CISCO-SESS-BORDER-CTRLR-EVENT-MIB: View SNMP OID List / Download MIB

The main purpose of this MIB is to define the SNMP notifications and alarms generated by Session Border Controller application and used to send these notifications to SNMP manager application. Each of these event/notification is explained in detail in the MIB file. The SBC service is implemented on a service card on CISCO routers. SBC application offer functionalities like firewall/NAT traversal, media bridging, policy-based call routing, signaling protocol inter-working, call billing and some degree of Call Admission Control. SBC looks to play an essential role in full-scale commercial deployment of VoIP and integration into the existing PSTN. The Session Border Controller (SBC) enables direct IP-to-IP interconnect between multiple administrative domains for session-based services providing protocol inter-working, security, and admission control and management. The SBC is a voice over IP (VoIP) device that sits on the border of a network and controls call admission to that network. The primary purpose of an SBC is to protect the interior of the network from excessive call load and malicious traffic. Additional functions provided by the SBC include media bridging and billing services. Various types of notifications required for SBC applications are as follows: 1. When SIP/H2.48 calls are established and SBC application receives traffic (RTP/RTCP packets) from a source whose IP address or port is ambiguous, a source alert event is generated for the unwanted data packets received by SBC application. 2. Blacklisting is the process of matching inbound packets based on some simple parameters (for example source IP address) and preventing packets that match those parameters from being processed. SBC detects an attempt to disrupt traffic flowing through it. When a source is blacklisted in SBC application, an event is generated to provide information of the blacklisted source like its IP address, port, VPN address etc. 3. When there is a change in the state of any SBC service configured like a new SBC service is configured or the SBC card goes to standby state, reboot or offline state, a service is removed from SBC card, an event is generated by SBC. 4. When a large number of SIP/H.248 calls are ongoing and system is congested i.e. high CPU usage or high use of memory utilization, congestion event is generated at this point and when congestion is cleared means CPU usage comes to normal another event for congestion clear is generated. 5. When a service is configured on SBC application, its call policies are defined during the configuration like maximum number of calls, maximum call rates etc. If any of these policies is violated, an event for violation of service level agreement is generated. 6. When a radius server is attached/detached with SBC, a notification is generated to provide information of radius server type, IP address, port etc. 7. When an adjacency is attached/detached with SBC, a notification is generated to provide its information like the adjacency type and state. 8. When a H.248 controller is attached/detached with SBC to establish H.248 calls with SBC, a notification is generated to provide the information regarding the attached/detached H.248 controller like controller index, IP address, port, state etc. GLOSSARY SBC: Session Border Controller CSB: CISCO Session Border Controller CAC: Call Admission Control - protects voice traffic from the negative effects of other voice traffic and to keep excess voice traffic off the network. It is used to prevent congestion in Voice traffic. It is used in the Call Setup phase. RTP: Real Time Transport Protocol - defines a standardized packet format for delivering audio and video over the Internet. RTCP: Real Time Control Protocol - It is a sister protocol of the Real-time Transport Protocol (RTP). RTCP provides out-of-band control information for an RTP flow. It partners RTP in the delivery and packaging of multimedia data, but does not transport any data itself. It is used periodically to transmit control packets to participants in a streaming multimedia session. VMG: Virtual Media Gateway - introduced to bridge between different transmission technologies and to add service to end-user connections. Its architecture separates control and connectivity functions into physically separate network layers. VPN: Virtual Private Network - It is a communications network tunneled through another network, and dedicated for a specific network. Gate Id - Context Identifiers assigned uniquely to a SIP/H.248 call flows. Flow Pair Id: Stream Identifiers assigned uniquely to a SIP/H.248 call flows. Adjacency: An adjacency contains the system information to be transmitted to next HOP. SLA: Service Level Agreement - Service level agreement includes some call admission control policies which are defined during the SBC configurations like maximum number of calls, maximum call rates etc. Diameter Server: A Diameter Server is one that handles authentication, authorization and accounting requests for a particular realm. REFERENCES 1. CISCO Session Border Controller Documents and FAQ http://zed.cisco.com/confluence/display/SBC/SBC

This notification is generated when after SIP/H.248 call establishment with one party, the media packets are received from some unexpected source/party (or some wrong/unexpected IP address). This is to alert that some unwanted data packets are received by the system from an undesirable IP/port.

