CISCO-GDOI-MIB

All MIBs › CISCO-GDOI-MIB

Organization: cisco Systems, Inc.

Last Updated: 2015-07-17

Category: Cisco Devices, VPN and Security

Description: Provides management objects for the Group Domain of Interpretation (GDOI) protocol used in GET VPN group key management on Cisco routers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-GDOI-MIB?

CISCO-GDOI-MIB is a Cisco Systems proprietary MIB (based on RFC 6407) managing GDOI (Group Domain of Interpretation) group key management for Cisco GET VPN. Its notifications cover key-server registration/rekey-push/no-RSA-keys events and group-member registration/re-registration/rekey-received/incomplete-config/no-IPsec-flows/rekey-failure/role-change/deletion/peer-reachability events, while a group table records group ID type/length/value, name, member count, active-peer key-server count, and last-rekey retransmit count/time-taken. As a configuration/status MIB it lets an administrator watch GET VPN group-member registration and rekey health and get alerted on rekey failures. It is deployed on Cisco Systems routers running GET VPN (GDOI). Engineers can download the CISCO-GDOI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-GDOI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Systems routers (GET VPN / GDOI)

Monitoring Examples

An administrator investigates a cgmGdoiGmRekeyFailure notification and checks cgmGdoiGroupLastRekeyRetransmits to diagnose a GET VPN group-key rekey problem on a Cisco router.

What Can Be Monitored

GDOI group-member registration and rekey event notifications

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TC

CiscoMilliSeconds

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using cgmGdoiKeyServerRekeysPushed OID:

Select a Cisco router (GET VPN / GDOI) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cgmGdoiKeyServerRekeysPushed into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The sequence number of the last rekey sent from the Key Server to its registered Group Members for this GDOI group. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in GROUPKEY-PUSH Messages), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
cgmGdoiCoopPeerEntry	1.3.6.1.4.1.9.9.759.1.2.3.1		not-accessible	An entry containing COOP Peer Key Server's (KS) information, uniquely identified by the Group & Peer Key Server IDs.
cgmGdoiCoopPeerGroup	1.3.6.1.4.1.9.9.759.2.1.16			This group consists of: 1) COOP Peer Key Server Table
U32 cgmGdoiCoopPeerIdLength	1.3.6.1.4.1.9.9.759.1.2.3.1.2	Unsigned32	read-only	The length (i.e. number of octets) of a Peer (Key Server) ID. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiCoopPeerIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiCoopPeerIdType	1.3.6.1.4.1.9.9.759.1.2.3.1.1	CgmGdoiIdentificationType	not-accessible	The Identification Type Value used to parse the identity information for a Key Server. RFC 4306 defines all valid types that can be used as an identifier. These identification types are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiCoopPeerIdValue	1.3.6.1.4.1.9.9.759.1.2.3.1.3	CgmGdoiIdentificationValue	not-accessible	The value of the identity information for a COOP Key Server with its type indicated by the cgmGdoiCoopPeerIdType. Use the cgmGdoiCoopPeerIdType to parse the COOP Peer (Key Server) ID correctly. This COOP Peer (Key Server) ID value is sent as the 'SRC Identification Data' and 'DST Identification Data' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
U32 cgmGdoiCoopPeerRegisteredGMs	1.3.6.1.4.1.9.9.759.1.2.3.1.6	Unsigned32	read-only	The count of registered Group Members to the COOP Peer (Key Server) identified by the index.
CGM cgmGdoiCoopPeerRole	1.3.6.1.4.1.9.9.759.1.2.3.1.4	CgmGdoiKsRole	read-only	The current role of the COOP Peer (Key Server) for the Group.
CGM cgmGdoiCoopPeerStatus	1.3.6.1.4.1.9.9.759.1.2.3.1.5	CgmGdoiKsStatus	read-only	The current status of the COOP Peer (Key Server) as seen from the local Key Server.
cgmGdoiCoopPeerTable	1.3.6.1.4.1.9.9.759.1.2.3		not-accessible	A table of information for the COOP peer(s). The information populated in this table, is extracted from the COOP messages exchanged between the local KS (device being queried) and the COOP Peer(s).
CGM cgmGdoiGmActiveKEK	1.3.6.1.4.1.9.9.759.1.2.2.1.7	CgmGdoiKekSPI	read-only	The SPI of the Key Encryption Key (KEK) that is currently being used by the Group Member to authenticate & decrypt a rekey from a GROUPKEY-PUSH message.
C32 cgmGdoiGmActiveTEKNum	1.3.6.1.4.1.9.9.759.1.2.2.1.9	Counter32	read-only	The number of active traffic encryption keys (TEKS) currently being used by the Group Member to encrypt/decrypt/authenticate dataplane traffic.
cgmGdoiGmEntry	1.3.6.1.4.1.9.9.759.1.2.2.1		not-accessible	An entry containing Local GDOI Group Member information, uniquely identified by Group & GM IDs. Because the Group Member is Local to the network device being queried, TEKs installed for this Group Member can be queried as well.
cgmGdoiGmErrorNotificationGroup	1.3.6.1.4.1.9.9.759.2.1.9			This group contains the Group Member (GM) error notifications for the GDOI MIB.
cgmGdoiGmGroup	1.3.6.1.4.1.9.9.759.2.1.3			This group consists of: 1) GDOI GM Table cgmGdoiGmGroupRev1 is an extension to this group.
cgmGdoiGmGroupRev1	1.3.6.1.4.1.9.9.759.2.1.13			This group consists of: 1) GDOI GM Table This group is an extension to cgmGdoiGmGroup.
U32 cgmGdoiGmIdLength	1.3.6.1.4.1.9.9.759.1.2.2.1.2	Unsigned32	read-only	The length (i.e. number of octets) of a Group Member ID. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiGmIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiGmIdType	1.3.6.1.4.1.9.9.759.1.2.2.1.1	CgmGdoiIdentificationType	not-accessible	The Identification Type Value used to parse the identity information for a Initiator or Group Member. RFC 4306 defines all valid types that can be used as an identifier. These identification types are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiGmIdValue	1.3.6.1.4.1.9.9.759.1.2.2.1.3	CgmGdoiIdentificationValue	not-accessible	The value of the identity information for a Group Member with its type indicated by the cgmGdoiGmIdType. Use the cgmGdoiGmIdType to parse the Group Member ID correctly. This Group Member ID value is sent as the 'SRC Identification Data' and 'DST Identification Data' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
T/F cgmGdoiGmIncompCfgNotifEnable	1.3.6.1.4.1.9.9.759.1.4.9	TruthValue	read-only	Indicates whether or not an error notification should be generated on a Group Member when there is missing information for configuring a GDOI group.
NTF cgmGdoiGmIncompleteCfg	1.3.6.1.4.1.9.9.759.0.9			An error notification from a Group Member when there is necessary information missing from the policy/configuration of a Group Member on an interface when it tries to register with a Key Server in its GDOI Group. If the GDOI Group configuration is not complete on a Group Member, it will not be able to register to the Key Server.
U32 cgmGdoiGmKekDstIdLength	1.3.6.1.4.1.9.9.759.1.3.2.1.8	Unsigned32	read-only	The length (i.e. number of octets) of the destination ID of a KEK SA. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiGmKekDstIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'DST ID Data Len' field sent in the KEK payload.
CGM cgmGdoiGmKekDstIdPort	1.3.6.1.4.1.9.9.759.1.3.2.1.10	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the dest. ID of a KEK SA. A value of zero means that the port should be ignored. This port value is sent as the `DST ID Port` field of a KEK payload.
CGM cgmGdoiGmKekDstIdType	1.3.6.1.4.1.9.9.759.1.3.2.1.7	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the dest. (multicast rekey address) of a KEK SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'DST ID Type' of the KEK payload.
CGM cgmGdoiGmKekDstIdValue	1.3.6.1.4.1.9.9.759.1.3.2.1.9	CgmGdoiIdentificationValue	read-only	The value of the identity information for the destination of a KEK SA (multicast rekey address) with its type indicated by cgmGdoiGmKekDstIdType. Use the cgmGdoiGmKekDstIdType to parse the KEK Dest. ID correctly. This ID value is sent as the 'DST Identification Data' of a KEK payload.
CGM cgmGdoiGmKekEncryptAlg	1.3.6.1.4.1.9.9.759.1.3.2.1.13	CgmGdoiEncryptionAlgorithm	read-only	The value of the KEK_ALGORITHM which specifies the encryption algorithm used with the KEK SA. A GDOI implementaiton must support KEK_ALG_3DES. Following are the KEK encryption algoritm values defined in the GDOI RFC 3547, however the CgmGdoiEncryptionAlgorithm TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 KEK_ALG_DES 1 KEK_ALG_3DES 2 KEK_ALG_AES 3 RESERVED 4-127 Private Use 128-255
U32 cgmGdoiGmKekEncryptKeyLength	1.3.6.1.4.1.9.9.759.1.3.2.1.14	Unsigned32	read-only	The value of the KEK_KEY_LENGTH which specifies the KEK Algorithm key length (in bits).
cgmGdoiGmKekEntry	1.3.6.1.4.1.9.9.759.1.3.2.1		not-accessible	An entry containing the attributes associated with a GDOI KEK SA, uniquely identified by the Group ID, Group Member (GM) ID, & SPI value assigned by the GM's registered Key Server to the KEK. There will be at least one KEK SA entry for each GM & two KEK SA entries for a given GM only during a KEK rekey when a new KEK is received & installed. The KEK SPI is unique for every KEK for a given Group Member.
U32 cgmGdoiGmKekIndex	1.3.6.1.4.1.9.9.759.1.3.2.1.1	Unsigned32	not-accessible	The index of the GM KEK in table.The value of the index is a number which begins at one and is incremented with each KEK that is used by the GM for that GDOI group.
CGM cgmGdoiGmKekIpProtocol	1.3.6.1.4.1.9.9.759.1.3.2.1.11	CgmGdoiIpProtocolId	read-only	The value of the IP protocol ID (e.g. UDP/TCP) being used for the rekey datagram.
CGM cgmGdoiGmKekMgmtAlg	1.3.6.1.4.1.9.9.759.1.3.2.1.12	CgmGdoiKeyManagementAlgorithm	read-only	The value of the KEK_MANAGEMENT_ALGORITHM which specifies the group KEK management algorithm used to provide forward or backward access control (i.e. used to exclude group members). KEK Management Type Value ------------------- ----- RESERVED 0 LKH 1 RESERVED 2-127 Private Use 128-255
