CIENA-WS-ENCRYPTION-MIB

All MIBs › CIENA-WS-ENCRYPTION-MIB

Organization: Ciena Corporation

Last Updated: 2017-03-02

Category: Optical and WDM, VPN and Security, Vendor: Ciena

Description: Manages optical layer encryption settings and key management on Ciena WaveServer platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CIENA-WS-ENCRYPTION-MIB?

CIENA-WS-ENCRYPTION-MIB manages datapath (optical layer) encryption on Ciena WaveServer platforms, covering both a global encryption enable state and per-port pre-shared-key provisioning and authentication. It exposes per-port encryption status and peer authentication status, along with a pre-shared-key table holding key values, fingerprints, status, and descriptions, plus a re-authentication table for key rollover events. Its monitoring value is primarily security/software-status oriented, confirming that encryption is enabled and that peer authentication has succeeded on each encrypted port, essential to detect a misconfigured or compromised optical link before unencrypted or unauthenticated traffic is carried. It is a Ciena WaveServer-specific vendor MIB with no direct IETF standard dependency, implementing proprietary key management alongside standard optical transport framing. It's deployed in high-security optical transport networks such as financial, government, and carrier backbone environments running Ciena WaveServer platforms where line-rate encryption of client traffic is required, and administrators can download the CIENA-WS-ENCRYPTION-MIB file directly to load into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CIENA-WS-ENCRYPTION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Ciena WaveServer optical transport platform

Monitoring Examples

A security operator polls cwsEncryptionPortEncryptionTable to confirm encryption is active on a given port and checks cwsEncryptionPortEncryptionPeerAuthenticationStatus to verify the far-end peer has successfully authenticated using the shared key. cwsEncryptionPreSharedKeyTable entries, cwsEncryptionPreSharedKeyStatus and cwsEncryptionPreSharedKeyFingerprint, are checked to confirm the correct key is provisioned and matches the expected fingerprint on both ends. If cwsEncryptionReAuthenticationTable shows repeated re-authentication attempts, it could indicate a key mismatch or an attempted man-in-the-middle condition on the optical link.

What Can Be Monitored

port encryption enable/status
peer authentication status
pre-shared key status/fingerprint
re-authentication events
global encryption state

Imported Objects

From CIENA-WS-MIB

cienaWsConfig

OBJECT-IDENTITY

From CIENA-WS-TYPEDEFS-MIB

PortId
StringMaxl32

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using cwsEncryptionPortEncryptionPeerAuthenticationStatus OID:

Select a Ciena optical transport platform as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cwsEncryptionPortEncryptionPeerAuthenticationStatus into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the whether the port is authenticated with its peer. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value is anything other than 'pass', since that indicates the condition this object reports has changed to one worth investigating. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
cienaWsEncryptionMIB	1.3.6.1.4.1.1271.3.4.23			Datapath encryption support on Waveserver. Encryption support includes a global encryption state and per-port pre-shared-key provisioning, authentication, and state.
cienaWsEncryptionObjects	1.3.6.1.4.1.1271.3.4.23.1
cienaWsEncryptionConformance	1.3.6.1.4.1.1271.3.4.23.2
cienaWsEncryptionGroups	1.3.6.1.4.1.1271.3.4.23.2.1
cienaWsEncryptionGroup	1.3.6.1.4.1.1271.3.4.23.2.1.1			Conformance Group
cienaWsEncryptionCompliances	1.3.6.1.4.1.1271.3.4.23.2.2
cienaWsEncryptionCompliance	1.3.6.1.4.1.1271.3.4.23.2.2.1			Compliance
cwsEncryptionPortEncryptionTable	1.3.6.1.4.1.1271.3.4.23.3		not-accessible	Data Path Encryption properties for a port.
cwsEncryptionPortEncryptionEntry	1.3.6.1.4.1.1271.3.4.23.3.1		not-accessible	Entry for cwsEncryptionPortEncryptionTable.
I32 cwsEncryptionPortEncryptionTableSnmpKey	1.3.6.1.4.1.1271.3.4.23.3.1.1	Integer32	not-accessible	Unique key for cwsEncryptionPortEncryption
INT cwsEncryptionPortEncryptionPeerAuthenticationStatusEx	1.3.6.1.4.1.1271.3.4.23.3.1.2	INTEGER	read-only	Whether the port is authenticated with its peer.
cwsEncryptionPreSharedKeyTable	1.3.6.1.4.1.1271.3.4.23.4		not-accessible	Port data path encryption pre-shared-key properties.
cwsEncryptionPreSharedKeyEntry	1.3.6.1.4.1.1271.3.4.23.4.1		not-accessible	Entry for cwsEncryptionPreSharedKeyTable.
I32 cwsEncryptionPreSharedKeyTableSnmpKey	1.3.6.1.4.1.1271.3.4.23.4.1.1	Integer32	not-accessible	Unique key for cwsEncryptionPreSharedKey
OCT cwsEncryptionPreSharedKeyValue	1.3.6.1.4.1.1271.3.4.23.4.1.2	OCTET STRING	read-write	Value for a pre-shared-key (PSK). The value must be specified as a hexadecimal encoded string. The string must be 32 characters to 512 characters consisting of (0-9, a-f, A-F). This is for support of 128bit key to 2048bit key in increment of 8 bits. Setting this attribute to an empty or blank string will clear the PSK. A read of this attribute will always return empty to protect the plaintext value. Note: This is a write-only attribute.
STR cwsEncryptionPreSharedKeyFingerprint	1.3.6.1.4.1.1271.3.4.23.4.1.3	StringMaxl32	read-only	A system generated hash value based on the provisioned pre-shared-key. If no key is provisioned, the fingerprint is empty.
T/F cwsEncryptionPreSharedKeyStatus	1.3.6.1.4.1.1271.3.4.23.4.1.4	TruthValue	read-only	Boolean value to indicate whether the pre-shared-key has been setup by user or not.
OCT cwsEncryptionPreSharedKeyDescription	1.3.6.1.4.1.1271.3.4.23.4.1.5	OCTET STRING	read-write	A human-readable description for the applied pre-shared-key. Eg. 'PSK for site 1 and site 2'
cwsEncryptionReAuthenticationTable	1.3.6.1.4.1.1271.3.4.23.5		not-accessible	Port data path encryption re-authentication properties.
cwsEncryptionReAuthenticationEntry	1.3.6.1.4.1.1271.3.4.23.5.1		not-accessible	Entry for cwsEncryptionReAuthenticationTable.
I32 cwsEncryptionReAuthenticationTableSnmpKey	1.3.6.1.4.1.1271.3.4.23.5.1.1	Integer32	not-accessible	Unique key for cwsEncryptionReAuthentication
U32 cwsEncryptionReAuthenticationPeriod	1.3.6.1.4.1.1271.3.4.23.5.1.2	Unsigned32	read-write	This determines how often peer re-authentication will be performed. Default is 1 hour. Range is 1 to 24 hours in increment of 1 hour.
INT cwsEncryptionReAuthenticationFailureMode	1.3.6.1.4.1.1271.3.4.23.5.1.3	INTEGER	read-write	This attribute is useful for hitless per-shared-key renewal. It determines what the system would do when peer re-authentication fails. If this is set to allow, then traffic will be maintained using the last known good encryption key. If this is set to drop, then traffic will be down until peer re-authentication passes.
cwsEncryptionEncryptionStateTable	1.3.6.1.4.1.1271.3.4.23.6		not-accessible	Chassis level data path encryption properties.
cwsEncryptionEncryptionStateEntry	1.3.6.1.4.1.1271.3.4.23.6.1		not-accessible	Entry for cwsEncryptionEncryptionStateTable.
I32 cwsEncryptionEncryptionStateTableSnmpKey	1.3.6.1.4.1.1271.3.4.23.6.1.1	Integer32	not-accessible	Unique key for cwsEncryptionEncryptionState
INT cwsEncryptionEncryptionStateLicenseState	1.3.6.1.4.1.1271.3.4.23.6.1.2	INTEGER	read-only	Datapath license feature state of this Waveserver.
INT cwsEncryptionEncryptionStateFeatureState	1.3.6.1.4.1.1271.3.4.23.6.1.3	INTEGER	read-only	Datapath encryption feature state of this Waveserver.

RFC description

Ciena Waveserver datapath encryption support including port pre-shared-key provisioning and authentication.

Start monitoring Ciena optical transport platforms with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CIENA-WS-ENCRYPTION-MIB