CISCO-IPSEC-MIB

All MIBs › CISCO-IPSEC-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2000-08-07

Category: Cisco Devices, VPN and Security

Description: Contains objects for configuring and managing IPSec-based Virtual Private Networks (VPNs).

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring CISCO-IPSEC-MIB with a free 30-day trial of IPNetwork Monitor.

What Is CISCO-IPSEC-MIB?

CISCO-IPSEC-MIB is a Cisco enterprise MIB modeling Cisco-specific attributes of a device's IPsec VPN tunneling implementation, complementing the vendor-neutral IPsec MIB jointly proposed by Tivoli and Cisco. Per its module description it covers an ISAKMP group (global parameters and an ISAKMP Policy Table) and an IPSec group providing operational information about tunnel establishment. Where implemented, it lets administrators monitor the software-level status of VPN tunnel negotiation and policy rather than hardware, such as whether phase-1/phase-2 parameters are correctly applied. It explicitly complements the standard Tivoli/Cisco IPsec MIB, so it depends on that MIB for baseline IPsec object modeling. It is typically deployed on Cisco routers and VPN gateways terminating site-to-site or remote-access IPsec tunnels. Engineers can download the CISCO-IPSEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-IPSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco routers and VPN gateways implementing IPsec

Monitoring Examples

The sample objects available for this module are limited to its conformance nodes (cipsMIBConformances, cipsMIBGroups), so no concrete runtime data-table names can be cited here; per the module description the real operational data lives in an ISAKMP Policy Table and an IPSec group, but those specific object identifiers were not present in this sample.

What Can Be Monitored

ISAKMP global parameter configuration
ISAKMP policy table entries
IPsec tunnel/security association status

Imported Objects

From CISCO-SMI

ciscoExperiment

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using cipsNumTEDProbesReceived OID:

