CISCO-IPSEC-PROVISIONING-MIB: View SNMP OID List / Download MIB

IPSec is the next-generation network layer crypto framework described in RFC2401-2411. This MIB defines the IPsec configurations. It may be used to view and provision IPsec-based VPNs. To create an IPsec tunnel, you need first configure Internet Key Exchange (IKE). IKE negotiates Security Associations with the peer for IPsec. To find out how to configure IKE, please see CISCO-IKE-CONFIGURATION-MIB for detail. Once you setup IKE, you will have to configure IPsec. To configure IPsec, you need perform following steps. 1. Create an IPsec transform set. A transform set describes a security protocol (AH or ESP) with its corresponding algorithms. For example, ESP with the DES cipher algorithm and HMAC-SHA for authentication. 2. Create a cryptomap and its peers. This will a) select data flows that need security processing and b) defines the policy for these flows and the crypto peer that traffic needs to go to. 3. Apply cryptomap to an interface A crypto map is applied to an egress interface. Outgoing data flows are protected by this cryptomap. Acronyms The following acronyms are used in this document: Static Cryptomap Template: A static cryptomap template (or static cryptomap) is a security template created for IPsec. A static cryptomap pulls together various parts to set up an IPsec security association which includes: - which traffic should be protected by IPsec - where IPsec protected traffic should be sent - the local address used for the the IPsec traffic - which transform sets should be applied to this traffic Dynamic Cryptomap Template: A dynamic cryptomap template (or a dynamic cryptomap) is essentially a crypto map entry without all the parameters configured. It acts as a policy template where the missing parameters are later dynamically configured (as the result of an IPsec negotiation) to match a peer's requirements. Cryptomap Set: A cryptomap set may contain multiple cryptomap templates which specify an IPsec policy. TED: Tunnel Endpoint Discovery protocol MIB Structure ------------- This MIB provides the operational information on Cisco's IPsec implementation of IPsec. This MIB delineates ISAKMP and IPsec configuration. This MIB deals only with IPsec (Phase-2) configuration. The following entities are managed: a) IPsec Global Parameters b) IPsec transform set definitions c) Cryptomap Group - Cryptomap Set Table - Cryptomap Table - CryptomapSet Transform Binding Table - CryptomapSet Peer Binding Table - CryptomapSet Interface Binding Table d) Notification Control Group e) Notifications Group

This notification is generated when a new cryptomap is added to the specified cryptomap set. Object 'cipsStaticCryptomapSetSize' contains the number of cryptomap entries after the addition.

This notification is generated when a cryptomap is removed from the specified cryptomap set. Object 'cipsStaticCryptomapSetSize' contains the number of cryptomap entries after the deletion.

A cryptomap set must be attached to an interface of the device in order for it to be operational. This trap is generated when the cryptomap set attached to an active interface of the managed entity. The contents of the notification includes: Size of the attached cryptomap set, Number of ISAKMP cryptomaps in the set and Number of Dynamic cryptomaps in the set.

This trap is generated when a cryptomap set is detached from an interafce to which it was bound earlier. The context of the event identifies the size of the cryptomap set.

The default lifetime (in seconds) assigned to an IPsec tunnel as a global policy (maybe overridden in specific cryptomap definitions).

The default lifesize in KBytes assigned to an IPsec tunnel as a global policy (unless overridden in cryptomap definition).

The number of seconds of idle time (no activity) after which an IPsec tunnel (and its parent ISAKMP SA) is to be deleted. An IPsec tunnel never times out if a value 0 is specified.

This table contains the list of all the transform sets configured on the managed entity. A transform set is usually configured by a management console before a cryptomap is created. Multiple transform sets could be assigned to a cryptomap configuration.

Each entry represents a single configured IPsec transform set.

This object contains the name of the transform set corresponding to this conceptual row.

This is the sequence number of the transform set that uniquely identifies the transform set. Distinct transform sets must have distinct sequence numbers.

This object represents the suite of Phase-2 security protocols of this transform set.

This object represents the transform used for ESP encryption. The only values this object may assume are 'xformNONE', 'xformEspNULL', 'xformEspDES', 'xformEsp3DES', 'xformEspAES128', 'xformEspAES192', 'xformEspAES256', 'xformEspAESCtr128', 'xformEspAESCtr192', 'xformEspAESCtr256' and 'xformEspAESXCbcMac'. If the value of the corresponding instance of cipsXformSetSuite is 'suiteIntegAh', 'suiteIntegAhComp' or 'suiteOther', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'.

This object represents the transform used to implement integrity check with ESP protocol. If the value of the corresponding instance of cipsXformSetSuite is 'suiteIntegAh', 'suiteIntegAhComp' or 'suiteOther', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'.

This object represents the transform used to implement integrity check with AH protocol. If the value of the corresponding instance of cipsXformSetSuite is neither 'suiteIntegAh' nor 'suiteIntegAhComp', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'.