OID cgmGdoiGmKekOakleyGroup	1.3.6.1.4.1.9.9.759.1.3.2.1.18	CgmGdoiDiffieHellmanGroup	read-only	The value of the KE_OAKLEY_GROUP which specifies the OAKLEY or Diffie-Hellman Group used to compute the PFS secret in the optional KE payload of the GDOI GROUPKEY-PULL exchange.
U32 cgmGdoiGmKekOriginalLifetime	1.3.6.1.4.1.9.9.759.1.3.2.1.19	Unsigned32	read-only	The value of the KEK_KEY_LIFETIME which specifies the maximum time for which a KEK is valid. The GCKS may refresh the KEK at any time before the end of the valid period. The value is a four (4) octet (32-bit) number defining a valid time period in seconds.
U32 cgmGdoiGmKekRemainingLifetime	1.3.6.1.4.1.9.9.759.1.3.2.1.20	Unsigned32	read-only	The value of the remaining time for which a KEK is valid. The value is a four (4) octet (32-bit) number which begins at the value of cgmGdoiGmKekOriginalLifetime and counts down to 0 in seconds. If the lifetime has already expired, this value should remain at zero (0) until the GCKS refreshes the KEK.
CGM cgmGdoiGmKekSigAlg	1.3.6.1.4.1.9.9.759.1.3.2.1.16	CgmGdoiSignatureMethod	read-only	The value of the SIG_ALGORITHM which specifies the SIG payload signature algorithm. A GDOI implementation must support SIG_ALG_RSA. Following are the Signature Algorithm values defined in the GDOI RFC 3547, however the CgmGdoiSignatureMethod TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 SIG_ALG_RSA 1 SIG_ALG_DSS 2 SIG_ALG_ECDSS 3 RESERVED 4-127 Private Use 128-255
CGM cgmGdoiGmKekSigHashAlg	1.3.6.1.4.1.9.9.759.1.3.2.1.15	CgmGdoiPseudoRandomFunction	read-only	The value of the SIG_HASH_ALGORITHM which specifies the SIG payload hash algorithm. This is not required (i.e. could have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a value of zero or SIG_HASH_SHA1). Following are the Signature Hash Algorithm values defined in the GDOI RFC 3547, however the CgmGdoiPseudoRandomFunction TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 SIG_HASH_MD5 1 SIG_HASH_SHA1 2 RESERVED 3-127 Private Use 128-255
U32 cgmGdoiGmKekSigKeyLength	1.3.6.1.4.1.9.9.759.1.3.2.1.17	Unsigned32	read-only	The value of the SIG_KEY_LENGTH which specifies the length of the SIG payload key.
CGM cgmGdoiGmKekSPI	1.3.6.1.4.1.9.9.759.1.3.2.1.2	CgmGdoiKekSPI	read-only	The value of the Security Parameter Index (SPI) of a KEK SA. The SPI must be the ISAKMP Header cookie pair where the first 8 octets become the 'Initiator Cookie' field of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8 octets become the 'Responder Cookie' in the same HDR. As described above, these cookies are assigned by the GCKS.
U32 cgmGdoiGmKekSrcIdLength	1.3.6.1.4.1.9.9.759.1.3.2.1.4	Unsigned32	read-only	The length (i.e. number of octets) of the source ID of a KEK SA. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiGmKekSrcIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' field sent in the KEK payload.
CGM cgmGdoiGmKekSrcIdPort	1.3.6.1.4.1.9.9.759.1.3.2.1.6	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the source ID of a KEK SA. A value of zero means that the port should be ignored. This port value is sent as the `SRC ID Port` field of a KEK payload.
CGM cgmGdoiGmKekSrcIdType	1.3.6.1.4.1.9.9.759.1.3.2.1.3	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the source of a KEK SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'SRC ID Type' of the KEK payload.
CGM cgmGdoiGmKekSrcIdValue	1.3.6.1.4.1.9.9.759.1.3.2.1.5	CgmGdoiIdentificationValue	read-only	The value of the identity information for the source of a KEK SA with its type indicated by the cgmGdoiGmKekSrcIdType. Use the cgmGdoiGmKekSrcIdType to parse the KEK Source ID correctly. This ID value is sent as the 'SRC Identification Data' of a KEK payload.
CGM cgmGdoiGmKekStatus	1.3.6.1.4.1.9.9.759.1.3.2.1.21	CgmGdoiKekStatus	read-only	The status of the KEK SA. When this status value is queried, one of the following is returned: inUse(1), new(2), old(3).
cgmGdoiGmKekTable	1.3.6.1.4.1.9.9.759.1.3.2		not-accessible	A table of information regarding GDOI Key Encryption Key (KEK) Security Associations (SAs) currently installed for GDOI entities acting as Group Members on the network device being queried. There is one entry in this table for each KEK SA that has been installed and not yet deleted. Each KEK SA is uniquely identified by a SPI at any given time.
NTF cgmGdoiGmNoIpSecFlows	1.3.6.1.4.1.9.9.759.0.10			An error notification from a Group Member when no more security associations can be installed after receiving its keying & security association material. When the Group Member receives the security association materials, it has to install the cryptographic keys and policies. If there is not enough memory to install these materials, there will be an error thrown.
T/F cgmGdoiGmNoIpSecFlowsNotifEnable	1.3.6.1.4.1.9.9.759.1.4.10	TruthValue	read-only	Indicates whether or not an error notification should be generated on a Group Member when no more security associations can be installed after receiving a rekey from a Key Server in a GDOI group.
cgmGdoiGmNotificationGroup	1.3.6.1.4.1.9.9.759.2.1.8			This group contains the Group Member (GM) notifications for the GDOI MIB.
T/F cgmGdoiGmRegCompNotifEnable	1.3.6.1.4.1.9.9.759.1.4.6	TruthValue	read-only	Indicates whether or not a notification should be generated on a Group Member when it successfully registers to a Key Server in a GDOI group.
NTF cgmGdoiGmRegister	1.3.6.1.4.1.9.9.759.0.5			A notification from a Group Member when it is starting to register with its GDOI Group's Key Server. Registration includes downloading keying & security association material. This is equivalent to a Group Member or Initiator sending the first message of a GROUPKEY-PULL exchange to its Group's Key Server.
NTF cgmGdoiGmRegistrationComplete	1.3.6.1.4.1.9.9.759.0.6			A notification from a Group Member when it has successfully registered with a Key Server in its GDOI Group. This is equivalent to a Group Member receiving the last message of a GROUPKEY-PULL exchange from the Key Server containing KEKs, TEKs, and their associated policies.
U32 cgmGdoiGmRegKeyServerIdLength	1.3.6.1.4.1.9.9.759.1.2.2.1.5	Unsigned32	read-only	The length (i.e. number of octets) of the registered Key Server's ID. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiGmRegKeyServerIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiGmRegKeyServerIdType	1.3.6.1.4.1.9.9.759.1.2.2.1.4	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information of this Group Member's registered Key Server. RFC 4306 defines all valid types that can be used as an identifier. These identification types are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiGmRegKeyServerIdValue	1.3.6.1.4.1.9.9.759.1.2.2.1.6	CgmGdoiIdentificationValue	read-only	The value of the identity information for this Group Member's registered Key Server with its type indicated by the cgmGdoiGmRegKeyServerIdType. Use the cgmGdoiGmRegKeyServerIdType to parse the registered Key Server's ID correctly. This Key Server ID value is sent as the 'SRC Identification Data' and 'DST Identification Data' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
T/F cgmGdoiGMRegNotifEnable	1.3.6.1.4.1.9.9.759.1.4.5	TruthValue	read-only	Indicates whether or not a notification should be generated on a Group Member when it starts registration to a Key Server in a GDOI group.
T/F cgmGdoiGmRekeyFailNotifEnable	1.3.6.1.4.1.9.9.759.1.4.11	TruthValue	read-only	Indicates whether or not an error notification should be generated on a Group Member when it is unable to successfully process and install a rekey.
NTF cgmGdoiGmRekeyFailure	1.3.6.1.4.1.9.9.759.0.11			An error notification from a Group Member when it is unable to successfully process and install a rekey (GROUPKEY-PUSH message) sent by the Key Server in its Group that it is registered with.
NTF cgmGdoiGmRekeyReceived	1.3.6.1.4.1.9.9.759.0.8			A notification from a Group Member when it has successfully received and processed a rekey from a Key Server in its GDOI Group. Periodically the key server sends a rekey to refresh the keying & security association material. This is equivalent to a Group Member receiving a GROUPKEY-PUSH message from the Key Server of the Group it is already registered with.
