IEEE8021X-PAE-MIB

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

An interface index indicates the port number associated with this port. Each PAE is uniquely identified by a port number. The port number used is unique amongst all port numbers for the system, and directly or indirectly identifies the Uncontrolled Port that supports the PAE. If the PAE indicates a real port, ieee8021XPaePortType object in the same row is 'realPort', the port number shall be the same as the ieee8021XPaeCommonPortNumber object in the same row for the associated PAC or SecY. If the PAE indicates a virtual port, ieee8021XPaePortType object in the same row is 'virtualPort', this port number should be the same as the uncontrolledPortNumber object in the same row for the associated PAC or SecY. ⓘ

INTEGER1 = realPort2 = virtualPort · Integer32

The port type of the PAE. realPort(1) : indicates the PAE is for a real port. virtualPort(2) : indicates the PAE is for a virtual port. ⓘ

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

An interface index indicates the port number associated with PAC or SecY's Controlled Port. ⓘ

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

An interface index indicates the port number associated with PAC or SecY's Uncontrolled Port. If the PAE supports a real port, this port number can be the same as the ieee8021XPaeCommonPortNumber object in the same row, otherwise it shall not be the same. ⓘ

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

An interface index indicates the port number associated with PAC or SecY's 'Common Port'. All the virtual ports created for a given real port share the same 'Common Port' and ieee8021XPaeCommonPortNumber in the same row. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The initialization control for this Port. Setting this object 'true' causes the Port to be reinitialized, terminating (and potentially restarting) authentication exchanges and MKA operation. If the port is a real port, any virtual ports previously instantiated are deleted. Virtual ports can be reinstantiated through normal protocol operation. The object value reverts to 'false' once initialization has completed. ⓘ

BITS

The capabilities of this PAE port. 'suppImplemented' : A PACP EAP supplicant functions are implemented in this PAE if this bit is on. 'authImplemented' : A PACP EAP authenticator functions are implemented in this PAE if this bit is on. 'mkaImplemented' : The KaY MKA functions are implemented in this PAE if this bit is on. 'macsecImplemented' : The MACsec functions in the Controlled Port are implemented in this PAE if this bit is on. 'announcementsImplemented' : The EAPOL announcement can be sent in this PAE if this bit is on. 'listenerImplemented' : This PAE can receive EAPOL announcement if this bit is on. 'virtualPortsImplemented' : Virtual Port functions are implemented in this PAE if this bit is on. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Enable or disable to Virtual Ports function for this Real Port PAE, the object ieee8021XPaePortType in the same row has the value 'realPort'. If this PAE is not a Real Port, this object should be read only and returns 'false'. This object will be read only and returns 'false' if the value of the object ieee8021XPaePortCapabilities in the same row has the bit 'virtualPortsImplemented' off. ⓘ

Unsigned32

The maximum number of virtual ports can be supported in this port. ⓘ

Gauge32

The current number of virtual ports is running in this port. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be 'true' if the virtual port is created by receipt of an EAPOL-Start packet. ⓘ

MacAddressRepresents an 802 MAC address represented in the `canonical' order defined by IEEE 802.1a, i.e., as if it were transmitted least significant bit first, even though 802.5 (in contrast to other 802.x protocols) requires MAC addresses to be transmitted most significant bit first. SIZE (6) · OCTET STRING · hint 1x:

The source MAC address of the received EAPOL-Start if ieee8021XPaePortVirtualPortStart is set 'true'. If ieee8021XPaePortVirtualPortStart is not 'true' in the same row, the value of this object should be 00-00-00-00-00-00. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Enable or disable to transmit network announcement information. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

True if the Authenticator is enabled. This object is read only. It returns 'false' if the value of the object ieee8021XPaePortCapabilities in the same row has the bit 'authImplemented' Off, or if the local control variable 'enable' has not been set by the Logon Process. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

True if the Suppplicant is enabled. This object is read only. It returns 'false' if the PAE lacks supplicant functionality (ieee8021XPaePortCapabilities in the same row has the bit 'suppImplemented' off), or if the local control variable'enable' has not been set by the Logon Process (perhaps because the supplicant is designed to authenticate a human user and that user is not present). ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Enable or disable the MKA protocol function in this PAE. This object will be read only and returns 'false' if the value of the object ieee8021XPaePortCapabilities in the same row has the bit 'mkaImplemented' off. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Enable or disable the network Announcer function in this PAE. This object will be read only and returns 'false' if the value of the object ieee8021XPaePortCapabilities in the same row has the bit 'announcementsImplemented' off. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Enable or disable the network Listener function in this PAE. This object will be read only and returns 'false' if the value of the object ieee8021XPaePortCapabilities in the same row has the bit 'listenerImplemented' off. ⓘ

MacAddressRepresents an 802 MAC address represented in the `canonical' order defined by IEEE 802.1a, i.e., as if it were transmitted least significant bit first, even though 802.5 (in contrast to other 802.x protocols) requires MAC addresses to be transmitted most significant bit first. SIZE (6) · OCTET STRING · hint 1x:

The destination Group MAC Address used by this PAE when transmitting EAPOL frames. ⓘ

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

The index to identify the 'Controlled Port' interface for a PAC. ⓘ

INTEGER1 = forceTrue2 = forceFalse3 = auto · Integer32

An object to control the service connectivity to at most one other system. The ieee8021XPacPortOperPt2PtMAC indicates operational status of the service connectivity for this PAC. 'forceTrue' : allows only one service connection to the other system. 'forceFalse' : no restriction on the number of service connections to the other systems. 'auto' : means the service connectivity is determined by the service providing entity. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

An object to reflect the current service connectivity status. 'true' : means the service connectivity of this PAC Controlled Port provides at most one other system. 'false' : means the service connectivity of this PAC could provide more than one other system. ⓘ

INTEGER1 = pending2 = unauthenticated3 = authenticated4 = secure · Integer32

The Logon Process sets this variable to one of the following values, to indicate to the CP state machine if, and how, connectivity is to be provided through the Controlled Port : 'pending' : Prevent connectivity by disabling the Controlled Port of this PAE. 'unauthenticated' : Provide unsecured connectivity, enabling the Controlled Port of this PAE. 'authenticated' : Provide unsecured connectivity but with authentication, enabling Controlled Port of this PAE. 'secure' : Provide secure connectivity, using SAKs provided by the KaY (when available) and enabling Controlled Port when those keys are installed and in use. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' if Controlled Port communication is secured as specified by the MACsec. ⓘ

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

The index to identify the 'Controlled Port' interface's session information for a PAE. ⓘ

Counter64 (0..18446744073709551615) · Octets

The number of octets received in this session of this PAE. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ieee8021XPaePortSessionStartTime. ⓘ

Counter64 (0..18446744073709551615) · Octets

The number of octets transmitted in this session of this PAE. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ieee8021XPaePortSessionStartTime. ⓘ

Counter64 (0..18446744073709551615) · Packets

The number of packets received in this session of this PAE. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ieee8021XPaePortSessionStartTime. ⓘ

Counter64 (0..18446744073709551615) · Packets

The number of packets transmitted in this session of this PAE. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ieee8021XPaePortSessionStartTime. ⓘ

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (3..253) · OCTET STRING · hint 255t

The session identifier for this session of the PAE. A UTF-8 string, uniquely identifying the session within the context of the PAE's system. ⓘ

