrapIPsec packets with invalid sequence numbers were found in
an inbound ESP SA. The total number of replay errors
accumulated is sent for the specific row of the
'ipsecSaEspInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.3 |
ahReplayFailureTrapIPsec packets with invalid sequence numbers were found in
the specified AH SA. The total number of replay errors
accumulated is sent for the specific row of the
'ipsecSaAhInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.4 |
espPolicyFailureTrapIPsec packets carrying packets with invalid selectors for
the specified ESP SA were found. The total number of policy
errors accumulated is sent for the specific row of the
'ipsecSaEspInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.5 |
ahPolicyFailureTrapIPsec packets carrying packets with invalid selectors for
the specified AH SA were found. The total number of policy
errors accumulated is sent for the specific row of the
'ipsecSaAhInTable' table for the SA; this provides the
identity of the SA in which the error occurred.
Implementations SHOULD send one trap per SA (within a
reasonable time period), rather than sending one trap per
packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.6 |
espInvalidSpiTrapA packet with an unknown SPI was detected from the
specified peer with the specified SPI using the specified
protocol. The destination address of the received packet is
specified by 'ipsecLocalAddress'.
The value 'ifIndex' may be 0 if this optional linkage is
unsupported.
If the object 'ipsecSecurityProtocol' has the value for
IPcomp, then the 'ipsecSPI' object is the CPI of the packet.
Implementations SHOULD send one trap per peer (within a
reasonable time period), rather than sending one trap per
packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.7 |
otherPolicyFailureTrapClear packets were found that should not have been sent to
the entity in the clear. The total number of policy errors
accumulated by the entity is sent, along with the source and
destination addresses of the packet that triggered the trap.
Implementations SHOULD send one trap per source address pair
(within a reasonable time period), rather than sending one
trap per packet. NOTIFICATION-TYPE .1.3.6.1.3.98.1.4.0.8 |
saTrapObjectsThis is the base object identifier for objects which are
used as part of traps. OBJECT IDENTIFIER .1.3.6.1.3.98.1.5 |
ipsecSecurityProtocolA security protocol associated with the trap.ro IpsecDoiSecProtocolId (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.3.98.1.5.1 |
ipsecSPIAn SPI associated with a trap. Where the security protocol
associated with the trap is IPcomp, this value has a maximum
of 65535.ro Unsigned32 .1.3.6.1.3.98.1.5.2 |
ipsecLocalAddressA local IP address associated with the trap.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.5.3 |
ipsecPeerAddressA peer IP address associated with the trap.
IPv4 entities will prefix the IP address with
'0000:0000:0000:0000:0000:FFFF::'.ro IpsecIpv6Address .1.3.6.1.3.98.1.5.4 |
saTrapControlThis is the base object identifier for all objects which
are trap controls for IPsec security associations. OBJECT IDENTIFIER .1.3.6.1.3.98.1.6 |
espAuthFailureTrapEnableIndicates whether espAuthFailureTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.1 |
ahAuthFailureTrapEnableIndicates whether ahAuthFailureTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.2 |
espReplayFailureTrapEnableIndicates whether espReplayFailureTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.3 |
ahReplayFailureTrapEnableIndicates whether ahReplayFailureTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.4 |
espPolicyFailureTrapEnableIndicates whether espPolicyFailureTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.5 |
ahPolicyFailureTrapEnableIndicates whether ahPolicyFailureTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.6 |
invalidSpiTrapEnableIndicates whether invalidSpiTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.7 |
otherPolicyFailureTrapEnableIndicates whether otherPolicyFailureTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.3.98.1.6.8 |
saGroupsThis is the base object identifier for all objects which
describe the groups in this MIB. OBJECT IDENTIFIER .1.3.6.1.3.98.1.7 |
saConformanceThis is the base object identifier for all objects which
describe the conformance for this MIB. OBJECT IDENTIFIER .1.3.6.1.3.98.1.8 |