Select a Cisco router or VPN gateway implementing IPsec as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cipsNumTEDProbesReceived into the Find box to locate it in the OID tree, then select it and click OK. The number of TED probes that were received by this managed entity since bootup. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in Integral Units), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoIPsecMIB	1.3.6.1.4.1.9.10.62			The MIB module for modeling Cisco-specific IPsec attributes Overview of Cisco IPsec MIB MIB description This MIB models the Cisco implementation-specific attributes of a Cisco entity that implements IPsec. This MIB is complementary to the standard IPsec MIB proposed jointly by Tivoli and Cisco. The ciscoIPsec MIB provides the operational information on Cisco's IPsec tunnelling implementation. The following entities are managed: 1) ISAKMP Group: a) ISAKMP global parameters b) ISAKMP Policy Table 2) IPSec Group: a) IPSec Global Parameters b) IPSec Global Traffic Parameters c) Cryptomap Group - Cryptomap Set Table - Cryptomap Table - CryptomapSet Binding Table 3) System Capacity & Capability Group: a) Capacity Parameters b) Capability Parameters 4) Trap Control Group 5) Notifications Group
ciscoIPsecMIBObjects	1.3.6.1.4.1.9.10.62.1
cipsIsakmpGroup	1.3.6.1.4.1.9.10.62.1.1
T/F cipsIsakmpEnabled	1.3.6.1.4.1.9.10.62.1.1.1	TruthValue	read-only	The value of this object is TRUE if ISAKMP has been enabled on the managed entity. Otherise the value of this object is FALSE.
IKE cipsIsakmpIdentity	1.3.6.1.4.1.9.10.62.1.1.2	IkeIdentityType	read-only	The value of this object is shows the type of identity used by the managed entity in ISAKMP negotiations with another peer.
I32 cipsIsakmpKeepaliveInterval	1.3.6.1.4.1.9.10.62.1.1.3	Integer32	read-only	The value of this object is time interval in seconds between successive ISAKMP keepalive heartbeats issued to the peers to which IKE tunnels have been setup.
I32 cipsNumIsakmpPolicies	1.3.6.1.4.1.9.10.62.1.1.4	Integer32	read-only	The value of this object is the number of ISAKMP policies that have been configured on the managed entity.
cipsIsakmpPolicyTable	1.3.6.1.4.1.9.10.62.1.1.5		not-accessible	The table containing the list of all ISAKMP policy entries configured by the operator.
cipsIsakmpPolicyEntry	1.3.6.1.4.1.9.10.62.1.1.5.1		not-accessible	Each entry contains the attributes associated with a single ISAKMP Policy entry.
I32 cipsIsakmpPolPriority	1.3.6.1.4.1.9.10.62.1.1.5.1.1	Integer32	not-accessible	The priotity of this ISAKMP Policy entry. This is also the index of this table.
ENC cipsIsakmpPolEncr	1.3.6.1.4.1.9.10.62.1.1.5.1.2	EncryptAlgo	read-only	The encryption transform specified by this ISAKMP policy specification. The Internet Key Exchange (IKE) tunnels setup using this policy item would use the specified encryption transform to protect the ISAKMP PDUs.
IKE cipsIsakmpPolHash	1.3.6.1.4.1.9.10.62.1.1.5.1.3	IkeHashAlgo	read-only	The hash transform specified by this ISAKMP policy specification. The IKE tunnels setup using this policy item would use the specified hash transform to protect the ISAKMP PDUs.
IKE cipsIsakmpPolAuth	1.3.6.1.4.1.9.10.62.1.1.5.1.4	IkeAuthMethod	read-only	The peer authentication mthod specified by this ISAKMP policy specification. If this policy entity is selected for negotiation with a peer, the local entity would authenticate the peer using the method specified by this object.
DIF cipsIsakmpPolGroup	1.3.6.1.4.1.9.10.62.1.1.5.1.5	DiffHellmanGrp	read-only	This object specifies the Oakley group used for Diffie Hellman exchange in the Main Mode. If this policy item is selected to negotiate Main Mode with an IKE peer, the local entity chooses the group specified by this object to perform Diffie Hellman exchange with the peer.