TimeStampThe value of the sysUpTime object at which a specific occurrence happened. The specific occurrence must be defined in the description of any object defined using this type. If sysUpTime is reset to zero as a result of a re- initialization of the network management (sub)system, then the values of all TimeStamp objects are also reset. However, after approximately 497 days without a re- initialization, the sysUpTime object will reach 2^^32-1 and then increment around to zero; in this case, existing values of TimeStamp objects do not change. This can lead to ambiguities in the value of TimeStamp objects. · TimeTicks

The starting time of this session. ⓘ

TimeIntervalA period of time, measured in units of 0.01 seconds. (0..2147483647) · Integer32

The duration time of the session has been last. ⓘ

INTEGER1 = macOperFailed2 = sysAccessDisableOrPortInit3 = receiveEapolLogOff4 = eapReauthFailure5 = mkaFailure6 = newSessionBegin7 = notTerminateYet · Integer32

The reason for the session termination, one of the following : 'macOperFailed' : 'Common Port' for this PAE is not operational. 'sysAccessDisableOrPortInit' : The ieee8021XPaeSysAccessControl object is set to 'false' or initialization process of this PAE is invoked. 'receiveEapolLogOff' : The PAE has received EAPOL-Logoff frame. 'eapReauthFailure' : EAP reauthentication has failed. 'mkaFailure' : MKA failure or other MKA termination. 'newSessionBegin' : New session beginning. 'notTerminateYet' : Not Terminated Yet. ⓘ

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..253) · OCTET STRING · hint 255t

The session user name for this session in the PAE. A UTF-8 string, representing the identity of the peer Supplicant. If no such information, zero length string will return. ⓘ

Ieee8021XPaeNIDThis textual convention indicates a Network Identifier (NID). Each network is identified by a NID, a UTF-8 string used by network attached systems to select a network profile.Reference: IEEE 802.1X Clause 12.6, Clause 10.1 SIZE (1..100) · OCTET STRING

The NID associated with the current connectivity (possibly unauthenticated) provided by the operation of the CP state machine. This object can differ from both the ieee8021XLogonNIDSelectedNID and the ieee8021XLogonNIDRequestedNID objects in the same row if authenticated connectivity (either secure or unsecured) has already been established, and EAP authentication and MKA operation for both of the latter have not met the necessary conditions (as specified by the control variables unauthAllowed and unsecureAllowed). ⓘ

Ieee8021XPaeNIDOrNullThis textual convention indicates a Network Identifier (NID). Each network is identified by a NID, a UTF-8 string used by network attached systems to select a network profile. If this is a zero length value, then the NULL string for NID information is applicable.Reference: IEEE 802.1X Clause 12.6, Clause 10.1 SIZE (0..100) · OCTET STRING

The NID marked as access requested in announcements, as determined from EAPOL-Start frames. The default of this object is as the configured value of object ieee8021XLogonNIDSelectedNID. This object information provides context for the PAE's EAP Authenticator. If no EAPOL-Start frame has been received since the PAE's 'Common Port' became operational, or the last EAPOL-Start frame received for the port did not contain a requested NID, the object will take on the value of the object ieee8021XLogonNIDSelectedNID in the same row. ⓘ

Ieee8021XPaeNIDOrNullThis textual convention indicates a Network Identifier (NID). Each network is identified by a NID, a UTF-8 string used by network attached systems to select a network profile. If this is a zero length value, then the NULL string for NID information is applicable.Reference: IEEE 802.1X Clause 12.6, Clause 10.1 SIZE (0..100) · OCTET STRING

The NID currently configured for use by an access 'Controlled Port' when transmitting EAPOL-Start frames. The default of this object is empty string. This object may be either explicitly configured by management or determined by the PAE using NID selection algorithms. If no authentication is in progress, and the current connectivity is terminated and then starts again, ieee8021XLogonNIDConnectedNID will take on the value of ieee8021XLogonNIDRequestedNID (though a PAE NID's election algorithm, if used, can subsequently select another NID). ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' by the PAE authenticator to request authentication, and if this object is 'true', reauthentication is allowed. This object will be 'false' while the PAE authenticator revokes authentication. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' by PACP if the PAE authenticator currently authenticated, and 'false' if the authentication fails or is revoked. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' by PACP if the authentication has failed or has been terminated. The cause could be a failure returned by EAP, either immediately or following a reauthentication, an excessive number of attempts to authenticate (either immediately or upon reauthentication), or the authenticator deasserting authenticate, the object authPaeAuthenticate in the same row is 'false'. The PACP will set the object authPaeAuthenticated false as well as setting the object 'true'. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object is set 'true' if PACP should initiate reauthentication periodically, 'false' otherwise. ⓘ

Unsigned32 (0..65535) · seconds

This object indicates a waiting period after a failed authentication attempt, before another attempt is permitted. ⓘ

Unsigned32 (0..65535) · seconds

This object indicates the time period of the reauthentication to the supplicant. ⓘ

Unsigned32 · times

The maximum number of authentication attempts before failure is reported to the Logon Process, and the authPaeQuietPeriod timer imposed before further attempts are permitted. ⓘ

Gauge32 · times

The count of the number of authentication attempts. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' by the PAE supplicant to request authentication, and if this object is 'true', reauthentication is allowed. This object will be 'false' while the PAE supplicant revokes authentication. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' by PACP if the PAE supplicant currently authenticated, and 'false' if the authentication fails or is revoked. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' by PACP if the authentication has failed or has been terminated. The cause could be a failure returned by EAP, either immediately or following a reauthentication, an excessive number of attempts to authenticate (either immediately or upon reauthentication), or the supplicant deasserting authenticate, the object ieee8021XSuppPaeAuthenticate in the same row is 'false'. The PACP will set the object ieee8021XSuppPaeAuthenticated false as well as setting the object 'true'. ⓘ

Unsigned32 (0..65535) · seconds

This object indicated a waiting time period after a failed authentication attempt, before another attempt is permitted. ⓘ

Unsigned32 · times

The maximum number of authentication attempts before failure is reported to the Logon Process, and the ieee8021XSuppPaeHelloPeriod timer imposed before further attempts are permitted. ⓘ

Gauge32 · times

The count of the number of authentication attempts. ⓘ

Counter32 · Packets

The number of invalid EAPOL frames of any type that have been received by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL frames that the Packet Body Length does not match a Packet Body that is contained within the octets of the received EAPOL MPDU in this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-Announcement frames that have been received by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-Announcement-Req frames that have been received by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL frames that are discarded because their processing would require the creation of a virtual port, for which there are inadequate or constrained resources, or an existing virtual port and no such port currently exists. If virtual port is not supported, this object should be always 0. ⓘ

Counter32 · Packets

The number of EAPOL-Start frames that have been received by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-EAP frames that have been received by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-Logoff frames that have been received by this PAE. ⓘ

Counter32 · Packets

The number of MKPDUs received with MKA not enabled or CKN not recognized in this PAE. ⓘ

Counter32 · Packets

The number of MKPDUs failing in message authentication on receipt process in this PAE. ⓘ

Unsigned32

The version of last received EAPOL frame by this PAE. ⓘ

MacAddressRepresents an 802 MAC address represented in the `canonical' order defined by IEEE 802.1a, i.e., as if it were transmitted least significant bit first, even though 802.5 (in contrast to other 802.x protocols) requires MAC addresses to be transmitted most significant bit first. SIZE (6) · OCTET STRING · hint 1x:

The source MAC address of last received EAPOL frame by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-EAP frames that have been transmitted by the supplicant of this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-Logoff frames that have been transmitted by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-Announcement frames that have been transmitted by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-Announcement-Req frames that have been transmitted by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-Start frames that have been transmitted by this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-EAP frames that have been transmitted by the authenticator of this PAE. ⓘ

