--******************************************************************************
--
--  TELDAT, SA.
--
--  Parque Tecnologico de Madrid
--  Tres Cantos
--  28760 MADRID
--  Tlf: +34-918076565
--  Fax: +34-918076521
--  E-mail: id@teldat.com
--
--******************************************************************************
--     MIB privada de Teldat
--
--     Protocolo IPSec
--******************************************************************************
--
-- Historial:
-- 1.3  07-02-14    M.A. Pastor     XH 3523. Errors with HP Openview 9.20
-- 1.2  11-01-13    E. Amorena      XH 2610. MIBs compilation.
-- 1.1  28-02-11    I.Serrano       Syntax errors are fixed
-- 1.0  12-07-11    I.Serrano       Implementacin inicial.
--******************************************************************************

TELDAT-MON-PROTOCOL-IPSEC-MIB DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY,
    OBJECT-TYPE,
    Unsigned32,
    IpAddress
        FROM SNMPv2-SMI

    DisplayString,
    TEXTUAL-CONVENTION
        FROM SNMPv2-TC

    telProdNpMonProtocols
        FROM TELDAT-SW-STRUCTURE-MIB;

--
-- teldatIpsecMonMIB
--

telProdNpMonProtIpsec MODULE-IDENTITY
    LAST-UPDATED    "1107081008Z"
    ORGANIZATION    "Teldat, S.A."
    CONTACT-INFO
        "Teldat, S.A.
        Customer Service

        Postal: Parque Tecnolgico de Madrid
                Tres Cantos 28760
                Madrid, SPAIN

        Tel.: +34 918 076 565

        http://www.teldat.com"
    DESCRIPTION
        "This module defines a MIB for monitoring Internet Protocol Security
        (IPSec). IPSec is a security platform on network level, which lets
        securing IP communications by authenticating and encrypting each IP
        data flow.

        The MIB is made up of three major groups: Advanced, SA and Statistics.

        Advanced group shows the counter values of use of SA and cypher queue.

        In SA group is visualized the state of every Security Association (SA).

        Statistics group contains statistics of IPSec performance."

    REVISION    "1107081008Z"
    DESCRIPTION "Initial implementation."

    ::= {telProdNpMonProtocols 15}

--
--  Location of node telProdNpMonProtIpsec in TELDAT-MIB
--

-- telproducts              OBJECT IDENTIFIER   ::= { teldat 4 }
-- telProductsNucleox       OBJECT IDENTIFIER   ::= { telproducts 1 }
-- telProductsNpMonit       OBJECT IDENTIFIER   ::= { telProductsNucleox 2 }
-- telProdNpMonProtocols    OBJECT IDENTIFIER   ::= { telProductsNpMonit 3 }
-- telProdNpMonProtIpsec    OBJECT IDENTIFIER   ::= { telProdNpMonProtocols 15 }

--******************************************************************************
--
--    GROUPS
--
--******************************************************************************
teldatIPSecAdvancedGroup        OBJECT IDENTIFIER   ::= { telProdNpMonProtIpsec 1 }
teldatIPSecSaGroup              OBJECT IDENTIFIER   ::= { telProdNpMonProtIpsec 2 }
teldatIPSecStatisticsGroup      OBJECT IDENTIFIER   ::= { telProdNpMonProtIpsec 3 }


--******************************************************************************
--
--    ADVANCED GROUP
--
--******************************************************************************

iPSecClear OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Reset the counter values of cypher queue and SA use. This variable
        just can take the values 1 (reset counters) or 0 (no effects) on SET
        operation."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 1 }

iPSecActive OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Close every Security Association and disable IPSec. This variable
        just can take the values 1 (enabling IPSec) or 0 (disabling IPSec).
        GET operation returns the protocol state: 1 (enabled) and 0 (disabled)."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 2 }

cypherQueueSize OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Size of cypher queue."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 3 }

cypherQueueWaterMark OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum number of messages which have been in the cypher queue."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 4 }

currentQueueLevel OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Current number of messages in the cypher queue."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 5 }

maxSASimultaneous OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum number of IPSec SA which have been simultaneously active."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 6 }

currentNumberIPSecSa OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Current number of active IPSec SA."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 7 }

maxNegotiationDuration OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum time that has lasted an IKE negotiation phase, in miliseconds."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 8 }

maxTunnelSupported OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum number of supported tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 9 }

accessListHashSize OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Size of access list hash."
    DEFVAL      { 0 }
    ::= { teldatIPSecAdvancedGroup 10 }