This object represents the transform used to implement packet compression. If the value of the corresponding instance of cipsXformSetSuite is 'suiteConf', 'suiteIntegEsp', 'suiteIntegAh', 'suiteConfAh', 'suiteIntegEspAhS', 'suiteConfIntegEsp', 'suiteConfIntegEspAh' or 'suiteOther', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'.

This object represents the encapsulation mode of the transform set.

This object represents the status of the transform set entry.

This object reflects the number of static cryptomap sets that are fully configured. Statically defined cryptomap sets are ones where the operator has fully specified all the parameters required to set up IPsec connections.

This object reflects the number of dynamic IPsec policy templates (called dynamic cryptomap templates) that are fully configured.

This object reflects the number of static cryptomap sets that have at least one dynamic cryptomap template which has the Tunnel Endpoint Discovery (TED) enabled.

This read-only table contains the list of all cryptomap sets that are fully configured. The operator may include different types of cryptomaps in such a set - manual, ISAKMP or dynamic. An entry is added to (removed from) this table automatically by the agent when the first (last) 'active' entry with the corresponding cipsStaticCryptomapSetName is added to (removed from) cipsStaticCryptomapTable.

Each entry contains the attributes associated with a single static cryptomap set.

This object reflects the total number of cryptomap templates contained in this cryptomap set.

This object reflects the number of cryptomaps associated with this cryptomap set that use ISAKMP protocol to do key exchange.

This object reflects the number of cryptomaps associated with this cryptomap set that require the operator to manually setup the keys and SPIs.

This object reflects the number of dynamic cryptomap templates linked to this cryptomap set.

This object reflects the number of dynamic cryptomap templates linked to this cryptomap set that have Tunnel Endpoint Discovery (TED) enabled.

This object reflects the number of IPsec Security Associations that are active and were setup using this cryptomap set.

The table listing the member cryptomaps of the cryptomap sets that are configured on the managed entity. This table does not include the members of dynamic cryptomap sets that may be linked with the parent static cryptomap set. Deletion of a cipsStaticCryptomapEntry will fail if the cipsStaticCryptomapSetName this cipsStaticCryptomapEntry belongs to is referred by a cipsCryptomapSetIfEntry.

Each entry contains the attributes associated with a single static (fully specified) cryptomap entry, identified by its priority.

The index of the static cryptomap table. The value of the string is the name string assigned by the NMS when defining a cryptomap set.

The priority of the cryptomap entry in the cryptomap set. A cryptomap entry with smaller cipsStaticCryptomapPriority value takes precedence over the ones with larger values.

The type of the cryptomap entry. This can be an ISAKMP cryptomap or manual. Dynamic cryptomaps are not counted in this table.

The description string created by the SNMP agent while creating this cryptomap. The string generally identifies a description and the purpose of this policy.

This object specifies an IP protocol filter, cippfIpProfileName (defined in CISCO-IP-PROTOCOL-FILTER-MIB), to be secured using this cryptomap entry. When this object has a value of zero-length string, this object is not valid/applicable.

The list of cipsXformSetId that are members of this CipsStaticCryptomapEntry. The value of this object is a concatenation of zero or more 4-octet strings, where each 4-octet string contains a 32-bit cipsXformSetId value in network byte order. A zero length string value means this list has no members.

This object reflects the number of peers associated with this cryptomap entry. The other peers listed in table cipsIPsecCryMapPeerTable are backup peers.

This object specifies the next available index for object cipsCryMapPeerIndex which can be used for creating an entry in cipsIPsecCryMapPeerTable.

This object represents the address type of cipsStaticCryptomapCurPAddr to which this cryptomap entry is currently connected.

The IP address of the peer to which this cryptomap entry is currently connected. The value of cipsStaticCryptomapCurPAddrType is 'unknown' and this MIB object is a zero-length string when no tunnels are presently spawned by this cryptomap entry or when cipsStaticCryptomapAutoPeer is equal to 'true'.

This object identifies if the tunnels instantiated due to this policy item should use Perfect Forward Secrecy (PFS) and if so, what group of Oakley they should use.

This object specifies the lifetime of the IPsec Security Associations (SA) created using this IPsec policy entry. The default value of this object is the current value of the object cipsTunnelLifetime. When a value 0 is specified in cipsStaticCryptomapLifetime, the default value is used as the lifetime.

This object identifies the lifesize (maximum traffic in bytes that may be carried) of the IPSec SAs created using this IPSec policy entry. When a Security Association (SA) is created using this IPsec policy entry, its lifesize takes the value of this object. The default value of this object is the current value of the object cipsTunnelLifesize. When a value 0 is specified in cipsStaticCryptomapLifesize, the default value is used as the lifesize.

This object specifies the granularity of the IPSec SAs created using this IPSec policy entry. If this value is 'true', distinct SA bundles are created for distinct hosts at the end of the application traffic.

This object specifies the idle time (lack of traffic) in seconds of a tunnel spawned by this cryptomap after which the tunnel will be torn down. The default value of this object is the current value of cipsTunnelIdleTimeout.