Counter32 · Packets

The number of EAPOL-MKA frames with no CKN information that have been transmitted by this PAE. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be 'true' if there is at least one MKA active actor, transmitting MKPDUs ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be 'true' if the principal actor, i.e. the actor controlling the PAC or SecY associated with the KaY, has determined that Controlled Port communication communication should proceed without MACsec. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be 'true' if the principal actor has determined that communication should use MACsec. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be 'true' if the object ieee8021XKayMkaSecured in the same row is 'false' and MKA Life Time has elapsed since an MKA participant was last created. ⓘ

SecySCITextual convention for a Secure Channel Identifier (SCI). Each SC is identified by an SCI comprising a 48-bit MAC Address, allocated to the transmitting system and a 16-bit Port Identifier.Reference: IEEE 802.1AE Clause 7.1.2 and figure 7.7 SIZE (8) · OCTET STRING

The SCI assigned by the system to the port, applies to all the port's MKA actors. ⓘ

Ieee8021XMkaKeyServerPriorityThis textual convention indicates a Key Server priority information. Each MKA participant encodes a Key Server Priority, an 8-bit integer, in each MKPDU. Each participant selects the live participant advertising the highest priority as its Key Server provided that participant has not selected another as its Key Server or is unwilling to act as the Key Server. If a Key Server cannot be selected SAKs are not distributed. In the event of a tie for highest priority Key Server, the member with the highest priority SCI is chosen. For consistency with other uses of the SCI's MAC Address component as a priority, numerically lower values of the Key Server Priority and SCI are accorded the highest priority. The Table 9-2 contains recommendations for the use of priority values for various system roles. Participants that will never act as a Key Server should advertise priority 0xFF.Reference: IEEE 802.1X Clause 9.5, Table 9-2 SIZE (1) · OCTET STRING

The Key Server priority for all the port's MKA actors. Each participant encodes a key server priority, an 8-bit integer, in each MKPDU. ⓘ

Ieee8021XMkaKeyServerPriorityThis textual convention indicates a Key Server priority information. Each MKA participant encodes a Key Server Priority, an 8-bit integer, in each MKPDU. Each participant selects the live participant advertising the highest priority as its Key Server provided that participant has not selected another as its Key Server or is unwilling to act as the Key Server. If a Key Server cannot be selected SAKs are not distributed. In the event of a tie for highest priority Key Server, the member with the highest priority SCI is chosen. For consistency with other uses of the SCI's MAC Address component as a priority, numerically lower values of the Key Server Priority and SCI are accorded the highest priority. The Table 9-2 contains recommendations for the use of priority values for various system roles. Participants that will never act as a Key Server should advertise priority 0xFF.Reference: IEEE 802.1X Clause 9.5, Table 9-2 SIZE (1) · OCTET STRING

The priority of the elected Key Server through MKA in the CA. ⓘ

SecySCITextual convention for a Secure Channel Identifier (SCI). Each SC is identified by an SCI comprising a 48-bit MAC Address, allocated to the transmitting system and a 16-bit Port Identifier.Reference: IEEE 802.1AE Clause 7.1.2 and figure 7.7 SIZE (8) · OCTET STRING

The SCI for key server for the MKA principal actor. The length of this object is 0 if there is no principal actor, or that actor has no live peers. This object matches the ieee8021XKayMkaActorSCI object in the same row if the actor is the key server. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be 'true' if the KaY will accept Group CAKs distributed by MKA protocol. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be 'true' if the KaY will attempt to use point-to-point CAKs to distribute a group CAK, if it is the Key Server for the MKA instances for all the point-to-point CAKs. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object is set 'true' if a new Group CAK is to be distributed if the KaY is the Key Server for the MKA instances for all the point-to-point CAKs. This object will be set 'false' by the KaY when distribution is complete. ⓘ

INTEGER0 = noMACsec1 = macSecCapability12 = macSecCapability23 = macSecCapability3 · Integer32

This object indicates whether MACsec is implemented, and if so whether the implementation provides integrity protection only, integrity and integrity with confidentiality, or integrity and integrity with confidentiality with a selectable confidentiality offset of 0, 30, or 50 octets (see IEEE Std 802.1AE). 'noMACsec' : the MACsec is not implemented. 'macSecCapability1' : capable in 'integrity protection without confidentiality'. 'macSecCapability2' : capable in 'integrity protection without confidentiality' and integrity protection and confidentiali with a confidentiality offset 0',. 'macSecCapability3' : capable in 'integrity protection without confidentiality' and integrity protection and confidentiali with a confidentiality offset 0, 30 or 50'. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object will be set 'true' if the MKA participants desire the use of MACsec to protect frames with this KaY. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The status of the MACsec protection function for this KaY. 'true' : then the status of the MACsec protection function will be as object secyIfProtectFramesEnable object configured in the IEEE8021-SECY-MIB. 'false' : then the MACsec protection function is disabled by this KaY. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The status of the MACsec replay protection function for this KaY. 'true' : then the status of the MACsec replay protection function will be as secyIfReplayProtectEnable object configured in the IEEE8021-SECY-MIB. 'false' : then the MACsec replay protection function is disabled by this KaY. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The status of the MACsec validation function for this KaY. 'true' : then the status of the MACsec validation function will be as secyIfValidateFrames object configured in the IEEE8021-SECY-MIB. 'false' : then the MACsec validation function is enabled but only for checking without filtering out invalid frames by the SecY. ⓘ

Integer32 (0 | 30 | 50) · bytes

The confidentiality protection offset options for the selected cipher suite in the MACsec. If the cipher suite does not have this capability, the configured value of the object will not apply to the cipher suite. ⓘ

Ieee8021XMkaKNThis textual convention indicates a Key Number (KN) used in MKA. The MN is a 32-bit integer assigned by that Key Server (sequentially, beginning with 1).Reference: IEEE 802.1X Clause 9.8 (1..2147483648) · Unsigned32 · hint d

The key number assigned by the key server to the SAK currently being used for transmission. This object will be 0 if MACsec is not being used or the key number is not available yet. ⓘ

RowPointerRepresents a pointer to a conceptual row. The value is the name of the instance of the first accessible columnar object in the conceptual row. For example, ifIndex.3 would point to the 3rd row in the ifTable (note that if ifIndex were not-accessible, then ifDescr.3 would be used instead). · OBJECT IDENTIFIER

The AN assigned by the key server for use with the key number for transmission. This row pointer will point to an entry in the secyTxSATable which the secyTxSCEncodingSA object also points to in the IEEE8021-SECY-MIB. If MACsec is not in use or the AN is not identified yet, the value of this object shall be set to the OBJECT IDENTIFIER { 0 0 }. ⓘ

Ieee8021XMkaKNThis textual convention indicates a Key Number (KN) used in MKA. The MN is a 32-bit integer assigned by that Key Server (sequentially, beginning with 1).Reference: IEEE 802.1X Clause 9.8 (1..2147483648) · Unsigned32 · hint d

The key number assigned by the key server to the oldest SAK currently being used for reception. It is the same as the key number for transmission if a single SAK is currently in use. This object will be 0 if MACsec is not being used or the key number is not available yet. ⓘ

RowPointerRepresents a pointer to a conceptual row. The value is the name of the instance of the first accessible columnar object in the conceptual row. For example, ifIndex.3 would point to the 3rd row in the ifTable (note that if ifIndex were not-accessible, then ifDescr.3 would be used instead). · OBJECT IDENTIFIER

