CISCO-ENHANCED-IPSEC-FLOW-MIB

All MIBs › CISCO-ENHANCED-IPSEC-FLOW-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2013-06-28

Category: Cisco Devices, VPN and Security

Description: Monitors IPSec tunnel flow statistics on Cisco security devices, tracking SA negotiations, encrypted packet counts, and flow lifetimes.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-ENHANCED-IPSEC-FLOW-MIB?

This MIB monitors IPSec-based VPN flows on Cisco security devices, tracking IKE/ISAKMP security association negotiations and the resulting encrypted traffic flows, designed to align with IETF standardization rather than expose vendor-specific IPSec extensions. It exposes global tunnel counts (active and previous tunnels) alongside detailed inbound/outbound traffic counters: octets, decompressed octets, packets, drops, replay drops, authentication successes/failures, and decrypt successes/failures. This is a performance-counter and fault-oriented MIB used to monitor the software/service status of IPSec VPN processing, confirming tunnels are established and healthy, and detecting authentication or decryption failures that indicate misconfigured or attacked IPSec sessions, rather than physical hardware sensors. Its module description explicitly notes it was designed for potential IETF standardization and deliberately excludes vendor-specific IPSec features, referencing standard IPSec/IKE/ISAKMP terminology. It is deployed on Cisco routers, firewalls, and VPN concentrators terminating IPSec site-to-site or remote-access VPN tunnels. Engineers can download the CISCO-ENHANCED-IPSEC-FLOW-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-ENHANCED-IPSEC-FLOW-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco router/firewall/VPN concentrator terminating IPSec tunnels

Monitoring Examples

An administrator would poll ceipSecGlobalActiveTunnels against ceipSecGlobalPreviousTunnels to track tunnel churn, and watch ceipSecGlobalInAuthFails and ceipSecGlobalInDecryptFails for signs of misconfigured pre-shared keys or an active attack. ceipSecGlobalInDrops and ceipSecGlobalInReplayDrops reveal packet loss or replay-attack mitigation activity, while ceipSecGlobalInOctets/ceipSecGlobalOutOctets and ceipSecGlobalInDecompOctets provide throughput and compression-ratio visibility into VPN traffic.

What Can Be Monitored

active/previous IPSec tunnel counts
inbound/outbound octet and packet counters
authentication failures
decryption failures
replay-attack drops

Imported Objects

From CISCO-IPSEC-TC

CIPsecAuthAlgorithm
CIPsecCompAlgorithm
CIPsecControlProtocol
CIPsecDiffHellmanGrp
CIPsecEncapMode
CIPsecEncryptAlgorithm
CIPsecEncryptionKeySize
CIPsecEndPtType
CIPsecNATTraversalMode
CIPsecPhase1TunnelIndexOrZero
CIPsecPhase2SaDirection
CIPsecPhase2TunnelIndex
CIPsecPmtu
CIPsecProtocol
CIPsecSpi
CIPsecTunnelStatus

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TC

CiscoIpProtocol
CiscoPort

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
TimeInterval
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using ceipSecGlobalPreviousTunnels OID:

