ISAKMP-DOI-IND-MON-MIB
AI MIB Summary
The ISAKMP-DOI-IND-MON-MIB monitors DOI-independent Internet Security Association and Key Management Protocol (ISAKMP) objects, specifically tracking security association states, negotiation session counts, and policy enforcement metrics across vendor implementations. This module enables centralized visibility into IKE phase 1 tunnel establishment, maintenance, and teardown events independent of the specific Domain of Interpretation (DOI) used.
The MIB module to describe the DOI-independent part of
ISAKMP objects; to be used for monitoring purposes.
Main OID:
isakmpDoiIndMonModule.1.3.6.1.4.1.1954.3.10.2
63
Objects
Active
Status
7
Dependencies
Imported Objects
Objects
63 total| Object Name |
|---|
invalidCookieTrapISAKMP packets with invalid cookies were detected from the
specified source, intended for the specified destination.
The initiator and responder cookies are also sent with the
trap.
The current count is sent to allow the trap to accurately
relfect dropped and throttled traps.
Implementations SHOULD send one trap per peer (within a
reasonable time period, rather than sending one trap per
packet. TRAP-TYPE .1.3.6.1.4.1.1954.0.24578 |
isakmpDoiIndMonModuleThe MIB module to describe the DOI-independent part of
ISAKMP objects; to be used for monitoring purposes. MODULE-IDENTITY .1.3.6.1.4.1.1954.3.10.2 |
isakmpDoiIndMIBObjectsThis is the base object identifier for all ISAKMP
branches. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1 |
isakmpSaTableThis is the base object identifier for the security
associations table. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.1 |
saTableThe (conceptual) table containing the DOI-independent
portion of ISAKMP SAs.
There should be one row for every phase 1 security
association that exists in the entity that uses ISAKMP. The
maximum number of rows is implementation dependent. SEQUENCE OF SaEntry .1.3.6.1.4.1.1954.3.10.2.1.1.1 |
saEntryAn entry (conceptual row) containing the DOI-independent
information on a particular ISAKMP SA.
A row in this table cannot be created or deleted by SNMP
operations on columns of the table. SaEntry .1.3.6.1.4.1.1954.3.10.2.1.1.1.1 |
saLocalIpAddressTypeThe type of the local address used to negotiate the ISAKMP
phase 1 SA.ro InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.1 |
saLocalIpAddressThe local address used to negotiate the ISAKMP phase 1 SA.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.2 |
saRemoteIpAddressTypeThe type of the remote address used to negotiate the ISAKMP
phase 1 SA.ro InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.3 |
saRemoteIpAddressThe remote address used to negotiate the ISAKMP phase 1
SA.ro InetAddressIPv4 .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.4 |
saInitiatorCookieThe value of the cookie used by the initiator for the
ISAKMP phase 1 SA.ro IsakmpCookie .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.5 |
saResponderCookieThe value of the cookie used by the responder for the
ISAKMP phase 1 SA.
Note that this value may be 0 if the ISAKMP phase 1 SA has
been initiated but not responded to by the peer entity.
It must never be 0 if this entry represents an ISAKMP phase
1 SA establishment attempt that has been initiated by the
peer. This rule prevents index collisions in the (unlikely)
event that two peers simultaneously initiate with the same
cookie at the same time.ro IsakmpCookie .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.6 |
saLocalUdpPortThe local UDP port number that this ISAKMP phase 1 SA was
negotiated with.ro INTEGER .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.7 |
saRemoteUdpPortThe remote UDP port number that this ISAKMP phase 1 SA was
negotiated with.ro INTEGER .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.8 |
saPeerMajorVersionThe major version number from the ISAKMP packet header used
by the peer.ro INTEGER .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.9 |
saPeerMinorVersionThe minor version number from the ISAKMP packet header used
by the peer.ro INTEGER .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.10 |
saDoiThe specific DOI value that this ISAKMP SA is using.
Note that this value MAY be 0, as allowed by Section 3.4 of
RFC 2408ro IsakmpDOI (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.11 |
saLocallyInitiatedThis value is 'true' if the ISAKMP phase 1 SA was initiated
by the local entity, and 'false' if initiated by the remote
entity.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.12 |
saStatusThe status of the ISAKMP phase 1 SA.