The AN assigned by the key server for use with the key number for reception. It is the same as AN for transmission if a single SAK is currently in use. This row pointer will point to an entry in the secyRxSATable which the secyRxSCCurrentSA object also points to in the IEEE8021-SECY-MIB. If MACsec is not in use or the AN is not identified yet, the value of this object shall be set to the OBJECT IDENTIFIER { 0 0 }. ⓘ

INTEGER (1..120) · Integer32

Set by management to a non-zero number of seconds between 1 and MKA Suspension Limit to initiate a suspension (9.18) of that duration (if the KaY's principal actor is the Key Server) or to request a suspension (otherwise) ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The status of the suspendOnRequest function for this KaY. 'true' : then the KaY's principal actor will initiate a suspension if it is the Key Server and another participant has requested a suspension by transmitting a non-zero value of its suspendFor parameter 'false' : then the KaY will not initiate a suspension on request from another participant. ⓘ

INTEGER (1..126) · Integer32

Read by management to determine if a suspension is in progress and to discover the remaining duration of that suspension. May be set directly to coordinate in-service upgrades. ⓘ

Ieee8021XPaeCKNThis textual convention indicates the CAK name to identify the Connectivity Association Key (CAK) which is the root key in the MACsec Key Agreement key hierarchy. All potential members of the CA use the same CKN.Reference: IEEE 802.1X Clause 5.4, Clause 9.3.1, Clause 6.2 SIZE (1..16) · OCTET STRING

The CKN information for this MKA participant. ⓘ

Ieee8021XPaeKMDThis textual convention indicates a Key Management Domain (KMD). KMD is a string of UTF-8 characters that names the transmitting authenticator's key management domain.Reference: IEEE 802.1X Clause 12.6 SIZE (0..253) · OCTET STRING

The KMD information for this MKA participant. ⓘ

Ieee8021XPaeNIDThis textual convention indicates a Network Identifier (NID). Each network is identified by a NID, a UTF-8 string used by network attached systems to select a network profile.Reference: IEEE 802.1X Clause 12.6, Clause 10.1 SIZE (1..100) · OCTET STRING

The NID information for this MKA participant. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object is set 'true' by the KaY if the participant's parameters are cached. If this object is 'true', this object can be set 'false' cleared by management to remove the participant's parameters from the cache. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object is set 'true' if the participant is active, i.e. is currently transmitting periodic MKPDUs. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object is set 'true' to retain the participant in the cache, even if the KaY would normally remove it (due to lack of use for example) ⓘ

INTEGER1 = default2 = disabled3 = onOperUp4 = always · Integer32

This object is for controlling the participant's behavior when the participant is activated. 'default' : the participant is from cached entries created by the KaY as part of normal operation, without explicit management, and is activated according to the implementation dependent policies of the KaY. 'disabled' : the participant allows the cache information to be retained, but disabled for indefinite period. 'onOperUp' : causing the participant to be activated when the PAE's 'Uncontrolled Port' becomes operational and when the PAE resumes following suspension. 'always' : causing the participant to remain active all the time, even in the continued absence of partners. If the object changed to disabled(1) or onOperUp(3), the participant ceases operation immediately and receipt of MKPDUs with a matching CKN during a subsequent period of twice MKA lifetime will not cause the participant to become active once more. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object is set 'true' if the participant is currently the principal actor. ⓘ

Ieee8021XPaeCKNOrNullThis textual convention indicates the CAK name to identify the Connectivity Association Key (CAK) which is the root key in the MACsec Key Agreement key hierarchy. All potential members of the CA use the same CKN. If this is a zero length value, then the NULL string means CKN information is applicable.Reference: IEEE 802.1X Clause 5.4, Clause 9.3.1, Clause 6.2 SIZE (0..16) · OCTET STRING

The CKN for the last CAK distributed either by the actor or one of its partners. Empty string for this object will be provided if this participant has not been used to distribute a CAK or the participant is not active, i.e. the object ieee8021XKayMkaPartActive in the same row is 'false'. ⓘ