Select a Cisco router/firewall/VPN concentrator terminating IPsec tunnel as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ceipSecGlobalPreviousTunnels into the Find box to locate it in the OID tree, then select it and click OK. The total number of previously active IPsec Phase-2 Tunnels. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in Tunnels), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
INT ceipSecCertExpiryStatus	1.3.6.1.4.1.9.9.432.1.6.6	INTEGER	read-only	This object provides the expiration status of the X.509 certificate on the application sending the notification. The notification is sent when the value of this object is changed from certOK(1) to certGoingExpired(2). certOK(1) = certificate is OK and is not within the configured time threshold for going to expire certGoingExpired(2) = certificate is within the configured time threshold for going to expire certExpired(3) = certificate has expired, the current time is after the certificate's validity notAfter time
STR ceipSecCertExpiryTime	1.3.6.1.4.1.9.9.432.1.6.4	SnmpAdminString	read-only	This object provides the validity notAfter time from the X.509 certificate. The notAfter time is the time after which the certificate is not valid. The time is formatted as a character string matching the output of a ssh-certview command-line application. Example: 2012 Apr 14th, 19:01:45 GMT
STR ceipSecCertIssuerName	1.3.6.1.4.1.9.9.432.1.6.3	SnmpAdminString	read-only	This object provides the issuer name from the X.509 certificate. The issuer name is formatted as a character string matching the output of a ssh-certview command-line application, except that the application sending the notification may limit the string length. The issuer name and the serial number identify a unique certificate. Example: C=US, O=Cisco, OU=MITG, CN=Lnx-Insta-RootCA-1
ceipSecCertNotification	1.3.6.1.4.1.9.9.432.1.6
INT ceipSecCertRenewalStatus	1.3.6.1.4.1.9.9.432.1.6.5	INTEGER	read-only	This object provides the renewal status of the X.509 certificate on the application sending the notification. renewalNotNeeded(1) = certificate is OK and does not need to be renewed renewalRequestNeeded(2) = certificate renewal request is needed renewalRequested(3) = certificate renewal has been requested and the renewal process is proceeding renewalSuccess(4) = certificate has been renewed and will be OK (renewalNotNeeded) renewalFailedUpdate(5) = certificate renewal failed, but certificate is still usable until the validity expiration time provided in the notification, or otherwise restricted by the application renewalFailedExpired(6) = certificate is no longer valid, the current time is after the certificate's validity notAfter time, which is provided in this notification
STR ceipSecCertSerialNumber	1.3.6.1.4.1.9.9.432.1.6.2	SnmpAdminString	read-only	This object provides the serial number from the X.509 certificate. The serial number is formatted as a character string matching the output of a ssh-certview command-line application. The issuer name and the serial number identify a unique certificate. Example: 1000655533
STR ceipSecCertSubjectName	1.3.6.1.4.1.9.9.432.1.6.1	SnmpAdminString	read-only	This object provides the subject name from the X.509 certificate, or the alternate subject name if it is available. The subject name is formatted as a character string matching the output of a ssh-certview command-line application, except that the application sending the notification may limit the string length. Example Subject Name: C=US, OU=DEV, CN=Test-01 Example Subject Alternative Name: 2001:0022:0022:0020:0000:0000:0000:0102
ceipSecEndPtEntry	1.3.6.1.4.1.9.9.432.1.1.3.1		not-accessible	An IPsec Phase-2 Tunnel Endpoint entry.
U32 ceipSecEndPtHistActiveIndex	1.3.6.1.4.1.9.9.432.1.2.3.1.3	Unsigned32	read-only	The index of the previously active Endpoint.
ceipSecEndPtHistEntry	1.3.6.1.4.1.9.9.432.1.2.3.1		not-accessible	Each entry contains the attributes associated with a previously active IPsec Phase-2 Tunnel Endpoint.
U32 ceipSecEndPtHistIndex	1.3.6.1.4.1.9.9.432.1.2.3.1.1	Unsigned32	not-accessible	The number of the previously active Endpoint associated with a IPsec Phase-2 Tunnel Table. The value of this index is a number which begins at one and is incremented with each Endpoint associated with an IPsec Phase-2 Tunnel. The value of this object will wrap at 4,294,967,295.
IP ceipSecEndPtHistLocalAddr1	1.3.6.1.4.1.9.9.432.1.2.3.1.7	InetAddress	read-only	The local Endpoint's first IP address specification. If the local Endpoint type is single IP address, then this is the value of the IP address. If the local Endpoint type is IP subnet, then this is the value of the subnet. If the local Endpoint type is IP address range, then this is the value of beginning IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from cceipSecEndPtLocalType.
IP ceipSecEndPtHistLocalAddr2	1.3.6.1.4.1.9.9.432.1.2.3.1.9	InetAddress	read-only	The local Endpoint's second IP address specification. If the local Endpoint type is single IP address, then this is the value of the IP address. If the local Endpoint type is IP subnet, then this is the value of the subnet mask. If the local Endpoint type is IP address range, then this is the value of ending IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from cceipSecEndPtLocalType.
IPt ceipSecEndPtHistLocalAddrType1	1.3.6.1.4.1.9.9.432.1.2.3.1.6	InetAddressType	read-only	The type of the IP address for this local Endpoint's first IP address.
IPt ceipSecEndPtHistLocalAddrType2	1.3.6.1.4.1.9.9.432.1.2.3.1.8	InetAddressType	read-only	The type of the IP address for this local Endpoint's second IP address.
STR ceipSecEndPtHistLocalName	1.3.6.1.4.1.9.9.432.1.2.3.1.4	SnmpAdminString	read-only	The DNS name of the local Endpoint.
CIS ceipSecEndPtHistLocalPort	1.3.6.1.4.1.9.9.432.1.2.3.1.11	CiscoPort	read-only	The port number of the local Endpoint's traffic.
CIS ceipSecEndPtHistLocalProtocol	1.3.6.1.4.1.9.9.432.1.2.3.1.10	CiscoIpProtocol	read-only	The protocol number of the local Endpoint's traffic.
CIP ceipSecEndPtHistLocalType	1.3.6.1.4.1.9.9.432.1.2.3.1.5	CIPsecEndPtType	read-only	The type of identity for the local Endpoint.
IP ceipSecEndPtHistRemoteAddr1	1.3.6.1.4.1.9.9.432.1.2.3.1.15	InetAddress	read-only	The remote Endpoint's first IP address specification. If the remote Endpoint type is single IP address, then this is the value of the IP address. If the remote Endpoint type is IP subnet, then this is the value of the subnet. If the remote Endpoint type is IP address range, then this is the value of beginning IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from cceipSecEndPtRemoteType.
IP ceipSecEndPtHistRemoteAddr2	1.3.6.1.4.1.9.9.432.1.2.3.1.17	InetAddress	read-only	The remote Endpoint's second IP address specification. If the remote Endpoint type is single IP address, then this is the value of the IP address. If the remote Endpoint type is IP subnet, then this is the value of the subnet mask. If the remote Endpoint type is IP address range, then this is the value of ending IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from cceipSecEndPtRemoteType.
IPt ceipSecEndPtHistRemoteAddrType1	1.3.6.1.4.1.9.9.432.1.2.3.1.14	InetAddressType	read-only	The type of the IP address for this remote Endpoint's first IP address.
IPt ceipSecEndPtHistRemoteAddrType2	1.3.6.1.4.1.9.9.432.1.2.3.1.16	InetAddressType	read-only	The type of the IP address for this remote Endpoint's second IP address.
STR ceipSecEndPtHistRemoteName	1.3.6.1.4.1.9.9.432.1.2.3.1.12	SnmpAdminString	read-only	The DNS name of the remote Endpoint.
CIS ceipSecEndPtHistRemotePort	1.3.6.1.4.1.9.9.432.1.2.3.1.19	CiscoPort	read-only	The port number of the remote Endpoint's traffic.
CIS ceipSecEndPtHistRemoteProtocol	1.3.6.1.4.1.9.9.432.1.2.3.1.18	CiscoIpProtocol	read-only	The protocol number of the remote Endpoint's traffic.
CIP ceipSecEndPtHistRemoteType	1.3.6.1.4.1.9.9.432.1.2.3.1.13	CIPsecEndPtType	read-only	The type of identity for the remote Endpoint.
ceipSecEndPtHistTable	1.3.6.1.4.1.9.9.432.1.2.3		not-accessible	The IPsec Phase-2 Tunnel Endpoint History Table. This table is conceptually a sliding window in which only the last 'N' entries are maintained, where 'N' is the value of the object 'ceipSecHistTableSize'. If the value of 'ceipSecHistTableSize' is 0, archiving of entries in this table is disabled.
U32 ceipSecEndPtHistTunIndex	1.3.6.1.4.1.9.9.432.1.2.3.1.2	Unsigned32	read-only	The index of the previously active IPsec Phase-2 Tunnel Table.
U32 ceipSecEndPtIndex	1.3.6.1.4.1.9.9.432.1.1.3.1.1	Unsigned32	not-accessible	The number of the Endpoint associated with the IPsec Phase-2 Tunnel Table. The value of this index is a number which begins at one and is incremented with each Endpoint associated with an IPsec Phase-2 Tunnel. The value of this object will wrap at 4,294,967,295.
IP ceipSecEndPtLocalAddr1	1.3.6.1.4.1.9.9.432.1.1.3.1.5	InetAddress	read-only	The local Endpoint's first IP address specification. If the local Endpoint type is single IP address, then this is the value of the IP address. If the local Endpoint type is IP subnet, then this is the value of the subnet. If the local Endpoint type is IP address range, then this is the value of beginning IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from ceipSecEndPtLocalType.
IP ceipSecEndPtLocalAddr2	1.3.6.1.4.1.9.9.432.1.1.3.1.7	InetAddress	read-only	The local Endpoint's second IP address specification. If the local Endpoint type is single IP address, then this is the value of the IP address. If the local Endpoint type is IP subnet, then this is the value of the subnet mask. If the local Endpoint type is IP address range, then this is the value of ending IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from ceipSecEndPtLocalType.