If 'true' the destination address is taken as the peer address, while creating the tunnel. If 'false' the value shown by the object cipsStaticCryptomapCurPAddr is being used as the peer address.

This object identifies the status of the cryptomap entry represented by this conceptual row.

The table containing the binding of peers to cryptomap entries. An entry is removed from this table automatically by the agent when the last 'active' entry with the corresponding cipsStaticCryptomapSetName is removed from cipsStaticCryptomapTable.

Each entry represents the binding of an IPsec peer address to the specified cryptomap.

This arbitrary number represents the index number in the cryptomap entry of the peer corresponding to this conceptual row. This object could have the same value as cipsStaticCryotomapNextPIndex.

This object represents the address type of cipsCryMapPeerAddr. This object cannot be modified while the corresponding value of cipsCryMapPeerStatus is equal to 'active'.

This object represents the address of the peer corresponding to this conceptual row. This object cannot be modified while the corresponding value of cipsCryMapPeerStatus is equal to 'active'.

This object represents the order in the cryptomap entry of the peer corresponding to this conceptual row. The peer with the lowest order number is applied first, that is cipsCryMapPeerOrder '1'.

This object specifies the status column used for creating and deleting instances of the columnar objects in the table.

The table lists the binding of cryptomap sets to the interfaces of the managed entity. One interface can be bound to only one cryptomap set while one cryptomap set can be bound to multiple interfaces. Any interface (with any ifType) which supports IPsec can be used in this table.

Each entry lists the association between an interface and a cryptomap set (static) that is defined on the managed entity.

This object identifies the status of the binding of the specified cryptomap set with the specified interface. Detaching a cryptomap from an interface: ---------------------------------------- When set to 'destroy', if a cryptomap set is attached to the interface corresponding to ifIndex, the cryptomap set is detached from the interface. Attaching a cryptomap to an interface: ---------------------------------------- If the value 'createAndGo' is set: a row in this table can be created only if it identifies a cryptomap which is represented by an entry in cipsStaticCryptomapSetTable.

The table lists the binding information of a interface to a cryptomap sets on the managed entity. One interface can be bound to only one cryptomap set while one cryptomap set can be bound to multiple interfaces. An entry is added to cipsIfCryptomapSetInfoTable when a static cryptomap set is successfully assigned to an interface (of any ifType) in cipsCryptomapSetIfTable. An entry is deleted from cipsIfCryptomapSetInfoTable when its assignment is removed from cipsIfCryptomapSetInfoTable.

Each entry lists the binding between an interface and a cryptomap set (static) that is defined on the managed entity.

The name of a static cryptomap set which is bound to this interface. The value of the string is one of the entries in cipsStaticCryptomapSetTable indexed by cipsStaticCryptomapSetName.

This object must be set to 'true' to enable any notification in addition to the notification-specific control variables defined below. A notification defined in this module is enabled if and only if the expression (cipsCntlAllNotifs && cipsCntl) evaluates to 'true'.

This variable controls the generation of ciscoIPsecProvCryptomapAdded notification. When this variable is set to 'true', a notification is generated when a static cryptomap is created in cipsStaticCryptomapTable. When this variable is set to 'false', generation of this notification is disabled.

This variable controls the generation of ciscoIPsecProvCryptomapDeleted notification. When this variable is set to 'true', a notification is generated when a static cryptomap is deleted from cipsStaticCryptomapTable. When this variable is set to 'false', generation of this notification is disabled.

This variable controls the generation of ciscoIPsecProvCryptomapAttached notification. When this variable is set to 'true', a notification is generated when a cryptomap set is attached to an active interface. When this variable is set to 'false', generation of this notification is disabled.

This variable controls the generation of ciscoIPsecProvCryptomapDetached notification. When this variable is set to 'true', a notification is generated when a cryptomap set is detached from an active interface. When this variable is set to 'false', generation of this notification is disabled.

The compliance statement for entities which implement the Cisco IPsec Provisioning MIB.

The compliance statement for entities which implement the Cisco IPsec Provisioning MIB.

A collection of objects providing Global IPSec policy monitoring capability to a IPsec capable VPN router.

A collection of objects modeling IPsec transform sets and transform set mappings.

A collection of objects modeling static crypto configuration of the Static (fully specified) Cryptomap Sets on the managed entity.

A collection of objects modeling the configuration of IPsec dynamic cryptomap elements.

A collection of objects instrumenting the properties of the Cryptomaps using tunnel endpoint discovery protocol.

A collection of objects displaying the binding of an IPsec peer address to the specified cryptomap.

A collection of objects providing IPsec Notification capability to a IPsec-capable router. It is mandatory to implement this set of objects pertaining to IOS notifications about IPSec activity.

A collection of notification objects signaling changes to the IPsec configuration on the managed entity.

A collection of objects providing current IPsec configuration information on the managedentity.