All MIBs › CISCO-IPSEC-PROVISIONING-MIB
Organization: Cisco Systems, Inc.
Last Updated: 2005-11-02
Category: Cisco Devices, VPN and Security
Description: Manages IPsec tunnel provisioning including crypto maps, transform sets, and security association parameters.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is CISCO-IPSEC-PROVISIONING-MIB?
CISCO-IPSEC-PROVISIONING-MIB is a Cisco enterprise MIB for provisioning and managing IPsec-based VPN tunnels on Cisco routers and security appliances, as defined by the RFC 2401-2411 IPsec framework. It exposes configuration data for crypto transform sets, security association lifetimes (time and byte-based), and idle timeouts used to build IPsec tunnels. In monitoring terms it is used primarily to check the software configuration status of VPN tunnels rather than hardware health — an operator can verify that transform-set parameters, tunnel lifetime/lifesize thresholds, and idle-timeout settings are correctly applied and consistent across peers. It has an explicit dependency on CISCO-IKE-CONFIGURATION-MIB, since Internet Key Exchange (IKE) must be configured before IPsec security associations can be negotiated. It is typically deployed on Cisco VPN routers, firewalls, and concentrators in enterprise or service-provider networks where site-to-site or remote-access IPsec tunnels are provisioned and audited via SNMP. Engineers can download the CISCO-IPSEC-PROVISIONING-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-IPSEC-PROVISIONING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Cisco VPN router
- Cisco security appliance/firewall
- Cisco VPN concentrator
Monitoring Examples
An administrator would poll cipsIPsecXformSetTable/cipsIPsecXformSetEntry to inventory configured transform sets, checking cipsXformSetEncryptionXform, cipsXformSetIntegrityXformEsp, and cipsXformSetIntegrityXformAh to confirm the encryption and integrity algorithms match corporate security policy. Polling cipsTunnelLifetime, cipsTunnelLifesize, and cipsTunnelIdleTimeout reveals whether SA rekey intervals are set too long (a security risk) or too short (causing excessive rekey churn). A mismatch between cipsXformSetSuite entries on two VPN peers would show up as a configuration anomaly explaining failed tunnel negotiation.
What Can Be Monitored
- IPsec transform set configuration
- encryption/integrity algorithm suite
- tunnel lifetime (time-based)
- tunnel lifesize (byte-based)
- tunnel idle timeout
- compression transform settings
This MIB depends on
Related MIBs
Imported Objects
From CISCO-IPSEC-TC
| CIPsecCryptomapType | |
| CIPsecDiffHellmanGrp | |
| CIPsecEncapMode | |
| CIPsecLifesize | |
| CIPsecLifetime | |
| CIPsecNumCryptoMaps | |
| CIPsecSecuritySuite | |
| CIPsecTransform | |
| CIPsecTunnelIdleTime |
From CISCO-SMI
| ciscoMgmt | OBJECT-IDENTITY |
From IF-MIB
| ifIndex | OBJECT-TYPE |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| RowStatus | |
| TruthValue |
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| T/F cipsCntlAllNotifs | 1.3.6.1.4.1.9.9.431.1.5.1 | TruthValue | read-write | This object must be set to 'true' to enable any notification in addition to the notification-specific control variables defined below. A notification defined in this module is enabled if and only if the expression (cipsCntlAllNotifs && cipsCntl) evaluates to 'true'. |
| T/F cipsCntlCryptomapAdded | 1.3.6.1.4.1.9.9.431.1.5.2 | TruthValue | read-write | This variable controls the generation of ciscoIPsecProvCryptomapAdded notification. When this variable is set to 'true', a notification is generated when a static cryptomap is created in cipsStaticCryptomapTable. When this variable is set to 'false', generation of this notification is disabled. |
