CISCO-FCSP-MIB

All MIBs › CISCO-FCSP-MIB

Organization: Cisco Systems Inc.

Last Updated: 2004-07-02

Category: Cisco Devices, Fibre Channel and Storage, VPN and Security

Description: Provides management objects for configuring and monitoring Fibre Channel Security Protocol (FC-SP) authentication between fabric entities on Cisco MDS switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-FCSP-MIB?

CISCO-FCSP-MIB manages Fibre Channel Security Protocol (FC-SP), an ANSI T11 standard for authenticating fabric switches and devices to each other, as implemented on Cisco MDS SAN switches. It exposes per-interface configuration for authentication mode, protocols, DH-CHAP hash and group lists, and a table of local passwords used for authentication. The MIB is primarily a security/configuration MIB rather than a hardware-health MIB, letting administrators monitor authentication mode and timeout settings and confirm which interfaces have FC-SP protection enabled. It explicitly references the T11 FC-SP Rev 1.1 standard as its normative dependency. It is deployed on Cisco MDS switches in SAN fabrics that require switch-to-switch or host-to-switch authentication. Engineers can download the CISCO-FCSP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-FCSP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco MDS series Fibre Channel SAN switches

Monitoring Examples

An administrator would poll cfcspIfTable, per interface, reading cfcspMode and cfcspAuthProtocols to confirm FC-SP authentication is active and using the expected protocol, and cfcspReauthInterval/cfcspTimeout to verify re-authentication cadence. An interface unexpectedly showing FC-SP disabled or a protocol mismatch against cfcspDhChapHashList/cfcspDhChapGroupList would indicate a misconfigured or non-compliant fabric connection posing a security risk.

What Can Be Monitored

FC-SP mode per interface
authentication protocol list
reauthentication interval and timeout
DH-CHAP hash/group lists
configured local passwords

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-ST-TC

FcNameId

From IF-MIB

ifDescr	OBJECT-TYPE
ifIndex	OBJECT-TYPE

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus

How to Use in IPNetwork Monitor

Example using cfcspIfAuthSucceeded OID:

Select a Cisco MDS series Fibre Channel SAN switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cfcspIfAuthSucceeded into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of times the FCSP authentication succeeded on this interface. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoFcspMIB	1.3.6.1.4.1.9.9.391			MIB module for managing Fibre Channel Security for the fibre channel devices. This MIB is used to configure and monitor the Fibre-Channel Security Protocol (FC-SP) Rev 1.1 of FC-SP, Dated 04/18/03, T11/Project 1570-D. Please refer to http://www.t11.org.
ciscoFcspMIBNotifications	1.3.6.1.4.1.9.9.391.0
NTF cfcspAuthFailNotification	1.3.6.1.4.1.9.9.391.0.1			FCSP Authentication Failure trap
ciscoFcspMIBObjects	1.3.6.1.4.1.9.9.391.1
cfcspConfig	1.3.6.1.4.1.9.9.391.1.1
cfcspIfTable	1.3.6.1.4.1.9.9.391.1.1.1		not-accessible	This table provides the FCSP configuration for the fibre channel interfaces. Note that the ifType for the fibre channel interfaces is fibreChannel(56).
cfcspIfEntry	1.3.6.1.4.1.9.9.391.1.1.1.1		not-accessible	An entry (conceptual row) in the cfcspIfTable, containing FCSP configuration for the interface identified by ifIndex. Each entry contains a FCSP mode of the interface, reauthentication interval and authentication command object.
INT cfcspMode	1.3.6.1.4.1.9.9.391.1.1.1.1.1	INTEGER	read-write	The FC-SP mode of this interface. If off(1), port would never initiate FC-SP authentication exchange and send reject to any FC-SP authentication message started from other end. If autoPassive(2), a port would not initiate any FC-SP authentication exchange; but would always take part in FC-SP authentication exchange initiated on this interface by other devices. If autoActive(3), a port would always try to initiate FC-SP authentication exchange after ESC. If otherside does not support FC-SP authentication, port will still be brought up. If the authentication fails, the port will not be brought up. If on(4), port would always try to initiate FC-SP authentication exchange and authentication is done before the port becomes up. If otherside does not support FC-SP authentication or if authentication fails, port will not be brought up.
U32 cfcspReauthInterval	1.3.6.1.4.1.9.9.391.1.1.1.1.2	Unsigned32	read-write	The time for which a port has to wait before trying to re-authenticate the other end. 0 means re-authentication is not done. This object is not relevant if cfcspMode is 'off'.
INT cfcspReauthenticate	1.3.6.1.4.1.9.9.391.1.1.1.1.3	INTEGER	read-write	If this object is set to 'enable', reauthentication is started. No action is taken if set to 'noOp'. When read, always 'noOp' is returned.
INT cfcspAuthProtocols	1.3.6.1.4.1.9.9.391.1.1.2	INTEGER	read-write	The FC-SP authentication protocols used by this device. Only 1 bit can be set to 1 at any time. The bit that is set to 1, its corresponding protocol will be used first and other protocol will be used as second preference.
U32 cfcspTimeout	1.3.6.1.4.1.9.9.391.1.1.3	Unsigned32	read-write	Timeout period for FC-SP messages
cfcspDhChapObjects	1.3.6.1.4.1.9.9.391.1.1.4
OCT cfcspDhChapHashList	1.3.6.1.4.1.9.9.391.1.1.4.1	OCTET STRING	read-write	Each octet in this object contains a IANA assigned identifier of a proposed hash mechanism, in the order of preference. The first octet is the most preferred and the last octet contains the least preferred.
OCT cfcspDhChapGroupList	1.3.6.1.4.1.9.9.391.1.1.4.2	OCTET STRING	read-write	Each octet in this object contains a group number, corresponding to a Diffie-Hellman group identifier, in order of preference. Currently there are 5 groups supported, from value 0 through 4. Each number corresponds to the Diffie-Hellman group as follows - 0 - DH_NULL 1 - DH_1024 2 - DH_1280 3 - DH_1536 4 - DH_2048
STR cfcspDhChapGenericPasswd	1.3.6.1.4.1.9.9.391.1.1.4.3	SnmpAdminString	read-write	DHCHAP Password for this device
cfcspLocalPasswdTable	1.3.6.1.4.1.9.9.391.1.1.5		not-accessible	This table provides the FCSP DHCHAP password configuration for the device.
cfcspLocalPasswdEntry	1.3.6.1.4.1.9.9.391.1.1.5.1		not-accessible	An entry (conceptual row) in the cfcspLocalPasswdTable. Each entry, indexed by the device's World-wide name, consists of a local password and a rowStatus object.
FCN cfcspSwitchWwn	1.3.6.1.4.1.9.9.391.1.1.5.1.1	FcNameId	not-accessible	The World-Wide Name of the host with which this password has to be used.
STR cfcspLocalPasswd	1.3.6.1.4.1.9.9.391.1.1.5.1.2	SnmpAdminString	read-create	DHCHAP Password of the local device.
ROW cfcspLocalPassRowStatus	1.3.6.1.4.1.9.9.391.1.1.5.1.3	RowStatus	read-create	The status of this conceptual row.
cfcspRemotePasswdTable	1.3.6.1.4.1.9.9.391.1.1.6		not-accessible	This table provides the FCSP DHCHAP password configuration for other devices
cfcspRemotePasswdEntry	1.3.6.1.4.1.9.9.391.1.1.6.1		not-accessible	An entry (conceptual row) in the cfcspRemotePasswdTable. Each entry, indexed by the remote device's World-wide name, consists of a DHCHAP password and a rowStatus object.
FCN cfcspRemoteSwitchWwn	1.3.6.1.4.1.9.9.391.1.1.6.1.1	FcNameId	not-accessible	The World-Wide Name of other device.
STR cfcspRemotePasswd	1.3.6.1.4.1.9.9.391.1.1.6.1.2	SnmpAdminString	read-create	Password of the other device.
ROW cfcspRemotePassRowStatus	1.3.6.1.4.1.9.9.391.1.1.6.1.3	RowStatus	read-create	The status of this conceptual row.
cfcspInfo	1.3.6.1.4.1.9.9.391.1.2
cfcspStatistics	1.3.6.1.4.1.9.9.391.1.3
cfcspIfStatsTable	1.3.6.1.4.1.9.9.391.1.3.1		not-accessible	This table provides the FCSP statistics for all the fibre channel interfaces.
cfcspIfStatsEntry	1.3.6.1.4.1.9.9.391.1.3.1.1		not-accessible	An entry (conceptual row) in the cfcspIfStatsTable.
C32 cfcspIfAuthSucceededEx	1.3.6.1.4.1.9.9.391.1.3.1.1.1	Counter32	read-only	The number of times the FCSP authentication succeeded on this interface.
C32 cfcspIfAuthFailed	1.3.6.1.4.1.9.9.391.1.3.1.1.2	Counter32	read-only	The number of times the FCSP authentication failed on this interface.
C32 cfcspIfAuthByPassed	1.3.6.1.4.1.9.9.391.1.3.1.1.3	Counter32	read-only	The number of times the FCSP authentication was bypassed on this interface.
cfcspNotificationObjects	1.3.6.1.4.1.9.9.391.1.4
ciscoFcspMIBConformance	1.3.6.1.4.1.9.9.391.2
ciscoFcspMIBCompliances	1.3.6.1.4.1.9.9.391.2.1
ciscoFcspMIBCompliance	1.3.6.1.4.1.9.9.391.2.1.1			The compliance statement for entities which implement the CISCO-FCSP-MIB.
ciscoFcspMIBGroups	1.3.6.1.4.1.9.9.391.2.2
cfcspConfigGroup	1.3.6.1.4.1.9.9.391.2.2.1			A collection of objects for configuring Fibre Channel security Information.
cfcspLocalPasswdGroup	1.3.6.1.4.1.9.9.391.2.2.2			A collection of objects for configuring Fibre Channel security Information.
cfcspIfStatsGroup	1.3.6.1.4.1.9.9.391.2.2.3			A collection of objects for monitoring FCSP statistics.
cfcspNotificationGroup	1.3.6.1.4.1.9.9.391.2.2.4			A collection of objects for FCSP notifications.

RFC description

Configures and monitors Fibre-Channel Security Protocol (FC-SP) for securing Fibre Channel device communications and fabric authentication.

Start monitoring Cisco MDS series Fibre Channel SAN switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-FCSP-MIB