IPt ceipSecEndPtLocalAddrType1	1.3.6.1.4.1.9.9.432.1.1.3.1.4	InetAddressType	read-only	The type of the IP address for this local Endpoint's first IP address.
IPt ceipSecEndPtLocalAddrType2	1.3.6.1.4.1.9.9.432.1.1.3.1.6	InetAddressType	read-only	The type of the IP address for this local Endpoint's second IP address.
STR ceipSecEndPtLocalName	1.3.6.1.4.1.9.9.432.1.1.3.1.2	SnmpAdminString	read-only	The DNS name of the local Endpoint.
CIS ceipSecEndPtLocalPort	1.3.6.1.4.1.9.9.432.1.1.3.1.9	CiscoPort	read-only	The port number of the local Endpoint's traffic.
CIS ceipSecEndPtLocalProtocol	1.3.6.1.4.1.9.9.432.1.1.3.1.8	CiscoIpProtocol	read-only	The protocol number of the local Endpoint's traffic.
CIP ceipSecEndPtLocalType	1.3.6.1.4.1.9.9.432.1.1.3.1.3	CIPsecEndPtType	read-only	The type of identity for the local Endpoint.
IP ceipSecEndPtRemoteAddr1	1.3.6.1.4.1.9.9.432.1.1.3.1.13	InetAddress	read-only	The remote Endpoint's first IP address specification. If the remote Endpoint type is single IP address, then this is the value of the IP address. If the remote Endpoint type is IP subnet, then this is the value of the subnet. If the remote Endpoint type is IP address range, then this is the value of beginning IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from ceipSecEndPtRemoteType.
IP ceipSecEndPtRemoteAddr2	1.3.6.1.4.1.9.9.432.1.1.3.1.15	InetAddress	read-only	The remote Endpoint's second IP address specification. If the remote Endpoint type is single IP address, then this is the value of the IP address. If the remote Endpoint type is IP subnet, then this is the value of the subnet mask. If the remote Endpoint type is IP address range, then this is the value of ending IP address of the range. If the type is an IP address, a range or a subnet, the type of the address can be inferred from ceipSecEndPtRemoteType.
IPt ceipSecEndPtRemoteAddrType1	1.3.6.1.4.1.9.9.432.1.1.3.1.12	InetAddressType	read-only	The type of the IP address for this remote Endpoint's first IP address.
IPt ceipSecEndPtRemoteAddrType2	1.3.6.1.4.1.9.9.432.1.1.3.1.14	InetAddressType	read-only	The type of the IP address for this remote Endpoint's second IP address.
STR ceipSecEndPtRemoteName	1.3.6.1.4.1.9.9.432.1.1.3.1.10	SnmpAdminString	read-only	The DNS name of the remote Endpoint.
CIS ceipSecEndPtRemotePort	1.3.6.1.4.1.9.9.432.1.1.3.1.17	CiscoPort	read-only	The port number of the remote Endpoint's traffic.
CIS ceipSecEndPtRemoteProtocol	1.3.6.1.4.1.9.9.432.1.1.3.1.16	CiscoIpProtocol	read-only	The protocol number of the remote Endpoint's traffic.
CIP ceipSecEndPtRemoteType	1.3.6.1.4.1.9.9.432.1.1.3.1.11	CIPsecEndPtType	read-only	The type of identity for the remote Endpoint.
ceipSecEndPtTable	1.3.6.1.4.1.9.9.432.1.1.3		not-accessible	The IPsec Phase-2 Tunnel Endpoint Table. This table contains an entry for each active endpoint associated with an IPsec Phase-2 Tunnel.
ceipSecFailEntry	1.3.6.1.4.1.9.9.432.1.3.2.1		not-accessible	Each entry contains the attributes associated with an IPsec Phase-1 failure.
ceipSecFailGlobal	1.3.6.1.4.1.9.9.432.1.3.1
ceipSecFailGlobalCntl	1.3.6.1.4.1.9.9.432.1.3.1.1
U32 ceipSecFailIndex	1.3.6.1.4.1.9.9.432.1.3.2.1.1	Unsigned32	not-accessible	The IPsec Phase-2 Failure Table index. The value of the index is a number which begins at one and is incremented with each IPsec Phase-1 failure. The value of this object will wrap at 4,294,967,295.
IP ceipSecFailPktDstAddress	1.3.6.1.4.1.9.9.432.1.3.2.1.9	InetAddress	read-only	The packet's destination IP address.
IPt ceipSecFailPktDstAddressType	1.3.6.1.4.1.9.9.432.1.3.2.1.8	InetAddressType	read-only	The type of the packet's destination IP address.
IP ceipSecFailPktSrcAddress	1.3.6.1.4.1.9.9.432.1.3.2.1.7	InetAddress	read-only	The packet's source IP address.
IPt ceipSecFailPktSrcAddressType	1.3.6.1.4.1.9.9.432.1.3.2.1.6	InetAddressType	read-only	The type of the packet's source IP address.
INT ceipSecFailReason	1.3.6.1.4.1.9.9.432.1.3.2.1.2	INTEGER	read-only	The reason for the failure. Possible reasons include: 1 = other 2 = internal error occurred 3 = peer encoding error 4 = proposal failure 5 = protocol use failure 6 = non-existent security association 7 = decryption failure 8 = encryption failure 9 = inbound authentication failure 10 = outbound authentication failure 11 = compression failure 12 = system capacity failure 13 = peer delete request was received 14 = contact with peer was lost 15 = sequence number rolled over 16 = operator requested termination 17 = performance utilization exceeding the threshold.
CIP ceipSecFailSaSpi	1.3.6.1.4.1.9.9.432.1.3.2.1.5	CIPsecSpi	read-only	The security association SPI value. If this conceptual row corresponds to a setup failure (failure to establish the tunnel), the value of this MIB object is undefined.
ceipSecFailTable	1.3.6.1.4.1.9.9.432.1.3.2		not-accessible	The IPsec Phase-2 Failure Table. This table is implemented as a sliding window in which only the last n entries are maintained. The maximum number of entries is specified by the ceipSecFailTableSize object.
U32 ceipSecFailTableSize	1.3.6.1.4.1.9.9.432.1.3.1.1.1	Unsigned32	read-write	The window size of the IPsec Phase-2 Failure Table. The IPsec Phase-2 Failure Tables are implemented as a sliding window in which only the last N entries are maintained. This object is used specify the number of entries which will be maintained in the IPsec Phase-2 Failure Tables. An implementation may choose suitable minimum and maximum values for this element based on the local policy and available resources. If an SNMP SET request specifies a value outside this window for this element, an appropriate SNMP error vode must be returned. Setting this value to zero is equivalent to deleting all conceptual rows in the archiving table 'ceipSecFailTable' and disabling the archiving of entries in these tables.
TIM ceipSecFailTime	1.3.6.1.4.1.9.9.432.1.3.2.1.3	TimeStamp	read-only	The value of sysUpTime in hundredths of seconds at the time of the failure.
CIP ceipSecFailTunnelIndex	1.3.6.1.4.1.9.9.432.1.3.2.1.4	CIPsecPhase2TunnelIndex	read-only	The Phase-2 Tunnel index (ceipSecTunIndex). If this conceptual row corresponds to an operation failure (that is, the failure of an established Phase-2 IPsec tunnel), then the value of this object may not be zero.
ceipSecFailures	1.3.6.1.4.1.9.9.432.1.3
G32 ceipSecGlobalActiveTunnels	1.3.6.1.4.1.9.9.432.1.1.1.1	Gauge32	read-only	The total number of currently active IPsec Phase-2 Tunnels.
C64 ceipSecGlobalInAuthFails	1.3.6.1.4.1.9.9.432.1.1.1.9	Counter64	read-only	The total number of inbound authentication's which ended in failure by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalInAuths	1.3.6.1.4.1.9.9.432.1.1.1.8	Counter64	read-only	The total number of inbound authentication's performed by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalInDecompOctets	1.3.6.1.4.1.9.9.432.1.1.1.4	Counter64	read-only	A high capacity count of the total number of decompressed octets received by all current and previous IPsec Phase-2 Tunnels. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of ceipSecGlobalInOctets.
C64 ceipSecGlobalInDecryptFails	1.3.6.1.4.1.9.9.432.1.1.1.11	Counter64	read-only	The total number of inbound decryption's which ended in failure by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalInDecrypts	1.3.6.1.4.1.9.9.432.1.1.1.10	Counter64	read-only	The total number of inbound decryption's performed by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalInDrops	1.3.6.1.4.1.9.9.432.1.1.1.6	Counter64	read-only	The total number of packets dropped during receive processing by all current and previous IPsec Phase-2 Tunnels. This count does NOT include packets dropped due to Anti-Replay processing.
C64 ceipSecGlobalInOctets	1.3.6.1.4.1.9.9.432.1.1.1.3	Counter64	read-only	A high capacity count of the total number of octets received by all current and previous IPsec Phase-2 Tunnels. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 ceipSecGlobalInPkts	1.3.6.1.4.1.9.9.432.1.1.1.5	Counter64	read-only	The total number of packets received by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalInReplayDrops	1.3.6.1.4.1.9.9.432.1.1.1.7	Counter64	read-only	The total number of packets dropped during receive processing due to Anti-Replay processing by all current and previous IPsec Phase-2 Tunnels.
U32 ceipSecGlobalLastAveragePacketSize	1.3.6.1.4.1.9.9.432.1.1.1.29	Unsigned32	read-only	This object is the average packet size in the last throughput utilization time interval that ended at ceipSecGlobalThroughputLastUpdatedTime.
U32 ceipSecGlobalLastThroughputInKpps	1.3.6.1.4.1.9.9.432.1.1.1.31	Unsigned32	read-only	The object is the total throughput in Kpps in the last throughput utilization time interval that ended at ceipSecGlobalThroughputLastUpdatedTime.
U32 ceipSecGlobalLastThroughputInMbps	1.3.6.1.4.1.9.9.432.1.1.1.30	Unsigned32	read-only	The object is the total throughput in Mbps in the last throughput utilization time interval that ended at ceipSecGlobalThroughputLastUpdatedTime.
U32 ceipSecGlobalLastThroughputUtilization	1.3.6.1.4.1.9.9.432.1.1.1.32	Unsigned32	read-only	The object is the throughput utilization in percentage in the last performance utilization time interval that ended at ceipSecGlobalThroughputLastUpdatedTime.
C64 ceipSecGlobalNoSaFails	1.3.6.1.4.1.9.9.432.1.1.1.21	Counter64	read-only	The total number of non-existent Security Association in failures which occurred during processing of all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalOutAuthFails	1.3.6.1.4.1.9.9.432.1.1.1.17	Counter64	read-only	The total number of outbound authentication's which ended in failure by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalOutAuths	1.3.6.1.4.1.9.9.432.1.1.1.16	Counter64	read-only	The total number of outbound authentication's performed by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalOutCompFailPkts	1.3.6.1.4.1.9.9.432.1.1.1.25	Counter64	read-only	The total number of outbound packets across all IPsec flows terminating at this device that failed compression because they grew in size after compression.
