CISCO-IPSEC-POLICY-MAP-MIB

Description: Maps IPSec policy entries to the traffic flows and interfaces they protect on Cisco VPN devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

This is a Cisco private MIB that supplements IPSec VPN monitoring by mapping the dynamically-created IPSec security entities on a device back to the configuration policy objects that caused them to be created, acting as an appendix to the standards-track IPSEC-MONITOR-MIB. It exposes relationship/mapping data rather than raw traffic counters, a table linking each IPSec Phase-1 (ISAKMP) tunnel to its governing ISAKMP policy, and a second table linking each IPSec Phase-2 tunnel to the policy that spawned it. Its monitoring value is diagnostic/configuration traceability for VPN software state; when an operator sees an active or failing IPSec tunnel in the standard IPSec MIBs, this module lets them trace that tunnel back to the specific crypto/ISAKMP policy configuration responsible, essential for troubleshooting misapplied or conflicting VPN policies rather than a hardware health check. It explicitly depends on and extends the IETF IPSEC-MONITOR-MIB, and by extension the underlying ISAKMP/IPSec security association model, rather than standing alone. It is deployed on Cisco VPN-capable routers and firewalls, such as ASA and ISR platforms, terminating site-to-site or remote-access IPSec VPN tunnels in enterprise and service-provider networks. Engineers can download the CISCO-IPSEC-POLICY-MAP-MIB file directly to load it into their MIB browser.

No sample object names were captured for this MIB; based on the module description, an administrator troubleshooting a misbehaving VPN tunnel would use its Phase-1 (ISAKMP tunnel-to-policy) mapping table to identify which ISAKMP policy governs a given active tunnel, and its Phase-2 (IPSec tunnel-to-policy) mapping table to identify which crypto/transform-set policy governs the corresponding data-plane security association. This lets an operator pinpoint that a tunnel using an unexpected or deprecated policy is the root cause of a VPN negotiation failure or mismatch, rather than treating it as a generic tunnel-down event. Because no concrete object names were provided in the input, this description stays at the table-relationship level rather than citing specific OIDs.

An enterprise-specific SNMP MIB that maps dynamically instantiated IPsec protocol structures (tunnels, security associations) to policy entities that created them, supporting IPsec configuration and status monitoring.