T/F cgmGdoiGmRekeyRecNotifEnable	1.3.6.1.4.1.9.9.759.1.4.8	TruthValue	read-only	Indicates whether or not a notification should be generated on a Group Member when it receives and processes a rekey sent by a Key Server in a GDOI group.
C32 cgmGdoiGmRekeysReceived	1.3.6.1.4.1.9.9.759.1.2.2.1.8	Counter32	read-only	The sequence number of the last rekey successfully received from this Group Member's registered Key Server.
NTF cgmGdoiGmReRegister	1.3.6.1.4.1.9.9.759.0.7			A notification from a Group Member when it is starting to re-register with a Key Server in its GDOI Group. A Group Member needs to re-register to the key server if its keying & security association material has expired and it has not received a rekey from the key server to refresh the material. This is equivalent to a Group Member sending the first message of a GROUPKEY-PULL exchange to the Key Server of a Group it is already registered with.
T/F cgmGdoiGmReRegNotifEnable	1.3.6.1.4.1.9.9.759.1.4.7	TruthValue	read-only	Indicates whether or not a notification should be generated on a Group Member when it starts to re-register to a Key Server in a GDOI group.
cgmGdoiGmSecurityAssociationsGroup	1.3.6.1.4.1.9.9.759.2.1.5			This group consists of: 1) GDOI Group Member KEK Policy/SA Table 2) GDOI Group Member TEK Policy/SA Table
cgmGdoiGmTable	1.3.6.1.4.1.9.9.759.1.2.2		not-accessible	A table of information regarding GDOI Group Members (GMs) locally configured on the network device being queried. Note that Local Group Members may or may not be registered to a Key Server in its GDOI Group on the same network device being queried.
U32 cgmGdoiGmTekDstIdLength	1.3.6.1.4.1.9.9.759.1.3.5.1.7	Unsigned32	read-only	The length (i.e. number of octets) of the destination ID of a TEK Policy/SA. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiGmTekDstIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'DST ID Data Len' field sent in the TEK payload.
CGM cgmGdoiGmTekDstIdPort	1.3.6.1.4.1.9.9.759.1.3.5.1.9	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the dest. ID of a TEK Policy/SA. A value of zero means that the port should be ignored. This port value is sent as the `DST ID Port` field of a TEK payload.
CGM cgmGdoiGmTekDstIdType	1.3.6.1.4.1.9.9.759.1.3.5.1.6	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the dest. of a TEK Policy/SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'DST ID Type' of the TEK payload.
CGM cgmGdoiGmTekDstIdValue	1.3.6.1.4.1.9.9.759.1.3.5.1.8	CgmGdoiIdentificationValue	read-only	The value of the identity information for the destination of a TEK Policy/SA with its type indicated by the cgmGdoiGmTekDstIdType. Use the cgmGdoiGmTekDstIdType to parse the TEK Dest. ID correctly. This ID value is sent as the 'DST Identification Data' of a TEK payload.
CGM cgmGdoiGmTekEncapsulationMode	1.3.6.1.4.1.9.9.759.1.3.6.1.3	CgmGdoiEncapsulationMode	read-only	The value of the Encapsulation Mode of a TEK (IPsec SA). Following are the Encapsulation Mode values defined in RFC 2407, however the CgmGdoiEncapsulationMode TC defines all possible values. Encapsulation Mode Value ------------------ ----- RESERVED 0 Tunnel 1 Transport 2
CGM cgmGdoiGmTekEncryptionAlgorithm	1.3.6.1.4.1.9.9.759.1.3.6.1.4	CgmGdoiEncryptionAlgorithm	read-only	The value of the Transform ID field of a PROTO_IPSEC_ESP payload which specifies the ESP transform to be used. If no encryption is used, this value will be zero (0). Following are the ESP Transform values defined in RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all possible values. IPsec ESP Transform ID Value ------------------------ ----- RESERVED 0 ESP_DES_IV64 1 ESP_DES 2 ESP_3DES 3 ESP_RC5 4 ESP_IDEA 5 ESP_CAST 6 ESP_BLOWFISH 7 ESP_3IDEA 8 ESP_DES_IV32 9 ESP_RC4 10 ESP_NULL 11
U32 cgmGdoiGmTekEncryptionKeyLength	1.3.6.1.4.1.9.9.759.1.3.6.1.5	Unsigned32	read-only	The length of the key used for encryption in a TEK (in bits).
NUM cgmGdoiGmTekIntegrityAlgorithm	1.3.6.1.4.1.9.9.759.1.3.6.1.6	CgmGdoiIntegrityAlgorithm	read-only	The value of the Authentication Algorithm for a TEK IPsec ESP SA. If no authentication is used, this value will be zero (0). Following are the Authentication Algorithm values defined in RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all possible values. Algorithm Type Value -------------- ----- HMAC-MD5 1 HMAC-SHA 2 DES-MAC 3 KPDK 4
U32 cgmGdoiGmTekIntegrityKeyLength	1.3.6.1.4.1.9.9.759.1.3.6.1.7	Unsigned32	read-only	The length of the key used for integrity/authentication in a TEK (in bits).
U32 cgmGdoiGmTekOriginalLifetime	1.3.6.1.4.1.9.9.759.1.3.6.1.9	Unsigned32	read-only	The value of the SA Life Type defined in RFC 2407 which specifies the maximum time for which a TEK IPsec SA is valid. The GCKS may refresh the TEK at any time before the end of the valid period. The value is a four (4) octet (32-bit) number defining a valid time period in seconds.
cgmGdoiGmTekPolicyEntry	1.3.6.1.4.1.9.9.759.1.3.6.1		not-accessible	An entry containing the attributes associated with a GDOI TEK Policy/SA, uniquely identified by the Group ID, Group Member ID, TEK Selector (Source/Destination IDs & Ports), and TEK Policy index (TEK SPI and direction). There will be one or more TEK entries for each TEK Policy/SA received and installed by the given Group Member from its registered Key Server, each with a unique tuple. This table contains the SPI information corresponding to a TEK Selector index.
U32 cgmGdoiGmTekPolicyIndex	1.3.6.1.4.1.9.9.759.1.3.6.1.1	Unsigned32	not-accessible	The index of the SPI used to secure the GM TEK.The value of the index is a number which begins at one and is incremented with each row of the GM TEK SPI table.
cgmGdoiGmTekPolicyTable	1.3.6.1.4.1.9.9.759.1.3.6		not-accessible	A table of information regarding GDOI Traffic Encryption Key (TEK) Security Associations (SAs/Policies) received by a Key Server & installed for GDOI entities acting as Group Members (GMs) on the network device being queried. There is one entry in this table for each TEK SA that has been installed on the Group Member.
U32 cgmGdoiGmTekRemainingLifetime	1.3.6.1.4.1.9.9.759.1.3.6.1.10	Unsigned32	read-only	The value of the remaining time for which a TEK is valid. The value is a four (4) octet (32-bit) number which begins at the value of cgmGdoiGmTekOriginalLifetime and counts down to 0 in seconds. If the lifetime has already expired, this value should remain at zero (0) until the GCKS refreshes the TEK.
CGM cgmGdoiGmTekSecurityProtocol	1.3.6.1.4.1.9.9.759.1.3.5.1.10	CgmGdoiSecurityProtocol	read-only	The value of the Protocol-ID field of a SA TEK (SAT) payload which specifies the Security Protocol for a TEK. Following are the Security Protocol values defined in the GDOI RFC 3547, however the CgmGdoiSecurityProtocol TC defines all possible values. Protocol ID Value ---------------------- ----- RESERVED 0 GDOI_PROTO_IPSEC_ESP 1 RESERVED 2-127 Private Use 128-255
cgmGdoiGmTekSelectorEntry	1.3.6.1.4.1.9.9.759.1.3.5.1		not-accessible	An entry containing the attributes associated with a GDOI TEK Policy/SA, uniquely identified by the Group ID, Group Member ID, Source/Destination IDs & Ports, and TEK SPI. There will be one or more TEK entries for each TEK Policy/SA received and installed by the given Group Member from its registered Key Server, each with a unique 5-tuple. This table does not contain the SPI which is part of the TEK policy table.
U32 cgmGdoiGmTekSelectorIndex	1.3.6.1.4.1.9.9.759.1.3.5.1.1	Unsigned32	not-accessible	The index of the Source/Destination pair secured by the GM TEK.The value of the index is a number which begins at one and is incremented with each Source/Destination pair that is secured by the GM TEK policy for that GDOI group.
cgmGdoiGmTekSelectorTable	1.3.6.1.4.1.9.9.759.1.3.5		not-accessible	A table of information regarding GDOI Traffic Encryption Key (TEK) Security Associations (SAs/Policies) pushed by a Key Server & installed for GDOI entities acting as Group Members (GMs) on the network device being queried. There is one entry in this table for each unique TEK traffic selector (Source/Destination tuple) that has been downloaded from the Key Server and installed on the Group Member.