--******************************************************************************
--
--    SA GROUP
--
--******************************************************************************

-- Negotiation Table
teldatIPSecIkeSaTable OBJECT-TYPE
    SYNTAX SEQUENCE OF TeldatIPSecIkeSaEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This table shows information of active ISAKMP SA."
    ::= { teldatIPSecSaGroup 1 }

teldatIPSecIkeSaEntry OBJECT-TYPE
    SYNTAX TeldatIPSecIkeSaEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Each entry identifies an active ISAKMP SA."
    INDEX { ikeSaIndex }
    ::= { teldatIPSecIkeSaTable 1 }

TeldatIPSecIkeSaEntry ::=
    SEQUENCE {
        ikeSaIndex Unsigned32,
        ikeSaClear Unsigned32,
        saConnection Unsigned32,
        initiatorCookie DisplayString,
        responderCookie DisplayString,
        negotiationInitiator DisplayString,
        negotiationResponder DisplayString,
        ikeSaSrc IpAddress,
        ikeSaDes IpAddress,
        ikeSaState DisplayString,
        saOakleyGroup Unsigned32,
        ikeSaLifeTime DisplayString,
        ikeSaRemLifeTime DisplayString,
        ikeSaPurgeTime DisplayString
    }

ikeSaIndex OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Table index."
    ::= { teldatIPSecIkeSaEntry 1 }

ikeSaClear OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Close this active ISAKMP SA. This variable just can take the value 1 on
        SET operation."
    ::= { teldatIPSecIkeSaEntry 2 }

saConnection OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of SA connection. This variable internally identifies an active
        SA in the router."
    ::= { teldatIPSecIkeSaEntry 3 }

initiatorCookie OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Cookie of the negotiation initiator."
    ::= { teldatIPSecIkeSaEntry 4 }

responderCookie OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Cookie of the negotiation responder."
    ::= { teldatIPSecIkeSaEntry 5 }

negotiationInitiator OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "IP address or hostname of the negotiation initiator."
    ::= { teldatIPSecIkeSaEntry 6 }

negotiationResponder OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "IP address or hostname of the negotiation responder."
    ::= { teldatIPSecIkeSaEntry 7 }

ikeSaSrc OBJECT-TYPE
    SYNTAX IpAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Local endpoint IP address of the tunnel."
    ::= { teldatIPSecIkeSaEntry 8 }

ikeSaDes OBJECT-TYPE
    SYNTAX IpAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Remote endpoint IP address of the tunnel."
    ::= { teldatIPSecIkeSaEntry 9 }

ikeSaState OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "State of negotiation SA. This variable just can take three values:
        ESTABLISH, DYING and ALIVE."
    ::= { teldatIPSecIkeSaEntry 10 }

saOakleyGroup OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Type of Oakley group."
    ::= { teldatIPSecIkeSaEntry 11 }

ikeSaLifeTime OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Life time of this ISAKMP SA."
    ::= { teldatIPSecIkeSaEntry 12 }

ikeSaRemLifeTime OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Remaining life time of this ISAKMP SA."
    ::= { teldatIPSecIkeSaEntry 13 }

ikeSaPurgeTime OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Time (seconds) for clearing this ISAKMP SA if destinity does not
        response during negotiation. This variable shows '-' if purge time
        is not configured."
    ::= { teldatIPSecIkeSaEntry 14 }