This notification is generated when a source is added to or removed from the blacklist table. Dynamic blacklists put in place automatically (subject to a set of configurable constraints) by the SBC when it detects an attempt to disrupt traffic flowing through it. Dynamic blacklisting does not require management interference. Blacklist table is restricted only to SBC service. This table is not made available to NM. For more Information on Dynamic Blacklisting refer to the following link: http://lbj.cisco.com/push_targets1/ucdit/cc/td/doc/product/ioxso ft/iox34/cgcr34/sbc_c34/sbc34dos.htm or Search cisco.com using keywords 'DoS Prevention and Dynamic Blacklisting'.

This notification is generated when an Adjacency is attached to (or detached from) the SBC.

This notification is generated when there is a change in the state of a service card. The changes in the service state are: -Active -Standby

This notification is generated when CPU/Memory congestion in SBC is raised or cleared.

This notification is generated when there is a violation of Service Level Agreement as described in the policy tables. The typical service level agreements include maximum number of calls allowed, max call rate, max bandwidth etc. This notification has been replaced by the csbSLAViolationRev1 notification.

This notification is generated when the connection to the radius server changes (connected or disconnected).

This notification is generated when the connection to the diameter server changes (connected or disconnected).

This notification is generated when in distributed deployment model, a DBE is attached or detached from the SBC.

This notification is generated when there is a violation of Service Level Agreement as described in the policy tables. The typical service level agreements include maximum number of alls allowed, max call rate, max bandwidth etc. This notification replaces the csbSLAViolation notification.

This notification is generated when QOS metric for Unanswered Call Ratio (UCR) crosses a configured threshold and attains either of minor, major or critical level.

This notification is generated when QOS metric for unanswered call ratio (UCR) reaches back to normal level from one of the major/minor/critical level.

This notification is generated when QOS metric for percentage of media packets lost crosses a configured threshold and attains either of minor, major or critical level.

This notification is raised whenever QOS metric for percentage media packet lost reaches back to normal level from one of the major/minor/critical level.

This notification is generated when QOS metric for percentage of media packets dropped crosses a configured threshold and attains either of minor, major or critical level.

This notification is raised whenever QOS metric for percentage media packet dropped reaches back to normal level from one of the major/minor/critical level.

This notification is generated when QOS metric for round trip delay(RTD) crosses a configured threshold and attains either of minor, major or critical level.

This notification is generated when QOS metric for round trip delay(RTD) reaches back to normal level from one of the major/minor/critical level.

This notification is generated when QOS metric for local media packet jitter crosses a configured threshold and attains either of minor, major or critical level.

This notification is generated when QOS metric for local media packet jitter reaches back to normal level from one of the major/minor/critical level.

This notification is generated when QOS metric for remote media packet jitter crosses a configured threshold and attains either of minor, major or critical level.

This notification is generated when QOS metric for remote media packet jitter reaches back to normal level from one of the major/minor/critical level.

This notification is generated when QOS metric for moscqe - Mean Opinion Score(MOS) - value crosses a configured threshold and attains either of minor, major or critical level.

This notification is generated when QOS metric for moscqe - Mean Opinion Score(MOS) - value reaches back to normal level from one of the major/minor/critical level.

This object identifies the subsystem or application module which generated the alarm. The subsystem which is involved in call establishment only is of type signaling. The subsystem which handles the traffic/data (RTP/RTCP packets) is of type media. The subsystem which is involved in call admission control is of type CAC. Enumeration: 'cac': 3, 'media': 2, 'signaling': 1.

This object identifies the perceived alarm severity associated with a service or safety affecting condition and/or event. These are based on ITU severities except that info is added. cleared - Indicates a previous alarm condition has been cleared. It is not required (unless specifically stated elsewhere on a case by case basis) that an alarm condition that has been cleared will produce a notification or other event containing an alarm severity with this value. indeterminate - Indicates that the severity level cannot be determined. critical - Indicates that a service or safety affecting condition has occurred and an immediate corrective action is required. major - Indicates that a service affecting condition has occurred and an urgent corrective action is required. minor - Indicates the existence of a non-service affecting condition and that corrective action should be taken in order to prevent a more serious (for example, service or safety affecting) condition. warning - Indicates the detection of a potential or impending service or safety affecting condition, before any significant effects have been felt. info - Indicates an alarm condition that does not meet any other severity definition. This can include important, but non-urgent, notices or informational events.