CGM cgmGdoiGmTekSPI	1.3.6.1.4.1.9.9.759.1.3.6.1.2	CgmGdoiTekSPI	read-only	The value of the Security Parameter Index (SPI) of a TEK Policy/SA. The SPI must be the SPI for ESP.
U32 cgmGdoiGmTekSrcIdLength	1.3.6.1.4.1.9.9.759.1.3.5.1.3	Unsigned32	read-only	The length (i.e. number of octets) of the source ID of a TEK Policy/SA. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiGmTekSrcIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' field sent in the TEK payload.
CGM cgmGdoiGmTekSrcIdPort	1.3.6.1.4.1.9.9.759.1.3.5.1.5	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the source ID of a TEK Policy/SA. A value of zero means that the port should be ignored. This port value is sent as the `SRC ID Port` field of a TEK payload.
CGM cgmGdoiGmTekSrcIdType	1.3.6.1.4.1.9.9.759.1.3.5.1.2	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the source of a TEK Policy/SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'SRC ID Type' of the TEK payload.
CGM cgmGdoiGmTekSrcIdValue	1.3.6.1.4.1.9.9.759.1.3.5.1.4	CgmGdoiIdentificationValue	read-only	The value of the identity information for the source of a TEK Policy/SA with its type indicated by the cgmGdoiGmTekSrcIdType. Use the cgmGdoiGmTekSrcIdType to parse the TEK Source ID correctly. This ID value is sent as the 'SRC Identification Data' of a TEK payload.
CGM cgmGdoiGmTekStatus	1.3.6.1.4.1.9.9.759.1.3.6.1.11	CgmGdoiTekStatus	read-only	The status of the TEK Policy/SA. When this status value is queried, one of the following is returned: inbound(1), outbound(2), notInUse(3).
U32 cgmGdoiGmTekWindowSize	1.3.6.1.4.1.9.9.759.1.3.6.1.8	Unsigned32	read-only	The size of the Time Based Anti-Replay (TBAR) window used by this TEK Policy/SA.
U32 cgmGdoiGroupActivePeerKeyServerCount	1.3.6.1.4.1.9.9.759.1.1.1.6	Unsigned32	read-only	The count of the active Key Server sessions between the local Key Server and peer Key Servers for this group.
cgmGdoiGroupEntry	1.3.6.1.4.1.9.9.759.1.1.1		not-accessible	An entry containing GDOI Group information, uniquely identified by the GDOI Group ID.
cgmGdoiGroupIdGroup	1.3.6.1.4.1.9.9.759.2.1.1			This group consists of: 1) GDOI Group Table cgmGdoiGroupIdGroupRev1 is an extension to this group.
cgmGdoiGroupIdGroupRev1	1.3.6.1.4.1.9.9.759.2.1.11			This group consists of: 1) GDOI Group Table This group is an extension to cgmGdoiGroupIdGroup.
U32 cgmGdoiGroupIdLength	1.3.6.1.4.1.9.9.759.1.1.1.2	Unsigned32	read-only	The length (i.e. number of octets) of a Group ID. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiGroupIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'Payload Length' (subtracting the generic header length) of the Identification Payload for a GDOI GROUPKEY-PULL exchange.
CGM cgmGdoiGroupIdType	1.3.6.1.4.1.9.9.759.1.1.1.1	CgmGdoiIdentificationType	not-accessible	The Identification Type Value used to parse a GDOI Group ID. The GDOI RFC 3547 defines the types that can be used as a GDOI Group ID, and RFC 4306 defines all valid types that can be used as an identifier. This Group ID type is sent as the 'ID Type' field of the Identification Payload for a GDOI GROUPKEY-PULL exchange.
CGM cgmGdoiGroupIdValue	1.3.6.1.4.1.9.9.759.1.1.1.3	CgmGdoiIdentificationValue	not-accessible	The value of a Group ID with its type indicated by the cgmGdoiGroupIdType. Use the cgmGdoiGroupIdType to parse the Group ID correctly. This Group ID value is sent as the 'Identification Data' field of the Identification Payload for a GDOI GROUPKEY-PULL exchange.
U32 cgmGdoiGroupLastRekeyRetransmits	1.3.6.1.4.1.9.9.759.1.1.1.7	Unsigned32	read-only	This variable returns the cummulative count of number of rekey messages and retransmits during the last cycle of rekey. This count displays the information pertaining to Group Members only (and is not related to any sync operation pertaining to peer Key Servers). This information is a reflection of rekey operation on a Primary Key Server, and is not available for Secondary Key Server(s), because they do not perform rekeys and do not receive any ACKs. While a rekey is in progress, this variable will give information of the last rekey operation.
CIS cgmGdoiGroupLastRekeyTimeTaken	1.3.6.1.4.1.9.9.759.1.1.1.8	CiscoMilliSeconds	read-only	This variable returns the duration (in milliseconds) of the last rekey operation. This information is valid for a Primary Key Server, and is not available with Secondary Key Server(s), because they do not perform rekeys and do not receive any ACKs. While a rekey is in progress, this variable will give information of the last rekey operation.
U32 cgmGdoiGroupMemberCount	1.3.6.1.4.1.9.9.759.1.1.1.5	Unsigned32	read-only	The count of registered Group Members to this group, on a Key Server.
STR cgmGdoiGroupName	1.3.6.1.4.1.9.9.759.1.1.1.4	DisplayString	read-only	The string-readable name configured for or given to a GDOI Group.
cgmGdoiGroupTable	1.3.6.1.4.1.9.9.759.1.1		not-accessible	A table of information regarding GDOI Groups in use on the network device being queried.
CGM cgmGdoiKeyServerActiveKEK	1.3.6.1.4.1.9.9.759.1.2.1.1.4	CgmGdoiKekSPI	read-only	The SPI of the Key Encryption Key (KEK) that is currently being used by the Key Server to encrypt the GROUPKEY-PUSH keying & security association material sent to the Key Server's registered Group Members.
cgmGdoiKeyServerEntry	1.3.6.1.4.1.9.9.759.1.2.1.1		not-accessible	An entry containing GDOI Key Server (KS) information, uniquely identified by the Group & Key Server IDs.
cgmGdoiKeyServerErrorNotificationGroup	1.3.6.1.4.1.9.9.759.2.1.7			This group contains the Key Server (GCKS) error notifications for the GDOI MIB.
NTF cgmGdoiKeyServerGmDeleted	1.3.6.1.4.1.9.9.759.0.13			This notification is generated when a Group Member is deleted from a Key Server. The varbinds encapsulate the Group information, the Key Server identifier and the Group Member identifier which is deleted.
cgmGdoiKeyServerGroup	1.3.6.1.4.1.9.9.759.2.1.2			This group consists of: 1) GDOI Key Server Table cgmGdoiKeyServerGroupRev1 is an extension to this group.
cgmGdoiKeyServerGroupRev1	1.3.6.1.4.1.9.9.759.2.1.12			This group consists of: 1) GDOI Key Server Table This group is an extension to cgmGdoiKeyServerGroup.
U32 cgmGdoiKeyServerIdLength	1.3.6.1.4.1.9.9.759.1.2.1.1.2	Unsigned32	read-only	The length (i.e. number of octets) of a Key Server ID. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiKeyServerIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiKeyServerIdType	1.3.6.1.4.1.9.9.759.1.2.1.1.1	CgmGdoiIdentificationType	not-accessible	The Identification Type Value used to parse the identity information for a Key Server. RFC 4306 defines all valid types that can be used as an identifier. These identification types are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
CGM cgmGdoiKeyServerIdValue	1.3.6.1.4.1.9.9.759.1.2.1.1.3	CgmGdoiIdentificationValue	not-accessible	The value of the identity information for a Key Server with its type indicated by the cgmGdoiKeyServerIdType. Use the cgmGdoiKeyServerIdType to parse the Key Server ID correctly. This Key Server ID value is sent as the 'SRC Identification Data' and 'DST Identification Data' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges.
NTF cgmGdoiKeyServerNewRegistration	1.3.6.1.4.1.9.9.759.0.1			A notification from a Key Server sent when a new Group Member registers to a GDOI Group. This is equivalent to a Key Server receiving the first message of a GROUPKEY-PULL exchange from a Group Member.
NTF cgmGdoiKeyServerNoRsaKeys	1.3.6.1.4.1.9.9.759.0.4			An error notification from a Key Server sent when an RSA key is not setup. Each Key Server and Group Member needs to have an RSA key established. The Key Server signs the TEK rekeys using this RSA key, also called a Key Encryption Key (KEK). The Group Member verifies the authenticity of the TEK rekey using this RSA key.
cgmGdoiKeyServerNotificationGroup	1.3.6.1.4.1.9.9.759.2.1.6			This group contains the Key Server (GCKS) notifications for the GDOI MIB. cgmGdoiKeyServerNotificationGroupRev1 is an extension to this group.
cgmGdoiKeyServerNotificationGroupRev1	1.3.6.1.4.1.9.9.759.2.1.14			This group contains the Key Server (GCKS) notifications for the GDOI MIB. This group is an extension to cgmGdoiKeyServerNotificationGroup.
