All MIBs › CISCO-IPSEC-POLICY-MAP-MIB › ipSecPolMapAceString
ipSecPolMapAceString
Module: CISCO-IPSEC-POLICY-MAP-MIB
OID (symbolic): CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAceString
OID (numeric): 1.3.6.1.4.1.9.9.172.1.2.1.1.5
Node type: OBJECT-TYPE
Type: DisplayString
Access: read-only
Description: The value of this object is the access control entry (ACE) within the ACL that caused this IPSec tunnel to be established.
For instance, if an ACL defines access for two traffic streams (FTP and SNMP) as follows:
access-list 101 permit tcp 172.16.14.0 0.0.0.255 172.16.16.0 0.0.0.255 eq ftp access-list 101 permit udp 172.16.14.0 0.0.0.255 host 172.16.16.1 eq 161
When associated with an IPSec policy, the second element of the ACL gives rise to an IPSec tunnel in the wake of SNMP traffic. The value of the object 'ipSecPolMapAceString' for the IPSec tunnel would be then the string 'access-list 101 permit udp 172.16.14.0 0.0.0.255 host 172.16.16.1 eq 161'
What is ipSecPolMapAceString?
This reports the specific access control entry (ACE) within the broader ACL that caused this IPSec tunnel to be established, per its description - narrowing down from the whole ACL (in ipSecPolMapAclString) to the single line that actually matched the triggering traffic. This matters when an ACL contains multiple entries for different protocols or traffic streams, since it tells an admin exactly which line - say, the FTP-matching line versus the SNMP-matching line - is responsible for this particular tunnel's existence. The description's own example, contrasting an FTP-matching ACE against an SNMP-matching ACE within the same ACL 101, shows how this object disambiguates which specific traffic pattern triggered this tunnel.
Examples
Walk all instances (SNMPv2c):
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.9.9.172.1.2.1.1.5 snmpwalk -v2c -c public <target> CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAceString
Get a specific instance (index 1):
snmpget -v2c -c public <target> 1.3.6.1.4.1.9.9.172.1.2.1.1.5.1 snmpget -v2c -c public <target> CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAceString.1
Start monitoring Cisco IPsec VPN router/firewall (ASA, ISR) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAceString OID value, configure state conditions and alerts, and monitor any Cisco IPsec VPN router/firewall (ASA, ISR) from a single console.
OID Breakdown
Upper-level ancestors (8 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.9 | cisco | CAT2600-MIB |
| 1.3.6.1.4.1.9.9 | ciscoMgmt | CISCO-SMI |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.9.9.172 | ciscoIpSecPolMapMIB | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1 | ciscoIpSecPolMapMIBObjects | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2 | ipSecPhaseTwoPolMap | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2.1 | ipSecPolMapTable | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2.1.1 | ipSecPolMapEntry | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2.1.1.5 | ipSecPolMapAceString | CISCO-IPSEC-POLICY-MAP-MIB |