2004-09-14
This MIB module is an extension to CISCO-IKE-FLOW-MIB and contains Cisco Specific extensions for monitoring IKE. It is for monitoring the structures and status of IPsec control flows based on Internet Key Exchange protocol. Acronyms The following acronyms are used in this document: Flow, Tunnel: An ISAKMP SA can be regarded as representing a flow of ISAKMP/IKE traffic. Hence an ISAKMP is referred to as a 'Phase 1 Tunnel' in this document. IPsec: Secure IP Protocol. ISAKMP: Internet Security Association and Key Management Protocol. IKE: Internet Key Exchange Protocol. FCSP: Fibre Channel Security Protocol. SA: Security Association (ref: rfc2408). Phase 2 Tunnel: AN instance of a non-ISAKMP SA bundle in which all the SA share the same proxy identifiers protect the same stream of application traffic. Such an SA bundle is termed a 'Phase 2 Tunnel'. Note that a Phase 2 tunnel may comprise different SA bundles and different number of SA bundles at different times (due to key refresh).
Download CISCO-IKE-FLOW-EXT-MIB.txt Open CISCO-IKE-FLOW-EXT-MIB.txt in a new tab
| Name | OID |
|---|---|
| cifeClearAllTunnels | 1.3.6.1.4.1.9.9.428.1.1.1 |
| Name | OID |
|---|---|
| cifeTunnelExtTable | 1.3.6.1.4.1.9.9.428.1.2 |
END OF TOC
1.3.6.1.4.1.9.9.428.1.1.1
INTEGER1 = none2 = clearIPSec3 = clearFCSP · Integer32
Clears all the tunnels of a specific type. 'none' is returned on reading this object. 'clearIPSec' all the IPSec tunnels are cleared. 'clearFCSP' all FCSP tunnels are cleared.
1.3.6.1.4.1.9.9.428.1.2
Index: cifeTunnelExtDoi · cisgIpsSgProtocol · cisgIpsSgTunIndex
The Phase-1 Internet Key Exchange Tunnel Table. There is one entry in this table for each active IKE tunnel. This table is an extension to cifIkeTunnelTable defined in CISCO-IKE-FLOW-MIB. Some information in this table is also present in the cisgIpsSgTunnelTable, but the table is indexed differently so that the rows in this table are grouped/ordered by domain of interpretation (DOI).
from CISCO-IPSEC-SIGNALING-MIB
CIPsecControlProtocol1 = cpUnknown2 = cpAll3 = cpOther4 = cpManual5 = cpIkev16 = cpIkev27 = cpKink8 = cpPhoturisThe protocol used for keying and control in IPsec connections. The value of 'cpManual' indicates manual administration of IPsec tunnels. This enumeration will be expanded as new keying protocols are standardized. The value 'cpAll' does not denote a specific keying protocol; it has been defined only as a convenience to facilitate aggregation of metrics across all control protocols. Description of enum constants of this type: cpManual: Denotes manual keying (i.e., no signaling). cpIkev1: Denotes keying signaling using IKEv1 protocol. cpIkev2: Denotes keying signaling using IKEv2 protocol. cpKink: Denotes keying signaling using KINK. cpPhoturis: Denotes keying signaling using Photuris. · Integer32
The identity of the signaling protocol used by the control tunnel corresponding to this conceptual row.
CIPsecPhase1TunnelIndexThe index of the IPsec Phase-1 (IKE) Tunnel Table. An index of this type is a number which begins at 1 and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647. (1..2147483647) · Unsigned32
The index of the Phase-1 Tunnel Table. The value of the index is a number which begins at 1 and is incremented with each tunnel that is created. The value of this object will wrap at 4,294,967,296.
1.3.6.1.4.1.9.9.428.1.2.1.1
CIKEIsakmpDoi1 = isakmpDoiUnknown2 = isakmpDoiOther3 = isakmpDoiIPsec4 = isakmpDoiFcsp5 = isakmpDoiCps6 = isakmpDoiFcCtAuthThe Domain of Interpretation of the IKE implementation. This type is used to implement distinctions between the configuration of the IKE implementation for distinct Phase 2 protocols that use IKE. Description of enum constants of this type: isakmpDoiIPsec: Denotes that IPsec protocol is used in Phase-2 isakmpDoiFcsp: Denotes that FC-SP protocol is used in Phase-2 isakmpDoiCps: Denotes that Cps protocol is used in Phase-2 isakmpDoiFcCtAuth: Denotes that Fc-Ct-Auth protocol is used in Phase-2 · Integer32
This identifies the DOI of Phase-2 operations in which this control tunnel operates. This may be used to identify the Phase-2 protocol.