NTF cgmGdoiKeyServerPeerReachable	1.3.6.1.4.1.9.9.759.0.14			This notification is generated from a Key Server when an unreachable peer Key Server becomes reachable. The varbinds encapsulate the Group information, the Key Server identifier and the peer Key Server identifier.
NTF cgmGdoiKeyServerPeerUnreachable	1.3.6.1.4.1.9.9.759.0.15			This notification is generated from a Key Server when a reachable peer Key Server becomes unreachable. The varbinds encapsulate the Group information, the Key Server identifier and the peer Key Server identifier.
U32 cgmGdoiKeyServerRegisteredGMs	1.3.6.1.4.1.9.9.759.1.2.1.1.7	Unsigned32	read-only	The count of registered Group Members to the Key Server identified by the index.
NTF cgmGdoiKeyServerRegistrationComplete	1.3.6.1.4.1.9.9.759.0.2			A notification from a Key Server sent when a Group Member has successfully registered to itself. This is equivalent to a Key Server sending the last message of a GROUPKEY-PULL exchange to the Group Member currently registering containing KEKs, TEKs, and their associated policies.
NTF cgmGdoiKeyServerRekeyPushed	1.3.6.1.4.1.9.9.759.0.3			A notification from a Key Server sent when a GROUPKEY-PUSH message is sent to refresh KEK(s) and or TEK(s). A rekey is sent periodically by a Key Server based on a configured time to the Group Members registered to its GDOI Group.
C32 cgmGdoiKeyServerRekeysPushedEx	1.3.6.1.4.1.9.9.759.1.2.1.1.5	Counter32	read-only	The sequence number of the last rekey sent from the Key Server to its registered Group Members for this GDOI group.
CGM cgmGdoiKeyServerRole	1.3.6.1.4.1.9.9.759.1.2.1.1.6	CgmGdoiKsRole	read-only	The current role of the queried Key Server for the Group.
NTF cgmGdoiKeyServerRoleChange	1.3.6.1.4.1.9.9.759.0.12			This notification is generated when a Key Server changes it's role from Primary to Secondary or vice-versa. The varbinds encapsulate the Group information, the Key Server identifier and the role it has moved to.
cgmGdoiKeyServerTable	1.3.6.1.4.1.9.9.759.1.2.1		not-accessible	A table of information for the GDOI group from the perspective of the Key Servers (GCKSs) on the network device being queried.
T/F cgmGdoiKsGmDeletedNotifEnable	1.3.6.1.4.1.9.9.759.1.4.13	TruthValue	read-only	Indicates whether or not cgmGdoiKeyServerGmDeleted notification should be generated on a Key Server when a Group Member is deleted from the group database.
U32 cgmGdoiKsKekDstIdLength	1.3.6.1.4.1.9.9.759.1.3.1.1.8	Unsigned32	read-only	The length (i.e. number of octets) of the destination ID of a KEK Policy/SA (multicast rekey address). If no length is given (i.e. it has a valueof 0), the default length of its cgmGdoiKsKekDstIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'DST ID Data Len' field sent in the KEK payload.
CGM cgmGdoiKsKekDstIdPort	1.3.6.1.4.1.9.9.759.1.3.1.1.10	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the dest. ID of a KEK Policy/SA. A value of zero means that the port should be ignored. This port value is sent as the `DST ID Port` field of a KEK payload.
CGM cgmGdoiKsKekDstIdType	1.3.6.1.4.1.9.9.759.1.3.1.1.7	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the dest. of a KEK Policy/SA (multicast rekey address). RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'DST ID Type' of the KEK payload.
CGM cgmGdoiKsKekDstIdValue	1.3.6.1.4.1.9.9.759.1.3.1.1.9	CgmGdoiIdentificationValue	read-only	The value of the identity information for the destination of a KEK Policy/SA (multicast rekey address) with its type indicated by the cgmGdoiKsKekDstIdType. Use the cgmGdoiKsKekDstIdType to parse the KEK Dest. ID correctly. This ID value is sent as the 'DST Identification Data' of a KEK payload.
CGM cgmGdoiKsKekEncryptAlg	1.3.6.1.4.1.9.9.759.1.3.1.1.13	CgmGdoiEncryptionAlgorithm	read-only	The value of the KEK_ALGORITHM which specifies the encryption algorithm used with the KEK Policy/SA. A GDOI implementaiton must support KEK_ALG_3DES. Following are the KEK encryption algoritm values defined in the GDOI RFC 3547, however the CgmGdoiEncryptionAlgorithm TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 KEK_ALG_DES 1 KEK_ALG_3DES 2 KEK_ALG_AES 3 RESERVED 4-127 Private Use 128-255
U32 cgmGdoiKsKekEncryptKeyLength	1.3.6.1.4.1.9.9.759.1.3.1.1.14	Unsigned32	read-only	The value of the KEK_KEY_LENGTH which specifies the KEK Algorithm key length (in bits).
cgmGdoiKsKekEntry	1.3.6.1.4.1.9.9.759.1.3.1.1		not-accessible	An entry containing the attributes associated with a GDOI KEK Policy/SA, uniquely identified by the Group ID, Key Server ID, & SPI value assigned by the given Key Server to the KEK. There will be at least one KEK Policy/SA entry for each Key Server & two KEK Policy/SA entries for a given Key Server only during a KEK rekey when a new KEK is created/installed. The KEK SPI is unique for every KEK for a given Key Server.
U32 cgmGdoiKsKekIndex	1.3.6.1.4.1.9.9.759.1.3.1.1.1	Unsigned32	not-accessible	The index of the KS KEK.The value of the index is a number which begins at one and is incremented with each KS KEK that is to be created by the KS for that GDOI group.
CGM cgmGdoiKsKekIpProtocol	1.3.6.1.4.1.9.9.759.1.3.1.1.11	CgmGdoiIpProtocolId	read-only	The value of the IP protocol ID (e.g. UDP/TCP) being used for the rekey datagram.
CGM cgmGdoiKsKekMgmtAlg	1.3.6.1.4.1.9.9.759.1.3.1.1.12	CgmGdoiKeyManagementAlgorithm	read-only	The value of the KEK_MANAGEMENT_ALGORITHM which specifies the group KEK management algorithm used to provide forward or backward access control (i.e. used to exclude group members). KEK Management Type Value ------------------- ----- RESERVED 0 LKH 1 RESERVED 2-127 Private Use 128-255
OID cgmGdoiKsKekOakleyGroup	1.3.6.1.4.1.9.9.759.1.3.1.1.18	CgmGdoiDiffieHellmanGroup	read-only	The value of the KE_OAKLEY_GROUP which specifies the OAKLEY or Diffie-Hellman Group used to compute the PFS secret in the optional KE payload of the GDOI GROUPKEY-PULL exchange.
U32 cgmGdoiKsKekOriginalLifetime	1.3.6.1.4.1.9.9.759.1.3.1.1.19	Unsigned32	read-only	The value of the KEK_KEY_LIFETIME which specifies the maximum time for which a KEK is valid. The GCKS may refresh the KEK at any time before the end of the valid period. The value is a four (4) octet (32-bit) number defining a valid time period in seconds.
U32 cgmGdoiKsKekRemainingLifetime	1.3.6.1.4.1.9.9.759.1.3.1.1.20	Unsigned32	read-only	The value of the remaining time for which a KEK is valid. The value is a four (4) octet (32-bit) number which begins at the value of cgmGdoiKsKekOriginalLifetime when the KEK is sent and counts down to zero in seconds. If the lifetime has already expired, this value should remain at zero (0) until the Key Server refreshes the KEK.
CGM cgmGdoiKsKekSigAlg	1.3.6.1.4.1.9.9.759.1.3.1.1.16	CgmGdoiSignatureMethod	read-only	The value of the SIG_ALGORITHM which specifies the SIG payload signature algorithm. A GDOI implementation must support SIG_ALG_RSA. Following are the Signature Algorithm values defined in the GDOI RFC 3547, however the CgmGdoiSignatureMethod TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 SIG_ALG_RSA 1 SIG_ALG_DSS 2 SIG_ALG_ECDSS 3 RESERVED 4-127 Private Use 128-255
CGM cgmGdoiKsKekSigHashAlg	1.3.6.1.4.1.9.9.759.1.3.1.1.15	CgmGdoiPseudoRandomFunction	read-only	The value of the SIG_HASH_ALGORITHM which specifies the SIG payload hash algorithm. This is not required (i.e. could have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a value of zero or SIG_HASH_SHA1). Following are the Signature Hash Algorithm values defined in the GDOI RFC 3547, however the CgmGdoiPseudoRandomFunction TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 SIG_HASH_MD5 1 SIG_HASH_SHA1 2 RESERVED 3-127 Private Use 128-255
U32 cgmGdoiKsKekSigKeyLength	1.3.6.1.4.1.9.9.759.1.3.1.1.17	Unsigned32	read-only	The value of the SIG_KEY_LENGTH which specifies the length of the SIG payload key.
CGM cgmGdoiKsKekSPI	1.3.6.1.4.1.9.9.759.1.3.1.1.2	CgmGdoiKekSPI	read-only	The value of the Security Parameter Index (SPI) of a KEK Policy/SA. The SPI must be the ISAKMP Header cookie pair where the first 8 octets become the 'Initiator Cookie' field of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8 octets become the 'Responder Cookie' in the same HDR. As described above, these cookies are assigned by the GCKS.
