XEDIA-IPSEC-MIB
AI MIB Summary
The XEDIA-IPSEC-MIB enables monitoring and configuration of Xedia IPsec VPN tunnel states, security associations, and cryptographic parameters on Xedia networking hardware. It provides specific objects for tracking tunnel establishment status, packet counters, and IPsec policy enforcement metrics to ensure secure data transmission integrity.
This module defines objects for management of Xedia's IP security (IPsec) Virtual Private Network (VPN) component.
Main OID:
xediaIpsecMIB.1.3.6.1.4.1.838.3.14
92
Objects
Active
Status
5
Dependencies
Imported Objects
Objects
92 total| Object Name |
|---|
xediaIpsecMIBThis module defines objects for management of Xedia's IP
security (IPsec) Virtual Private Network (VPN) component. MODULE-IDENTITY .1.3.6.1.4.1.838.3.14 |
ipsecObjects OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.14.1 |
ipsecSubsystemGroup OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.14.1.1 |
ipsecTransformLayerTypeThe type of IPSec Transform Layer currently active
(i.e., software only, hardware assisted).ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.14.1.1.1 |
ipsecAlgorithmsThe IPSec algorithms currently available.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.14.1.1.2 |
ipsecSecurityProfileTableThis table defines a set of security attributes that will be
used to describe a security association (SA). There may be
many SAs that use the same security profile. SEQUENCE OF IpsecSecurityProfileEntry .1.3.6.1.4.1.838.3.14.1.2 |
ipsecSecurityProfileEntryThe attributes that make up a single security profile. New
entries are created using the ipsecSecurityProfileRowStatus
object. IpsecSecurityProfileEntry .1.3.6.1.4.1.838.3.14.1.2.1 |
ipsecSecurityProfileNameThe name of the security profile. For example
'Medium-Security' or 'Maximum-Security'. IpsecSecurityProfileName .1.3.6.1.4.1.838.3.14.1.2.1.1 |
ipsecSecurityProfileProtocolThe IPsec security protocol(s). When the combination of
'ah(1)' and 'esp(0)' is used, the authentication protocol
specified in ipsecSecurityProfileAuthentication is used for
AH only and no authentication is performed for ESP.rw BIT STRING { esp(0), ah(1), ipcomp(2) } .1.3.6.1.4.1.838.3.14.1.2.1.2 |
ipsecSecurityProfileEncryptionThe encryption protocol. In the first release we support
'des(3)', 'des3(4)', and null(12)' only.rw Enumeration .1.3.6.1.4.1.838.3.14.1.2.1.3 |
ipsecSecurityProfileAuthenticationThe authentication protocol. Used for ESP or AH only. Note
that when ipsecSecurityProfileAuthentication is not 'null(1)',
anti-replay services are also implemented.rw Enumeration .1.3.6.1.4.1.838.3.14.1.2.1.4 |
ipsecSecurityProfileCompressionThe compression method. This is used when
ipsecSecurityProfileProtocol is set to 'ipcomp(2)' or both
'esp(0)' and 'ipcomp(2)'. The default is 'lzs(3)'.rw Enumeration .1.3.6.1.4.1.838.3.14.1.2.1.5 |
ipsecSecurityProfileExpirationTimerThe number of seconds before the SA expires. When 0, the SA
expiration timer is disabled. The default is 24*3600 = 86400
seconds (i.e., 24 hours). The minimum allowed expiration
timer value is 5*60 = 300 seconds (i.e., 5 minutes). The
maximum value is 86400 seconds (i.e., 24 hours).
Rekeying begins 1 minute prior to SA expiration.rw Unsigned32 (0 | 300..86400) UNITS "seconds" .1.3.6.1.4.1.838.3.14.1.2.1.6 |
ipsecSecurityProfileExpirationVolumeThe number of KBytes before re-keying. When 0, SA expiration
volume is disabled. The default is 0. The minimum allowed
expiration volume value is 100 KBytes. The maximum is
1000000KBytes (i.e., 10GBytes).
Rekeying begins when 95% of the volume limit has been used up.rw Unsigned32 (0 | 100..1000000) UNITS "KBytes" .1.3.6.1.4.1.838.3.14.1.2.1.7 |
ipsecSecurityProfileInactivityTimerThe number of seconds of inactivity before the SA is
removed. When 0, SA inactivity timer is disabled. The minimum
allowed expiration timer value is 10*60 = 600 seconds (i.e.,
10 minutes). The maximum value is 86400 seconds (i.e., 24 hours).