| T/F cipsCntlCryptomapDeleted | 1.3.6.1.4.1.9.9.431.1.5.3 | TruthValue | read-write | This variable controls the generation of ciscoIPsecProvCryptomapDeleted notification. When this variable is set to 'true', a notification is generated when a static cryptomap is deleted from cipsStaticCryptomapTable. When this variable is set to 'false', generation of this notification is disabled. |
| T/F cipsCntlCryptomapSetAttached | 1.3.6.1.4.1.9.9.431.1.5.4 | TruthValue | read-write | This variable controls the generation of ciscoIPsecProvCryptomapAttached notification. When this variable is set to 'true', a notification is generated when a cryptomap set is attached to an active interface. When this variable is set to 'false', generation of this notification is disabled. |
| T/F cipsCntlCryptomapSetDetached | 1.3.6.1.4.1.9.9.431.1.5.5 | TruthValue | read-write | This variable controls the generation of ciscoIPsecProvCryptomapDetached notification. When this variable is set to 'true', a notification is generated when a cryptomap set is detached from an active interface. When this variable is set to 'false', generation of this notification is disabled. |
| IP cipsCryMapPeerAddr | 1.3.6.1.4.1.9.9.431.1.4.4.1.3 | InetAddress | read-create | This object represents the address of the peer corresponding to this conceptual row. This object cannot be modified while the corresponding value of cipsCryMapPeerStatus is equal to 'active'. |
| IPt cipsCryMapPeerAddrType | 1.3.6.1.4.1.9.9.431.1.4.4.1.2 | InetAddressType | read-create | This object represents the address type of cipsCryMapPeerAddr. This object cannot be modified while the corresponding value of cipsCryMapPeerStatus is equal to 'active'. |
| U32 cipsCryMapPeerIndex | 1.3.6.1.4.1.9.9.431.1.4.4.1.1 | Unsigned32 | not-accessible | This arbitrary number represents the index number in the cryptomap entry of the peer corresponding to this conceptual row. This object could have the same value as cipsStaticCryotomapNextPIndex. |
| U32 cipsCryMapPeerOrder | 1.3.6.1.4.1.9.9.431.1.4.4.1.4 | Unsigned32 | read-only | This object represents the order in the cryptomap entry of the peer corresponding to this conceptual row. The peer with the lowest order number is applied first, that is cipsCryMapPeerOrder '1'. |
| ROW cipsCryMapPeerStatus | 1.3.6.1.4.1.9.9.431.1.4.4.1.5 | RowStatus | read-create | This object specifies the status column used for creating and deleting instances of the columnar objects in the table. |
| cipsCryptoMapGeneral | 1.3.6.1.4.1.9.9.431.1.3 | |||
| cipsCryptoMaps | 1.3.6.1.4.1.9.9.431.1.4 | |||
| cipsCryptomapSetIfEntry | 1.3.6.1.4.1.9.9.431.1.4.5.1 | not-accessible | Each entry lists the association between an interface and a cryptomap set (static) that is defined on the managed entity. | |
| ROW cipsCryptomapSetIfStatus | 1.3.6.1.4.1.9.9.431.1.4.5.1.1 | RowStatus | read-create | This object identifies the status of the binding of the specified cryptomap set with the specified interface. Detaching a cryptomap from an interface: ---------------------------------------- When set to 'destroy', if a cryptomap set is attached to the interface corresponding to ifIndex, the cryptomap set is detached from the interface. Attaching a cryptomap to an interface: ---------------------------------------- If the value 'createAndGo' is set: a row in this table can be created only if it identifies a cryptomap which is represented by an entry in cipsStaticCryptomapSetTable. |
| cipsCryptomapSetIfTable | 1.3.6.1.4.1.9.9.431.1.4.5 | not-accessible | The table lists the binding of cryptomap sets to the interfaces of the managed entity. One interface can be bound to only one cryptomap set while one cryptomap set can be bound to multiple interfaces. Any interface (with any ifType) which supports IPsec can be used in this table. | |