C64 ceipSecGlobalOutCompressedPkts	1.3.6.1.4.1.9.9.432.1.1.1.23	Counter64	read-only	The cumulative number of outbound packets across all IPsec flows terminating at this device which were successfully compressed.
C64 ceipSecGlobalOutCompSkippedPkts	1.3.6.1.4.1.9.9.432.1.1.1.24	Counter64	read-only	The total number of outbound packets across all IPsec flows terminating at this devices that were to be compressed but which were skipped due to the compression hysteresis.
C64 ceipSecGlobalOutCompTooSmallPkts	1.3.6.1.4.1.9.9.432.1.1.1.26	Counter64	read-only	The total number of outbound packets across all IPsec flows terminating at this device that were to be compressed but were smaller than the compression threshold size. This number is cumulative since the last system start.
C64 ceipSecGlobalOutDrops	1.3.6.1.4.1.9.9.432.1.1.1.15	Counter64	read-only	The total number of packets dropped during send processing by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalOutEncryptFails	1.3.6.1.4.1.9.9.432.1.1.1.19	Counter64	read-only	The total number of outbound encryption's which ended in failure by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalOutEncrypts	1.3.6.1.4.1.9.9.432.1.1.1.18	Counter64	read-only	The total number of outbound encryption's performed by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalOutOctets	1.3.6.1.4.1.9.9.432.1.1.1.12	Counter64	read-only	A high capacity count of the total number of octets sent by all current and previous IPsec Phase-2 Tunnels. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 ceipSecGlobalOutPkts	1.3.6.1.4.1.9.9.432.1.1.1.14	Counter64	read-only	The total number of packets sent by all current and previous IPsec Phase-2 Tunnels.
C64 ceipSecGlobalOutUncompOctets	1.3.6.1.4.1.9.9.432.1.1.1.13	Counter64	read-only	A high capacity count of the total number of uncompressed octets sent by all current and previous IPsec Phase-2 Tunnels. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of ceipSecGlobalOutOctets.
U32 ceipSecGlobalPeakAvgPacketSize	1.3.6.1.4.1.9.9.432.1.1.1.36	Unsigned32	read-only	This object indicates the average packet size in bytes in the throughput utilization time interval that ended at ceipSecGlobalPeakThroughputDateAndTime.
DAT ceipSecGlobalPeakThroughputDateAndTime	1.3.6.1.4.1.9.9.432.1.1.1.34	DateAndTime	read-only	The date and time when ceipSecGlobalPeakThroughputUtilization is updated.
U32 ceipSecGlobalPeakThroughputInMbps	1.3.6.1.4.1.9.9.432.1.1.1.35	Unsigned32	read-only	The object indicates the peak value of throughput in Mbps.
U32 ceipSecGlobalPeakThroughputUtilization	1.3.6.1.4.1.9.9.432.1.1.1.33	Unsigned32	read-only	The object is the peak throughput utilization in percentage since the managed system is active. It was observed in the throughput utilization time interval that ended at ceipSecGlobalPeakThroughputDateAndTime.
C64 ceipSecGlobalPreviousTunnelsEx	1.3.6.1.4.1.9.9.432.1.1.1.2	Counter64	read-only	The total number of previously active IPsec Phase-2 Tunnels.
C64 ceipSecGlobalProtocolUseFails	1.3.6.1.4.1.9.9.432.1.1.1.20	Counter64	read-only	The total number of protocol use failures which occurred during processing of all current and previously active IPsec Phase-2 Tunnels.
ceipSecGlobalStats	1.3.6.1.4.1.9.9.432.1.1.1
C64 ceipSecGlobalSysCapFails	1.3.6.1.4.1.9.9.432.1.1.1.22	Counter64	read-only	The total number of system capacity failures which occurred during processing of all current and previously active IPsec Phase-2 Tunnels.
TIM ceipSecGlobalThroughputLastUpdatedTime	1.3.6.1.4.1.9.9.432.1.1.1.28	TimeStamp	read-only	The timestamp is the end of the last throughput utilization time interval.
U32 ceipSecGlobalThroughputUtilizatioinTimeInterval	1.3.6.1.4.1.9.9.432.1.1.1.27	Unsigned32	read-only	The object is the length of the time interval to measure the throughtput utilization.
ceipSecHistGlobal	1.3.6.1.4.1.9.9.432.1.2.1
ceipSecHistGlobalCntl	1.3.6.1.4.1.9.9.432.1.2.1.1
ceipSecHistory	1.3.6.1.4.1.9.9.432.1.2
U32 ceipSecHistTableSize	1.3.6.1.4.1.9.9.432.1.2.1.1.1	Unsigned32	read-write	The window size of the IPsec Phase-2 History Tables. The IPsec Phase-2 History Tables are implemented as a sliding window in which only the last 'N' entries are maintained. This object is used specify the number of entries which will be maintained in the IPsec Phase-2 History Tables. An implementation may choose suitable minimum and maximum values for this element based on the local policy and available resources. If an SNMP SET request specifies a value outside this window for this element, in appropriate SNMP error code should be returned. Setting this value to zero is equivalent to deleting all conceptual rows in the archiving tables ('ceipSecHistTable' and 'ceipSecEndPtHistTable') and disabling the archiving of entries in the tables.
NUM ceipSecIfIndex	1.3.6.1.4.1.9.9.432.1.1.2.1.53	InterfaceIndex	read-only	This object represents the ifIndex of an interface where this tunnel is created. Multiple IPsec tunnels can be created using the same interface.
ceipSecIfTunnelEntry	1.3.6.1.4.1.9.9.432.1.1.6.1		not-accessible	Each entry contains the IPsec Phase-2 Tunnel associated with an interface.
CIP ceipSecIfTunnelStatus	1.3.6.1.4.1.9.9.432.1.1.6.1.1	CIPsecTunnelStatus	read-only	This object corresponds to the status of a IPsec Phase-2 Tunnel in ceipSecTunnelTable indexed by ceipSecTunIndex. The valid status this object can have are 'active' and 'awaitCommit'.
ceipSecIfTunnelTable	1.3.6.1.4.1.9.9.432.1.1.6		not-accessible	The IPsec Phase-2 Tunnels to Interface association table. This table contains an entry for each active IPsec Phase-2 Tunnel created under an interface. Multiple IPsec Phase-2 Tunnels can be created using the same interface.
T/F ceipSecNotiCntlIpSecAllNotifs	1.3.6.1.4.1.9.9.432.1.5.1	TruthValue	read-write	This object sending any notification defined in this MIB module. That is, a particular notification 'foo' defined in this MIB module is enabled if and only if the expression (ceipSecNotiCntlIpSecAllNotifs && ceipSecNotiCntl) evaluates to 'true', where ceipSecNotiCntl is a notification defined in this MIB module.
T/F ceipSecNotifCntlCertExpiry	1.3.6.1.4.1.9.9.432.1.5.7	TruthValue	read-write	This object defines the administrative state of sending the IPSec certificate expiry notification. If the value of this object is 'true', the issuing of the notification 'ciscoEnhIpsecFlowCertExpiry' is enabled, otherwise notification 'ciscoEnhIpsecFlowCertExpiry' is disabled.
T/F ceipSecNotifCntlCertRenewal	1.3.6.1.4.1.9.9.432.1.5.8	TruthValue	read-write	This object defines the administrative state of sending the IPSec X.509 certificate renewal status notification. If the value of this object is 'true', the issuing of the notification 'ciscoEnhIpsecFlowCertRenewal' is enabled, otherwise notification 'ciscoEnhIpsecFlowCertRenewal' is disabled.
T/F ceipSecNotifCntlIpSecBadSa	1.3.6.1.4.1.9.9.432.1.5.6	TruthValue	read-write	This object defines the administrative state of sending the IPsec Phase-2 No Security Association trap. If the value of this object is 'true', the issuing of the notification 'ciscoEnhIpsecFlowBadSa' is enabled.
T/F ceipSecNotifCntlIpSecSetUpFail	1.3.6.1.4.1.9.9.432.1.5.5	TruthValue	read-write	This object defines the administrative state of sending the IPsec Phase-2 Set Up Failure TRAP. If the value of this object is 'true', the issuing of the notification 'ciscoEnhIpsecFlowSetupFail' is enabled.
T/F ceipSecNotifCntlIpSecSysFailure	1.3.6.1.4.1.9.9.432.1.5.4	TruthValue	read-write	This object defines the administrative state of sending the IPsec Phase-2 System Failure TRAP. If the value of this object is 'true', the issuing of the notification 'ciscoEnhIpsecFlowSysFailure' is enabled.
T/F ceipSecNotifCntlIpSecTunnelStart	1.3.6.1.4.1.9.9.432.1.5.2	TruthValue	read-write	This object defines the administrative state of sending the IPsec Phase-2 Tunnel Start TRAP. If the value of this object is 'true', the issuing of the notification 'ciscoEnhIpsecFlowTunnelStart' is enabled.
T/F ceipSecNotifCntlIpSecTunnelStop	1.3.6.1.4.1.9.9.432.1.5.3	TruthValue	read-write	This object defines the administrative state of sending the IPsec Phase-2 Tunnel Stop TRAP. If the value of this object is 'true', the issuing of the notification 'ciscoEnhIpsecFlowTunnelStop' is enabled.
ceipSecNotificationCntl	1.3.6.1.4.1.9.9.432.1.5
ceipSecPhaseTwo	1.3.6.1.4.1.9.9.432.1.1
CIP ceipSecSaDirection	1.3.6.1.4.1.9.9.432.1.1.4.1.3	CIPsecPhase2SaDirection	read-only	Phase-2 IPsec security associations are simplex. Hence a particular security association is used either for securing outgoing traffic or decoding incoming traffic. This column identifies the direction of the security association represented by this entry.
ceipSecSaEntry	1.3.6.1.4.1.9.9.432.1.1.4.1		not-accessible	Each entry contains the attributes associated with active and expiring IPsec Phase-2 security associations.
U32 ceipSecSaIndex	1.3.6.1.4.1.9.9.432.1.1.4.1.2	Unsigned32	not-accessible	The object, in the context of the IPsec tunnel 'ceipSecTunIndex', is an index of security associations comprising the Phase-2 IPsec tunnel represented by the tunnel index 'ceipSecTunIndex'. The value of this index is a number which begins at 1 and is incremented with each SPI associated with the corresponding IPsec Phase-2 Tunnel.
CIP ceipSecSaProtocol	1.3.6.1.4.1.9.9.432.1.1.4.1.1	CIPsecProtocol	not-accessible	This column represents the security protocol (AH, ESP or IPComp) for which this security association was setup.