RowStatus1 = active2 = notInService3 = notReady4 = createAndGo5 = createAndWait6 = destroyThe RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of [2].) The status column has six defined values: - `active', which indicates that the conceptual row is available for use by the managed device; - `notInService', which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device (see NOTE below); 'notInService' has no implication regarding the internal consistency of the row, availability of resources, or consistency with the current state of the managed device; - `notReady', which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device (i.e., one or more required columns in the conceptual row have not been instanciated); - `createAndGo', which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; - `createAndWait', which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, - `destroy', which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row. Whereas five of the six values (all except `notReady') may be specified in a management protocol set operation, only three values will be returned in response to a management protocol retrieval operation: `notReady', `notInService' or `active'. That is, when queried, an existing conceptual row has only three states: it is either available for use by the managed device (the status column has value `active'); it is not available for use by the managed device, though the agent has sufficient information to attempt to make it so (the status column has value `notInService'); or, it is not available for use by the managed device, and an attempt to make it so would fail because the agent has insufficient information (the state column has value `notReady'). NOTE WELL This textual convention may be used for a MIB table, irrespective of whether the values of that table's conceptual rows are able to be modified while it is active, or whether its conceptual rows must be taken out of service in order to be modified. That is, it is the responsibility of the DESCRIPTION clause of the status column to specify whether the status column must not be `active' in order for the value of some other column of the same conceptual row to be modified. If such a specification is made, affected columns may be changed by an SNMP set PDU if the RowStatus would not be equal to `active' either immediately before or after processing the PDU. In other words, if the PDU also contained a varbind that would change the RowStatus value, the column in question may be changed if the RowStatus was not equal to `active' as the PDU was received, or if the varbind sets the status to a value other than 'active'. Also note that whenever any elements of a row exist, the RowStatus column must also exist. To summarize the effect of having a conceptual row with a status column having a SYNTAX clause value of RowStatus, consider the following state diagram: STATE +--------------+-----------+-------------+------------- | A | B | C | D | |status col.|status column| |status column | is | is |status column ACTION |does not exist| notReady | notInService| is active --------------+--------------+-----------+-------------+------------- set status |noError ->D|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndGo |inconsistent- | | | | Value| | | --------------+--------------+-----------+-------------+------------- set status |noError see 1|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndWait |wrongValue | | | --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError column to | Value| entValue| | active | | | | | | or | | | | | | | |see 2 ->D|see 8 ->D| ->D --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError ->C column to | Value| entValue| | notInService | | | | | | or | | or | | | | | |see 3 ->C| ->C|see 6 --------------+--------------+-----------+-------------+------------- set status |noError |noError |noError |noError ->A column to | | | | or destroy | ->A| ->A| ->A|see 7 --------------+--------------+-----------+-------------+------------- set any other |see 4 |noError |noError |see 5 column to some| | | | value | | see 1| ->C| ->D --------------+--------------+-----------+-------------+------------- (1) goto B or C, depending on information available to the agent. (2) if other variable bindings included in the same PDU, provide values for all columns which are missing but required, and all columns have acceptable values, then return noError and goto D. (3) if other variable bindings included in the same PDU, provide legal values for all columns which are missing but required, then return noError and goto C. (4) at the discretion of the agent, the return value may be either: inconsistentName: because the agent does not choose to create such an instance when the corresponding RowStatus instance does not exist, or inconsistentValue: if the supplied value is inconsistent with the state of some other MIB object's value, or noError: because the agent chooses to create the instance. If noError is returned, then the instance of the status column must also be created, and the new state is B or C, depending on the information available to the agent. If inconsistentName or inconsistentValue is returned, the row remains in state A. (5) depending on the MIB definition for the column/table, either noError or inconsistentValue may be returned. (6) the return value can indicate one of the following errors: wrongValue: because the agent does not support notInService (e.g., an agent which does not support createAndWait), or inconsistentValue: because the agent is unable to take the row out of service at this time, perhaps because it is in use and cannot be de-activated. (7) the return value can indicate the following error: inconsistentValue: because the agent is unable to remove the row at this time, perhaps because it is in use and cannot be de-activated. (8) the transition to D can fail, e.g., if the values of the conceptual row are inconsistent, then the error code would be inconsistentValue. NOTE: Other processing of (this and other varbinds of) the set request may result in a response other than noError being returned, e.g., wrongValue, noCreation, etc. Conceptual Row Creation There are four potential interactions when creating a conceptual row: selecting an instance-identifier which is not in use; creating the conceptual row; initializing any objects for which the agent does not supply a default; and, making the conceptual row available for use by the managed device. Interaction 1: Selecting an Instance-Identifier The algorithm used to select an instance-identifier varies for each conceptual row. In some cases, the instance- identifier is semantically significant, e.g., the destination address of a route, and a management station selects the instance-identifier according to the semantics. In other cases, the instance-identifier is used solely to distinguish conceptual rows, and a management station without specific knowledge of the conceptual row might examine the instances present in order to determine an unused instance-identifier. (This approach may be used, but it is often highly sub-optimal; however, it is also a questionable practice for a naive management station to attempt conceptual row creation.) Alternately, the MIB module which defines the conceptual row might provide one or more objects which provide assistance in determining an unused instance-identifier. For example, if the conceptual row is indexed by an integer-value, then an object having an integer-valued SYNTAX clause might be defined for such a purpose, allowing a management station to issue a management protocol retrieval operation. In order to avoid unnecessary collisions between competing management stations, `adjacent' retrievals of this object should be different. Finally, the management station could select a pseudo-random number to use as the index. In the event that this index was already in use and an inconsistentValue was returned in response to the management protocol set operation, the management station should simply select a new pseudo-random number and retry the operation. A MIB designer should choose between the two latter algorithms based on the size of the table (and therefore the efficiency of each algorithm). For tables in which a large number of entries are expected, it is recommended that a MIB object be defined that returns an acceptable index for creation. For tables with small numbers of entries, it is recommended that the latter pseudo-random index mechanism be used. Interaction 2: Creating the Conceptual Row Once an unused instance-identifier has been selected, the management station determines if it wishes to create and activate the conceptual row in one transaction or in a negotiated set of interactions. Interaction 2a: Creating and Activating the Conceptual Row The management station must first determine the column requirements, i.e., it must determine those columns for which it must or must not provide values. Depending on the complexity of the table and the management station's knowledge of the agent's capabilities, this determination can be made locally by the management station. Alternately, the management station issues a management protocol get operation to examine all columns in the conceptual row that it wishes to create. In response, for each column, there are three possible outcomes: - a value is returned, indicating that some other management station has already created this conceptual row. We return to interaction 1. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it should supply a value for this column when the conceptual row is to be created. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. Once the column requirements have been determined, a management protocol set operation is accordingly issued. This operation also sets the new instance of the status column to `createAndGo'. When the agent processes the set operation, it verifies that it has sufficient information to make the conceptual row available for use by the managed device. The information available to the agent is provided by two sources: the management protocol set operation which creates the conceptual row, and, implementation-specific defaults supplied by the agent (note that an agent must provide implementation-specific defaults for at least those objects which it implements as read-only). If there is sufficient information available, then the conceptual row is created, a `noError' response is returned, the status column is set to `active', and no further interactions are necessary (i.e., interactions 3 and 4 are skipped). If there is insufficient information, then the conceptual row is not created, and the set operation fails with an error of `inconsistentValue'. On this error, the management station can issue a management protocol retrieval operation to determine if this was because it failed to specify a value for a required column, or, because the selected instance of the status column already existed. In the latter case, we return to interaction 1. In the former case, the management station can re-issue the set operation with the additional information, or begin interaction 2 again using `createAndWait' in order to negotiate creation of the conceptual row. NOTE WELL Regardless of the method used to determine the column requirements, it is possible that the management station might deem a column necessary when, in fact, the agent will not allow that particular columnar instance to be created or written. In this case, the management protocol set operation will fail with an error such as `noCreation' or `notWritable'. In this case, the management station decides whether it needs to be able to set a value for that particular columnar instance. If not, the management station re-issues the management protocol set operation, but without setting a value for that particular columnar instance; otherwise, the management station aborts the row creation algorithm. Interaction 2b: Negotiating the Creation of the Conceptual Row The management station issues a management protocol set operation which sets the desired instance of the status column to `createAndWait'. If the agent is unwilling to process a request of this sort, the set operation fails with an error of `wrongValue'. (As a consequence, such an agent must be prepared to accept a single management protocol set operation, i.e., interaction 2a above, containing all of the columns indicated by its column requirements.) Otherwise, the conceptual row is created, a `noError' response is returned, and the status column is immediately set to either `notInService' or `notReady', depending on whether it has sufficient information to (attempt to) make the conceptual row available for use by the managed device. If there is sufficient information available, then the status column is set to `notInService'; otherwise, if there is insufficient information, then the status column is set to `notReady'. Regardless, we proceed to interaction 3. Interaction 3: Initializing non-defaulted Objects The management station must now determine the column requirements. It issues a management protocol get operation to examine all columns in the created conceptual row. In the response, for each column, there are three possible outcomes: - a value is returned, indicating that the agent implements the object-type associated with this column and had sufficient information to provide a value. For those columns to which the agent provides read-create access (and for which the agent allows their values to be changed after their creation), a value return tells the management station that it may issue additional management protocol set operations, if it desires, in order to change the value associated with this column. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. However, the agent does not have sufficient information to provide a value, and until a value is provided, the conceptual row may not be made available for use by the managed device. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it must issue additional management protocol set operations, in order to provide a value associated with this column. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. If the value associated with the status column is `notReady', then the management station must first deal with all `noSuchInstance' columns, if any. Having done so, the value of the status column becomes `notInService', and we proceed to interaction 4. Interaction 4: Making the Conceptual Row Available Once the management station is satisfied with the values associated with the columns of the conceptual row, it issues a management protocol set operation to set the status column to `active'. If the agent has sufficient information to make the conceptual row available for use by the managed device, the management protocol set operation succeeds (a `noError' response is returned). Otherwise, the management protocol set operation fails with an error of `inconsistentValue'. NOTE WELL A conceptual row having a status column with value `notInService' or `notReady' is unavailable to the managed device. As such, it is possible for the managed device to create its own instances during the time between the management protocol set operation which sets the status column to `createAndWait' and the management protocol set operation which sets the status column to `active'. In this case, when the management protocol set operation is issued to set the status column to `active', the values held in the agent supersede those used by the managed device. If the management station is prevented from setting the status column to `active' (e.g., due to management station or network failure) the conceptual row will be left in the `notInService' or `notReady' state, consuming resources indefinitely. The agent must detect conceptual rows that have been in either state for an abnormally long period of time and remove them. It is the responsibility of the DESCRIPTION clause of the status column to indicate what an abnormally long period of time would be. This period of time should be long enough to allow for human response time (including `think time') between the creation of the conceptual row and the setting of the status to `active'. In the absence of such information in the DESCRIPTION clause, it is suggested that this period be approximately 5 minutes in length. This removal action applies not only to newly-created rows, but also to previously active rows which are set to, and left in, the notInService state for a prolonged period exceeding that which is considered normal for such a conceptual row. Conceptual Row Suspension When a conceptual row is `active', the management station may issue a management protocol set operation which sets the instance of the status column to `notInService'. If the agent is unwilling to do so, the set operation fails with an error of `wrongValue' or `inconsistentValue'. Otherwise, the conceptual row is taken out of service, and a `noError' response is returned. It is the responsibility of the DESCRIPTION clause of the status column to indicate under what circumstances the status column should be taken out of service (e.g., in order for the value of some other column of the same conceptual row to be modified). Conceptual Row Deletion For deletion of conceptual rows, a management protocol set operation is issued which sets the instance of the status column to `destroy'. This request may be made regardless of the current value of the status column (e.g., it is possible to delete conceptual rows which are either `notReady', `notInService' or `active'.) If the operation succeeds, then all instances associated with the conceptual row are immediately removed. · Integer32

