All MIBs › CISCO-IKE-FLOW-CAPABILITY
Organization: Cisco Systems, Inc.
Last Updated: 2006-02-02
Category: Cisco Devices, SNMP Framework, VPN and Security
Description: Declares SNMP agent capabilities for the Cisco IKE flow monitoring MIB on VPN-capable platforms.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is CISCO-IKE-FLOW-CAPABILITY?
This module is an AGENT-CAPABILITIES statement, not a data MIB, describing which object groups of CISCO-IKE-FLOW-MIB a particular Cisco VPN-capable device's SNMP agent implements for monitoring IKE (Internet Key Exchange) negotiation flows used in IPsec VPN tunnel establishment. It carries no pollable data itself; it documents conformance so a management system can determine, ahead of polling, whether IKE Phase 1/Phase 2 negotiation statistics, tunnel counts, and failure-reason objects are available on a given platform/software version. Its indirect monitoring value is in enabling accurate VPN health monitoring: knowing which IKE flow objects are supported lets an NMS reliably track tunnel establishment success/failure and negotiation errors on that device without querying unsupported OIDs. It is entirely dependent on CISCO-IKE-FLOW-MIB, the MIB it profiles, which itself relates to IPsec/IKE standards such as RFC 2409 and successors. It applies to Cisco VPN-capable routers, firewalls, and concentrators, and is consulted by MIB compilers and NMS platforms during capability negotiation rather than at runtime. Engineers can download the CISCO-IKE-FLOW-CAPABILITY file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-IKE-FLOW-CAPABILITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Cisco VPN-capable routers, firewalls, and VPN concentrators
Monitoring Examples
A VPN operations team's NMS would consult this capability statement when onboarding a new Cisco VPN gateway to confirm whether CISCO-IKE-FLOW-MIB's IKE negotiation and tunnel-failure-reason object groups are implemented on that IOS/ASA version before enabling IKE-flow monitoring. If certain object groups, such as detailed negotiation-failure-reason codes, aren't declared supported, the monitoring platform would fall back to more basic tunnel up/down counters instead. This prevents the monitoring system from repeatedly polling OIDs the device's agent doesn't actually implement.
What Can Be Monitored
- supported IKE flow MIB object groups
- agent conformance to CISCO-IKE-FLOW-MIB
Imported Objects
From CISCO-SMI
| ciscoAgentCapability | OBJECT-IDENTITY |
From SNMPv2-CONF
| AGENT-CAPABILITIES |
From SNMPv2-SMI
| MODULE-IDENTITY |
OIDs
RFC description
Agent capabilities for monitoring IKE (Internet Key Exchange) flow activity on Cisco SanOS and MDS 9000 platforms.
Start monitoring Cisco VPN routers and firewalls with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.