Note that the inactivity timer, if enabled, must be less than
the expiration timer minus one minute, to ensure it will expire
for an idle SA prior to the start of rekeying.rw Unsigned32 (0 | 600..86400) UNITS "seconds" .1.3.6.1.4.1.838.3.14.1.2.1.8 |
ipsecSecurityProfileEnablePfsWhen enabled PFS is enforced. This requires generation on new
key material for each protocol SA (i.e., non ISAKMP SA). The
default is 'false(2)'.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.838.3.14.1.2.1.9 |
ipsecSecurityProfileOakleyGroupDefines 1st or 2nd Oakley group used by ISAKMP. The default
is 'first(1)'.rw Enumeration .1.3.6.1.4.1.838.3.14.1.2.1.10 |
ipsecSecurityProfileAssignmentStatusWhen status is 'assigned(1)', the security profile is
referenced by one or more SAs. Modifications and deletions are
allowed for unassigned security profiles only.ro Enumeration .1.3.6.1.4.1.838.3.14.1.2.1.11 |
ipsecSecurityProfileRowStatusThis object allows entries to be created and deleted in this
table. Note that entries with ipsecSecurityProfileAssignmentStatus
of 'assigned(1)' cannot be deleted.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.838.3.14.1.2.1.12 |
ipsecIfTableInformation associated with an IPSec Interface. SEQUENCE OF IpsecIfEntry .1.3.6.1.4.1.838.3.14.1.3 |
ipsecIfEntryInformation about a single IPSec Interface. IpsecIfEntry .1.3.6.1.4.1.838.3.14.1.3.1 |
ipsecIfTypeThe type of IPSec interface.ro Enumeration .1.3.6.1.4.1.838.3.14.1.3.1.1 |
ipsecIfRemoteGatewayThe IP address of the remote security gateway.rw IpAddress .1.3.6.1.4.1.838.3.14.1.3.1.2 |
ipsecIfPresharedKeySpecifies pre-shared key to be used by ISAKMP for
authentication.rw DisplayString .1.3.6.1.4.1.838.3.14.1.3.1.3 |
ipsecIfCurTunnelsThe number of tunnels currently configured on the interface.ro Gauge32 .1.3.6.1.4.1.838.3.14.1.3.1.4 |
ipsecIfTotTunnelsThe total number of tunnels created on the interface
since the interface was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.5 |
ipsecIfUpTunnelsThe number of tunnels in the 'Up' state on the interface.ro Gauge32 .1.3.6.1.4.1.838.3.14.1.3.1.6 |
ipsecIfLastTunnelChangeThe value of sysUpTime the last time a tunnel on the
interface changed status (ipsecTunnelOperStatus). This
object indicates to the manager when it needs to repoll
for new tunnel configuration and status.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.838.3.14.1.3.1.7 |
ipsecIfCurSAsThe current number of security associations (SAs) for all
the tunnels on this interface. Typically there will be 2 SAs
(1 inbound and 1 outbound) for each tunnel in the 'up' state.
During dynamic tunnel rekeying there may be 0 to 4 SAs on a
tunnel since IKE removes the current SAs and adds new SAs.ro Gauge32 .1.3.6.1.4.1.838.3.14.1.3.1.8 |
ipsecIfTotSAsThe total number of security associations (SAs) for all
tunnels created on the interface since the interface was
configured. For interfaces with dynamic tunnels, this object
gives an indication of how many IKE rekeying events have
occured. Every time a dynamic tunnel successfully rekeys, new
inbound and outbound SAs are created and this object is
incremented by 2.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.9 |
ipsecIfInErrsInvalidSpiThe total number of IPSec packets received which contained
an invalid SPI (Security Parameter Index) and therefore could
not be associated with a tunnel nor a specific interface.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.10 |
ipsecIfOutDiscardsNoTunnelThe number of packets that could not be send out a
tunnel because the tunnel lookup failed.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.11 |
ipsecIfInCompressedPktsThe total number of compressed packets received.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.12 |
ipsecIfInCompressedOctetsThe total number of bytes after decompression in
compressed packets received.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.13 |
ipsecIfOutCompressedPktsThe total number of compressed packets transmitted.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.14 |
ipsecIfOutCompressedOctetsThe total number of bytes prior to compression in
compressed packets transmitted.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.15 |
ipsecIfIkeAuthentMethodSpecifies the authentication method which will be used
by this gateway to establish dynamic IKE tunnel
connections.