If the state is 'negotiating', it means that processing of
the final packet of the phase 1 exchange is not yet
complete.
If the state is 'established', it means that processing of
all packets associated with ISAKMP phase 1 SA negotation is
complete, and the entities involved in the ISAKMP phase 1 SA
are authenticated.ro Enumeration .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.13 |
saExchangeTypeThe exchange type used to negotiate the ISAKMP phase 1 SA.ro IsakmpExchangeType (IPSEC-ISAKMP-IKE-DOI-TC) .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.14 |
saTimeSecondsThe number of seconds the SA has existed. In other words,
how old the SA is.ro Counter32 UNITS "seconds" .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.15 |
saInPacketsThe total number of packets received by the ISAKMP phase 1
SA, including un-encrypted packets used to negotiate the
ISAKMP phase 1 SA, and any re-transmissions.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.16 |
saOutPacketsThe total number of packets sent by the ISAKMP phase 1 SA,
including un-encrypted packets used to negotiate the ISAKMP
phase 1 SA, and any re-transmissions received.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.17 |
saInOctetsThe amount of traffic measured in bytes received by the
ISAKMP phase 1 SA. This includes encrypted and un-encrypted
traffic used to negotiate the ISAKMP phase 1 SA, and any re-
transmissions received.ro Counter32 UNITS "bytes" .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.18 |
saOutOctetsThe amount of traffic measured in bytes sent by the ISAKMP
phase 1 SA. This includes encrypted and un-encrypted traffic
used to negotiate the ISAKMP phase 1 SA, and any re-
transmissions.ro Counter32 UNITS "bytes" .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.19 |
saByCreatorsIndexA unique value, greater than zero, for each IKE phase 1 SA
that exists between the two endpoints. It is recommended
that values are assigned contiguously starting from 1.ro Unsigned32 .1.3.6.1.4.1.1954.3.10.2.1.1.1.1.20 |
isakmpGlobalsThis is the base object identifier for all objects which
are global values for ISAKMP. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.2 |
isakmpMajorVersionThe maximum major version number value capable of being
supported by the entity.ro INTEGER ( 0..15 ) .1.3.6.1.4.1.1954.3.10.2.1.2.1 |
isakmpMinorVersionThe maximum minor version number value capable of being
supported by the entity.ro INTEGER ( 0..15 ) .1.3.6.1.4.1.1954.3.10.2.1.2.2 |
isakmpNegStatsThis is the base object identifier for all objects which
are global counters for ISAKMP negotiation statistics. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.3 |
isakmpCurrentSAsThe current number of ISAKMP SAs in the entity.ro Gauge32 .1.3.6.1.4.1.1954.3.10.2.1.3.1 |
isakmpCurrentInitiatedSAsThe current number of ISAKMP SAs successfully negotiated in
the entity that were initiated by the entity.ro Gauge32 .1.3.6.1.4.1.1954.3.10.2.1.3.2 |
isakmpCurrentRespondedSAsThe current number of ISAKMP SAs successfully negotiated in
the entity that were initiated by the peer entity.ro Gauge32 .1.3.6.1.4.1.1954.3.10.2.1.3.3 |
isakmpTotalSAsThe total number of ISAKMP SAs successfully negotiated in
the entity since boot time.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.3.4 |
isakmpTotalInitiatedSAsThe total number of ISAKMP SAs successfully negotiated in
the entity since boot time that were initiated by the
entity.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.3.5 |
isakmpTotalRespondedSAsThe total number of ISAKMP SAs successfully negotiated in
the entity since boot time that were initiated by the peer
entity.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.3.6 |
isakmpTotalAttemptsThe total number of ISAKMP SAs negotiation attempts made
since boot time. This includes successful negotiations.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.3.7 |
isakmpTotalAsInitAttemptsThe total number of ISAKMP SAs negotiation attempts made
where the entity was the initiator since boot time. This
includes successful negotiations.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.3.8 |
isakmpTotalAsRespAttemptsThe total number of ISAKMP SAs negotiation attempts made
where the entity was the responder since boot time. This
includes successful negotiations.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.3.9 |
isakmpTrafStatsThis is the base object identifier for all objects which