The object to create the parameters for the supported participant information in the system. If the participant information is from downloaded policies, this object is 'active'. ⓘ

Ieee8021XMkaMIThis textual convention indicates a Member Identifier (MI). The MI is a 96-bit random value chosen when the MKA Instance begins, used with a 32-bit MN to protect against replay attacks and to record liveliness in the Live Peer List or potential liveliness in the Potential Peer List. If the MN wraps, a new random MI value is chosen and the MN begins again at 1.Reference: IEEE 802.1X Clause 9.4.2 SIZE (12) · OCTET STRING

The peer entry's MI information in the peer list of this active participant in MKA protocol. ⓘ

Ieee8021XMkaMNThis textual convention indicates a Member Number (MN). The MN is a 32-bit value which begins at 1 and increases for each MKPDU transmitted. It is used with the MI to protect against replay attacks and to record liveliness in the Live Peers List or potential liveliness in the Potential Peer List. If the MN wraps, a new random MI value is chosen and the MN begins again at a value of 1.Reference: IEEE 802.1X Clause 9.4.2 (1..2147483648) · Unsigned32 · hint d

The peer entry's latest MN information in the peer list of this active participant in MKA protocol. ⓘ

INTEGER1 = livePeerList2 = potentialPeerList · Integer32

The peer entry's type in the peer list of this active participant in MKA protocol. 'livePeerList' : the peer entry is in the Live Peer List. 'potentialPeerList' : the peer entry is in the Potential Peer List. ⓘ

SecySCITextual convention for a Secure Channel Identifier (SCI). Each SC is identified by an SCI comprising a 48-bit MAC Address, allocated to the transmitting system and a 16-bit Port Identifier.Reference: IEEE 802.1AE Clause 7.1.2 and figure 7.7 SIZE (8) · OCTET STRING

The SCI information of the peer entry in the peer list of this active participant in MKA protocol. ⓘ

Ieee8021XPaeNIDThis textual convention indicates a Network Identifier (NID). Each network is identified by a NID, a UTF-8 string used by network attached systems to select a network profile.Reference: IEEE 802.1X Clause 12.6, Clause 10.1 SIZE (1..100) · OCTET STRING

The network identifier to identify NID configuration in the PAE. ⓘ

INTEGER1 = never2 = immediate3 = mkaFail · Integer32

Determines when the Logon Process will initiate EAP, if the Supplicant and or Authenticator are enabled, and takes one of the following values: 'never' : Never. 'immediate' : Immediately, concurrently with the use of MKA with any cached CAK(s). 'mkaFail' : Not until MKA has failed, if a prior CAK has been cached. ⓘ

INTEGER1 = never2 = immediate3 = authFail · Integer32

Determines when the Logon Process will tell the CP state machine to provide unauthenticated connectivity, and takes one of the following values: 'never' : Never. 'immediate' : Immediately, independently of any current or future attempts to authenticate using the PAE or MKA. 'authFail' : Not until an attempt has been made to authenticate using EAP, unless neither the Supplicant nor the Authenticator is enabled, and MKA has attempted to use any cached CAK (unless the KaY is not enabled). ⓘ

INTEGER1 = never2 = immediate3 = mkaFail4 = mkaServer · Integer32

Determines when the Logon Process will tell the CP state machine to provide authenticated but unsecured connectivity, takes one of the following values: 'never' : Never. 'immediate' : Immediately, to provide connectivity concurrently with the use of MKA with any CAK acquired through EAP. 'mkaFail' : Not until MKA has failed, or is not enabled. 'mkaServer' : Only if directed by the MKA server. ⓘ

Ieee8021XPaeNIDUnauthenticatedStatus0 = noAccess1 = fallbackAccess2 = limitedAccess3 = openAccessThis textual convention indicates the access capabilities of the port's clients without authentication. 'noAccess' : Other than to authentication services (see Ieee8021XPaeNIDCapabilites information. 'fallbackAccess' : Limited access can be provided after authentication failure. 'limitedAccess' : Immediate limited access is available without authentication. 'openAccess' : Immediate access is available without authentication.Reference: IEEE 802.1X Clause 10.1, Table 11-8 · Integer32

The configured access capability of the port's clients without authentication in this NID. ⓘ

Ieee8021XPaeNIDCapabilitesThis textual convention indicates the combinations of authentication and protection capabilities supported for a NID. Any set of these combinations can be supported.Reference: IEEE 802.1X Clause 10.1, Table 11-8 · BITS

The authentication and protection capabilities supported for the NID. ⓘ

Ieee8021XPaeKMDThis textual convention indicates a Key Management Domain (KMD). KMD is a string of UTF-8 characters that names the transmitting authenticator's key management domain.Reference: IEEE 802.1X Clause 12.6 SIZE (0..253) · OCTET STRING