Note that the ipsecTunnelAuthentMethod represents the
authentication method used to bring up the current tunnel
connection.rw IkeAuthentMethod .1.3.6.1.4.1.838.3.14.1.3.1.16 |
ipsecIfIkeInitiateSpecifies when IKE will initiate dynamic, site to site
tunnel establishment with the remote gateway. If
'automatic(1)', the gateway attempts to negotiate tunnels
as soon as they are configured and enabled. If
'outboundTraffic(2)', the gateway attempts to negotiate
tunnels only when traffic is routed out the tunnel. If
'disabled(3)', the gateway never initiates tunnel
establishment.
In all cases, the gateway will participate in tunnel
negotiation when initiated by the remote gateway.
Note that this object is 'disabled(3)' for dialin group
and client tunnels since clients always initiate.rw Enumeration .1.3.6.1.4.1.838.3.14.1.3.1.17 |
ipsecIfIkeKeepaliveUpdateIKE keepalive protocol update timeout value. When set to 0,
the IKE keepalive protocol is disabled. Default is set to
disabled. Minimum value is 10 sec, maximum value is 3600 sec.
This value specifies frequency in seconds of IKE keepalive update
messages to be generated.rw Unsigned32 (0 | 10..3600) UNITS "seconds" .1.3.6.1.4.1.838.3.14.1.3.1.18 |
ipsecIfIkeKeepaliveExpireIKE keepalive protocol expire retry counter value.
Default is set to 4. Minimum value is 2, maximum value is 10.
This value specifies a number of IKE keepalive update
messages missed before the remote gateway/end system is
declared to be down.rw Unsigned32 .1.3.6.1.4.1.838.3.14.1.3.1.19 |
ipsecIfIkeKeepaliveCancelIKE keepalive protocol cancel retry counter value.
Default is set to 6. Minimum value is 2, maximum value is 10.
This value specifies a number of IKE keepalive update
messages missed immediately after IKE keepalive protocol starts
running for the protocol to be disabled (likely reason: remote
gateway does not support/disabled IKE keepalive protocol.rw Unsigned32 .1.3.6.1.4.1.838.3.14.1.3.1.20 |
ipsecIfIkeKeepaliveStateIKE keepalive state.ro Enumeration .1.3.6.1.4.1.838.3.14.1.3.1.21 |
ipsecIfPacketsQueuedThe total number of packets that are currently queued for
all dynamic site-to-site tunnels created on the interface.
These packets will remained queued for a particular tunnel
until that tunnel state transitions to DOWN or UP.ro Counter32 .1.3.6.1.4.1.838.3.14.1.3.1.22 |
ipsecTunnelTableThe tunnel table is used to configure and monitor VPN
tunnels. There two cases here: site-to-site and remote
dial-in. For site-to-site VPN the entry in the tunnel table
must be configured. There are two types of tunnels: static
tunnels and dynamic tunnels. When dynamic tunnels are
configured and become operational, the ISAKMP protocol
creates an SA pair, one inbound and one outbound.
When static tunnels are configured, inbound and outbound
SAa need to be created through network management. In this
case key and peer SPI (security profile index) must be set.
Static SAs are like ATM PVCs. Dynamic SAs are like ATM SVCs.
All dial-in clients are organized into user groups. One or
more users (dial-in clients) may be in the group. All dial-in
users that are members of the same group get the same security
attributes. Actual users may be either configured internally
(in the ipsecRemoteClient table) or in the external database
such as X.500 directory or Radius, etc. The administrator has
an option of defining a Default group. Users that do not have
any User group membership are assigned into a Default group.
For remote dial-in VPNs, the tunnel entries are first
statically configured for every defined user group, for
example XediaEngineering, etc. Tunnels for individual users in
the group are created automatically when user of the group
initiates a connection. These automatically created remote
client tunnels are 'children' of a statically configured
'parent' user group tunnel. The name of automatically created
dial-in tunnel (which must be unique) is constructed as
follows: tunnelName.userName, for example
XediaEngineering.schwartz.