-- IN Table
teldatIPSecInSaTable OBJECT-TYPE
    SYNTAX SEQUENCE OF TeldatIPSecInSaEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Table of manual or dinamic active input SA. In this table each SA
        represents a input IPSec data flow."
    ::= { teldatIPSecSaGroup 2 }

teldatIPSecInSaEntry OBJECT-TYPE
    SYNTAX TeldatIPSecInSaEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Each entry identifies an input IPSec SA."
    INDEX { inSaIndex }
    ::= { teldatIPSecInSaTable 1 }

TeldatIPSecInSaEntry ::=
    SEQUENCE {
        inSaIndex Unsigned32,
        inSaClear Unsigned32,
        inSaConnection Unsigned32,
        inSaSpi DisplayString,
        inSaKeyType DisplayString,
        inSaStatus DisplayString,
        inSaEncryption DisplayString,
        inSaAuthentication DisplayString,
        inSaSrc IpAddress,
        inSaDes IpAddress,
        inSaLifeTime DisplayString,
        inSaRemLifeTime DisplayString,
        inSaEncodePkts Unsigned32,
        inSaEncodePktsErr Unsigned32,
        inSaDecodePkts Unsigned32,
        inSaDecodePktsErr Unsigned32,
        inSaDpd DisplayString
        }

inSaIndex OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Table index."
    ::= { teldatIPSecInSaEntry 1 }

inSaClear OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Close this SA if it is dinamic. This variable just can take
        the values 1 (clear SA) or 0 (not clear) on SET operation.
        For manual SA it does not effect."
    ::= { teldatIPSecInSaEntry 2 }

inSaConnection OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of SA connection. This variable internally identifies
        an active SA in the router."
    ::= { teldatIPSecInSaEntry 3 }

inSaSpi OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Identification number of the security configuration of the SA."
    ::= { teldatIPSecInSaEntry 4 }

inSaKeyType OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Type of keys used by the IPSec tunnel. This variable only can take
        two values: 'manual-keying' if the keys have been setted by user,
        and 'IKE' if the keys have been dinamically managed using IKE protocol."
    ::= { teldatIPSecInSaEntry 5 }

inSaStatus OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "State of the SA. It just can take two values:
        UP: the SA is active.
        DOWN: the SA is not active."
    ::= { teldatIPSecInSaEntry 6 }

inSaEncryption OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "SA encryption protocol."
    ::= { teldatIPSecInSaEntry 7 }

inSaAuthentication OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only    STATUS current
    DESCRIPTION
        "SA authentication protocol."
    ::= { teldatIPSecInSaEntry 8 }

inSaSrc OBJECT-TYPE
    SYNTAX IpAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Local endpoint IP address of the tunnel."
    ::= { teldatIPSecInSaEntry 9 }

inSaDes OBJECT-TYPE
    SYNTAX IpAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Remote endpoint IP address of the tunnel."
    ::= { teldatIPSecInSaEntry 10 }

inSaLifeTime OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Life time of the input SA."
    ::= { teldatIPSecInSaEntry 11 }

inSaRemLifeTime OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Remaining life time of the input SA."
    ::= { teldatIPSecInSaEntry 12 }

inSaEncodePkts OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of packets sent by this tunnel."
    ::= { teldatIPSecInSaEntry 13 }

inSaEncodePktsErr OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of errors in sent packets."
    ::= { teldatIPSecInSaEntry 14 }

inSaDecodePkts OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of packets received by this tunnel."
    ::= { teldatIPSecInSaEntry 15 }

inSaDecodePktsErr OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of errors in received packets."
    ::= { teldatIPSecInSaEntry 16 }

inSaDpd OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "This variable indicates if the Dead Peer Detection is enabled. It just
        can take two possible values: ON (enabled) and OFF (disabled)."
    ::= { teldatIPSecInSaEntry 17 }

-- OUT Table
teldatIPSecOutSaTable OBJECT-TYPE
    SYNTAX SEQUENCE OF TeldatIPSecOutSaEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Table of manual or dinamic active output SA. In this table each SA
        represents a output IPSec data flow."
    ::= { teldatIPSecSaGroup 3 }

teldatIPSecOutSaEntry OBJECT-TYPE
    SYNTAX TeldatIPSecOutSaEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "Each entry identifies an output IPSec SA."
    INDEX { outSaIndex }
    ::= { teldatIPSecOutSaTable 1 }