| cipsIfCryptomapSetInfoEntry | 1.3.6.1.4.1.9.9.431.1.4.6.1 | not-accessible | Each entry lists the binding between an interface and a cryptomap set (static) that is defined on the managed entity. | |
| cipsIfCryptomapSetInfoTable | 1.3.6.1.4.1.9.9.431.1.4.6 | not-accessible | The table lists the binding information of a interface to a cryptomap sets on the managed entity. One interface can be bound to only one cryptomap set while one cryptomap set can be bound to multiple interfaces. An entry is added to cipsIfCryptomapSetInfoTable when a static cryptomap set is successfully assigned to an interface (of any ifType) in cipsCryptomapSetIfTable. An entry is deleted from cipsIfCryptomapSetInfoTable when its assignment is removed from cipsIfCryptomapSetInfoTable. | |
| STR cipsIfStaticCryptomapSetName | 1.3.6.1.4.1.9.9.431.1.4.6.1.1 | SnmpAdminString | read-only | The name of a static cryptomap set which is bound to this interface. The value of the string is one of the entries in cipsStaticCryptomapSetTable indexed by cipsStaticCryptomapSetName. |
| cipsIPsecCryMapPeerEntry | 1.3.6.1.4.1.9.9.431.1.4.4.1 | not-accessible | Each entry represents the binding of an IPsec peer address to the specified cryptomap. | |
| cipsIPsecCryMapPeerTable | 1.3.6.1.4.1.9.9.431.1.4.4 | not-accessible | The table containing the binding of peers to cryptomap entries. An entry is removed from this table automatically by the agent when the last 'active' entry with the corresponding cipsStaticCryptomapSetName is removed from cipsStaticCryptomapTable. | |
| cipsIPsecGlobals | 1.3.6.1.4.1.9.9.431.1.1 | |||
| cipsIPsecTransforms | 1.3.6.1.4.1.9.9.431.1.2 | |||
| cipsIPsecXformSetEntry | 1.3.6.1.4.1.9.9.431.1.2.1.1 | not-accessible | Each entry represents a single configured IPsec transform set. | |
| cipsIPsecXformSetTable | 1.3.6.1.4.1.9.9.431.1.2.1 | not-accessible | This table contains the list of all the transform sets configured on the managed entity. A transform set is usually configured by a management console before a cryptomap is created. Multiple transform sets could be assigned to a cryptomap configuration. | |
| cipsNotificationCntl | 1.3.6.1.4.1.9.9.431.1.5 | |||
| CIP cipsNumDynamicCryptomapSets | 1.3.6.1.4.1.9.9.431.1.3.2 | CIPsecNumCryptoMaps | read-only | This object reflects the number of dynamic IPsec policy templates (called dynamic cryptomap templates) that are fully configured. |
| CIP cipsNumStaticCryptomapSets | 1.3.6.1.4.1.9.9.431.1.3.1 | CIPsecNumCryptoMaps | read-only | This object reflects the number of static cryptomap sets that are fully configured. Statically defined cryptomap sets are ones where the operator has fully specified all the parameters required to set up IPsec connections. |
| CIP cipsNumTEDCryptomapSets | 1.3.6.1.4.1.9.9.431.1.3.3 | CIPsecNumCryptoMaps | read-only | This object reflects the number of static cryptomap sets that have at least one dynamic cryptomap template which has the Tunnel Endpoint Discovery (TED) enabled. |
| U32 cipsStaticCryotomapNextPIndex | 1.3.6.1.4.1.9.9.431.1.4.3.1.8 | Unsigned32 | read-only | This object specifies the next available index for object cipsCryMapPeerIndex which can be used for creating an entry in cipsIPsecCryMapPeerTable. |
| T/F cipsStaticCryptomapAutoPeer | 1.3.6.1.4.1.9.9.431.1.4.3.1.16 | TruthValue | read-create | If 'true' the destination address is taken as the peer address, while creating the tunnel. If 'false' the value shown by the object cipsStaticCryptomapCurPAddr is being used as the peer address. |
