CISCO-IKE-FLOW-EXT-MIB

All MIBs › CISCO-IKE-FLOW-EXT-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2004-09-14

Category: Cisco Devices, VPN and Security

Description: Provides extended IKE flow statistics including tunnel counts, SA lifetimes, and negotiation metrics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-IKE-FLOW-EXT-MIB?

CISCO-IKE-FLOW-EXT-MIB is an extension to CISCO-IKE-FLOW-MIB that adds Cisco-specific detail for monitoring runtime IPsec/IKE control-plane flows, i.e. ISAKMP security associations or tunnels. It exposes a tunnel extension table with local and remote identity type/value fields (DOI, identity) per tunnel, plus a control object to clear all tunnels. This is squarely a runtime monitoring/software-status MIB for VPN tunnels: an admin uses it to see how many IKE tunnels are currently established and their peer identities, and to force-clear stuck tunnels, directly analogous to monitoring process or session status for the IKE service. It explicitly depends on and augments CISCO-IKE-FLOW-MIB's base tunnel table. It is typically deployed on Cisco VPN concentrators and routers terminating many site-to-site or remote-access IPsec tunnels. Engineers can download the CISCO-IKE-FLOW-EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-IKE-FLOW-EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco VPN routers/concentrators terminating IPsec/IKE tunnels

Monitoring Examples

cifeTunnelExtTable/cifeTunnelExtEntry augments the base flow table with cifeTunnelExtLocalIdentity/cifeTunnelExtLocalIdenType and cifeTunnelExtRemoteIdentity/cifeTunnelExtRemoteIdenType per tunnel, so an operator can identify exactly which peer identity a given IKE tunnel belongs to; polling cifeTunnelExtDoi confirms the domain of interpretation matches expectations. If tunnels accumulate with unexpected or duplicate remote identities, an admin might invoke cifeClearAllTunnels to force renegotiation and recover from a stuck IKE state.

What Can Be Monitored

number and identity of active IKE tunnels
local/remote ISAKMP identity per tunnel
tunnel domain of interpretation (DOI)
ability to clear all IKE tunnels

Imported Objects

From CISCO-IPSEC-SIGNALING-MIB

cisgIpsSgProtocol	OBJECT-TYPE
cisgIpsSgTunIndex	OBJECT-TYPE

From CISCO-IPSEC-TC

CIKEIsakmpDoi
CIPsecPhase1PeerIdentityType

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoIkeFlowExtMIB	1.3.6.1.4.1.9.9.428			This MIB module is an extension to CISCO-IKE-FLOW-MIB and contains Cisco Specific extensions for monitoring IKE. It is for monitoring the structures and status of IPsec control flows based on Internet Key Exchange protocol. Acronyms The following acronyms are used in this document: Flow, Tunnel: An ISAKMP SA can be regarded as representing a flow of ISAKMP/IKE traffic. Hence an ISAKMP is referred to as a 'Phase 1 Tunnel' in this document. IPsec: Secure IP Protocol. ISAKMP: Internet Security Association and Key Management Protocol. IKE: Internet Key Exchange Protocol. FCSP: Fibre Channel Security Protocol. SA: Security Association (ref: rfc2408). Phase 2 Tunnel: AN instance of a non-ISAKMP SA bundle in which all the SA share the same proxy identifiers protect the same stream of application traffic. Such an SA bundle is termed a 'Phase 2 Tunnel'. Note that a Phase 2 tunnel may comprise different SA bundles and different number of SA bundles at different times (due to key refresh).
ciscoIkeFlowExtMIBNotifs	1.3.6.1.4.1.9.9.428.0
ciscoIkeFlowExtMIBObjects	1.3.6.1.4.1.9.9.428.1
cifeIkeGlobals	1.3.6.1.4.1.9.9.428.1.1
INT cifeClearAllTunnels	1.3.6.1.4.1.9.9.428.1.1.1	INTEGER	read-write	Clears all the tunnels of a specific type. 'none' is returned on reading this object. 'clearIPSec' all the IPSec tunnels are cleared. 'clearFCSP' all FCSP tunnels are cleared.
cifeTunnelExtTable	1.3.6.1.4.1.9.9.428.1.2		not-accessible	The Phase-1 Internet Key Exchange Tunnel Table. There is one entry in this table for each active IKE tunnel. This table is an extension to cifIkeTunnelTable defined in CISCO-IKE-FLOW-MIB. Some information in this table is also present in the cisgIpsSgTunnelTable, but the table is indexed differently so that the rows in this table are grouped/ordered by domain of interpretation (DOI).
cifeTunnelExtEntry	1.3.6.1.4.1.9.9.428.1.2.1		not-accessible	Each entry contains the attributes associated with an active IKE Tunnel, identified by cisgIpsSgTunIndex, for the IKE protocol, identified by cisgIpsSgProtocol, in this DOI, identified by cifeTunnelExtDoi.
CIK cifeTunnelExtDoi	1.3.6.1.4.1.9.9.428.1.2.1.1	CIKEIsakmpDoi	not-accessible	This identifies the DOI of Phase-2 operations in which this control tunnel operates. This may be used to identify the Phase-2 protocol.
CIP cifeTunnelExtLocalIdenType	1.3.6.1.4.1.9.9.428.1.2.1.2	CIPsecPhase1PeerIdentityType	read-only	The type of the identity used by the managed entity authenticating itself to the peer in the setup of the IKE tunnel corresponding to this conceptual row. This object would have same value as cisgIpsSgTunLocalType from CISCO-IPSEC-SIGNALLING-MIB.
STR cifeTunnelExtLocalIdentity	1.3.6.1.4.1.9.9.428.1.2.1.3	SnmpAdminString	read-only	The value of the local peer identity. This object would have same value as cisgIpsSgTunLocalValue from CISCO-IPSEC-SIGNALLING-MIB.
CIP cifeTunnelExtRemoteIdenType	1.3.6.1.4.1.9.9.428.1.2.1.4	CIPsecPhase1PeerIdentityType	read-only	The type of the identity used by the peer in authenticating itself to the local entity in the setup of the IKE tunnel corresponding to this conceptual row. This object would have same value as cisgIpsSgTunRemoteType from CISCO-IPSEC-SIGNALLING-MIB.
STR cifeTunnelExtRemoteIdentity	1.3.6.1.4.1.9.9.428.1.2.1.5	SnmpAdminString	read-only	The value of the remote peer identity. This object would have same value as cisgIpsSgTunRemoteValue from CISCO-IPSEC-SIGNALLING-MIB.
ciscoIkeFlowExtMIBConform	1.3.6.1.4.1.9.9.428.2
cifeMIBConformances	1.3.6.1.4.1.9.9.428.2.1
cifeMIBCompliance	1.3.6.1.4.1.9.9.428.2.1.1			The compliance statement for entities which implement the Cisco IKE extension MIB.
cifeMIBGroups	1.3.6.1.4.1.9.9.428.2.2
cifeGlobalsGroup	1.3.6.1.4.1.9.9.428.2.2.1			A collection of objects providing Global IKE configuration.
cifeTunnelExtGroup	1.3.6.1.4.1.9.9.428.2.2.2			The collection of objects providing IKE tunnels info.

RFC description

Extends IKE flow monitoring for Cisco IPsec implementations, tracking Internet Key Exchange control flows and phase tunnels.

Start monitoring Cisco VPN routers/concentrators terminating IPsec/IKE tunnels with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-IKE-FLOW-EXT-MIB

What Is CISCO-IKE-FLOW-EXT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description