INT ceipSecSaStatus	1.3.6.1.4.1.9.9.432.1.1.4.1.5	INTEGER	read-only	This column represents the status of the security association represented by this conceptual row. If the status of the SA is 'active', the SA is ready for active use. The status 'expiring' represents any of the various states that the security association transitions through before being purged.
ceipSecSaTable	1.3.6.1.4.1.9.9.432.1.1.4		not-accessible	The IPsec Phase-2 Security Association Table. This table identifies the structure (in terms of component SAs) of each active Phase-2 IPsec tunnel. This table contains an entry for each active and expiring security association and maps each entry in the active Phase-2 tunnel table (ceipSecTunTable) into a number of entries in this table. The index of this table reflects the rule for identifying Security Associations.
CIP ceipSecSaValue	1.3.6.1.4.1.9.9.432.1.1.4.1.4	CIPsecSpi	read-only	This is the value of the Security Protection Index (SPI) assigned by the system to the security association represented by this entry.
NUM ceipSecTunActiveTime	1.3.6.1.4.1.9.9.432.1.1.2.1.13	TimeInterval	read-only	The length of time the IPsec Phase-2 Tunnel has been active in hundredths of seconds.
CIP ceipSecTunControlProtocol	1.3.6.1.4.1.9.9.432.1.1.2.1.6	CIPsecControlProtocol	read-only	Identifies the protocol used to setup and administer this Phase-2 IPsec tunnel. In case this tunnel was spawned by an IPsec signaling protocol, this MIB object contains the value of the object 'cisgIpsSgProtocol' defined in CISCO-IPSEC-SIGNALING-MIB in the table 'cisgIpsSgTunnelTable' in the row corresponding to the control tunnel. A value of 'cpManual' is indicative of a manually installed and administered Phase-2 tunnel.
T/F ceipSecTunControlTunnelAlive	1.3.6.1.4.1.9.9.432.1.1.2.1.8	TruthValue	read-only	An indicator which specifies whether or not the IPsec Phase-1 Tunnel that spawned this Phase-2 tunnel currently exists.
CIP ceipSecTunControlTunnelIndex	1.3.6.1.4.1.9.9.432.1.1.2.1.7	CIPsecPhase1TunnelIndexOrZero	read-only	The index of the associated IPsec Phase-1 Tunnel. In case this tunnel was spawned by an IPsec signaling protocol, this MIB object contains the value of the object 'cisgIpsSgTunIndex' defined in CISCO-IPSEC-SIGNALING-MIB in the table 'cisgIpsSgTunnelTable' in the row corresponding to the control tunnel. A value of 0 identifies that this Phase-2 tunnel was setup manually.
G32 ceipSecTunCurrentSaInstances	1.3.6.1.4.1.9.9.432.1.1.2.1.18	Gauge32	read-only	The number of security associations which are currently active or expiring.
CIP ceipSecTunEncapMode	1.3.6.1.4.1.9.9.432.1.1.2.1.9	CIPsecEncapMode	read-only	The encapsulation mode used by the IPsec Phase-2 Tunnel.
C32 ceipSecTunExpiredSaInstances	1.3.6.1.4.1.9.9.432.1.1.2.1.17	Counter32	read-only	The total number of security associations which have expired. If the tunnel was setup manually, the value of this MIB element should be 0.
CIP ceipSecTunHistActiveIndex	1.3.6.1.4.1.9.9.432.1.2.2.1.3	CIPsecPhase2TunnelIndex	read-only	The index of the previously active IPsec Phase-2 Tunnel. This object must correspond to an expired IPsec tunnel; hence this object may not assume the value of 0.
NUM ceipSecTunHistActiveTime	1.3.6.1.4.1.9.9.432.1.2.2.1.15	TimeInterval	read-only	The length of time the IPsec Phase-2 Tunnel has been active in hundredths of seconds.
CIP ceipSecTunHistControlProtocol	1.3.6.1.4.1.9.9.432.1.2.2.1.8	CIPsecControlProtocol	read-only	Identifies the protocol that was used to setup and administer Phase-2 IPsec tunnel.
CIP ceipSecTunHistControlTunnelIndex	1.3.6.1.4.1.9.9.432.1.2.2.1.9	CIPsecPhase1TunnelIndexOrZero	read-only	The index of the IPsec Phase-1 Tunnel that spawned this Phase-2 tunnel (in case of IKE, this value would refer to 'csikeTunIndex' in the 'csikeTunnelTable'). If the IPsec tunnel corresponding to this entry was setup manually, the value of this object should be zero.
CIP ceipSecTunHistEncapMode	1.3.6.1.4.1.9.9.432.1.2.2.1.10	CIPsecEncapMode	read-only	The encapsulation mode used by the IPsec Phase-2 Tunnel.
C32 ceipSecTunHistInAuthFails	1.3.6.1.4.1.9.9.432.1.2.2.1.37	Counter32	read-only	The total number of inbound authentication's which ended in failure by this IPsec Phase-2 Tunnel .
C32 ceipSecTunHistInAuths	1.3.6.1.4.1.9.9.432.1.2.2.1.36	Counter32	read-only	The total number of inbound authentication's performed by this IPsec Phase-2 Tunnel.
C64 ceipSecTunHistInDecompOctets	1.3.6.1.4.1.9.9.432.1.2.2.1.32	Counter64	read-only	A high capacity count of the total number of decompressed octets received by this IPsec Phase-2 Tunnel. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of ceipSecTunInOctets.
C32 ceipSecTunHistInDecryptFails	1.3.6.1.4.1.9.9.432.1.2.2.1.39	Counter32	read-only	The total number of inbound decryption's which ended in failure by this IPsec Phase-2 Tunnel.
C32 ceipSecTunHistInDecrypts	1.3.6.1.4.1.9.9.432.1.2.2.1.38	Counter32	read-only	The total number of inbound decryption's performed by this IPsec Phase-2 Tunnel.
U32 ceipSecTunHistIndex	1.3.6.1.4.1.9.9.432.1.2.2.1.1	Unsigned32	not-accessible	The index of the IPsec Phase-2 Tunnel History Table. The value of the index is a number which begins at one and is incremented with each tunnel that ends. The value of this object will wrap at 4,294,967,295.
C32 ceipSecTunHistInDropPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.34	Counter32	read-only	The total number of packets dropped during receive processing by this IPsec Phase-2 Tunnel. This count does NOT include packets dropped due to Anti-Replay processing.
C64 ceipSecTunHistInOctets	1.3.6.1.4.1.9.9.432.1.2.2.1.31	Counter64	read-only	A high capacity count of the total number of octets received by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C32 ceipSecTunHistInPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.33	Counter32	read-only	The total number of packets received by this IPsec Phase-2 Tunnel.
C32 ceipSecTunHistInReplayDropPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.35	Counter32	read-only	The total number of packets dropped during receive processing due to Anti-Replay processing by this IPsec Phase-2 Tunnel.
CIP ceipSecTunHistInSaAhAuthAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.21	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the inbound authentication header (AH) security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistInSaDecompAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.23	CIPsecCompAlgorithm	read-only	The decompression algorithm used by the inbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistInSaDHGrp	1.3.6.1.4.1.9.9.432.1.2.2.1.18	CIPsecDiffHellmanGrp	read-only	The Diffie Hellman Group used by the inbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistInSaEncryptAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.19	CIPsecEncryptAlgorithm	read-only	The encryption algorithm used by the inbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistInSaEncryptKeySize	1.3.6.1.4.1.9.9.432.1.2.2.1.20	CIPsecEncryptionKeySize	read-only	The size in bits of the key which was negotiated to be used with the encryption transform used with this tunnel denoted by ceipSecTunHistInSaEncryptAlgo. For DES and 3DES the key size is respectively 56 and 168. For AES, this will denote the negotiated key size.
CIP ceipSecTunHistInSaEspAuthAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.22	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the inbound encapsulation security protocol (ESP) security association of the IPsec Phase-2 Tunnel.
U32 ceipSecTunHistLifeSize	1.3.6.1.4.1.9.9.432.1.2.2.1.12	Unsigned32	read-only	The negotiated LifeSize of the IPsec Phase-2 Tunnel in kilobytes.
U32 ceipSecTunHistLifeTime	1.3.6.1.4.1.9.9.432.1.2.2.1.13	Unsigned32	read-only	The negotiated LifeTime of the IPsec Phase-2 Tunnel in seconds.
IP ceipSecTunHistLocalAddress	1.3.6.1.4.1.9.9.432.1.2.2.1.5	InetAddress	read-only	The IP address of the local endpoint for the IPsec Phase-2 Tunnel.
IPt ceipSecTunHistLocalAddressType	1.3.6.1.4.1.9.9.432.1.2.2.1.4	InetAddressType	read-only	The type of the IP address of the local endpoint for the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistNATTraversalMode	1.3.6.1.4.1.9.9.432.1.2.2.1.11	CIPsecNATTraversalMode	read-only	The encapsulation used by the IPsec Phase-2 tunnel corresponding to this conceptual row for NAT traversal.
C32 ceipSecTunHistOutAuthFails	1.3.6.1.4.1.9.9.432.1.2.2.1.45	Counter32	read-only	The total number of outbound authentication's which ended in failure by this IPsec Phase-2 Tunnel.
C32 ceipSecTunHistOutAuths	1.3.6.1.4.1.9.9.432.1.2.2.1.44	Counter32	read-only	The total number of outbound authentication's performed by this IPsec Phase-2 Tunnel.
C32 ceipSecTunHistOutCompFailPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.50	Counter32	read-only	The total number of outbound packets that failed compression because they grew in size after compression.
C32 ceipSecTunHistOutCompressedPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.48	Counter32	read-only	The total number of outbound packets which were successfully compressed.
C32 ceipSecTunHistOutCompSkippedPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.49	Counter32	read-only	The total number of outbound packets that were to be compressed but which were skipped due to the compression hysteresis.
C32 ceipSecTunHistOutCompSmallPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.51	Counter32	read-only	The total number of outbound packets that were to be compressed but were smaller than the compression threshold size.
C32 ceipSecTunHistOutDropPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.43	Counter32	read-only	The total number of packets dropped during send processing by this IPsec Phase-2 Tunnel.
