This module defines the object used to monitor the entries pertaining to IPSec objects and the management of the IPSEC VPN functionalities for Juniper security product lines.
This mib module extend Juniper's common IPSEC flow monitoring MIB, building on the existing common infrastruature, the security implementation integrates the value-added features for the security products
The IPsec Phase-2 Tunnel Table. There is one entry in this table for each active IPsec Phase-2 Tunnel. If the tunnel is terminated, then the entry is no longer available after the table has been refreshed.
InetAddressType0 = unknown1 = ipv42 = ipv63 = ipv4z4 = ipv6z16 = dnsA value that represents a type of Internet address.
unknown(0) An unknown address type. This value MUST
be used if the value of the corresponding InetAddress object is a zero-length string. It may also be used to indicate an IP address that is not in one of the formats defined below.
ipv4(1) An IPv4 address as defined by the
InetAddressIPv4 textual convention.
ipv6(2) An IPv6 address as defined by the
InetAddressIPv6 textual convention.
ipv4z(3) A non-global IPv4 address including a zone
index as defined by the InetAddressIPv4z textual convention.
ipv6z(4) A non-global IPv6 address including a zone
index as defined by the InetAddressIPv6z textual convention.
dns(16) A DNS domain name as defined by the
InetAddressDNS textual convention.
Each definition of a concrete InetAddressType value must be accompanied by a definition of a textual convention for use with that InetAddressType.
To support future extensions, the InetAddressType textual convention SHOULD NOT be sub-typed in object type definitions. It MAY be sub-typed in compliance statements in order to require only a subset of these address types for a compliant implementation.
Implementations must ensure that InetAddressType objects and any dependent objects (e.g., InetAddress objects) are consistent. An inconsistentValue error must be generated if an attempt to change an InetAddressType object would, for example, lead to an undefined InetAddress value. In particular, InetAddressType/InetAddress pairs must be changed together if the address type changes (e.g., from ipv6(2) to ipv4(1)). · Integer32
The IP address type of the remote gateway (endpoint) for the IPsec Phase-2 Tunnel.
jnxIpSecTunMonRemoteGwAddr
InetAddressDenotes a generic Internet address.
An InetAddress value is always interpreted within the context of an InetAddressType value. Every usage of the InetAddress textual convention is required to specify the InetAddressType object that provides the context. It is suggested that the InetAddressType object be logically registered before the object(s) that use the InetAddress textual convention, if they appear in the same logical row.
The value of an InetAddress object must always be consistent with the value of the associated InetAddressType object. Attempts to set an InetAddress object to a value inconsistent with the associated InetAddressType must fail with an inconsistentValue error.
When this textual convention is used as the syntax of an index object, there may be issues with the limit of 128 sub-identifiers specified in SMIv2, STD 58. In this case, the object definition MUST include a 'SIZE' clause to limit the number of potential instance sub-identifiers; otherwise the applicable constraints MUST be stated in the appropriate conceptual row DESCRIPTION clauses, or in the surrounding documentation if there is no single DESCRIPTION clause that is appropriate. SIZE (0..255) · OCTET STRING
The IP address of the remote gateway (endpoint) for the IPsec Phase-2 Tunnel.
jnxIpSecTunMonIndex
Integer32 (1..2147483647)
The index of the IPsec Phase-2 Tunnel Table. The value of the index is a number which begins at one and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647.
jnxJsIpSecTunPolicyName
1.3.6.1.4.1.2636.3.39.1.5.1.2.1.1.1
DisplayStringRepresents textual information taken from the NVT ASCII
character set, as defined in pages 4, 10-11 of RFC 854.
To summarize RFC 854, the NVT ASCII repertoire specifies:
- the use of character codes 0-127 (decimal)
- the graphics characters (32-126) are interpreted as US ASCII
- NUL, LF, CR, BEL, BS, HT, VT and FF have the special meanings specified in RFC 854
- the other 25 codes have no standard interpretation
- the sequence 'CR LF' means newline
- the sequence 'CR NUL' means carriage-return
- an 'LF' not preceded by a 'CR' means moving to the same column on the next line.
- the sequence 'CR x' for any x other than LF or NUL is illegal. (Note that this also means that a string may end with either 'CR LF' or 'CR NUL', but not with CR.)
Any object defined using this syntax may not exceed 255 characters in length. SIZE (0..80) · OCTET STRING · hint 255a
The policy name assoicated with this tunnel if the this IPSEC VPN is policy based. Otherwise, this attribute is not applicable.
jnxJsIpSecVpnTunType
1.3.6.1.4.1.2636.3.39.1.5.1.2.1.1.2
JnxJsIpSecVpnType1 = policyBased2 = routeBasedThe type of the remote peer gateway (endpoint). It can be one of the following two types: - policyBased : tunnels requires a policy with action 'tunnel' to trigger IPSEC VPN. The device receives traffic and matches it with policy that has action 'tunnel', it performs the encryption/decryption and authentication options negotiated for this VPN phase 2 negotiation. - routeBased : requires a tunnel interface a route directing traffic to protected networks to exit the system using that tunnel interface. The tunnel interface is bound to a Phase 2 VPN configuration that specifies all the tunnel parameters. · Integer32
This attribute indicates the IPSEC VPN tunnel is policy based or route based.
jnxJsIpSecTunCfgMonState
1.3.6.1.4.1.2636.3.39.1.5.1.2.1.1.3
INTEGER1 = disable2 = enable · Integer32
The user configuration states whether to monitor the IPSec tunnel to be alive or not.
This attribute indicates whether the IPSec Tunnel is up or down, determined by icmp ping if the jnxJsIpSecTunCfgMonState is enable.
Down: VPN monitor detects the tunnel is down
Up: VPN monitor detects the tunnel is up.
vpnMonitoringDisabled: user has disabled VPN tunnel monitoring.