This object identifies the alarm identification number. It is a unique number generated by agent in the incremented order like for the first alarm it is 1, for second alarm it is 2 and so on.

This object identifies the time when alarm was generated. It is in the form: dow mon dd hh:mm:ss zzz yyyy where: dow is the day of the week (Sun, Mon, Tue, Wed, Thu, Fri, Sat). mon is the month (Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec). dd is the day of the month (01 through 31), as two decimal digits. hh is the hour of the day (00 through 23), as two decimal digits. mm is the minute within the hour (00 through 59), as two decimal digits. ss is the second within the minute (00 through 61), as two decimal digits. zzz is the time zone (and may reflect daylight savings time). Standard time zone abbreviations include those recognized by the method parse. If time zone information is not available, then zzz is empty - that is, it consists of no characters at all. yyyy is the year, as four decimal digits.

This MIB object represents the name of the SBC service configured on the service card.

This MIB object represents the description of the conditions due to which the notification is raised.

This MIB object represents the name of the virtual media gateway. The length of this object will be zero if the virtual media gateway is not defined.

This MIB object represents the context identifier for a particular SIP/H.248 call flow. The context identifier for each call is unique. The context identifier is also called as gate identifier for the SIP/H.248 call flow.

This MIB object represents the stream identifier given to a particular SIP/H.248 call flow. The stream identifier for each call is unique. The stream identifier is also called as flow pair identifier for the SIP/H.248 call flow.

This MIB object represents the address type of local source on which the media (RTP/RTCP) packets from an unexpected source was received during a SIP/H.248 call flow. The IP address could be IPv4 as well as IPv6.

This MIB object represents the local address on which the media (RTP/RTCP) packets from an unexpected source was received during a SIP/H.248 call flow. The IP address could be of type csbSrcAlertLocalAddressType.

This MIB object represents the local RTP port number for the flow on which the unexpected source packet was received. Note the RTP port number is reported in the case where the unexpected packet was received on the RTCP port for the flow.

This MIB object represents the type of address for the source address in media packets received from an unexpected source (not received from the source with which SIP/H.248 call is already established but are received from some other IP address).

This MIB object represents the source address from which unexpected media packets are received during a SIP/H.248 call flow, i.e., media packets are not received from the source with which SIP/H.248 call is already established but are received from some other IP address. The IP address could be of type csbSrcAlertRemoteAddressType.

This MIB object represents the source port from which unexpected media packets are received during a SIP/H.248 call flow (i.e. media packets are not received from the source with which SIP/H.248 call is already established but are received from some other IP address).

This MIB object represents the VPN Identifier for the Virtual Private Network within which the source flow is allocated. As this is an OCTET STRING, the MIB object will populate a NULL string if the source flow is not part of a VPN and in this case its length will be 0.

This MIB object represents the subfamily to which a blacklist source belongs.

This MIB object represents the VPN Identifier for the Virtual Private Network that the source flow is allocated in. The value of this MIB object will be 0 if the source flow is not part of a VPN.

This MIB object represents the type of the address of the source. This MIB object is not applicable for subfamilies of type 'blackVpn' and hence a value of 'unknown' will be populated.

This MIB object represents the address of the source. This object could be if type csbDynamicBlackListAddressType. This MIB object is not applicable for subfamilies of type 'blackVpn' and hence a value of 'unknown' will be populated.

This MIB object represents the transport type of the source port. This MIB object is not applicable for subfamilies of type 'blackVpn' and 'blackAddr', hence a value 'unknown' will be populated.

This MIB object represents the source port number. This MIB object is not applicable for subfamilies of type 'blackVpn' and 'blackAddr' and hence a value of 'unknown' will be populated.

This MIB object represents the access control imposed on the blacklisted source by the controller. A value of 'true' indicates access is blocked and A value of 'false' indicates that the access is unblocked.