C32 ceipSecTunHistOutEncryptFails	1.3.6.1.4.1.9.9.432.1.2.2.1.47	Counter32	read-only	The total number of outbound encryption's which ended in failure by this IPsec Phase-2 Tunnel.
C32 ceipSecTunHistOutEncrypts	1.3.6.1.4.1.9.9.432.1.2.2.1.46	Counter32	read-only	The total number of outbound encryption's performed by this IPsec Phase-2 Tunnel.
C64 ceipSecTunHistOutOctets	1.3.6.1.4.1.9.9.432.1.2.2.1.40	Counter64	read-only	A high capacity count of the total number of octets sent by this IPsec Phase-2 Tunnel. This value is accumulated AFTER determining whether or not the packet should be compressed.
C32 ceipSecTunHistOutPkts	1.3.6.1.4.1.9.9.432.1.2.2.1.42	Counter32	read-only	The total number of packets sent by this IPsec Phase-2 Tunnel.
CIP ceipSecTunHistOutSaAhAuthAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.27	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the outbound authentication header (AH) security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistOutSaCompAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.29	CIPsecCompAlgorithm	read-only	The compression algorithm used by the inbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistOutSaDHGrp	1.3.6.1.4.1.9.9.432.1.2.2.1.24	CIPsecDiffHellmanGrp	read-only	The Diffie Hellman Group used by the outbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistOutSaEncryptAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.25	CIPsecEncryptAlgorithm	read-only	The encryption algorithm used by the outbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunHistOutSaEncryptKeySz	1.3.6.1.4.1.9.9.432.1.2.2.1.26	CIPsecEncryptionKeySize	read-only	The size in bits of the key which was negotiated to be used with the encryption transform used with this tunnel denoted by ceipSecTunHistOutSaEncryptAlgo. For DES and 3DES the key size is respectively 56 and 168. For AES, this will denote the negotiated key size.
CIP ceipSecTunHistOutSaEspAuthAlgo	1.3.6.1.4.1.9.9.432.1.2.2.1.28	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the inbound ecapsulation security protocol (ESP) security association of the IPsec Phase-2 Tunnel.
C64 ceipSecTunHistOutUncompOctets	1.3.6.1.4.1.9.9.432.1.2.2.1.41	Counter64	read-only	A high capacity count of the total number of uncompressed octets sent by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of 'ceipSecTunOutOctets'.
CIP ceipSecTunHistPmtu	1.3.6.1.4.1.9.9.432.1.2.2.1.30	CIPsecPmtu	read-only	The Path MTU that was determined for this IPsec Phase-2 tunnel.
IP ceipSecTunHistRemoteAddress	1.3.6.1.4.1.9.9.432.1.2.2.1.7	InetAddress	read-only	The IP address of the remote endpoint for the IPsec Phase-2 Tunnel.
IPt ceipSecTunHistRemoteAddressType	1.3.6.1.4.1.9.9.432.1.2.2.1.6	InetAddressType	read-only	The type of the IP address of the remote endpoint for the IPsec Phase-2 Tunnel.
TIM ceipSecTunHistStartTime	1.3.6.1.4.1.9.9.432.1.2.2.1.14	TimeStamp	read-only	The value of sysUpTime in hundredths of seconds when the IPsec Phase-2 Tunnel was started.
INT ceipSecTunHistTermReason	1.3.6.1.4.1.9.9.432.1.2.2.1.2	INTEGER	read-only	The reason the IPsec Phase-2 Tunnel was terminated. Possible reasons include: 1 = other 2 = normal termination 3 = operator request 4 = peer delete request was received 5 = contact with peer was lost 6 = applicationInitiated (eg: L2TP requesting the termination) 7 = failure of extended authentication 8 = local failure occurred 9 = operator initiated check point request
C32 ceipSecTunHistTotalRefreshes	1.3.6.1.4.1.9.9.432.1.2.2.1.16	Counter32	read-only	The total number of security association refreshes performed.
C32 ceipSecTunHistTotalSas	1.3.6.1.4.1.9.9.432.1.2.2.1.17	Counter32	read-only	The total number of security associations used during the life of the IPsec Phase-2 Tunnel.
C32 ceipSecTunInAuthFails	1.3.6.1.4.1.9.9.432.1.1.2.1.38	Counter32	read-only	The total number of inbound authentication's which ended in failure by this IPsec Phase-2 Tunnel .
C32 ceipSecTunInAuths	1.3.6.1.4.1.9.9.432.1.1.2.1.37	Counter32	read-only	The total number of inbound authentication's performed by this IPsec Phase-2 Tunnel.
C64 ceipSecTunInDecompOctets	1.3.6.1.4.1.9.9.432.1.1.2.1.33	Counter64	read-only	A high capacity count of the total number of decompressed octets received by this IPsec Phase-2 Tunnel. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of ceipSecTunInOctets.
C32 ceipSecTunInDecryptFails	1.3.6.1.4.1.9.9.432.1.1.2.1.40	Counter32	read-only	The total number of inbound decryption's which ended in failure by this IPsec Phase-2 Tunnel.
C32 ceipSecTunInDecrypts	1.3.6.1.4.1.9.9.432.1.1.2.1.39	Counter32	read-only	The total number of inbound decryption's performed by this IPsec Phase-2 Tunnel.
CIP ceipSecTunIndex	1.3.6.1.4.1.9.9.432.1.1.2.1.1	CIPsecPhase2TunnelIndex	not-accessible	The index of the IPsec Phase-2 Tunnel Table. The value of the index is a number which begins at 1 and is incremented with each tunnel that is created. The value of this object will wrap at 2,147,483,647. Since this object must correspond to a valid Phase-2 IPsec tunnel, this object may not assume the value of 0.
C32 ceipSecTunInDropPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.35	Counter32	read-only	The total number of packets dropped during receive processing by this IPsec Phase-2 Tunnel. This count does NOT include packets dropped due to Anti-Replay processing.
C64 ceipSecTunInOctets	1.3.6.1.4.1.9.9.432.1.1.2.1.32	Counter64	read-only	A high capacity count of the total number of octets received by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C32 ceipSecTunInPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.34	Counter32	read-only	The total number of packets received by this IPsec Phase-2 Tunnel.
C32 ceipSecTunInReplayDropPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.36	Counter32	read-only	The total number of packets dropped during receive processing due to Anti-Replay processing by this IPsec Phase-2 Tunnel.
CIP ceipSecTunInSaAhAuthAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.22	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the inbound authentication header (AH) security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunInSaDecompAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.24	CIPsecCompAlgorithm	read-only	The decompression algorithm used by the inbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunInSaDHGrp	1.3.6.1.4.1.9.9.432.1.1.2.1.19	CIPsecDiffHellmanGrp	read-only	The Diffie Hellman Group used by the inbound security association of the IPsec Phase-2 Tunnel. If the tunnel was setup manually, the value of this MIB element would be `none'.
CIP ceipSecTunInSaEncryptAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.20	CIPsecEncryptAlgorithm	read-only	The encryption algorithm used by the inbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunInSaEncryptKeySize	1.3.6.1.4.1.9.9.432.1.1.2.1.21	CIPsecEncryptionKeySize	read-only	The key size in bits of the negotiated key to be used with the algorithm denoted by 'ceipSecTunInSaEncryptAlgo'. For DES and 3DES the key size is respectively 56 and 168. For AES, this will denote the negotiated key size.
CIP ceipSecTunInSaEspAuthAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.23	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the inbound ecapsulation security protocol (ESP) security association of the IPsec Phase-2 Tunnel.
U32 ceipSecTunLifeSize	1.3.6.1.4.1.9.9.432.1.1.2.1.11	Unsigned32	read-only	The negotiated LifeSize of the IPsec Phase-2 Tunnel in kilobytes.
U32 ceipSecTunLifeTime	1.3.6.1.4.1.9.9.432.1.1.2.1.12	Unsigned32	read-only	The negotiated LifeTime of the IPsec Phase-2 Tunnel in seconds. If the tunnel was setup manually, the value of this MIB element should be 0.
IP ceipSecTunLocalAddress	1.3.6.1.4.1.9.9.432.1.1.2.1.3	InetAddress	read-only	The IP address of the local endpoint for the IPsec Phase-2 Tunnel.
IPt ceipSecTunLocalAddressType	1.3.6.1.4.1.9.9.432.1.1.2.1.2	InetAddressType	read-only	The type of the IP address of the local endpoint for the IPsec Phase-2 Tunnel.
CIP ceipSecTunNATTraversalMode	1.3.6.1.4.1.9.9.432.1.1.2.1.10	CIPsecNATTraversalMode	read-only	The encapsulation used by the IPsec Phase-2 tunnel for NAT traversal. The value of this object is constrained based on the value of the column 'ceipSecTunEncapMode'. If the value of 'ceipSecTunEncapMode' is 'encapTransport', then this object may not assume the values 'natEncapIPsecOverUdp' or 'natEncapIPsecOverTcp'.
ceipSecTunnelEntry	1.3.6.1.4.1.9.9.432.1.1.2.1		not-accessible	Each entry contains the attributes associated with an active IPsec Phase-2 Tunnel.
ceipSecTunnelHistEntry	1.3.6.1.4.1.9.9.432.1.2.2.1		not-accessible	Each entry contains the attributes associated with a previously active IPsec Phase-2 Tunnel.
ceipSecTunnelHistTable	1.3.6.1.4.1.9.9.432.1.2.2		not-accessible	The IPsec Phase-2 Tunnel History Table. This table is conceptually a sliding window in which only the last 'N' entries are maintained, where 'N' is the value of the object 'ceipSecHistTableSize'. If the value of 'ceipSecHistTableSize' is 0, archiving of entries in this table is disabled.
ceipSecTunnelSaEntry	1.3.6.1.4.1.9.9.432.1.1.5.1		not-accessible	Each entry contains the attributes and statistics associated with an active or expiring IPsec Phase-2 security associations.
ceipSecTunnelSaTable	1.3.6.1.4.1.9.9.432.1.1.5		not-accessible	The IPsec Phase-2 Tunnel Security Association Table. This table identifies the SAs that are currently associated with an active Phase-2 tunnel. This table contains an entry for each active or expiring security association (SA) which is associated with an ceipSecTunnelEntry in 'active' state and provides statistic information of this SA. There might be multiple SAs associated with one ceipSecTunnelEntry.
