ALTIGA-CERT-STATS-MIB

All MIBs › ALTIGA-CERT-STATS-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2002-09-05

Category: VPN and Security, Vendor: Altiga

Description: Altiga (Cisco VPN 3000) certificate statistics MIB for monitoring PKI certificate validation and enrollment activity.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ALTIGA-CERT-STATS-MIB?

ALTIGA-CERT-STATS-MIB is a private MIB originally from Altiga Networks and carried forward by Cisco after its acquisition (the basis of the Cisco VPN 3000 Concentrator series), providing statistics on digital certificate and Certificate Revocation List (CRL) exchanges used for PKI-based VPN authentication. It exposes a per-CA-server statistics table tracking certificate request, retransmission, receipt, pending, and timeout counts, as well as CRL request/retransmission counts, alongside a global certificate statistics scalar. For hardware/software status monitoring this MIB is a software-health indicator for the VPN concentrator's PKI subsystem: rising certificate timeouts or retransmissions against a given CA server point to a failing or unreachable certificate authority, which would prevent new IPsec/SSL VPN tunnels using certificate authentication from establishing. It depends on the certificate-authority and CRL concepts standardized in PKI/X.509, though the MIB itself is Altiga/Cisco-private. It is deployed on Altiga/Cisco VPN 3000 Series Concentrators in enterprise remote-access and site-to-site VPN deployments using certificate-based authentication. Engineers can download the ALTIGA-CERT-STATS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ALTIGA-CERT-STATS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Altiga/Cisco VPN 3000 Series Concentrator

Monitoring Examples

An administrator would poll the alCertStatsServerTable/alCertStatsServerEntry rows, indexed by alCertStatsServerIndex, comparing alCertStatsServerCertRequests against alCertStatsServerCertRcvd for a given alCertStatsServerAddress to see whether certificate responses are actually arriving. A high alCertStatsServerCertTimeouts or alCertStatsServerCertRetransmissions count for one CA server would indicate that server is unreachable or overloaded, explaining failed VPN tunnel establishments. Similarly, elevated alCertStatsServerCRLRequests with few successful completions would point to CRL-checking failures possibly blocking certificate validation.

What Can Be Monitored

certificate request/response counts per CA server
certificate retransmissions and timeouts
CRL request/retransmission counts
pending certificate requests

Imported Objects

From ALTIGA-GLOBAL-REG

alCertMibModule

OBJECT-IDENTITY

From ALTIGA-MIB

alCertGroup	OBJECT-IDENTITY
alStatsCert	OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using alCertStatsServerCertRequests OID:

Select a Cisco (Altiga) VPN 3000 Series Concentrator (legacy) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type alCertStatsServerCertRequests into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The total number of certificate request packets sent to this CA since client start-up. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
altigaCertStatsMibModule	1.3.6.1.4.1.3076.1.1.32.2			The Altiga Digital Certificates Statistics MIB models counters and objects that are of management interest for digital certificates. Acronyms The following acronyms are used in this document: CA: Certificate Authority CRL: Certificate Revocation List IP: Internet Protocol MIB: Management Information Base
altigaCertStatsMibConformance	1.3.6.1.4.1.3076.1.1.32.2.1
altigaCertStatsMibCompliances	1.3.6.1.4.1.3076.1.1.32.2.1.1
altigaCertStatsMibCompliance	1.3.6.1.4.1.3076.1.1.32.2.1.1.1			The compliance statement for agents which implement the Altiga Digital Certificates Statistics MIB.
altigaCertStatsGroup	1.3.6.1.4.1.3076.2.1.1.1.27.2			The objects for Cert statistics.
alStatsCertGlobal	1.3.6.1.4.1.3076.2.1.2.27.1
alCertStatsServerTable	1.3.6.1.4.1.3076.2.1.2.27.2		not-accessible	List table listing the CA servers.
alCertStatsServerEntry	1.3.6.1.4.1.3076.2.1.2.27.2.1		not-accessible	An entry representing a CA server.
I32 alCertStatsServerIndex	1.3.6.1.4.1.3076.2.1.2.27.2.1.1	Integer32	read-only	Index of this CA.
IP alCertStatsServerAddress	1.3.6.1.4.1.3076.2.1.2.27.2.1.2	IpAddress	read-only	The IP address of this CA.
I32 alCertStatsServerPortNumber	1.3.6.1.4.1.3076.2.1.2.27.2.1.3	Integer32	read-only	The port number of this CA.
C32 alCertStatsServerCertRequestsEx	1.3.6.1.4.1.3076.2.1.2.27.2.1.4	Counter32	read-only	The total number of certificate request packets sent to this CA since client start-up. This does not include retransmissions.
C32 alCertStatsServerCertRetransmissions	1.3.6.1.4.1.3076.2.1.2.27.2.1.5	Counter32	read-only	The total number of certificate request packets retransmitted to this CA since client start-up.
C32 alCertStatsServerCertRcvd	1.3.6.1.4.1.3076.2.1.2.27.2.1.6	Counter32	read-only	The total number of certificates received from this server since client start-up.
G32 alCertStatsServerCertPendingRequests	1.3.6.1.4.1.3076.2.1.2.27.2.1.7	Gauge32	read-only	The total number of certificate request packets destined for this server that have not yet timed out or received a response. This variable is incremented when certificate request is sent and decremented due to receipt of a certificate, a timeout or retransmission.
C32 alCertStatsServerCertTimeouts	1.3.6.1.4.1.3076.2.1.2.27.2.1.8	Counter32	read-only	The total number of certificate timeouts to this server since client startup.
C32 alCertStatsServerCRLRequests	1.3.6.1.4.1.3076.2.1.2.27.2.1.9	Counter32	read-only	The total number of CRL request packets sent to this CA since client start-up. This does not include retransmissions.
C32 alCertStatsServerCRLRetransmissions	1.3.6.1.4.1.3076.2.1.2.27.2.1.10	Counter32	read-only	The total number of CRL request packets retransmitted to this CA since client start-up.
C32 alCertStatsServerCRLRcvd	1.3.6.1.4.1.3076.2.1.2.27.2.1.11	Counter32	read-only	The total number of CRL received from this server since client start-up.
G32 alCertStatsServerCRLPendingRequests	1.3.6.1.4.1.3076.2.1.2.27.2.1.12	Gauge32	read-only	The total number of CRL request packets destined for this server that have not yet timed out or received a response. This variable is incremented when certificate request is sent and decremented due to receipt of a certificate, a timeout or retransmission.
C32 alCertStatsServerCRLTimeouts	1.3.6.1.4.1.3076.2.1.2.27.2.1.13	Counter32	read-only	The total number of CRL timeouts to this server since client startup.

RFC description

Digital certificate statistics and CA server management for Altiga VPN appliances.

Start monitoring Cisco (Altiga) VPN 3000 Series Concentrators (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ALTIGA-CERT-STATS-MIB