I32 cipsIsakmpPolLifetime	1.3.6.1.4.1.9.10.62.1.1.5.1.6	Integer32	read-only	This object specifies the lifetime in seconds of the IKE tunnels generated using this policy specification.
cipsIPsecGroup	1.3.6.1.4.1.9.10.62.1.2
cipsIPsecGlobals	1.3.6.1.4.1.9.10.62.1.2.1
CIP cipsSALifetime	1.3.6.1.4.1.9.10.62.1.2.1.1	CIPsecLifetime	read-only	The default lifetime (in seconds) assigned to an SA as a global policy (maybe overridden in specific cryptomap definitions).
CIP cipsSALifesize	1.3.6.1.4.1.9.10.62.1.2.1.2	CIPsecLifesize	read-only	The default lifesize in KBytes assigned to an SA as a global policy (unless overridden in cryptomap definition)
CIP cipsNumStaticCryptomapSets	1.3.6.1.4.1.9.10.62.1.2.1.3	CIPsecNumCryptoMaps	read-only	The number of Cryptomap Sets that are are fully configured. Statically defined cryptomap sets are ones where the operator has fully specified all the parameters required set up IPSec Virtual Private Networks (VPNs).
CIP cipsNumCETCryptomapSets	1.3.6.1.4.1.9.10.62.1.2.1.4	CIPsecNumCryptoMaps	read-only	The number of static Cryptomap Sets that have at least one CET cryptomap element as a member of the set.
CIP cipsNumDynamicCryptomapSets	1.3.6.1.4.1.9.10.62.1.2.1.5	CIPsecNumCryptoMaps	read-only	The number of dynamic IPSec Policy templates (called 'dynamic cryptomap templates') configured on the managed entity.
CIP cipsNumTEDCryptomapSets	1.3.6.1.4.1.9.10.62.1.2.1.6	CIPsecNumCryptoMaps	read-only	The number of static Cryptomap Sets that have at least one dynamic cryptomap template bound to them which has the Tunnel Endpoint Discovery (TED) enabled.
cipsIPsecStatistics	1.3.6.1.4.1.9.10.62.1.2.2
C32 cipsNumTEDProbesReceivedEx	1.3.6.1.4.1.9.10.62.1.2.2.1	Counter32	read-only	The number of TED probes that were received by this managed entity since bootup. Not affected by any CLI operation.
C32 cipsNumTEDProbesSent	1.3.6.1.4.1.9.10.62.1.2.2.2	Counter32	read-only	The number of TED probes that were dispatched by all the dynamic cryptomaps in this managed entity since bootup. Not affected by any CLI operation.
C32 cipsNumTEDFailures	1.3.6.1.4.1.9.10.62.1.2.2.3	Counter32	read-only	The number of TED probes that were dispatched by the local entity and that failed to locate crypto endpoint. Not affected by any CLI operation.
cipsCryptomapGroup	1.3.6.1.4.1.9.10.62.1.2.3
cipsStaticCryptomapSetTable	1.3.6.1.4.1.9.10.62.1.2.3.1		not-accessible	The table containing the list of all cryptomap sets that are fully specified and are not wild-carded. The operator may include different types of cryptomaps in such a set - manual, CET, ISAKMP or dynamic.
cipsStaticCryptomapSetEntry	1.3.6.1.4.1.9.10.62.1.2.3.1.1		not-accessible	Each entry contains the attributes associated with a single static cryptomap set.
STR cipsStaticCryptomapSetName	1.3.6.1.4.1.9.10.62.1.2.3.1.1.1	DisplayString	not-accessible	The index of the static cryptomap table. The value of the string is the name string assigned by the operator in defining the cryptomap set.
G32 cipsStaticCryptomapSetSize	1.3.6.1.4.1.9.10.62.1.2.3.1.1.2	Gauge32	read-only	The total number of cryptomap entries contained in this cryptomap set.
G32 cipsStaticCryptomapSetNumIsakmp	1.3.6.1.4.1.9.10.62.1.2.3.1.1.3	Gauge32	read-only	The number of cryptomaps associated with this cryptomap set that use ISAKMP protocol to do key exchange.
G32 cipsStaticCryptomapSetNumManual	1.3.6.1.4.1.9.10.62.1.2.3.1.1.4	Gauge32	read-only	The number of cryptomaps associated with this cryptomap set that require the operator to manually setup the keys and SPIs.