The configured KMD information for this NID. ⓘ

RowStatus1 = active2 = notInService3 = notReady4 = createAndGo5 = createAndWait6 = destroyThe RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of [2].) The status column has six defined values: - `active', which indicates that the conceptual row is available for use by the managed device; - `notInService', which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device (see NOTE below); 'notInService' has no implication regarding the internal consistency of the row, availability of resources, or consistency with the current state of the managed device; - `notReady', which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device (i.e., one or more required columns in the conceptual row have not been instanciated); - `createAndGo', which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; - `createAndWait', which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, - `destroy', which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row. Whereas five of the six values (all except `notReady') may be specified in a management protocol set operation, only three values will be returned in response to a management protocol retrieval operation: `notReady', `notInService' or `active'. That is, when queried, an existing conceptual row has only three states: it is either available for use by the managed device (the status column has value `active'); it is not available for use by the managed device, though the agent has sufficient information to attempt to make it so (the status column has value `notInService'); or, it is not available for use by the managed device, and an attempt to make it so would fail because the agent has insufficient information (the state column has value `notReady'). NOTE WELL This textual convention may be used for a MIB table, irrespective of whether the values of that table's conceptual rows are able to be modified while it is active, or whether its conceptual rows must be taken out of service in order to be modified. That is, it is the responsibility of the DESCRIPTION clause of the status column to specify whether the status column must not be `active' in order for the value of some other column of the same conceptual row to be modified. If such a specification is made, affected columns may be changed by an SNMP set PDU if the RowStatus would not be equal to `active' either immediately before or after processing the PDU. In other words, if the PDU also contained a varbind that would change the RowStatus value, the column in question may be changed if the RowStatus was not equal to `active' as the PDU was received, or if the varbind sets the status to a value other than 'active'. Also note that whenever any elements of a row exist, the RowStatus column must also exist. To summarize the effect of having a conceptual row with a status column having a SYNTAX clause value of RowStatus, consider the following state diagram: STATE +--------------+-----------+-------------+------------- | A | B | C | D | |status col.|status column| |status column | is | is |status column ACTION |does not exist| notReady | notInService| is active --------------+--------------+-----------+-------------+------------- set status |noError ->D|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndGo |inconsistent- | | | | Value| | | --------------+--------------+-----------+-------------+------------- set status |noError see 1|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndWait |wrongValue | | | --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError column to | Value| entValue| | active | | | | | | or | | | | | | | |see 2 ->D|see 8 ->D| ->D --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError ->C column to | Value| entValue| | notInService | | | | | | or | | or | | | | | |see 3 ->C| ->C|see 6 --------------+--------------+-----------+-------------+------------- set status |noError |noError |noError |noError ->A column to | | | | or destroy | ->A| ->A| ->A|see 7 --------------+--------------+-----------+-------------+------------- set any other |see 4 |noError |noError |see 5 column to some| | | | value | | see 1| ->C| ->D --------------+--------------+-----------+-------------+------------- (1) goto B or C, depending on information available to the agent. (2) if other variable bindings included in the same PDU, provide values for all columns which are missing but required, and all columns have acceptable values, then return noError and goto D. (3) if other variable bindings included in the same PDU, provide legal values for all columns which are missing but required, then return noError and goto C. (4) at the discretion of the agent, the return value may be either: inconsistentName: because the agent does not choose to create such an instance when the corresponding RowStatus instance does not exist, or inconsistentValue: if the supplied value is inconsistent with the state of some other MIB object's value, or noError: because the agent chooses to create the instance. If noError is returned, then the instance of the status column must also be created, and the new state is B or C, depending on the information available to the agent. If inconsistentName or inconsistentValue is returned, the row remains in state A. (5) depending on the MIB definition for the column/table, either noError or inconsistentValue may be returned. (6) the return value can indicate one of the following errors: wrongValue: because the agent does not support notInService (e.g., an agent which does not support createAndWait), or inconsistentValue: because the agent is unable to take the row out of service at this time, perhaps because it is in use and cannot be de-activated. (7) the return value can indicate the following error: inconsistentValue: because the agent is unable to remove the row at this time, perhaps because it is in use and cannot be de-activated. (8) the transition to D can fail, e.g., if the values of the conceptual row are inconsistent, then the error code would be inconsistentValue. NOTE: Other processing of (this and other varbinds of) the set request may result in a response other than noError being returned, e.g., wrongValue, noCreation, etc. Conceptual Row Creation There are four potential interactions when creating a conceptual row: selecting an instance-identifier which is not in use; creating the conceptual row; initializing any objects for which the agent does not supply a default; and, making the conceptual row available for use by the managed device. Interaction 1: Selecting an Instance-Identifier The algorithm used to select an instance-identifier varies for each conceptual row. In some cases, the instance- identifier is semantically significant, e.g., the destination address of a route, and a management station selects the instance-identifier according to the semantics. In other cases, the instance-identifier is used solely to distinguish conceptual rows, and a management station without specific knowledge of the conceptual row might examine the instances present in order to determine an unused instance-identifier. (This approach may be used, but it is often highly sub-optimal; however, it is also a questionable practice for a naive management station to attempt conceptual row creation.) Alternately, the MIB module which defines the conceptual row might provide one or more objects which provide assistance in determining an unused instance-identifier. For example, if the conceptual row is indexed by an integer-value, then an object having an integer-valued SYNTAX clause might be defined for such a purpose, allowing a management station to issue a management protocol retrieval operation. In order to avoid unnecessary collisions between competing management stations, `adjacent' retrievals of this object should be different. Finally, the management station could select a pseudo-random number to use as the index. In the event that this index was already in use and an inconsistentValue was returned in response to the management protocol set operation, the management station should simply select a new pseudo-random number and retry the operation. A MIB designer should choose between the two latter algorithms based on the size of the table (and therefore the efficiency of each algorithm). For tables in which a large number of entries are expected, it is recommended that a MIB object be defined that returns an acceptable index for creation. For tables with small numbers of entries, it is recommended that the latter pseudo-random index mechanism be used. Interaction 2: Creating the Conceptual Row Once an unused instance-identifier has been selected, the management station determines if it wishes to create and activate the conceptual row in one transaction or in a negotiated set of interactions. Interaction 2a: Creating and Activating the Conceptual Row The management station must first determine the column requirements, i.e., it must determine those columns for which it must or must not provide values. Depending on the complexity of the table and the management station's knowledge of the agent's capabilities, this determination can be made locally by the management station. Alternately, the management station issues a management protocol get operation to examine all columns in the conceptual row that it wishes to create. In response, for each column, there are three possible outcomes: - a value is returned, indicating that some other management station has already created this conceptual row. We return to interaction 1. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it should supply a value for this column when the conceptual row is to be created. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. Once the column requirements have been determined, a management protocol set operation is accordingly issued. This operation also sets the new instance of the status column to `createAndGo'. When the agent processes the set operation, it verifies that it has sufficient information to make the conceptual row available for use by the managed device. The information available to the agent is provided by two sources: the management protocol set operation which creates the conceptual row, and, implementation-specific defaults supplied by the agent (note that an agent must provide implementation-specific defaults for at least those objects which it implements as read-only). If there is sufficient information available, then the conceptual row is created, a `noError' response is returned, the status column is set to `active', and no further interactions are necessary (i.e., interactions 3 and 4 are skipped). If there is insufficient information, then the conceptual row is not created, and the set operation fails with an error of `inconsistentValue'. On this error, the management station can issue a management protocol retrieval operation to determine if this was because it failed to specify a value for a required column, or, because the selected instance of the status column already existed. In the latter case, we return to interaction 1. In the former case, the management station can re-issue the set operation with the additional information, or begin interaction 2 again using `createAndWait' in order to negotiate creation of the conceptual row. NOTE WELL Regardless of the method used to determine the column requirements, it is possible that the management station might deem a column necessary when, in fact, the agent will not allow that particular columnar instance to be created or written. In this case, the management protocol set operation will fail with an error such as `noCreation' or `notWritable'. In this case, the management station decides whether it needs to be able to set a value for that particular columnar instance. If not, the management station re-issues the management protocol set operation, but without setting a value for that particular columnar instance; otherwise, the management station aborts the row creation algorithm. Interaction 2b: Negotiating the Creation of the Conceptual Row The management station issues a management protocol set operation which sets the desired instance of the status column to `createAndWait'. If the agent is unwilling to process a request of this sort, the set operation fails with an error of `wrongValue'. (As a consequence, such an agent must be prepared to accept a single management protocol set operation, i.e., interaction 2a above, containing all of the columns indicated by its column requirements.) Otherwise, the conceptual row is created, a `noError' response is returned, and the status column is immediately set to either `notInService' or `notReady', depending on whether it has sufficient information to (attempt to) make the conceptual row available for use by the managed device. If there is sufficient information available, then the status column is set to `notInService'; otherwise, if there is insufficient information, then the status column is set to `notReady'. Regardless, we proceed to interaction 3. Interaction 3: Initializing non-defaulted Objects The management station must now determine the column requirements. It issues a management protocol get operation to examine all columns in the created conceptual row. In the response, for each column, there are three possible outcomes: - a value is returned, indicating that the agent implements the object-type associated with this column and had sufficient information to provide a value. For those columns to which the agent provides read-create access (and for which the agent allows their values to be changed after their creation), a value return tells the management station that it may issue additional management protocol set operations, if it desires, in order to change the value associated with this column. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. However, the agent does not have sufficient information to provide a value, and until a value is provided, the conceptual row may not be made available for use by the managed device. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it must issue additional management protocol set operations, in order to provide a value associated with this column. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. If the value associated with the status column is `notReady', then the management station must first deal with all `noSuchInstance' columns, if any. Having done so, the value of the status column becomes `notInService', and we proceed to interaction 4. Interaction 4: Making the Conceptual Row Available Once the management station is satisfied with the values associated with the columns of the conceptual row, it issues a management protocol set operation to set the status column to `active'. If the agent has sufficient information to make the conceptual row available for use by the managed device, the management protocol set operation succeeds (a `noError' response is returned). Otherwise, the management protocol set operation fails with an error of `inconsistentValue'. NOTE WELL A conceptual row having a status column with value `notInService' or `notReady' is unavailable to the managed device. As such, it is possible for the managed device to create its own instances during the time between the management protocol set operation which sets the status column to `createAndWait' and the management protocol set operation which sets the status column to `active'. In this case, when the management protocol set operation is issued to set the status column to `active', the values held in the agent supersede those used by the managed device. If the management station is prevented from setting the status column to `active' (e.g., due to management station or network failure) the conceptual row will be left in the `notInService' or `notReady' state, consuming resources indefinitely. The agent must detect conceptual rows that have been in either state for an abnormally long period of time and remove them. It is the responsibility of the DESCRIPTION clause of the status column to indicate what an abnormally long period of time would be. This period of time should be long enough to allow for human response time (including `think time') between the creation of the conceptual row and the setting of the status to `active'. In the absence of such information in the DESCRIPTION clause, it is suggested that this period be approximately 5 minutes in length. This removal action applies not only to newly-created rows, but also to previously active rows which are set to, and left in, the notInService state for a prolonged period exceeding that which is considered normal for such a conceptual row. Conceptual Row Suspension When a conceptual row is `active', the management station may issue a management protocol set operation which sets the instance of the status column to `notInService'. If the agent is unwilling to do so, the set operation fails with an error of `wrongValue' or `inconsistentValue'. Otherwise, the conceptual row is taken out of service, and a `noError' response is returned. It is the responsibility of the DESCRIPTION clause of the status column to indicate under what circumstances the status column should be taken out of service (e.g., in order for the value of some other column of the same conceptual row to be modified). Conceptual Row Deletion For deletion of conceptual rows, a management protocol set operation is issued which sets the instance of the status column to `destroy'. This request may be made regardless of the current value of the status column (e.g., it is possible to delete conceptual rows which are either `notReady', `notInService' or `active'.) If the operation succeeds, then all instances associated with the conceptual row are immediately removed. · Integer32