TeldatIPSecOutSaEntry ::=
    SEQUENCE {
        outSaIndex Unsigned32,
        outSaClear Unsigned32,
        outSaConnection Unsigned32,
        outSaSpi DisplayString,
        outSaKeyType DisplayString,
        outSaStatus DisplayString,
        outSaEncryption DisplayString,
        outSaAuthentication DisplayString,
        outSaSrc IpAddress,
        outSaDes IpAddress,
        outSaLifeTime DisplayString,
        outSaRemLifeTime DisplayString,
        outSaEncodePkts Unsigned32,
        outSaEncodePktsErr Unsigned32,
        outSaDecodePkts Unsigned32,
        outSaDecodePktsErr Unsigned32,
        outSaDpd DisplayString
        }

outSaIndex OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Table index."
    ::= { teldatIPSecOutSaEntry 1 }

outSaClear OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-write
    STATUS current
    DESCRIPTION
        "Close this SA if it is dinamic. This variable just can take
        the values 1 (clear SA) or 0 (not clear) on SET operation.
        For manual SA it does not effect."
    ::= { teldatIPSecOutSaEntry 2 }

outSaConnection OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of SA connection. This variable internally identifies
        an active SA in the router."
    ::= { teldatIPSecOutSaEntry 3 }

outSaSpi OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Identification number of the security configuration of the SA."
    ::= { teldatIPSecOutSaEntry 4 }

outSaKeyType OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Type of keys used by the IPSec tunnel. This variable only can take
        two values: 'manual-keying' if the keys have been setted by the user,
        and 'IKE' if the keys have been setted by IKE protocol."
    ::= { teldatIPSecOutSaEntry 5 }

outSaStatus OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "State of the SA. It just can take two values:
        UP: the SA is active.
        DOWN: the SA is not active."
    ::= { teldatIPSecOutSaEntry 6 }

outSaEncryption OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "SA encryption protocol."
    ::= { teldatIPSecOutSaEntry 7 }

outSaAuthentication OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "SA authentication protocol."
    ::= { teldatIPSecOutSaEntry 8 }

outSaSrc OBJECT-TYPE
    SYNTAX IpAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Local endpoint IP address of the tunnel."
    ::= { teldatIPSecOutSaEntry 9 }

outSaDes OBJECT-TYPE
    SYNTAX IpAddress
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Remote endpoint IP address of the tunnel."
    ::= { teldatIPSecOutSaEntry 10 }

outSaLifeTime OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Life time of the output SA."
    ::= { teldatIPSecOutSaEntry 11 }

outSaRemLifeTime OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Remaining life time of the output SA."
    ::= { teldatIPSecOutSaEntry 12 }

outSaEncodePkts OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of packets sent by this tunnel."
    ::= { teldatIPSecOutSaEntry 13 }

outSaEncodePktsErr OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of errors in sent packets."
    ::= { teldatIPSecOutSaEntry 14 }

outSaDecodePkts OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of packets received by this tunnel."
    ::= { teldatIPSecOutSaEntry 15 }

outSaDecodePktsErr OBJECT-TYPE
    SYNTAX Unsigned32
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "Number of errors in received packets."
    ::= { teldatIPSecOutSaEntry 16 }

outSaDpd OBJECT-TYPE
    SYNTAX DisplayString
    MAX-ACCESS read-only
    STATUS current
    DESCRIPTION
        "This variable indicates if the Dead Peer Detection is enabled.
        It just can take two possible values: ON (enabled) and OFF (disabled)."
    ::= { teldatIPSecOutSaEntry 17 }

--******************************************************************************
--
--    STATISTICS GROUP
--
--******************************************************************************

statisticsClear OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "Reset the statistics of IPSec use. This variable just can take the
        value 1 on SET operation. If reset was successfully, GET operation
        returns 0 (OK) and otherwise returns 2 (Error)."
    DEFVAL      { 0 }
    ::= { teldatIPSecStatisticsGroup 1 }