For site-to-site and dial-in-group tunnel VPNs the objects'
access is as specified. For dial-in 'children' tunnel VPNs which
are automatically created by the system, all objects are
read-only except for ipsecTunnelAdminStatus. This object has
write access and when set to down, it would result in tearing
down user dial-in session, i.e. all security associations for
this dial-in client will be deleted. SEQUENCE OF IpsecTunnelEntry .1.3.6.1.4.1.838.3.14.1.4 |
ipsecTunnelEntryInformation about a tunnel. Tunnels are manually created
using the ipsecTunnelRowStatus object. IpsecTunnelEntry .1.3.6.1.4.1.838.3.14.1.4.1 |
ipsecTunnelNameName of the tunnel. For example, Boston-to-LA (site-to-site),
XediaEnginnering (remote client dial-in group), etc. The name
must be unique in the system and it is used as tunnel entry
index. When new tunneling tables are defined (i.e. L2TP, etc.)
the tunnel name still has to be unique in the system. IpsecTunnelName .1.3.6.1.4.1.838.3.14.1.4.1.1 |
ipsecTunnelTypeThe tunnel type. When 'dialinGroup(1)', 'dialinClient(2)' or
'siteToSiteDynamic(4)' is specified, ISAKMP is responsible for
SA creation. Otherwise, when 'siteToSiteStatic(2)' is
specified, SAs must be configured manually. This definition
implies that all dial-in tunnels (and SAs created for them)
are always dynamic.
Tunnels of type 'dialinGroup(1)' are created by the
administrator and are read-write. They have a range of remote
client addresses. When a dial-in client connects within the
remote client range of a parent tunnel, a read-only
'dialinClient(2)' tunnel is dynamically created.rw Enumeration .1.3.6.1.4.1.838.3.14.1.4.1.2 |
ipsecTunnelAdminStatusThis object is the desired state of the tunnel and is
similar to interface administrative state. The default is
'up(1)'. When the ipsecTunnelAdminStatus is set to 'up(1)' for
a dialin parent tunnel, it enables remote clients in this
group to connect to the VPN gateway. When the
ipsecTunnelAdminStatus is set to 'down(2)' for a dialin parent
tunnel, it disables remote clients in this group from
connecting to the VPN gateway. When tunnelAdminStatus is set
to up for siteToSiteStatic, it enables use of statically
configured SAs. Setting it to down, effectively disables use
of statically configured SAs. When tunnelAdminStatus is set
to up for siteToSiteDynamic, it enables the VPN gateway to
start establishments of SAs via ISAKMP. If the ISAKMP failed
to setup SA (for example when the peer is not ready) it will
periodically retry SA establishment indefinetly until it
succeeds. Setting it to down, disables initiation of SAs and
it also disables responding to remote ISAKMP initiation
requests.rw Enumeration .1.3.6.1.4.1.838.3.14.1.4.1.3 |
ipsecTunnelOperStatusThis is the operational state (the actual state of the
tunnel. This object is similar to interface operational
state.ro Enumeration .1.3.6.1.4.1.838.3.14.1.4.1.4 |
ipsecTunnelLastChangeThe value of sysUpTime the last time the
ipsecTunnelOperStatus changed. On re-initialization of the
system, this object contains a zero value. When a new tunnel
is created, this will be initialized to the value of sysUpTime
when the entry was created.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.838.3.14.1.4.1.5 |
ipsecTunnelLocalAddressThe local address and mask define the local trusted subnet
(or single host if mask is all 1's) for the tunnel. The
local trusted subnet or host identifies 'source' addresses
for the tunnel. The local trusted address(es) together with
the remote trusted address(es) identify the traffic flow
into the tunnel. This attribute and the mask default to
0 which specifies any source address for the tunnel.rw IpAddress .1.3.6.1.4.1.838.3.14.1.4.1.6 |
ipsecTunnelLocalAddressMaskThe local trusted address mask of the tunnel. Refer to
ipsecTunnelLocalAddress.rw IpAddress .1.3.6.1.4.1.838.3.14.1.4.1.7 |
ipsecTunnelRemoteAddressThe remote address and mask define the remote trusted subnet
(or single host if mask is all 1's) for the tunnel. The
remote trusted subnet or host identifies 'destination' addresses
for the tunnel. The remote trusted address(es) together with
the local trusted address(es) identify the traffic flow
into the tunnel. This attribute and the mask default to
0 which specifies any destination address for the tunnel.
For 'dialinGroup' tunnels with ipsecTunnelClientAddressAssign
set to 'internalPool', the remote subnet is used as a pool
of addresses which the gateway allocates to dialin clients.
In this case, the remote subnet must be specified.