are global counters for ISAKMP security association traffic
statistics. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.4 |
isakmpTotalInPacketsThe total number of ISAKMP packets received by the entity
since boot time, including re-transmissions and un-encrypted
packets.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.4.1 |
isakmpTotalOutPacketsThe total number of ISAKMP packets sent by the entity since
boot time, including re-transmissions and un-encrypted
packets.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.4.2 |
isakmpTotalInOctetsThe total amount of ISAKMP traffic received by the entity
since boot time, measured in bytes, including any re-
transmitted packets received, and including encrypted and
un-encrypted packets.ro Counter32 UNITS "bytes" .1.3.6.1.4.1.1954.3.10.2.1.4.3 |
isakmpTotalOutOctetsThe total amount of ISAKMP traffic sent by the entity since
boot time, measured in bytes, including any re-transmissions
and including encrypted and un-encrypted packets.ro Counter32 UNITS "bytes" .1.3.6.1.4.1.1954.3.10.2.1.4.4 |
isakmpErrorsThis is the base object identifier for all objects which
are global error counters for ISAKMP. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.5 |
isakmpTotalInitFailuresThe total number of attempts to initiate an ISAKMP phase 1
SA that failed since boot time, when there was a response
from the peer entity.
This value may be used to detect clogging or denial-of-
service attacks.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.5.1 |
isakmpTotalInitNoResponsesThe total number of attempts to initiate an ISAKMP phase 1
SA that failed since boot time, when there was no response
from the peer entity.
This should only be incremented if the peer does not repond
to the first packet of attempted negotiations.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.5.2 |
isakmpTotalRespFailuresThe total number of attempts to initiate an ISAKMP phase 1
SA that failed since boot time, when the initiation attempt
came for the peer entity.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.5.3 |
isakmpInvalidCookieCountThe total number of ISAKMP packets with invalid cookies
received by the entity since boot time.ro Counter32 .1.3.6.1.4.1.1954.3.10.2.1.5.4 |
isakmpGroupsThis is the base object identifier for all objects which
describe the groups in this MIB. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.6 |
isakmpConformanceThis is the base object identifier for all objects which
describe the conformance for this MIB. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.7 |
isakmpTrapControlThis is the base object identifier for all trap controls
for this MIB. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.8 |
invalidCookieTrapEnableIndicates whether invalidCookieTrap traps should be
generated.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.1954.3.10.2.1.8.1 |
isakmpTrapsThis is the base object identifier for all traps for this
MIB. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.9 |
isakmpTrapObjectsThis is the base object identifier for all objects used by
traps for this MIB. OBJECT IDENTIFIER .1.3.6.1.4.1.1954.3.10.2.1.10 |
localIpAddressTypeThe type of the local IP address used in an ISAKMP message,
to be associated with a trap.ro InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.1954.3.10.2.1.10.1 |
localIpAddressThe local IP address used in an ISAKMP message, to be
associated with a trap.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.1954.3.10.2.1.10.2 |
localUdpPortThe local port UDP number used in an ISAKMP message, to be
associated with a trap.ro INTEGER .1.3.6.1.4.1.1954.3.10.2.1.10.3 |
remoteIpAddressTypeThe type of the remote IP used in an ISAKMP message, to be
associated with a trap.ro InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.1954.3.10.2.1.10.4 |
remoteIpAddressThe remote IPaddress used in an ISAKMP message, to be
associated with a trap.ro IsakmpCookie .1.3.6.1.4.1.1954.3.10.2.1.10.5 |
remoteUdpPortThe remote UDP port number used in an ISAKMP message, to be
associated with a trap.ro INTEGER .1.3.6.1.4.1.1954.3.10.2.1.10.6 |
initiatorCookieThe initiator cookie used in an ISAKMP message, to be
associated with a trap.ro IsakmpCookie .1.3.6.1.4.1.1954.3.10.2.1.10.7 |
responderCookieThe responder cookie used in an ISAKMP message, to be
associated with a trap.ro IsakmpCookie .1.3.6.1.4.1.1954.3.10.2.1.10.8 |