-- ESP/AH Group
teldatIPSecESPAHGroup        OBJECT IDENTIFIER   ::= { teldatIPSecStatisticsGroup 2 }

inFramesOk OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Correctly decapsulated and received frames on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 1 }

inFramesError OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of received erroneous frames on IPSec data tunnels.
        That is the sum of three parameters:
        - Out order received frames.
        - Discarded frames by unknown payload protocol.
        - Discarded frames by ESP authentication error."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 2 }

inFramesErrOutOfOrder OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of out order received frames on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 3 }

inFramesErrUnkPayloadProt OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of discarded frames by unknown payload protocol on IPSec data
        tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 4 }

inFramesInternalErrors OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of discarded frames by ESP authentication error on IPSec data
        tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 5 }

inFramesPerSec OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Received traffic (frames/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 6 }

inFramesPerSecMax OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum received traffic (frames/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 7 }

inKbitsPerSec OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Decoded traffic (kbytes/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 8 }

inKbitsPerSecMax OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum decoded traffic (kbytes/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 9 }

outFramesOk OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Correctly encapsulated and transmitted frames on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 10 }

outFramesUnkAuthAlg OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of frames with unknown authentication algorithm on IPSec
        data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 11 }

outFramesPerSec OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Transmitted traffic (frames/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 12 }

outFramesPerSecMax OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum transmitted traffic (frames/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 13 }

outKbitsPerSec OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Encoded traffic (kbytes/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 14 }

outKbitsPerSecMax OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Maximum encoded traffic (kbytes/second) on IPSec data tunnels."
    DEFVAL      { 0 }
    ::= { teldatIPSecESPAHGroup 15 }

-- Forwarding Group
teldatIPSecForwardingGroup        OBJECT IDENTIFIER   ::= { teldatIPSecStatisticsGroup 3 }

inSaNotFound OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of input SA not found."
    DEFVAL      { 0 }
    ::= { teldatIPSecForwardingGroup 1 }

outSaTemplateNotFound OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of output SA templates not found."
    DEFVAL      { 0 }
    ::= { teldatIPSecForwardingGroup 2 }

outSaNotFound OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of output SA not found."
    DEFVAL      { 0 }
    ::= { teldatIPSecForwardingGroup 3 }

-- IKE statistics Group
teldatIPSecIKEGroup        OBJECT IDENTIFIER   ::= { teldatIPSecStatisticsGroup 4 }

ikeNegotiationsPhaseI OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of phase I negotiations."
    DEFVAL      { 0 }
    ::= { teldatIPSecIKEGroup 1 }

ikeNegotiationsPhaseII OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of phase II negotiations."
    DEFVAL      { 0 }
    ::= { teldatIPSecIKEGroup 2 }

ikeCheckHashErrorPhaseI OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of check hash errors on phase I."
    DEFVAL      { 0 }
    ::= { teldatIPSecIKEGroup 3 }

ikeCheckHashErrorPhaseII OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of check hash errors on phase II."
    DEFVAL      { 0 }
    ::= { teldatIPSecIKEGroup 4 }

dropsCollisionsIKEMessage OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of packets dropped by collision of IKE messages."
    DEFVAL      { 0 }
    ::= { teldatIPSecIKEGroup 5 }

dropsWaittingIKEMessage OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of packets dropped waiting for IKE processing."
    DEFVAL      { 0 }
    ::= { teldatIPSecIKEGroup 6 }

-- Other Variables
cypherQueueEmpty OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Attempts of getting a free message from the empty queue of free
        generic cypher messages."
    DEFVAL      { 0 }
    ::= { teldatIPSecStatisticsGroup 5 }

jobQueueEmpty OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Attempts of getting a job from the empty queue of pending jobs."
    DEFVAL      { 0 }
    ::= { teldatIPSecStatisticsGroup 6 }

openConnectNotNotified OBJECT-TYPE
    SYNTAX      Unsigned32
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Number of open connections not notified during last connevent-period."
    DEFVAL      { 0 }
    ::= { teldatIPSecStatisticsGroup 7 }

END