The object to create the parameters for the supported Network Announcement information in the system. If the Network Announcement information of the entry is from downloaded policies, this object is 'active'. ⓘ

Ieee8021XPaeNIDThis textual convention indicates a Network Identifier (NID). Each network is identified by a NID, a UTF-8 string used by network attached systems to select a network profile.Reference: IEEE 802.1X Clause 12.6, Clause 10.1 SIZE (1..100) · OCTET STRING

The NID information to identify a transmitting network announcement for the PAE. ⓘ

Ieee8021XPaeNIDAccessStatus0 = noAccess1 = remedialAccess2 = restrictedAccess3 = expectedAccessThis textual convention indicates the transmitter's Controlled Port operational status and current level of access resulting from authentication and the consequent authorization controls applied by that port's clients. 'noAccess' : Other than to authentication services, and to services announced as available in the absence of authentication (unauthenticated). 'remedialAccess' : The access granted is severely limited, possibly to remedial services. 'restrictedAccess' : The Controlled Port is operational, but restrictions have been applied by the network that can limit access to some resources. 'expectedAccess' : The Controlled Port is operational, and access provided is as expected for successful authentication and authorization for the NID.Reference: IEEE 802.1X Clause 10.1, Table 11-8 · Integer32

The object information reflects connectivity as a result of authentication attempts of this NID for this Announcer. ⓘ

Ieee8021XPaeNIDThis textual convention indicates a Network Identifier (NID). Each network is identified by a NID, a UTF-8 string used by network attached systems to select a network profile.Reference: IEEE 802.1X Clause 12.6, Clause 10.1 SIZE (1..100) · OCTET STRING

The NID information to identify a received network announcement for the PAE. ⓘ

Ieee8021XPaeKMDThis textual convention indicates a Key Management Domain (KMD). KMD is a string of UTF-8 characters that names the transmitting authenticator's key management domain.Reference: IEEE 802.1X Clause 12.6 SIZE (0..253) · OCTET STRING

The KMD information for this received network announcement of the PAE. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object indicates the received announcement information was specific to the receiving PAE, not generic for all systems attached to the LAN. ⓘ

Ieee8021XPaeNIDAccessStatus0 = noAccess1 = remedialAccess2 = restrictedAccess3 = expectedAccessThis textual convention indicates the transmitter's Controlled Port operational status and current level of access resulting from authentication and the consequent authorization controls applied by that port's clients. 'noAccess' : Other than to authentication services, and to services announced as available in the absence of authentication (unauthenticated). 'remedialAccess' : The access granted is severely limited, possibly to remedial services. 'restrictedAccess' : The Controlled Port is operational, but restrictions have been applied by the network that can limit access to some resources. 'expectedAccess' : The Controlled Port is operational, and access provided is as expected for successful authentication and authorization for the NID.Reference: IEEE 802.1X Clause 10.1, Table 11-8 · Integer32

The object information reflects connectivity as a result of authentication attempts for this received network announcement of the PAE. ⓘ

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The authenticated access has been requested for this particular NID or not. ⓘ

Ieee8021XPaeNIDUnauthenticatedStatus0 = noAccess1 = fallbackAccess2 = limitedAccess3 = openAccessThis textual convention indicates the access capabilities of the port's clients without authentication. 'noAccess' : Other than to authentication services (see Ieee8021XPaeNIDCapabilites information. 'fallbackAccess' : Limited access can be provided after authentication failure. 'limitedAccess' : Immediate limited access is available without authentication. 'openAccess' : Immediate access is available without authentication.Reference: IEEE 802.1X Clause 10.1, Table 11-8 · Integer32

The access capability of the port's clients without authentication in this received network announcement of the PAE. 'openAccess', 'limitedAccess' should not be returned if the object ieee8021XNidUnauthAllowed is 'immediate'. ⓘ

Ieee8021XPaeNIDCapabilitesThis textual convention indicates the combinations of authentication and protection capabilities supported for a NID. Any set of these combinations can be supported.Reference: IEEE 802.1X Clause 10.1, Table 11-8 · BITS

The announcement capabilities of this received network announcement for this PAE. ⓘ

OCTET STRING SIZE (8)

The identifier for the announced cipher suite. This is a global unique 64-bit (EUI-64) identifier to identify a cipher suite. ⓘ

Unsigned32 (0..65535)

The capability of a Cipher Suite received from the network announcement by the Listener. A 2 octets Cipher Suite dependent implementation capability field precedes each Cipher Suite reference number. If the Cipher Suite, ieee8021XAnnouncementCipherSuite, identifies the Default Cipher Suite (specified in IEEE Std 802.1AE), the two least significant bits of the implementation capability field encode the MACsec Capability parameter specified in Table 11-7 and the fourteen more significant bits are as 0 and ignored on receipt. ⓘ