U32 cgmGdoiKsKekSrcIdLength	1.3.6.1.4.1.9.9.759.1.3.1.1.4	Unsigned32	read-only	The length (i.e. number of octets) of the source ID of a KEK Policy/SA. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiKsKekSrcIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' field sent in the KEK payload.
CGM cgmGdoiKsKekSrcIdPort	1.3.6.1.4.1.9.9.759.1.3.1.1.6	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the source ID of a KEK Policy/SA. A value of zero means that the port should be ignored. This port value is sent as the `SRC ID Port` field of a KEK payload.
CGM cgmGdoiKsKekSrcIdType	1.3.6.1.4.1.9.9.759.1.3.1.1.3	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the source of a KEK Policy/SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'SRC ID Type' of the KEK payload.
CGM cgmGdoiKsKekSrcIdValue	1.3.6.1.4.1.9.9.759.1.3.1.1.5	CgmGdoiIdentificationValue	read-only	The value of the identity information for the source of a KEK Policy/SA with its type indicated by the cgmGdoiKsKekSrcIdType. Use the cgmGdoiKsKekSrcIdType to parse the KEK Source ID correctly. This ID value is sent as the 'SRC Identification Data' of a KEK payload.
CGM cgmGdoiKsKekStatus	1.3.6.1.4.1.9.9.759.1.3.1.1.21	CgmGdoiKekStatus	read-only	The status of the KEK Policy/SA. When this status value is queried, one of the following is returned: inUse(1), new(2), old(3).
cgmGdoiKsKekTable	1.3.6.1.4.1.9.9.759.1.3.1		not-accessible	A table of information regarding GDOI Key Encryption Key (KEK) Policies & Security Associations (SAs) currently configured/installed for GDOI entities acting as Key Servers on the network device being queried. There is one entry in this table for each KEK Policy/SA that has been configured/installed. Each KEK Policy/SA is uniquely identified by a SPI at any given time.
T/F cgmGdoiKSNewRegNotifEnable	1.3.6.1.4.1.9.9.759.1.4.1	TruthValue	read-write	Indicates whether or not a notification should be generated on a Key Server when a new Group Member begins registration to a GDOI group.
T/F cgmGdoiKSNoRSANotifEnable	1.3.6.1.4.1.9.9.759.1.4.4	TruthValue	read-write	Indicates whether or not an error notification should be generated on a Key Server when an RSA key is not set up.
T/F cgmGdoiKsPeerReachNotifEnable	1.3.6.1.4.1.9.9.759.1.4.14	TruthValue	read-only	Indicates whether or not cgmGdoiKeyServerPeerReachable notification should be generated on a Key Server when unreachable peer Key Server becomes reachable.
T/F cgmGdoiKsPeerUnreachNotifEnable	1.3.6.1.4.1.9.9.759.1.4.15	TruthValue	read-only	Indicates whether or not cgmGdoiKeyServerPeerUnreachable notification should be generated on a Key Server when reachable peer Key Server becomes unreachable.
T/F cgmGdoiKSRegCompNotifEnable	1.3.6.1.4.1.9.9.759.1.4.2	TruthValue	read-write	Indicates whether or not a notification should be generated on a Key Server when a new Group Member successfully registers to a GDOI group.
T/F cgmGdoiKSRekeyPushNotifEnable	1.3.6.1.4.1.9.9.759.1.4.3	TruthValue	read-write	Indicates whether or not a notification should be generated on a Key Server when a rekey is sent to a GDOI group.
T/F cgmGdoiKsRoleChangeNotifEnable	1.3.6.1.4.1.9.9.759.1.4.12	TruthValue	read-only	Indicates whether or not cgmGdoiKeyServerRoleChange notification should be generated on a Key Server when its role changes from Primary to Secondary or vice-versa.
cgmGdoiKsSecurityAssociationsGroup	1.3.6.1.4.1.9.9.759.2.1.4			This group consists of: 1) GDOI Key Server KEK Policy/SA Table 2) GDOI Key Server TEK Policy Table
U32 cgmGdoiKsTekDstIdLength	1.3.6.1.4.1.9.9.759.1.3.3.1.7	Unsigned32	read-only	The length (i.e. number of octets) of the destination ID of a TEK Policy. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiKsTekDstIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'DST ID Data Len' field sent in the TEK payload.
CGM cgmGdoiKsTekDstIdPort	1.3.6.1.4.1.9.9.759.1.3.3.1.9	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the dest. ID of a TEK Policy. A value of zero means that the port should be ignored. This port value is sent as the `DST ID Port` field of a TEK payload.
CGM cgmGdoiKsTekDstIdType	1.3.6.1.4.1.9.9.759.1.3.3.1.6	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the dest. of a TEK Policy. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'DST ID Type' of the TEK payload.
CGM cgmGdoiKsTekDstIdValue	1.3.6.1.4.1.9.9.759.1.3.3.1.8	CgmGdoiIdentificationValue	read-only	The value of the identity information for the destination of a TEK Policy with its type indicated by the cgmGdoiKsTekDstIdType. Use the cgmGdoiKsTekDstIdType to parse the TEK Dest. ID correctly. This ID value is sent as the 'DST Identification Data' of a TEK payload.
CGM cgmGdoiKsTekEncapsulationMode	1.3.6.1.4.1.9.9.759.1.3.4.1.3	CgmGdoiEncapsulationMode	read-only	The value of the Encapsulation Mode of a TEK (IPsec SA). Following are the Encapsulation Mode values defined in RFC 2407, however the CgmGdoiEncapsulationMode TC defines all possible values. Encapsulation Mode Value ------------------ ----- RESERVED 0 Tunnel 1 Transport 2
CGM cgmGdoiKsTekEncryptionAlgorithm	1.3.6.1.4.1.9.9.759.1.3.4.1.4	CgmGdoiEncryptionAlgorithm	read-only	The value of the Transform ID field of a PROTO_IPSEC_ESP payload which specifies the ESP transform to be used. If no encryption is used, this value will be zero (0). Following are the ESP Transform values defined in RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all possible values. IPsec ESP Transform ID Value ------------------------ ----- RESERVED 0 ESP_DES_IV64 1 ESP_DES 2 ESP_3DES 3 ESP_RC5 4 ESP_IDEA 5 ESP_CAST 6 ESP_BLOWFISH 7 ESP_3IDEA 8 ESP_DES_IV32 9 ESP_RC4 10 ESP_NULL 11
U32 cgmGdoiKsTekEncryptionKeyLength	1.3.6.1.4.1.9.9.759.1.3.4.1.5	Unsigned32	read-only	The length of the key used for encryption in a TEK (in bits).
NUM cgmGdoiKsTekIntegrityAlgorithm	1.3.6.1.4.1.9.9.759.1.3.4.1.6	CgmGdoiIntegrityAlgorithm	read-only	The value of the Authentication Algorithm for a TEK IPsec ESP SA. If no authentication is used, this value will be zero (0). Following are the Authentication Algorithm values defined in RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all possible values. Algorithm Type Value -------------- ----- HMAC-MD5 1 HMAC-SHA 2 DES-MAC 3 KPDK 4
U32 cgmGdoiKsTekIntegrityKeyLength	1.3.6.1.4.1.9.9.759.1.3.4.1.7	Unsigned32	read-only	The length of the key used for integrity/authentication in a TEK (in bits).
U32 cgmGdoiKsTekOriginalLifetime	1.3.6.1.4.1.9.9.759.1.3.4.1.9	Unsigned32	read-only	The value of the SA Life Type defined in RFC 2407 which specifies the maximum time for which a TEK IPsec SA is valid. The GCKS may refresh the TEK at any time before the end of the valid period. The value is a four (4) octet (32-bit) number defining a valid time period in seconds.
cgmGdoiKsTekPolicyEntry	1.3.6.1.4.1.9.9.759.1.3.4.1		not-accessible	An entry containing the attributes associated with a GDOI TEK Policy, uniquely identified by the Group ID, Key Server ID, TEK Selector Index (Source/Destination IDs & Ports), and TEK Policy Index (TEK SPI and direction). There will be one or more TEK entries for each TEK Policy sent by the given Key Server to its registered Group Members, each with a unique 5-tuple.
U32 cgmGdoiKsTekPolicyIndex	1.3.6.1.4.1.9.9.759.1.3.4.1.1	Unsigned32	not-accessible	The index of the policy that is used to secure the KS TEK. The value of the index is a number which begins at one and is incremented with each row in this table.
cgmGdoiKsTekPolicyTable	1.3.6.1.4.1.9.9.759.1.3.4		not-accessible	A table of information regarding GDOI Traffic Encryption Key (TEK) Policies currently configured/pushed for GDOI entities acting as Key Servers on the network device being queried. There is one entry in this table for each TEK that has been configured & pushed to Group Members registered to the given Key Server.
U32 cgmGdoiKsTekRemainingLifetime	1.3.6.1.4.1.9.9.759.1.3.4.1.10	Unsigned32	read-only	The value of the remaining time for which a TEK is valid. The value is a four (4) octet (32-bit) number which begins at the value of cgmGdoiKsTekOriginalLifetime when the TEK is sent and counts down to zero in seconds. If the lifetime has already expired, this value should remain at zero (0) until the Key Server refreshes the TEK.