| IP cipsStaticCryptomapCurPAddr | 1.3.6.1.4.1.9.9.431.1.4.3.1.10 | InetAddress | read-only | The IP address of the peer to which this cryptomap entry is currently connected. The value of cipsStaticCryptomapCurPAddrType is 'unknown' and this MIB object is a zero-length string when no tunnels are presently spawned by this cryptomap entry or when cipsStaticCryptomapAutoPeer is equal to 'true'. |
| IPt cipsStaticCryptomapCurPAddrType | 1.3.6.1.4.1.9.9.431.1.4.3.1.9 | InetAddressType | read-only | This object represents the address type of cipsStaticCryptomapCurPAddr to which this cryptomap entry is currently connected. |
| STR cipsStaticCryptomapDescr | 1.3.6.1.4.1.9.9.431.1.4.3.1.4 | SnmpAdminString | read-only | The description string created by the SNMP agent while creating this cryptomap. The string generally identifies a description and the purpose of this policy. |
| cipsStaticCryptomapEntry | 1.3.6.1.4.1.9.9.431.1.4.3.1 | not-accessible | Each entry contains the attributes associated with a single static (fully specified) cryptomap entry, identified by its priority. | |
| CIP cipsStaticCryptomapIdleTimeout | 1.3.6.1.4.1.9.9.431.1.4.3.1.15 | CIPsecTunnelIdleTime | read-create | This object specifies the idle time (lack of traffic) in seconds of a tunnel spawned by this cryptomap after which the tunnel will be torn down. The default value of this object is the current value of cipsTunnelIdleTimeout. |
| OCT cipsStaticCryptomapIpFilter | 1.3.6.1.4.1.9.9.431.1.4.3.1.5 | OCTET STRING | read-create | This object specifies an IP protocol filter, cippfIpProfileName (defined in CISCO-IP-PROTOCOL-FILTER-MIB), to be secured using this cryptomap entry. When this object has a value of zero-length string, this object is not valid/applicable. |
| T/F cipsStaticCryptomapLevelHost | 1.3.6.1.4.1.9.9.431.1.4.3.1.14 | TruthValue | read-create | This object specifies the granularity of the IPSec SAs created using this IPSec policy entry. If this value is 'true', distinct SA bundles are created for distinct hosts at the end of the application traffic. |
| CIP cipsStaticCryptomapLifesize | 1.3.6.1.4.1.9.9.431.1.4.3.1.13 | CIPsecLifesize | read-create | This object identifies the lifesize (maximum traffic in bytes that may be carried) of the IPSec SAs created using this IPSec policy entry. When a Security Association (SA) is created using this IPsec policy entry, its lifesize takes the value of this object. The default value of this object is the current value of the object cipsTunnelLifesize. When a value 0 is specified in cipsStaticCryptomapLifesize, the default value is used as the lifesize. |
| CIP cipsStaticCryptomapLifetime | 1.3.6.1.4.1.9.9.431.1.4.3.1.12 | CIPsecLifetime | read-create | This object specifies the lifetime of the IPsec Security Associations (SA) created using this IPsec policy entry. The default value of this object is the current value of the object cipsTunnelLifetime. When a value 0 is specified in cipsStaticCryptomapLifetime, the default value is used as the lifetime. |
| U32 cipsStaticCryptomapNumPeers | 1.3.6.1.4.1.9.9.431.1.4.3.1.7 | Unsigned32 | read-only | This object reflects the number of peers associated with this cryptomap entry. The other peers listed in table cipsIPsecCryMapPeerTable are backup peers. |
| CIP cipsStaticCryptomapPfs | 1.3.6.1.4.1.9.9.431.1.4.3.1.11 | CIPsecDiffHellmanGrp | read-create | This object identifies if the tunnels instantiated due to this policy item should use Perfect Forward Secrecy (PFS) and if so, what group of Oakley they should use. |
| U32 cipsStaticCryptomapPriority | 1.3.6.1.4.1.9.9.431.1.4.3.1.2 | Unsigned32 | not-accessible | The priority of the cryptomap entry in the cryptomap set. A cryptomap entry with smaller cipsStaticCryptomapPriority value takes precedence over the ones with larger values. |