G32 cipsStaticCryptomapSetNumCET	1.3.6.1.4.1.9.10.62.1.2.3.1.1.5	Gauge32	read-only	The number of cryptomaps of type 'ipsec-cisco' associated with this cryptomap set. Such cryptomap elements implement Cisco Encryption Technology based Virtual Private Networks.
G32 cipsStaticCryptomapSetNumDynamic	1.3.6.1.4.1.9.10.62.1.2.3.1.1.6	Gauge32	read-only	The number of dynamic cryptomap templates linked to this cryptomap set.
G32 cipsStaticCryptomapSetNumDisc	1.3.6.1.4.1.9.10.62.1.2.3.1.1.7	Gauge32	read-only	The number of dynamic cryptomap templates linked to this cryptomap set that have Tunnel Endpoint Discovery (TED) enabled.
G32 cipsStaticCryptomapSetNumSAs	1.3.6.1.4.1.9.10.62.1.2.3.1.1.8	Gauge32	read-only	The number of and IPsec Security Associations that are active and were setup using this cryptomap.
cipsDynamicCryptomapSetTable	1.3.6.1.4.1.9.10.62.1.2.3.2		not-accessible	The table containing the list of all dynamic cryptomaps that use IKE, defined on the managed entity.
cipsDynamicCryptomapSetEntry	1.3.6.1.4.1.9.10.62.1.2.3.2.1		not-accessible	Each entry contains the attributes associated with a single dynamic cryptomap template.
STR cipsDynamicCryptomapSetName	1.3.6.1.4.1.9.10.62.1.2.3.2.1.1	DisplayString	not-accessible	The index of the dynamic cryptomap table. The value of the string is the one assigned by the operator in defining the cryptomap set.
G32 cipsDynamicCryptomapSetSize	1.3.6.1.4.1.9.10.62.1.2.3.2.1.2	Gauge32	read-only	The number of cryptomap entries in this cryptomap.
G32 cipsDynamicCryptomapSetNumAssoc	1.3.6.1.4.1.9.10.62.1.2.3.2.1.3	Gauge32	read-only	The number of static cryptomap sets with which this dynamic cryptomap is associated.
cipsStaticCryptomapTable	1.3.6.1.4.1.9.10.62.1.2.3.3		not-accessible	The table ilisting the member cryptomaps of the cryptomap sets that are configured on the managed entity.
cipsStaticCryptomapEntry	1.3.6.1.4.1.9.10.62.1.2.3.3.1		not-accessible	Each entry contains the attributes associated with a single static (fully specified) cryptomap entry. This table does not include the members of dynamic cryptomap sets that may be linked with the parent static cryptomap set.
I32 cipsStaticCryptomapPriority	1.3.6.1.4.1.9.10.62.1.2.3.3.1.1	Integer32	not-accessible	The priority of the cryptomap entry in the cryptomap set. This is the second index component of this table.
CRY cipsStaticCryptomapType	1.3.6.1.4.1.9.10.62.1.2.3.3.1.2	CryptomapType	read-only	The type of the cryptomap entry. This can be an ISAKMP cryptomap, CET or manual. Dynamic cryptomaps are not counted in this table.
STR cipsStaticCryptomapDescr	1.3.6.1.4.1.9.10.62.1.2.3.3.1.3	DisplayString	read-only	The description string entered by the operatoir while creating this cryptomap. The string generally identifies a description and the purpose of this policy.
ADR cipsStaticCryptomapPeer	1.3.6.1.4.1.9.10.62.1.2.3.3.1.4	IPSIpAddress	read-only	The IP address of the current peer associated with this IPSec policy item. Traffic that is protected by this cryptomap is protected by a tunnel that terminates at the device whose IP address is specified by this object.
I32 cipsStaticCryptomapNumPeers	1.3.6.1.4.1.9.10.62.1.2.3.3.1.5	Integer32	read-only	The number of peers associated with this cryptomap entry. The peers other than the one identified by 'cipsStaticCryptomapPeer' are backup peers. Manual cryptomaps may have only one peer.
DIF cipsStaticCryptomapPfs	1.3.6.1.4.1.9.10.62.1.2.3.3.1.6	DiffHellmanGrp	read-only	This object identifies if the tunnels instantiated due to this policy item should use Perfect Forward Secrecy (PFS) and if so, what group of Oakley they should use.
I32 cipsStaticCryptomapLifetime	1.3.6.1.4.1.9.10.62.1.2.3.3.1.7	Integer32	read-only	This object identifies the lifetime of the IPSec Security Associations (SA) created using this IPSec policy entry. If this value is zero, the lifetime assumes the value specified by the global lifetime parameter.