CGM cgmGdoiKsTekSecurityProtocol	1.3.6.1.4.1.9.9.759.1.3.3.1.10	CgmGdoiSecurityProtocol	read-only	The value of the Protocol-ID field of a SA TEK (SAT) payload which specifies the Security Protocol for a TEK. Following are the Security Protocol values defined in the GDOI RFC 3547, however the CgmGdoiSecurityProtocol TC defines all possible values. Protocol ID Value ---------------------- ----- RESERVED 0 GDOI_PROTO_IPSEC_ESP 1 RESERVED 2-127 Private Use 128-255
cgmGdoiKsTekSelectorEntry	1.3.6.1.4.1.9.9.759.1.3.3.1		not-accessible	An entry containing the Source/Destination attributes associated with a GDOI TEK Policy, uniquely identified by the Group ID, Key Server ID and TEK Selector index. There will be one entry for each Source/Destination Policy sent by the given Key Server to its registered Group Members, each with a unique 5-tuple. However, due to the 255-octet constraint placed on an OID, the 4-tuple cannot be used to INDEX a TEK entry for a given Group ID & Key Server ID. Therefore, the TEK Selector index for a given Group ID & Key Server ID MUST be unique. The TEK SPI is part of the TEK Policy Table.
U32 cgmGdoiKsTekSelectorIndex	1.3.6.1.4.1.9.9.759.1.3.3.1.1	Unsigned32	not-accessible	The index of the Source/Destination tuple to be secured by the KS TEK.The value of the index is a number which begins at one and is incremented with each Source/Destination pair that is to be secured by the KS TEK policy for that GDOI group.
cgmGdoiKsTekSelectorTable	1.3.6.1.4.1.9.9.759.1.3.3		not-accessible	A table of information regarding GDOI Traffic Encryption Key (TEK) Selectors (source, destination, protocol information) that is currently configured/pushed for GDOI entities acting as Key Servers on the network device being queried. There is one entry in this table for each TEK that has been configured & pushed to Group Members registered to the given Key Server.
CGM cgmGdoiKsTekSPI	1.3.6.1.4.1.9.9.759.1.3.4.1.2	CgmGdoiTekSPI	read-only	The value of the Security Parameter Index (SPI) of a TEK Policy. The SPI must be the SPI for ESP.
U32 cgmGdoiKsTekSrcIdLength	1.3.6.1.4.1.9.9.759.1.3.3.1.3	Unsigned32	read-only	The length (i.e. number of octets) of the source ID of a TEK Policy. If no length is given (i.e. it has a value of 0), the default length of its cgmGdoiKsTekSrcIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' field sent in the TEK payload.
CGM cgmGdoiKsTekSrcIdPort	1.3.6.1.4.1.9.9.759.1.3.3.1.5	CgmGdoiUnsigned16	read-only	The value specifying a port associated with the source ID of a TEK Policy. A value of zero means that the port should be ignored. This port value is sent as the `SRC ID Port` field of a TEK payload.
CGM cgmGdoiKsTekSrcIdType	1.3.6.1.4.1.9.9.759.1.3.3.1.2	CgmGdoiIdentificationType	read-only	The Identification Type Value used to parse the identity information for the source of a TEK Policy. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'SRC ID Type' of the TEK payload.
CGM cgmGdoiKsTekSrcIdValue	1.3.6.1.4.1.9.9.759.1.3.3.1.4	CgmGdoiIdentificationValue	read-only	The value of the identity information for the source of a TEK Policy with its type indicated by the cgmGdoiKsTekSrcIdType. Use the cgmGdoiKsTekSrcIdType to parse the TEK Source ID correctly. This ID value is sent as the 'SRC Identification Data' of a TEK payload.
CGM cgmGdoiKsTekStatus	1.3.6.1.4.1.9.9.759.1.3.4.1.11	CgmGdoiTekStatus	read-only	The status of the TEK Policy. When this status value is queried, one of the following is returned: inbound(1), outbound(2), notInUse(3).
U32 cgmGdoiKsTekWindowSize	1.3.6.1.4.1.9.9.759.1.3.4.1.8	Unsigned32	read-only	The size of the Time Based Anti-Replay (TBAR) window used by this TEK Policy.
cgmGdoiMIBCompliance	1.3.6.1.4.1.9.9.759.2.2.1			At minimum, only GDOI Group Member functionality is required so only objects associated with and needed by Group Members are mandatory to implement. If Key Server functionality is also implemented, all other objects will need to be implemented as well. This group is deprecated and is superseeded by cgmGdoiMIBCompliance1.
cgmGdoiMIBComplianceRev1	1.3.6.1.4.1.9.9.759.2.2.2			At minimum, only GDOI Group Member functionality is required so only objects associated with and needed by Group Members are mandatory to implement. If Key Server functionality is also implemented, all other objects will need to be implemented as well. Updated the conformance group with new MIB Groups and objects with min-access as read-only.
cgmGdoiMIBCompliances	1.3.6.1.4.1.9.9.759.2.2
cgmGdoiMIBConformance	1.3.6.1.4.1.9.9.759.2
cgmGdoiMIBGroups	1.3.6.1.4.1.9.9.759.2.1
cgmGdoiMIBNotifications	1.3.6.1.4.1.9.9.759.0
cgmGdoiMIBObjects	1.3.6.1.4.1.9.9.759.1
cgmGdoiNotifCntl	1.3.6.1.4.1.9.9.759.1.4
CGM cgmGdoiNotifGmIdType	1.3.6.1.4.1.9.9.759.1.5.7	CgmGdoiIdentificationType	accessible-for-notify	Variable used only for notifications. The Identification Type Value used to parse the identity information for a Initiator or Group Member.
CGM cgmGdoiNotifGmIdValue	1.3.6.1.4.1.9.9.759.1.5.8	CgmGdoiIdentificationValue	accessible-for-notify	Variable used only for notifications. The value of the identity information for a Group Member with its type indicated by the cgmGdoiNotifGmIdType. Use the cgmGdoiNotifGmIdType to parse the Group Member ID's value correctly.
CGM cgmGdoiNotifGroupIdType	1.3.6.1.4.1.9.9.759.1.5.1	CgmGdoiIdentificationType	accessible-for-notify	Variable used only for notifications. This variable captures the identification type of the GDOI group.
CGM cgmGdoiNotifGroupIdValue	1.3.6.1.4.1.9.9.759.1.5.2	CgmGdoiIdentificationValue	accessible-for-notify	Variable used only for notifications. The value of a Group ID with its type indicated by the cgmGdoiNotifGroupIdType. Use the cgmGdoiNotifGroupIdType to parse the value of this field correctly.
STR cgmGdoiNotifGroupName	1.3.6.1.4.1.9.9.759.1.5.3	DisplayString	accessible-for-notify	Variable used only for notifications. The string-readable name configured for or given to a GDOI Group.
cgmGdoiNotificationControlGroup	1.3.6.1.4.1.9.9.759.2.1.10			This group contains the GDOI notification control objects for the GDOI MIB. cgmGdoiNotificationControlGroupRev1 is an extension to this group.
cgmGdoiNotificationControlGroupRev1	1.3.6.1.4.1.9.9.759.2.1.15			This group contains the GDOI notification control objects for the GDOI MIB. This group is an extension to cgmGdoiNotificationControlGroup.
cgmGdoiNotificationVariablesGroup	1.3.6.1.4.1.9.9.759.2.1.17			This group contains the GDOI notification variables for the GDOI MIB.
CGM cgmGdoiNotifKeyServerIdType	1.3.6.1.4.1.9.9.759.1.5.4	CgmGdoiIdentificationType	accessible-for-notify	Variable used only for notifications. The Identification Type Value used to parse the identity information of a Key Server.
CGM cgmGdoiNotifKeyServerIdValue	1.3.6.1.4.1.9.9.759.1.5.5	CgmGdoiIdentificationValue	accessible-for-notify	Variable used only for notifications. The value of the identity information for a Key Server with its type indicated by the cgmGdoiNotifKeyServerIdType. Use the cgmGdoiNotifKeyServerIdType to parse the Key Server ID correctly.
CGM cgmGdoiNotifKeyServerRole	1.3.6.1.4.1.9.9.759.1.5.6	CgmGdoiKsRole	accessible-for-notify	Variable used only for notifications. The current role of the Key Server for the Group.
CGM cgmGdoiNotifPeerKsIdType	1.3.6.1.4.1.9.9.759.1.5.9	CgmGdoiIdentificationType	accessible-for-notify	Variable used only for notifications. The Identification Type Value used to parse the identity information of a Key Server.
CGM cgmGdoiNotifPeerKsIdValue	1.3.6.1.4.1.9.9.759.1.5.10	CgmGdoiIdentificationValue	accessible-for-notify	Variable used only for notifications. The value of the identity information for a Peer Key Server with its type indicated by the cgmGdoiNotifPeerKsIdType. Use the cgmGdoiNotifPeerKsIdType to parse the Peer Key Server ID correctly.
cgmGdoiNotifVars	1.3.6.1.4.1.9.9.759.1.5
cgmGdoiPeers	1.3.6.1.4.1.9.9.759.1.2
cgmGdoiSecAssociations	1.3.6.1.4.1.9.9.759.1.3
ciscoGdoiMIB	1.3.6.1.4.1.9.9.759			This MIB module defines objects for managing the GDOI protocol. Copyright (c) The IETF Trust (2010). This version of this MIB module is based on RFC 6407; see the RFC itself for full legal notices.

RFC description

Cisco Group Domain of Interpretation MIB for managing IPsec group security associations and multicast rekey server operations

Start monitoring Cisco routers (GET VPN / GDOI) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-GDOI-MIB