| cipsStaticCryptomapSetEntry | 1.3.6.1.4.1.9.9.431.1.4.1.1 | not-accessible | Each entry contains the attributes associated with a single static cryptomap set. | |
| STR cipsStaticCryptomapSetName | 1.3.6.1.4.1.9.9.431.1.4.3.1.1 | SnmpAdminString | not-accessible | The index of the static cryptomap table. The value of the string is the name string assigned by the NMS when defining a cryptomap set. |
| U32 cipsStaticCryptomapSetNumDynamic | 1.3.6.1.4.1.9.9.431.1.4.1.1.4 | Unsigned32 | read-only | This object reflects the number of dynamic cryptomap templates linked to this cryptomap set. |
| U32 cipsStaticCryptomapSetNumIsakmp | 1.3.6.1.4.1.9.9.431.1.4.1.1.2 | Unsigned32 | read-only | This object reflects the number of cryptomaps associated with this cryptomap set that use ISAKMP protocol to do key exchange. |
| U32 cipsStaticCryptomapSetNumManual | 1.3.6.1.4.1.9.9.431.1.4.1.1.3 | Unsigned32 | read-only | This object reflects the number of cryptomaps associated with this cryptomap set that require the operator to manually setup the keys and SPIs. |
| U32 cipsStaticCryptomapSetNumSAs | 1.3.6.1.4.1.9.9.431.1.4.1.1.6 | Unsigned32 | read-only | This object reflects the number of IPsec Security Associations that are active and were setup using this cryptomap set. |
| U32 cipsStaticCryptomapSetNumTED | 1.3.6.1.4.1.9.9.431.1.4.1.1.5 | Unsigned32 | read-only | This object reflects the number of dynamic cryptomap templates linked to this cryptomap set that have Tunnel Endpoint Discovery (TED) enabled. |
| U32 cipsStaticCryptomapSetSize | 1.3.6.1.4.1.9.9.431.1.4.1.1.1 | Unsigned32 | read-only | This object reflects the total number of cryptomap templates contained in this cryptomap set. |
| cipsStaticCryptomapSetTable | 1.3.6.1.4.1.9.9.431.1.4.1 | not-accessible | This read-only table contains the list of all cryptomap sets that are fully configured. The operator may include different types of cryptomaps in such a set - manual, ISAKMP or dynamic. An entry is added to (removed from) this table automatically by the agent when the first (last) 'active' entry with the corresponding cipsStaticCryptomapSetName is added to (removed from) cipsStaticCryptomapTable. | |
| ROW cipsStaticCryptomapStatus | 1.3.6.1.4.1.9.9.431.1.4.3.1.17 | RowStatus | read-create | This object identifies the status of the cryptomap entry represented by this conceptual row. |
| cipsStaticCryptomapTable | 1.3.6.1.4.1.9.9.431.1.4.3 | not-accessible | The table listing the member cryptomaps of the cryptomap sets that are configured on the managed entity. This table does not include the members of dynamic cryptomap sets that may be linked with the parent static cryptomap set. Deletion of a cipsStaticCryptomapEntry will fail if the cipsStaticCryptomapSetName this cipsStaticCryptomapEntry belongs to is referred by a cipsCryptomapSetIfEntry. | |
| CIP cipsStaticCryptomapType | 1.3.6.1.4.1.9.9.431.1.4.3.1.3 | CIPsecCryptomapType | read-create | The type of the cryptomap entry. This can be an ISAKMP cryptomap or manual. Dynamic cryptomaps are not counted in this table. |
| OCT cipsStaticCryptomapXformSetList | 1.3.6.1.4.1.9.9.431.1.4.3.1.6 | OCTET STRING | read-create | The list of cipsXformSetId that are members of this CipsStaticCryptomapEntry. The value of this object is a concatenation of zero or more 4-octet strings, where each 4-octet string contains a 32-bit cipsXformSetId value in network byte order. A zero length string value means this list has no members. |
| CIP cipsTunnelIdleTimeout | 1.3.6.1.4.1.9.9.431.1.1.3 | CIPsecTunnelIdleTime | read-write | The number of seconds of idle time (no activity) after which an IPsec tunnel (and its parent ISAKMP SA) is to be deleted. An IPsec tunnel never times out if a value 0 is specified. |