I32 cipsStaticCryptomapLifesize	1.3.6.1.4.1.9.10.62.1.2.3.3.1.8	Integer32	read-only	This object identifies the lifesize (maximum traffic in bytes that may be carried) of the IPSec SAs created using this IPSec policy entry. If this value is zero, the lifetime assumes the value specified by the global lifesize parameter.
T/F cipsStaticCryptomapLevelHost	1.3.6.1.4.1.9.10.62.1.2.3.3.1.9	TruthValue	read-only	This object identifies the granularity of the IPSec SAs created using this IPSec policy entry. If this value is TRUE, distinct SA bundles are created for distinct hosts at the end of the application traffic.
cipsCryptomapSetIfTable	1.3.6.1.4.1.9.10.62.1.2.3.4		not-accessible	The table lists the binding of cryptomap sets to the interfaces of the managed entity.
cipsCryptomapSetIfEntry	1.3.6.1.4.1.9.10.62.1.2.3.4.1		not-accessible	Each entry contains the record of the association between an interface and a cryptomap set (static) that is defined on the managed entity. Note that the cryptomap set identified in this binding must static. Dynamic cryptomaps cannot be bound to interfaces.
T/F cipsCryptomapSetIfVirtual	1.3.6.1.4.1.9.10.62.1.2.3.4.1.1	TruthValue	read-only	The value of this object identifies if the interface to which the cryptomap set is attached is a tunnel (such as a GRE or PPTP tunnel).
CRY cipsCryptomapSetIfStatus	1.3.6.1.4.1.9.10.62.1.2.3.4.1.2	CryptomapSetBindStatus	read-write	This object identifies the status of the binding of the specified cryptomap set with the specified interface. The value when queried is always 'attached'. When set to 'detached', the cryptomap set if detached from the specified interface. The effect of this is same as the CLI command config-if# no crypto map cryptomapSetName Setting the value to 'attached' will result in SNMP General Error.
cipsSysCapacityGroup	1.3.6.1.4.1.9.10.62.1.3
INT cipsMaxSAs	1.3.6.1.4.1.9.10.62.1.3.1	INTEGER	read-only	The maximum number of IPsec Security Associations that can be established on this managed entity. If no theoretical limit exists, this returns value 0. Not affected by any CLI operation.
T/F cips3DesCapable	1.3.6.1.4.1.9.10.62.1.3.2	TruthValue	read-only	The value of this object is TRUE if the managed entity has the hardware nad software features to support 3DES encryption algorithm. Not affected by any CLI operation.
cipsTrapCntlGroup	1.3.6.1.4.1.9.10.62.1.4
TRA cipsCntlIsakmpPolicyAdded	1.3.6.1.4.1.9.10.62.1.4.1	TrapStatus	read-write	This object defines the administrative state of sending the IOS IPsec ISAKMP Policy Add trap.
TRA cipsCntlIsakmpPolicyDeleted	1.3.6.1.4.1.9.10.62.1.4.2	TrapStatus	read-write	This object defines the administrative state of sending the IOS IPsec ISAKMP Policy Delete trap.
TRA cipsCntlCryptomapAdded	1.3.6.1.4.1.9.10.62.1.4.3	TrapStatus	read-write	This object defines the administrative state of sending the IOS IPsec Cryptomap Add trap.
TRA cipsCntlCryptomapDeleted	1.3.6.1.4.1.9.10.62.1.4.4	TrapStatus	read-write	This object defines the administrative state of sending the IOS IPsec Cryptomap Delete trap.
TRA cipsCntlCryptomapSetAttached	1.3.6.1.4.1.9.10.62.1.4.5	TrapStatus	read-write	This object defines the administrative state of sending the IOS IPsec trap that is issued when a cryptomap set is attached to an interface.
TRA cipsCntlCryptomapSetDetached	1.3.6.1.4.1.9.10.62.1.4.6	TrapStatus	read-write	This object defines the administrative state of sending the IOS IPsec trap that is issued when a cryptomap set is detached from an interface. to which it was earlier bound.