ceipSecTunnelTable	1.3.6.1.4.1.9.9.432.1.1.2		not-accessible	The IPsec Phase-2 Tunnel Table. There is one entry in this table for each active IPsec Phase-2 Tunnel.
C32 ceipSecTunOutAuthFails	1.3.6.1.4.1.9.9.432.1.1.2.1.46	Counter32	read-only	The total number of outbound authentication's which ended in failure by this IPsec Phase-2 Tunnel.
C32 ceipSecTunOutAuths	1.3.6.1.4.1.9.9.432.1.1.2.1.45	Counter32	read-only	The total number of outbound authentication's performed by this IPsec Phase-2 Tunnel.
C32 ceipSecTunOutCompFailPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.51	Counter32	read-only	The total number of outbound packets that failed compression because they grew in size after compression.
C32 ceipSecTunOutCompressedPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.49	Counter32	read-only	The total number of outbound packets which were successfully compressed.
C32 ceipSecTunOutCompSkippedPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.50	Counter32	read-only	The total number of outbound packets that were to be compressed but which were skipped due to the compression hysteresis.
C32 ceipSecTunOutCompTooSmallPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.52	Counter32	read-only	The total number of outbound packets that were to be compressed but were smaller than the compression threshold size.
C32 ceipSecTunOutDropPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.44	Counter32	read-only	The total number of packets dropped during send processing by this IPsec Phase-2 Tunnel.
C32 ceipSecTunOutEncryptFails	1.3.6.1.4.1.9.9.432.1.1.2.1.48	Counter32	read-only	The total number of outbound encryption's which ended in failure by this IPsec Phase-2 Tunnel.
C32 ceipSecTunOutEncrypts	1.3.6.1.4.1.9.9.432.1.1.2.1.47	Counter32	read-only	The total number of outbound encryption's performed by this IPsec Phase-2 Tunnel.
C64 ceipSecTunOutOctets	1.3.6.1.4.1.9.9.432.1.1.2.1.41	Counter64	read-only	A high capacity count of the total number of octets sent by this IPsec Phase-2 Tunnel. This value is accumulated AFTER determining whether or not the packet should be compressed.
C32 ceipSecTunOutPkts	1.3.6.1.4.1.9.9.432.1.1.2.1.43	Counter32	read-only	The total number of packets sent by this IPsec Phase-2 Tunnel.
CIP ceipSecTunOutSaAhAuthAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.28	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the outbound authentication header (AH) security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunOutSaCompAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.30	CIPsecCompAlgorithm	read-only	The compression algorithm used by the inbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunOutSaDHGrp	1.3.6.1.4.1.9.9.432.1.1.2.1.25	CIPsecDiffHellmanGrp	read-only	The Diffie Hellman Group used by the outbound security association of the IPsec Phase-2 Tunnel. If the tunnel was setup manually, the value of this MIB element would be 'none'.
CIP ceipSecTunOutSaEncryptAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.26	CIPsecEncryptAlgorithm	read-only	The encryption algorithm used by the outbound security association of the IPsec Phase-2 Tunnel.
CIP ceipSecTunOutSaEncryptKeySize	1.3.6.1.4.1.9.9.432.1.1.2.1.27	CIPsecEncryptionKeySize	read-only	The key size in bits of the negotiated key to be used with the algorithm denoted by 'ceipSecTunOutSaEncryptAlgo'. For DES and 3DES the key size is respectively 56 and 168. For AES, this will denote the negotiated key size.
CIP ceipSecTunOutSaEspAuthAlgo	1.3.6.1.4.1.9.9.432.1.1.2.1.29	CIPsecAuthAlgorithm	read-only	The authentication algorithm used by the inbound encapsulation security protocol (ESP) security association of the IPsec Phase-2 Tunnel.
C64 ceipSecTunOutUncompOctets	1.3.6.1.4.1.9.9.432.1.1.2.1.42	Counter64	read-only	A high capacity count of the total number of uncompressed octets sent by this IPsec Phase-2 Tunnel. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of ceipSecTunOutOctets.
CIP ceipSecTunPmtu	1.3.6.1.4.1.9.9.432.1.1.2.1.31	CIPsecPmtu	read-only	The Path MTU for this IPsec Phase-2 tunnel, which has been either learnt from the network or which has been specified by the administrator. The lower end of the range is 68 which is the minimum MTU for IPv4.
IP ceipSecTunRemoteAddress	1.3.6.1.4.1.9.9.432.1.1.2.1.5	InetAddress	read-only	The IP address of the remote endpoint for the IPsec Phase-2 Tunnel.
IPt ceipSecTunRemoteAddressType	1.3.6.1.4.1.9.9.432.1.1.2.1.4	InetAddressType	read-only	The type of the IP address of the remote endpoint for the IPsec Phase-2 Tunnel.
CIP ceipSecTunSaDirection	1.3.6.1.4.1.9.9.432.1.1.5.1.3	CIPsecPhase2SaDirection	not-accessible	Phase-2 IPsec security associations are simplex. Hence a particular security association is used either for securing outgoing traffic or decoding incoming traffic. This column identifies the direction of the security association represented by this entry.
NUM ceipSecTunSaIfIndex	1.3.6.1.4.1.9.9.432.1.1.5.1.5	InterfaceIndex	read-only	This object represents the ifIndex of an interface where a tunnel with ceipSecTunIndex is created. Multiple IPsec tunnels can be created using the same interface.
C64 ceipSecTunSaInAuthFails	1.3.6.1.4.1.9.9.432.1.1.5.1.12	Counter64	read-only	The total number of inbound authentication's which ended in failure by using this SA.
C64 ceipSecTunSaInAuths	1.3.6.1.4.1.9.9.432.1.1.5.1.11	Counter64	read-only	The total number of inbound authentication's performed by using this SA.
C64 ceipSecTunSaInDecompOctets	1.3.6.1.4.1.9.9.432.1.1.5.1.7	Counter64	read-only	A high capacity count of the total number of decompressed octets received by using this SA. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of ceipSecTunSaTunInOctets.
C64 ceipSecTunSaInDecryptFails	1.3.6.1.4.1.9.9.432.1.1.5.1.14	Counter64	read-only	The total number of inbound decryption's which ended in failure by using this SA.
C64 ceipSecTunSaInDecrypts	1.3.6.1.4.1.9.9.432.1.1.5.1.13	Counter64	read-only	The total number of inbound decryption's performed by this SA.
U32 ceipSecTunSaIndex	1.3.6.1.4.1.9.9.432.1.1.5.1.2	Unsigned32	not-accessible	The object, in the context of the IPsec tunnel 'ceipSecTunIndex', is an index of security associations comprising the Phase-2 IPsec tunnel represented by the tunnel index 'ceipSecTunIndex'. The value of this index is a number which begins at 1 and is incremented with each SPI associated with the corresponding IPsec Phase-2 Tunnel.
C64 ceipSecTunSaInDropPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.9	Counter64	read-only	The total number of packets dropped during receive process by using this SA. This count does NOT include packets dropped due to Anti-Replay processing.
C64 ceipSecTunSaInOctets	1.3.6.1.4.1.9.9.432.1.1.5.1.6	Counter64	read-only	A high capacity count of the total number of octets received by using this SA. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 ceipSecTunSaInPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.8	Counter64	read-only	The total number of packets received by using this SA.
C64 ceipSecTunSaInReplayDropPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.10	Counter64	read-only	The total number of packets dropped during receive processing due to Anti-Replay processing by using this SA.
U32 ceipSecTunSaLifeSizeThreshold	1.3.6.1.4.1.9.9.432.1.1.2.1.14	Unsigned32	read-only	The security association LifeSize refresh threshold in kilobytes. If the tunnel was setup manually, the value of this MIB element should be 0.
U32 ceipSecTunSaLifeTimeThreshold	1.3.6.1.4.1.9.9.432.1.1.2.1.15	Unsigned32	read-only	The security association LifeTime refresh threshold in seconds. If the tunnel was setup manually, the value of this MIB element should be 0.
C64 ceipSecTunSaOutAuthFails	1.3.6.1.4.1.9.9.432.1.1.5.1.20	Counter64	read-only	The total number of outbound authentication's which ended in failure by using this SA.
C64 ceipSecTunSaOutAuths	1.3.6.1.4.1.9.9.432.1.1.5.1.19	Counter64	read-only	The total number of outbound authentication's performed by using this SA.
C64 ceipSecTunSaOutCompFailPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.25	Counter64	read-only	The total number of outbound packets that failed compression because they grew in size after compression when using this SA.
C64 ceipSecTunSaOutCompressedPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.23	Counter64	read-only	The total number of outbound packets which were successfully compressed by using this SA.
C64 ceipSecTunSaOutCompSkippedPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.24	Counter64	read-only	The total number of outbound packets that were to be compressed but which were skipped due to the compression hysteresis when using this SA.
C64 ceipSecTunSaOutCompTooSmallPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.26	Counter64	read-only	The total number of outbound packets that were to be compressed but were smaller than the compression threshold size when using this SA.
C64 ceipSecTunSaOutDropPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.18	Counter64	read-only	The total number of packets dropped during send processing by using this SA.
C64 ceipSecTunSaOutEncryptFails	1.3.6.1.4.1.9.9.432.1.1.5.1.22	Counter64	read-only	The total number of outbound encryption's which ended in failure by using this SA.
C64 ceipSecTunSaOutEncrypts	1.3.6.1.4.1.9.9.432.1.1.5.1.21	Counter64	read-only	The total number of outbound encryption's performed by using this SA.
C64 ceipSecTunSaOutOctets	1.3.6.1.4.1.9.9.432.1.1.5.1.15	Counter64	read-only	A high capacity count of the total number of octets sent by using this SA. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 ceipSecTunSaOutPkts	1.3.6.1.4.1.9.9.432.1.1.5.1.17	Counter64	read-only	The total number of packets sent by using this SA.