For 'dialinClient(2)' tunnels this object gives the
enterprise address of the client aka the 'inner' client
address within the tunnel as opposed to the 'outer' Internet
address which is given by ipsecTunnelRemoteGateway.rw IpAddress .1.3.6.1.4.1.838.3.14.1.4.1.8 |
ipsecTunnelRemoteAddressMaskThe remote trusted address mask of the tunnel. Refer to
ipsecTunnelRemoteAddress. For dialin client tunnels, the
ipsecTunnelRemoteAddress and ipsecTunnelRemoteMask provides
represents the client's assigned subnet mask.rw IpAddress .1.3.6.1.4.1.838.3.14.1.4.1.9 |
ipsecTunnelRemoteGatewayThe IP address of the remote security gateway.
For 'siteToSite' tunnels, this object is a copy of
the associated ipsecIfRemoteGateway.
For 'dialinClient' tunnels, this is the 'outer' Internet
address of the client as opposed to the 'inner' enterprise
address which is given by ipsecTunnelRemoteAddress.ro IpAddress .1.3.6.1.4.1.838.3.14.1.4.1.10 |
ipsecTunnelSecurityProfileDefines which Security Profile to use for this tunnel. This
is a name of Security Profile entry in the Security Profile
table.rw IpsecSecurityProfileName .1.3.6.1.4.1.838.3.14.1.4.1.11 |
ipsecTunnelIkeAuthentMethodDefines authentication method which was used to establish
the current IKE tunnel connection. Not applicable for static
tunnels.
Note that ipsecIfIkeAuthentMethod specifies the method with which
the local system will attempt to initiate a connection.ro IkeAuthentMethod .1.3.6.1.4.1.838.3.14.1.4.1.12 |
ipsecTunnelClientAddressAssignAddress assignment method is configured for dialin
group tunnels and determines how clients within the
group will be assigned an enterprise IP address and
subnet. The enterprise address is the 'inner' tunneled
address as opposed to the 'outer' Internet address
which is typically assigned by the client's local ISP.
If 'disabled(0)', clients are preconfigured with an address
and subnet, so no assignment occurs. If 'internalPool(1)',
clients are assigned an address and subnet from the
dialin group's remote address/mask. If 'radius(2)',
clients' address and subnet are given by the RADIUS
server as part of the user's information.
This object is read-only for clients and simply reflects
the address assignment value of the dialin group. This
object is not applicable for site to site tunnels and
will always read 'disabled(0)'.rw Enumeration .1.3.6.1.4.1.838.3.14.1.4.1.13 |
ipsecTunnelCurSAsThe current number of security associations (SAs) for
this tunnel. Typically there will be 2 SAs (1 inbound and
1 outbound) for a tunnel in the 'up' state. During dynamic
tunnel rekeying there may be 0 to 4 SAs on the tunnel since
IKE removes the current SAs and adds new SAs.ro Gauge32 .1.3.6.1.4.1.838.3.14.1.4.1.14 |
ipsecTunnelTotSAsThe total number of security associations (SAs) created
for this tunnel since the tunnel was configured. For dynamic
tunnels, this object gives an indication of how many IKE
rekeying events have occured. Every time a dynamic tunnel
successfully rekeys, new inbound and outbound SAs are created
and this object is incremented by 2.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.15 |
ipsecTunnelInPktsThe total number of packets received on the tunnel since it
was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.16 |
ipsecTunnelInOctetsThe total number of bytes received on the tunnel since it
was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.17 |
ipsecTunnelInDiscardsQueFullThe total number of packets received on the tunnel which
had to be dropped because of a full queue.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.18 |
ipsecTunnelInErrsInvalidMacThe total number of packets received on the tunnel with
invalid authentication data.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.19 |
ipsecTunnelInErrsInvalidSeqThe total number of packets received on the tunnel with
an invalid sequence number.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.20 |
ipsecTunnelInErrsInvalidFormatThe total number of packets received on the tunnel with
a valid sequence number and authentication data (if
applicable), but an invalid packet format. For instance
if the packet has an invalid length or next header.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.21 |
ipsecTunnelOutPktsThe total number of packets transmitted out the tunnel
since it was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.22 |
ipsecTunnelOutOctetsThe total number of bytes transmitted out the tunnel
since it was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.23 |
ipsecTunnelOutDiscardsStateNotUpThe total number of packets that could not be sent out
the tunnel because the tunnel state was not up.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.24 |
ipsecTunnelOutDiscardsNoSAThe total number of packets that could not be sent out
the tunnel because there was no security association (SA).ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.25 |
ipsecTunnelOutDiscardsQueFullThe total number of packets that could not be sent out
the tunnel because the transform engine's queue was full.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.26 |
ipsecTunnelRowStatusThis object allows entries to be created and deleted in this
table.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.838.3.14.1.4.1.27 |
ipsecTunnelInCompressedPktsThe total number of compressed packets received on the tunnel
since it was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.28 |
ipsecTunnelInCompressedOctetsThe total number of bytes after decompression in
compressed packets received on the tunnel
since it was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.29 |
ipsecTunnelOutCompressedPktsThe total number of compressed packets transmitted out the tunnel
since it was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.30 |
ipsecTunnelOutCompressedOctetsThe total number of bytes prior to compression in
compressed packets transmitted out the tunnel
since it was created.ro Counter32 .1.3.6.1.4.1.838.3.14.1.4.1.31 |
ipsecSaTableSecurity Association (SA) table. Each entry in the table is a
Security Association. SA's are associated with a single IPSec
tunnel or transport and indexed accordingly. SA's associated
with a tunnel will have the same ifIndex and name as the tunnel.