This MIB object represents the protocol type of the adjacency. The adjacency are of two types - SIP and H.323. Enumeration: 'sip': 1, 'h323': 2.

This MIB object represents the adjacency state. The adjacency state can either be attached or detached. Enumeration: 'detached': 2, 'attached': 1.

This MIB object represents the name of the adjacency. The length of this object will be zero if the adjacency name is not defined.

This MIB object represents the account name associated with the adjacency.

This MIB object represents the current state of the service card. SBC service is in active state if it is configured on the primary card and the service card is in active state. The SBC service is in standby state if the service card on which the service is configured goes to standby mode. The SBC service is in offline mode if the service card on which the service is configured is in reset state or reboot state. Enumeration: 'active': 1, 'standby': 2, 'offline': 3.

This MIB object represents the slot identifier of the service card.

This MIB object represents the type of the CSB system congestion alarm. The alarm is raised either due to 'high CPU usage' or 'high memory usage'. Enumeration: 'unknown': 1, 'cp': 2, 'memory': 3.

This MIB object represents the CSB system congestion alarm state. The state is either 'raised' or 'cleared'. Enumeration: 'raised': 1, 'cleared': 2.

This MIB object represents the account name of the source which was involved in policy violation.

This MIB object represents the scope of the SLA policy which has been violated.

This MIB object represents the currently defined policy limits.

This MIB object represents the type of SLA policy violation event.

This MIB object represents the SLA policy restriction description means the violation of the call policy has resulted into which type of restriction, like if maximum number of calls exceeds then it will restrict the number of concurrent calls.

This MIB object represents the actual usage value for the event which leads to the SLA violation, like if maximum number of calls are more than SLA policy then actual value of this parameter/event.

This MIB object represents the RADIUS server connection state. The connection state can either be up or down. Enumeration: 'down': 2, 'up': 1.

This MIB object represents the type of RADIUS either for accounting or for authentication. Enumeration: 'accounting': 1, 'authentication': 2.

This MIB object represents the name of the RADIUS server.

This MIB object represents the address type of RADIUS server (IPv4 or IPv6).

This MIB object represents address of the RADIUS server. This object could be of type csbRadiusServerAddressType.

This MIB object represents the priority of the RADIUS server in case of the multiple servers. Higher the number, the higher is its priority.

This MIB object represents the diameter server connection state. The connection state can either be up or down. Enumeration: 'down': 2, 'up': 1.

This MIB object represents the type of diameter server used which can be either for accounting or for authentication here. Enumeration: 'accounting': 1, 'authentication': 2.

This MIB object represents the diameter group name. The length of this object is zero if the diameter type is authentication.

This MIB object represents the diameter server name.

This MIB object represents the current state of H.248 controller with respect to SBC which is attached or detached state. Enumeration: 'detached': 2, 'attached': 1.

This MIB object represents the address type of the H.248 controller.

This MIB object represents the address of the H.248 controller. This object is of the type csb248ControllerAddressType.

This MIB object represents the port of the H.248 controller.

The source alert linkset notification truth value. 'true' - Indicates that csbSourceAlertEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbSourceAlertEvent notification generation is disabled.

The dynamic blacklist linkset notification truth value. 'true' - Indicates that csbDynamicBlackListEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbDynamicBlackListEvent notification generation is disabled.

The adjacency status linkset notification truth value. 'true' - Indicates that csbAdjacencyStatus notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbAdjacencyStatus notification generation is disabled.

The service state linkset notification truth value. 'true' - Indicates that csbServiceStateEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbServiceStateEvent notification generation is disabled.

The system congestion alarm linkset notification truth value. 'true' - Indicates that csbSystemCongestionAlarmEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbSystemCongestionAlarmEvent notification generation is disabled.

The SLA violation linkset notification truth value. 'true' - Indicates that csbSLAViolation notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbSLAViolation notification generation is disabled.

The radius connection status linkset notification truth value. 'true' - Indicates that csbRadiusConnectionStatus notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbRadiusConnectionStatus notification generation is disabled.

The diameter connection status linkset notification truth value. 'true' - Indicates that csbDiameterConnectionStatus notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbDiameterConnectionStatus notification generation is disabled.

The H248 controller status linkset notification truth value. 'true' - Indicates that csbH248ControllerStatus notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbH248ControllerStatus notification generation is disabled.