C64 ceipSecTunSaOutUncompOctets	1.3.6.1.4.1.9.9.432.1.1.5.1.16	Counter64	read-only	A high capacity count of the total number of uncompressed octets sent by using this SA. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of ceipSecTunSaTunOutOctets.
CIP ceipSecTunSaProtocol	1.3.6.1.4.1.9.9.432.1.1.5.1.1	CIPsecProtocol	not-accessible	This column represents the security protocol (AH, ESP or IPComp) for which this security association was setup.
INT ceipSecTunSaStatus	1.3.6.1.4.1.9.9.432.1.1.5.1.27	INTEGER	read-only	This column represents the status of the security association represented by this conceptual row. If the status of the SA is 'active', the SA is ready for active use. The status 'expiring' represents any of the various states that the security association transitions through before being purged.
CIP ceipSecTunSaValue	1.3.6.1.4.1.9.9.432.1.1.5.1.4	CIPsecSpi	read-only	This is the value of the Security Protection Index (SPI) assigned by the system to the security association represented by this entry.
CIP ceipSecTunStatus	1.3.6.1.4.1.9.9.432.1.1.2.1.54	CIPsecTunnelStatus	read-write	The status of the MIB table row. This object can be used to bring the tunnel down or force a rekeying. When the value is set to destroy(5), the SA bundle is destroyed and this row is deleted from this table. When the value is set to rekey(6), then rekeying is forced on this tunnel. When this MIB value is queried, the value of active(4) is always returned, if the instance exists. This object cannot be used to create a MIB table row.
C32 ceipSecTunTotalRefreshes	1.3.6.1.4.1.9.9.432.1.1.2.1.16	Counter32	read-only	The total number of security association refreshes performed.
ciscoEnhancedIpsecFlowMIB	1.3.6.1.4.1.9.9.432			This is a MIB Module for monitoring the structures and status of IPSec-based networks. The MIB has been designed to be adopted as an IETF standard. Hence vendor-specific features of IPSec protocol are excluded from this MIB. Acronyms The following acronyms are used in this document: IPsec: Secure IP Protocol VPN: Virtual Private Network ISAKMP: Internet Security Association and Key Exchange Protocol IKE: Internet Key Exchange Protocol SA: Security Association (ref: rfc2408). SPI: Security Parameter Index is the pointer or identifier used in accessing SA attributes (ref: rfc2408). MM: Main Mode - the process of setting up a Phase 1 SA to secure the exchanges required to setup Phase 2 SAs QM: Quick Mode - the process of setting up Phase 2 Security Associations using a Phase 1 SA. Phase 1 Tunnel: An ISAKMP SA can be regarded as representing a flow of ISAKMP/IKE traffic. Hence an ISAKMP is referred to as a 'Phase 1 Tunnel' in this document. Control Tunnel: Another term for a Phase 1 Tunnel. Phase 2 Tunnel: An instance of a non-ISAKMP SA bundle in which all the SA share the same proxy identifiers (IDii,IDir) protect the same stream of application traffic. Such an SA bundle is termed a 'Phase 2 Tunnel'. Note that a Phase 2 tunnel may comprise different SA bundles and different number of SA bundles at different times (due to key refresh). MTU: Maximum Transmission Unit (of an IPsec tunnel). History of the MIB A precursor to this MIB was written by Tivoli and implemented in IBM Nways routers in 1999. During late 1999, Cisco adopted the MIB and together with Tivoli publised the IPsec Flow Monitor MIB in IETF IPsec WG in draft-ietf-ipsec-flow-monitoring-mib-00.txt. In 2000, the MIB was Cisco-ized and implemented this draft as CISCO-IPSEC-FLOW-MONITOR-MIB in IOS and VPN3000 platforms. With the evolution of IKEv2, the MIB was modified and presented to the IPsec WG again in May 2003 in draft-ietf-ipsec-flow-monitoring-mib-02.txt. With the emergence of multiple IPsec signaling protocols, it became apparent that the signaling aspects of IPsec need to be instrumented separately in their own right. Thus, the IPsec control attributes and metrics were separated out into CISCO-IPSEC-SIGNALING-MIB and CISCO-IKE-FLOW-MIB. This version of the draft is the version of the draft that models that IPsec data protocol, structures and activity alone. Overview of MIB The MIB contains four major groups of objects which are used to manage the IPsec Protocol. These groups include a Levels Group, a Phase-1 Group, a Phase-2 Group, a History Group, a Failure Group and a TRAP Control Group. The following table illustrates the structure of the IPsec MIB. The Phase 2 group models objects pertaining to IPsec data tunnels. The History group is to aid applications that do trending analysis. The Failure group is to enable an operator to do troubleshooting and debugging of the VPN Router. Further, counters are supported to aid detection of potential security violations. In addition to the three major MIB Groups, there are a number of Notifications. The following table illustrates the name and description of the IPsec TRAPs.
ciscoEnhancedIpsecFlowMIBConform	1.3.6.1.4.1.9.9.432.2
ciscoEnhancedIpsecFlowMIBNotifs	1.3.6.1.4.1.9.9.432.0
ciscoEnhancedIpsecFlowMIBObjects	1.3.6.1.4.1.9.9.432.1
ciscoEnhIPsecFlowActivityGroup	1.3.6.1.4.1.9.9.432.2.2.1			This group consists of: 1) IPsec Phase-2 Global Statistics 2) IPsec Phase-2 Tunnel Table 3) IPsec Phase-2 Endpoint Table 4) IPsec Phase-2 Security Association Table
NTF ciscoEnhIpsecFlowBadSa	1.3.6.1.4.1.9.9.432.0.5			This notification is generated when the managed entity receives an IPsec packet with a non-existent (non-existant in the local Security Association Database) SPI.
NTF ciscoEnhIpsecFlowCertExpiry	1.3.6.1.4.1.9.9.432.0.6			This notification is generated to notify that an X.509 certificate is going to expire. The notification is triggered the time threshold configured on the application for notification before the certificate is going to expire, which is when the value of ceipSecCertExpiryStatus is changed from certOK(1) to certGoingExpired(2). The user should take action to renew the certificate identified in the notification prior to the certificate expiration, which is at the validity notAfter time provided in the notification.
ciscoEnhIPsecFlowCertObjectGroup	1.3.6.1.4.1.9.9.432.2.2.11			This group consists of objects to support X.509 certificates.
NTF ciscoEnhIpsecFlowCertRenewal	1.3.6.1.4.1.9.9.432.0.7			This notification is generated to report a status transition for an X.509 certificate renewal performed by the application. The notification is generated when the value of ceipSecCertRenewalStatus is changed from 1. renewalNotNeeded(1) to renewalRequestNeeded(2) or renewalRequested(3) 2. renewalRequestNeeded(2) to renewalRequested(3) 3. renewalRequested(3) to renewalSuccess(4) or renewalFailedUpdate(5) or renewalFailedExpired(6) 4. renewalFailedUpdate(5) to renewalFailedExpired(6)
ciscoEnhIPsecFlowCoreFailGroup	1.3.6.1.4.1.9.9.432.2.2.4			This group consists of the core (mandatory) objects pertaining to maintaining history of failure IPsec activity.
ciscoEnhIPsecFlowCoreHistGroup	1.3.6.1.4.1.9.9.432.2.2.2			This group consists of the core (mandatory) objects pertaining to maintaining history of IPsec activity.
ciscoEnhIPsecFlowFailureGroup	1.3.6.1.4.1.9.9.432.2.2.5			This group consists of objects that pertain to maintenance of history of failures associated with Phase 2 IPsec activity.
ciscoEnhIPsecFlowHistoryGroup	1.3.6.1.4.1.9.9.432.2.2.3			This group consists of objects that pertain to maintenance of history of IPsec Phase 2 activity.
ciscoEnhIPsecFlowMIBCompliance	1.3.6.1.4.1.9.9.432.2.1.1			The compliance statement for SNMP entities pertaining to Phase-2 of IP Security Protocol.
ciscoEnhIPsecFlowMIBComplianceRev1	1.3.6.1.4.1.9.9.432.2.1.2			The compliance statement for SNMP entities pertaining to Phase-2 of IP Security Protocol.
ciscoEnhIPsecFlowMIBComplianceRev2	1.3.6.1.4.1.9.9.432.2.1.3			The compliance statement for SNMP entities pertaining to Phase-2 of IP Security Protocol.
ciscoEnhIPsecFlowMIBCompliances	1.3.6.1.4.1.9.9.432.2.1
ciscoEnhIPsecFlowNotifCntlGroup	1.3.6.1.4.1.9.9.432.2.2.6			This group of objects controls the sending of notifications pertaining to IPsec Phase-2 processing.
ciscoEnhIPsecFlowNotifCntlGroupSup01	1.3.6.1.4.1.9.9.432.2.2.9			This supplement group of objects controls the sending of X.509 certificate IPSec notifications.
ciscoEnhIPsecFlowNotifGroup	1.3.6.1.4.1.9.9.432.2.2.7			This group contains the notifications pertaining to Phase-2 operations and data transfer.
ciscoEnhIPsecFlowNotifGroupSup01	1.3.6.1.4.1.9.9.432.2.2.10			This supplement group contains the X.509 certificate notifications for the IPSec MIB.
ciscoEnhIPsecFlowPerformanceThroughputGroup	1.3.6.1.4.1.9.9.432.2.2.12			This group consists of objects to show the the performance utilization.
NTF ciscoEnhIpsecFlowSetupFail	1.3.6.1.4.1.9.9.432.0.4			This notification is generated when the setup for an IPsec Phase-2 Tunnel fails.
NTF ciscoEnhIpsecFlowSysFailure	1.3.6.1.4.1.9.9.432.0.3			This notification is generated when the processing for an IPsec Phase-2 Tunnel experiences an internal or system capacity error.
ciscoEnhIPsecFlowTunnelSaGroup	1.3.6.1.4.1.9.9.432.2.2.8			This group consists of the Phase-2 IPsec tunnel Security Association and traffic information.
NTF ciscoEnhIpsecFlowTunnelStart	1.3.6.1.4.1.9.9.432.0.1			This notification is generated when an IPsec Phase-2 Tunnel becomes active.
NTF ciscoEnhIpsecFlowTunnelStop	1.3.6.1.4.1.9.9.432.0.2			This notification is generated when an IPsec Phase-2 Tunnel becomes inactive.
ciscoIPsecFlowMIBGroups	1.3.6.1.4.1.9.9.432.2.2

RFC description

Monitors IPsec tunnel status, security associations, encryption algorithms, and flow statistics for VPN networks.

Start monitoring Cisco router/firewall/VPN concentrator terminating IPsec tunnels with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-ENHANCED-IPSEC-FLOW-MIB