SA's associated with a transport have a zero ifIndex and the
same name as the transport.
Dynamic site-to-site and dialin-client tunnels have dynamic
SA's created dynamically by ISAKMP. Dialin-group tunnels
do not have associated SA's since these represent a group of
dialin-client tunnels which individually have SA's. Static
tunnels have static SA's created manually. SEQUENCE OF IpsecSaEntry .1.3.6.1.4.1.838.3.14.1.5 |
ipsecSaEntryInformation about a specific Security Association. IpsecSaEntry .1.3.6.1.4.1.838.3.14.1.5.1 |
ipsecSaNameThe name of the tunnel or transport that this Security
Association is associated with. DisplayString .1.3.6.1.4.1.838.3.14.1.5.1.1 |
ipsecSaIndexA numeric index to allow multiple Security Associations per
tunnel or transport. Unsigned32 .1.3.6.1.4.1.838.3.14.1.5.1.2 |
ipsecSaSpiSecurity profile index. For static or dynamic inbound SAs,
SPI is selected by us. For dynamic outbound SAs, SPI is
selected by peer. For static outbound SAs, SPI is manually
configured.rw Unsigned32 .1.3.6.1.4.1.838.3.14.1.5.1.3 |
ipsecSaCreationSpecifies how SA was created. Manually configured SAs will
have the value static(1). Dynamical SAs such as those created by
key management protocols such as ISA-KMP will have the value
dynamic(2).ro Enumeration .1.3.6.1.4.1.838.3.14.1.5.1.4 |
ipsecSaDirectionSA direction. Traffic SAs are unidirectional whereas
key management protocol SAs such as ISA-KMP are bidirectional.rw Enumeration .1.3.6.1.4.1.838.3.14.1.5.1.5 |
ipsecSaProtocolSpecifies the SA protocol type.rw Enumeration .1.3.6.1.4.1.838.3.14.1.5.1.6 |
ipsecSaEncryptionKeyThe SAs encryption key. For a dynamic SA, the encryption
key is negotiated by the key management protocol such as
ISAKMP and is not writeable. For static SAs, the keys are
manually configured.rw IpsecKeyValue .1.3.6.1.4.1.838.3.14.1.5.1.7 |
ipsecSaAuthenticationKeyFor dynamic SAs, the authentication keys have been negotiated
by ISAKMP. For static SA, the keys have been configured. For
static SA this is read-create object. For dynamic SA the
object is not accessible.rw IpsecKeyValue .1.3.6.1.4.1.838.3.14.1.5.1.8 |
ipsecSaInOutPktsIt counts a total number of frames since the SA was
created. For inbound SA it represents received frames. For
outbound SA it represent transmitted frames. For isakmp SA it
represents both received and transmitted frames.ro Counter32 .1.3.6.1.4.1.838.3.14.1.5.1.9 |
ipsecSaInOutOctetsIt counts a total number of bytes since the SA was
created. For inbound SA it represents received bytes. For
outbound SA it represent transmitted bytes. For isakmp SA it
represents both received and transmitted bytes.ro Counter32 .1.3.6.1.4.1.838.3.14.1.5.1.10 |
ipsecSaRowStatusThis object allows entries to be created and deleted in this
table. The only supported values supported are active(1),
createAndGo(4), and destroy(4).rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.838.3.14.1.5.1.11 |
ipsecConformance OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.14.2 |
ipsecCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.14.2.1 |
ipsecGroups OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.14.2.2 |