This MIB object represents the currently defined policy limits. If the SLA is for max-num-calls, this value is the configured maximum number of calls. If the SLA is for max-call-rate, this value is the configured maximum number of calls per minute. If the SLA is for max-bandwidth, this value is the configured maximum bidirection bandwidth in bps. This object replaces the csbSLAPolicyLimit object.

This MIB object represents the actual usage value for the event which leads to the SLA violation, like if maximum number of calls are more than SLA policy then actual value of this parameter/event. If the SLA is for max-num-calls, this value is the current number of calls. If the SLA is for max-call-rate, this value is the current number of calls per minute. If the SLA is for max-bandwidth, this value is the current bidirection bandwidth in bps. This object replaces the csbSLACurrentUsage object.

The SLA violation linkset notification truth value. 'true' - Indicates that csbSLAViolationRev1 notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbSLAViolationReve1 notification generation is disabled.

This object indicates the current measured value of the QOS object.

The current Threshold Level of the measured object. The levels are Major, Minor, Critical.

The previous threshold level of the measured object. The levels are Major, Minor, Critical.

This object represents the number of times this QOS object, has entered normal level.

This object represents number of times the QOS object, has entered minor level.

This object represents the number of times the QOS object, has entered critical level.

This object represents number the of times the QOS object, has entered major level.

This object represents that the value of QOS parameter is applicable at which scope. QOS parameters can be calculated both at global as well as adjacency scope.

This object indicates the interval for which the periodic statistics information is to be displayed. The interval values can be 5 min, 15 mins, 1 hour or 1 day.

The Unanswered Call Ratio notification truth value. 'true' - Indicates that csbQOSUnansweredCallRatioEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbQOSUnansweredCallRatioEvent notification generation is disabled.

The percent media packet drop notification truth value. 'true' - Indicates that csbQOSPercentPktDropEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbQOSPercentPktDropEvent notification generation is disabled.

The round trip delay notification truth value. 'true' - Indicates that csbQOSRoundTripDelayEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbQOSRoundTripDelayEvent notification generation is disabled.

The moscqe notification truth value. 'true' - Indicates that csbQOSMoscqeEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbQOSMoscqeEvent notification generation is disabled.

The remote media packet jitter notification truth value. 'true' - Indicates that csbQOSLocalJitterEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbQOSLocalJitterEvent notification generation is disabled.

The remote media packet jitter notification truth value. 'true' - Indicates that csbQOSRemoteJitterEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbQOSRemoteJitterEvent notification generation is disabled.

The percent media packet drop notification truth value. 'true' - Indicates that csbQOSPercentPktLostEvent notification is to be generated when the state changes. That is, the notification generation is enabled. 'false' - Indicates that csbQOSPercentPktLostEvent notification generation is disabled.

The compliance statement for the SNMP entities that implement this MIB module.

The compliance statement for the SNMP entities that implement this MIB module.

The compliance statement for the SNMP entities that implement this MIB module.

This collection of objects represents the notifications generated by the agent.

This collection of objects represents the information which must be included in every notification.

This collection of objects represents the information about flows and unknown sources from which media packets have arrived at the respective flows.

This collection of objects represents the information about black-listed sources.

This collection of objects represents the information about the adjacency notification.

This collection of objects represents the information related to the SBC service configured on a router.

This collection of objects represents the information about the congestion state of the SBC system.

This collection of objects represents the information related to the Service Level Agreement (SLA) violation notification.

This collection of objects represents the information about the radius server connection state.

This collection of objects represents the information about the diameter server connection state.

This collection of objects represents the information about the H.248 associations in distributed deployment model.

This collection of objects represent the information about the standalone object which are used to tell the linkset notification truth value for each of the notification type.

This collection of objects represents the notifications generated by the agent.

This collection of objects represents the information related to the Service Level Agreement (SLA) violation notification.

This collection of objects represent the information about the standalone object which are used to tell the linkset notification truth value for each of the notification type.

This collection of objects representing the information about QOS statistics Alert traps.

This collection of objects represents the additional notifications generated by the agent.

This collection of objects represent the information about the standalone object which are used to tell the linkset notification truth value for each of the notification type.