ALTIGA-SEP-STATS-MIB

All MIBs › ALTIGA-SEP-STATS-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2003-03-27

Category: VPN and Security, Vendor: Altiga

Description: Altiga (Cisco VPN 3000) SEP (Scalable Encryption Processor) statistics MIB for monitoring crypto hardware utilization.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ALTIGA-SEP-STATS-MIB?

ALTIGA-SEP-STATS-MIB is a Cisco (originally Altiga Networks) MIB for the VPN 3000 Series concentrator, modeling statistics and status for the Scalable Encryption Processor (SEP), a hardware crypto-acceleration module used to offload IPsec encryption/hashing workloads. It exposes a per-slot module statistics table describing SEP hardware type, operational state, DSP firmware code version, and hashing/encryption packet and octet throughput counters. Its monitoring focus is hardware status and performance: administrators check alSepModuleStatsState per slot to confirm each crypto module is operational, and alSepModuleStatsDspCodeVersion to verify firmware consistency, while the hash/encryption packet and octet counters reveal crypto processing load and can expose a failing or underperforming SEP card. It is a self-contained Cisco/Altiga hardware MIB with no dependency on external standard MIBs noted beyond generic SNMPv2 conformance conventions. It is deployed on Cisco VPN 3000 Series concentrators terminating large volumes of IPsec VPN tunnels where hardware crypto acceleration is required, and administrators can download the ALTIGA-SEP-STATS-MIB file to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ALTIGA-SEP-STATS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco VPN 3000 Series concentrator (Altiga)

Monitoring Examples

An admin would poll alSepModuleStatsTable/alSepModuleStatsEntry, indexed by alSepModuleStatsSlotNum, to check alSepModuleStatsState for each SEP module and confirm it is in a healthy operational state rather than failed or degraded. alSepModuleStatsHashOutboundPackets/alSepModuleStatsHashInboundPackets and alSepModuleStatsEncPackets would be trended to detect a SEP card whose throughput has dropped or stalled relative to peers, indicating a hardware fault, while alSepModuleStatsDspCodeVersion confirms all installed SEP cards run matching firmware.

What Can Be Monitored

SEP module operational state
SEP hardware type per slot
DSP firmware code version
hash inbound/outbound packet and octet counts
encryption packet counts

Imported Objects

From ALTIGA-GLOBAL-REG

alSepMibModule

OBJECT-IDENTITY

From ALTIGA-MIB

alSepGroup	OBJECT-IDENTITY
alStatsSep	OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus

How to Use in IPNetwork Monitor

Example using alSepModuleStatsHashOutboundPackets OID:

Select a Cisco (Altiga) VPN 3000 Series Concentrator (legacy) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type alSepModuleStatsHashOutboundPackets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of outbound authentication-only packets processed by this SEP. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
altigaSepStatsMibModule	1.3.6.1.4.1.3076.1.1.35.2			The Cisco VPN 3000 Series SEP Statistics MIB models counters and objects that are of management interest for the SEP hardware. Acronyms The following acronyms are used in this document: MIB: Management Information Base RSA: Rivest, Shamir, and Adelman SEP: Scalable Encryption Processor
altigaSepStatsMibConformance	1.3.6.1.4.1.3076.1.1.35.2.1
altigaSepStatsMibCompliances	1.3.6.1.4.1.3076.1.1.35.2.1.1
altigaSepStatsMibCompliance	1.3.6.1.4.1.3076.1.1.35.2.1.1.1			The compliance statement for agents which implement the Altiga SEP Statistics MIB.
altigaSepStatsGroup	1.3.6.1.4.1.3076.2.1.1.1.30.2			The objects for the SEP Module statistics.
alSepModuleStatsTable	1.3.6.1.4.1.3076.2.1.2.30.2		not-accessible	List of SEPs modules found.
alSepModuleStatsEntry	1.3.6.1.4.1.3076.2.1.2.30.2.1		not-accessible	An entry in the alSepModuleStatsTable.
ROW alSepModuleStatsRowStatus	1.3.6.1.4.1.3076.2.1.2.30.2.1.1	RowStatus	read-create	The status of this row.
INT alSepModuleStatsSlotNum	1.3.6.1.4.1.3076.2.1.2.30.2.1.2	INTEGER	not-accessible	The physical slot this SEP is connected to.
INT alSepModuleStatsType	1.3.6.1.4.1.3076.2.1.2.30.2.1.3	INTEGER	read-only	Indicates the type of HW engine used to perform the cryptographic transforms. cryptSet: First generation of Hardware Cryptographic Processor. cryptIc: Cryptographic Integrated Circuit. bcm582x: BroadCom 582x series Hardware Cryptographic Products.
INT alSepModuleStatsState	1.3.6.1.4.1.3076.2.1.2.30.2.1.4	INTEGER	read-only	The functional state of this SEP. sepNotFound: SEP is not found. sepFound: SEP is found. sepDiagFailure: SEP dialog fail. sepNotOperational: SEP is not operational. sepLoading: SEP is loading data. sepInitializing: SEP is initializing. sepOperational: SEP is operational. sepDisabled: SEP is disabled.
STR alSepModuleStatsDspCodeVersion	1.3.6.1.4.1.3076.2.1.2.30.2.1.5	DisplayString	read-only	The version of DSP microcode running on this SEP.
C32 alSepModuleStatsHashOutboundPacketsEx	1.3.6.1.4.1.3076.2.1.2.30.2.1.6	Counter32	read-only	The number of outbound authentication-only packets processed by this SEP.
C32 alSepModuleStatsHashOutboundOctets	1.3.6.1.4.1.3076.2.1.2.30.2.1.7	Counter32	read-only	The number of outbound octets authenticated by this SEP.
C32 alSepModuleStatsHashInboundPackets	1.3.6.1.4.1.3076.2.1.2.30.2.1.8	Counter32	read-only	The number of inbound authentication-only packets processed by this SEP.
C32 alSepModuleStatsHashInboundOctets	1.3.6.1.4.1.3076.2.1.2.30.2.1.9	Counter32	read-only	The number of inbound octets authenticated by this SEP.
C32 alSepModuleStatsEncPackets	1.3.6.1.4.1.3076.2.1.2.30.2.1.10	Counter32	read-only	The number of outbound encryption-only packets processed by this SEP.
C32 alSepModuleStatsEncOctets	1.3.6.1.4.1.3076.2.1.2.30.2.1.11	Counter32	read-only	The number of outbound octets encrypted by this SEP.
C32 alSepModuleStatsDecPackets	1.3.6.1.4.1.3076.2.1.2.30.2.1.12	Counter32	read-only	The number of inbound decryption-only packets processed by this SEP.
C32 alSepModuleStatsDecOctets	1.3.6.1.4.1.3076.2.1.2.30.2.1.13	Counter32	read-only	The number of inbound octets decrypted by this SEP.
C32 alSepModuleStatsHashEncPackets	1.3.6.1.4.1.3076.2.1.2.30.2.1.14	Counter32	read-only	The number of combined outbound hash/encrypt packets processed by this SEP.
C32 alSepModuleStatsHashDecPackets	1.3.6.1.4.1.3076.2.1.2.30.2.1.15	Counter32	read-only	The number of combined inbound hash/decrypt packets processed by this SEP.
C32 alSepModuleStatsCryptoTransformsTotal	1.3.6.1.4.1.3076.2.1.2.30.2.1.16	Counter32	read-only	The total number of hash, encryption, decryption, hash/encrypt, and hash/decrypt transforms performed by this SEP.
C32 alSepModuleStatsPacketDrops	1.3.6.1.4.1.3076.2.1.2.30.2.1.17	Counter32	read-only	The number of packets intended for SEP processing, dropped due to the SEP ring being full.
C32 alSepModuleStatsRandRequests	1.3.6.1.4.1.3076.2.1.2.30.2.1.18	Counter32	read-only	The number of random # requests made to the SEP.
C32 alSepModuleStatsRandReplens	1.3.6.1.4.1.3076.2.1.2.30.2.1.19	Counter32	read-only	The number of random # requests fulfilled by the SEP.
I32 alSepModuleStatsRandBytesAvail	1.3.6.1.4.1.3076.2.1.2.30.2.1.20	Integer32	read-only	The number of random bytes currently cached on the Host.
C32 alSepModuleStatsRandCacheEmpty	1.3.6.1.4.1.3076.2.1.2.30.2.1.21	Counter32	read-only	The number of times a random # request came in and we had no SEP generated random #'s available on the host.
C32 alSepModuleStatsDHKeysGenerated	1.3.6.1.4.1.3076.2.1.2.30.2.1.22	Counter32	read-only	The number of times a new Diffie Hellman key pair has been generated by a SEP.
C32 alSepModuleStatsDHDerivedSecretKeys	1.3.6.1.4.1.3076.2.1.2.30.2.1.23	Counter32	read-only	The number of times a SEP has derived the Diffie Hellman secret key.
C32 alSepModuleStatsRSASignings	1.3.6.1.4.1.3076.2.1.2.30.2.1.24	Counter32	read-only	The number of times an RSA Digital Signature has been generated by a SEP.
C32 alSepModuleStatsRSAVerifications	1.3.6.1.4.1.3076.2.1.2.30.2.1.25	Counter32	read-only	The number of times an RSA Digital Signature has been verified by a SEP.
C32 alSepModuleStatsRSAEncPackets	1.3.6.1.4.1.3076.2.1.2.30.2.1.26	Counter32	read-only	The number of packets RSA-encrypted by this SEP.
C32 alSepModuleStatsRSAEncOctets	1.3.6.1.4.1.3076.2.1.2.30.2.1.27	Counter32	read-only	The number of octets RSA-encrypted by this SEP.
C32 alSepModuleStatsRSADecPackets	1.3.6.1.4.1.3076.2.1.2.30.2.1.28	Counter32	read-only	The number of packets RSA-decrypted by this SEP.
C32 alSepModuleStatsRSADecOctets	1.3.6.1.4.1.3076.2.1.2.30.2.1.29	Counter32	read-only	The number of octets RSA-decrypted by this SEP.
C32 alSepModuleStatsDSAKeysGenerated	1.3.6.1.4.1.3076.2.1.2.30.2.1.30	Counter32	read-only	The number of times a new DSA Key pair has been generated by a SEP.
C32 alSepModuleStatsDSASignings	1.3.6.1.4.1.3076.2.1.2.30.2.1.31	Counter32	read-only	The number of times a DSA Digital Signature has been generated by a SEP.
C32 alSepModuleStatsDSAVerifications	1.3.6.1.4.1.3076.2.1.2.30.2.1.32	Counter32	read-only	The number of times a DSA Digital Signature has been verified by a SEP.
C32 alSepModuleStatsRSAKeysGenerated	1.3.6.1.4.1.3076.2.1.2.30.2.1.33	Counter32	read-only	The number of times a new RSA Key pair has been generated by a SEP.

RFC description

Cisco VPN 3000 Series Scalable Encryption Processor (SEP) statistics for RSA encryption module monitoring.

Start monitoring Cisco (Altiga) VPN 3000 Series Concentrators (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ALTIGA-SEP-STATS-MIB