TRA cipsCntlTooManySAs	1.3.6.1.4.1.9.10.62.1.4.7	TrapStatus	read-write	This object defines the administrative state of sending the IOS IPsec trap that is issued when the number of SAs crosses the maximum number of SAs that may be supported on the managed entity.
ciscoIPsecMIBNotificationPrefix	1.3.6.1.4.1.9.10.62.2
cipsMIBNotifications	1.3.6.1.4.1.9.10.62.2.0
NTF cipsIsakmpPolicyAdded	1.3.6.1.4.1.9.10.62.2.0.1			This trap is generated when a new ISAKMP policy element is defined on the managed entity. The context of the event includes the updated number of ISAKMP policy elements currently available.
NTF cipsIsakmpPolicyDeleted	1.3.6.1.4.1.9.10.62.2.0.2			This trap is generated when an existing ISAKMP policy element is deleted on the managed entity. The context of the event includes the updated number of ISAKMP policy elements currently available.
NTF cipsCryptomapAdded	1.3.6.1.4.1.9.10.62.2.0.3			This trap is generated when a new cryptomap is added to the specified cryptomap set.
NTF cipsCryptomapDeleted	1.3.6.1.4.1.9.10.62.2.0.4			This trap is generated when a cryptomap is removed from the specified cryptomap set.
NTF cipsCryptomapSetAttached	1.3.6.1.4.1.9.10.62.2.0.5			A cryptomap set must be attached to an interface of the device in order for it to be operational. This trap is generated when the cryptomap set attached to an active interface of the managed entity. The context of the notification includes: Size of the attached cryptomap set, Number of ISAKMP cryptomaps in the set and Number of Dynamic cryptomaps in the set.
NTF cipsCryptomapSetDetached	1.3.6.1.4.1.9.10.62.2.0.6			This trap is generated when a cryptomap set is detached from an interafce to which it was bound earlier. The context of the event identifies the size of the cryptomap set.
NTF cipsTooManySAs	1.3.6.1.4.1.9.10.62.2.0.7			This trap is generated when a new SA is attempted to be setup while the number of currently active SAs equals the maximum configurable. The variables are: cipsMaxSAs
ciscoIPsecMIBConformance	1.3.6.1.4.1.9.10.62.3
cipsMIBConformances	1.3.6.1.4.1.9.10.62.3.1
cipsMIBCompliance	1.3.6.1.4.1.9.10.62.3.1.1			The compliance statement for entities which implement the Cisco IPsec MIB
cipsMIBGroups	1.3.6.1.4.1.9.10.62.3.2
cipsMIBConfIsakmpGroup	1.3.6.1.4.1.9.10.62.3.2.1			A collection of objects providing Global ISAKMP policy monitoring capability to a Cisco IPsec capable VPN router.
cipsMIBConfIPSecGlobalsGroup	1.3.6.1.4.1.9.10.62.3.2.2			A collection of objects providing Global IPSec policy monitoring capability to a Cisco IPsec capable VPN router.
cipsMIBConfCapacityGroup	1.3.6.1.4.1.9.10.62.3.2.3			A collection of objects providing IPsec System Capacity monitoring capability to a Cisco IPsec capable VPN router.
cipsMIBStaticCryptomapGroup	1.3.6.1.4.1.9.10.62.3.2.4			A collection of objects instrumenting the properties of the Static (fully specified) Cryptomap Sets on an IPsec-capable IOS router.
cipsMIBManualCryptomapGroup	1.3.6.1.4.1.9.10.62.3.2.5			A collection of objects instrumenting the properties of the Manual Cryptomap entries on a Cisco IPsec capable IOS router.
cipsMIBDynamicCryptomapGroup	1.3.6.1.4.1.9.10.62.3.2.6			A collection of objects instrumenting the properties of the Dynamic Cryptomap group on a Cisco IPsec capable IOS router.
cipsMIBMandatoryNotifCntlGroup	1.3.6.1.4.1.9.10.62.3.2.7			A collection of objects providing IPsec Notification capability to a IPsec-capable IOS router. It is mandatory to implement this set of objects pertaining to IOS notifications about IPSec activity.

RFC description

Monitors Cisco IPSec VPN implementation-specific metrics and configuration for secure tunnel establishment and management.

Start monitoring Cisco routers and VPN gateways implementing IPsec with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-IPSEC-MIB