1.3.6.1.4.1.9.9.428.1.2.1.2
CIPsecPhase1PeerIdentityType1 = idOther2 = idIpv4Addr3 = idFqdn4 = idDn5 = idIpv6Addr6 = idUserFqdn7 = idIpv4AddrSubnet8 = idIpv6AddrSubnet9 = idIpv4AddrRange10 = idIpv6AddrRange11 = idDerAsn1Gn12 = idKeyId13 = idWwnThe type of IPsec Phase-1 peer identity. The peer may be identified by one of the ID types defined in IPSEC DOI. Description of enum constants of this type: idIpv4Addr: IPv4 address idFqdn: Fully QUalified Domain Name idDn: Represents the binary DER encoding of the identity. idIpv6Addr: IPv6 address idUserFqdn: User FQDN (such as an email address). idIpv4AddrSubnet: IPv4 subnet specification (comprising a subnet identifier and a subnet mask). idIpv6AddrSubnet: IPv6 subnet specification (comprising a subnet identifier and a subnet mask). idIpv4AddrRange: A range of IPv4 addresses (comprising a starting address and an ending address) idIpv6AddrRange: A range of IPv6 addresses (comprising a starting address and an ending address) idDerAsn1Gn: The ASN.1 encoded general number. idKeyId: This is the symbolic name (key identifier). idWwn: World Wide Number or the encoding of the layer-2 address used by MDS switches.Reference: rfc2408 and rfc2409 · Integer32
The type of the identity used by the managed entity authenticating itself to the peer in the setup of the IKE tunnel corresponding to this conceptual row. This object would have same value as cisgIpsSgTunLocalType from CISCO-IPSEC-SIGNALLING-MIB.
1.3.6.1.4.1.9.9.428.1.2.1.3
SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (1..255) · OCTET STRING · hint 255t
The value of the local peer identity. This object would have same value as cisgIpsSgTunLocalValue from CISCO-IPSEC-SIGNALLING-MIB.
1.3.6.1.4.1.9.9.428.1.2.1.4
CIPsecPhase1PeerIdentityType1 = idOther2 = idIpv4Addr3 = idFqdn4 = idDn5 = idIpv6Addr6 = idUserFqdn7 = idIpv4AddrSubnet8 = idIpv6AddrSubnet9 = idIpv4AddrRange10 = idIpv6AddrRange11 = idDerAsn1Gn12 = idKeyId13 = idWwnThe type of IPsec Phase-1 peer identity. The peer may be identified by one of the ID types defined in IPSEC DOI. Description of enum constants of this type: idIpv4Addr: IPv4 address idFqdn: Fully QUalified Domain Name idDn: Represents the binary DER encoding of the identity. idIpv6Addr: IPv6 address idUserFqdn: User FQDN (such as an email address). idIpv4AddrSubnet: IPv4 subnet specification (comprising a subnet identifier and a subnet mask). idIpv6AddrSubnet: IPv6 subnet specification (comprising a subnet identifier and a subnet mask). idIpv4AddrRange: A range of IPv4 addresses (comprising a starting address and an ending address) idIpv6AddrRange: A range of IPv6 addresses (comprising a starting address and an ending address) idDerAsn1Gn: The ASN.1 encoded general number. idKeyId: This is the symbolic name (key identifier). idWwn: World Wide Number or the encoding of the layer-2 address used by MDS switches.Reference: rfc2408 and rfc2409 · Integer32
The type of the identity used by the peer in authenticating itself to the local entity in the setup of the IKE tunnel corresponding to this conceptual row. This object would have same value as cisgIpsSgTunRemoteType from CISCO-IPSEC-SIGNALLING-MIB.
1.3.6.1.4.1.9.9.428.1.2.1.5
SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (1..255) · OCTET STRING · hint 255t
The value of the remote peer identity. This object would have same value as cisgIpsSgTunRemoteValue from CISCO-IPSEC-SIGNALLING-MIB.