| CIP cipsTunnelLifesize | 1.3.6.1.4.1.9.9.431.1.1.2 | CIPsecLifesize | read-write | The default lifesize in KBytes assigned to an IPsec tunnel as a global policy (unless overridden in cryptomap definition). |
| CIP cipsTunnelLifetime | 1.3.6.1.4.1.9.9.431.1.1.1 | CIPsecLifetime | read-write | The default lifetime (in seconds) assigned to an IPsec tunnel as a global policy (maybe overridden in specific cryptomap definitions). |
| CIP cipsXformSetCompressionXform | 1.3.6.1.4.1.9.9.431.1.2.1.1.7 | CIPsecTransform | read-create | This object represents the transform used to implement packet compression. If the value of the corresponding instance of cipsXformSetSuite is 'suiteConf', 'suiteIntegEsp', 'suiteIntegAh', 'suiteConfAh', 'suiteIntegEspAhS', 'suiteConfIntegEsp', 'suiteConfIntegEspAh' or 'suiteOther', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'. |
| CIP cipsXformSetEncryptionXform | 1.3.6.1.4.1.9.9.431.1.2.1.1.4 | CIPsecTransform | read-create | This object represents the transform used for ESP encryption. The only values this object may assume are 'xformNONE', 'xformEspNULL', 'xformEspDES', 'xformEsp3DES', 'xformEspAES128', 'xformEspAES192', 'xformEspAES256', 'xformEspAESCtr128', 'xformEspAESCtr192', 'xformEspAESCtr256' and 'xformEspAESXCbcMac'. If the value of the corresponding instance of cipsXformSetSuite is 'suiteIntegAh', 'suiteIntegAhComp' or 'suiteOther', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'. |
| U32 cipsXformSetId | 1.3.6.1.4.1.9.9.431.1.2.1.1.2 | Unsigned32 | read-only | This is the sequence number of the transform set that uniquely identifies the transform set. Distinct transform sets must have distinct sequence numbers. |
| CIP cipsXformSetIntegrityXformAh | 1.3.6.1.4.1.9.9.431.1.2.1.1.6 | CIPsecTransform | read-create | This object represents the transform used to implement integrity check with AH protocol. If the value of the corresponding instance of cipsXformSetSuite is neither 'suiteIntegAh' nor 'suiteIntegAhComp', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'. |
| CIP cipsXformSetIntegrityXformEsp | 1.3.6.1.4.1.9.9.431.1.2.1.1.5 | CIPsecTransform | read-create | This object represents the transform used to implement integrity check with ESP protocol. If the value of the corresponding instance of cipsXformSetSuite is 'suiteIntegAh', 'suiteIntegAhComp' or 'suiteOther', this object must be set to 'xformNONE'. For any other value of the corresponding instance of cipsXformSetSuite, this object must not be set to 'xformNONE'. |
| CIP cipsXformSetMode | 1.3.6.1.4.1.9.9.431.1.2.1.1.8 | CIPsecEncapMode | read-create | This object represents the encapsulation mode of the transform set. |
| STR cipsXformSetName | 1.3.6.1.4.1.9.9.431.1.2.1.1.1 | SnmpAdminString | not-accessible | This object contains the name of the transform set corresponding to this conceptual row. |
| ROW cipsXformSetStatus | 1.3.6.1.4.1.9.9.431.1.2.1.1.9 | RowStatus | read-create | This object represents the status of the transform set entry. |
| CIP cipsXformSetSuite | 1.3.6.1.4.1.9.9.431.1.2.1.1.3 | CIPsecSecuritySuite | read-create | This object represents the suite of Phase-2 security protocols of this transform set. |
| ciscoIPsecCryptomapPeerGroup | 1.3.6.1.4.1.9.9.431.2.2.6 | A collection of objects displaying the binding of an IPsec peer address to the specified cryptomap. | ||
| NTF ciscoIPsecProvCryptomapAdded | 1.3.6.1.4.1.9.9.431.0.1 | This notification is generated when a new cryptomap is added to the specified cryptomap set. Object 'cipsStaticCryptomapSetSize' contains the number of cryptomap entries after the addition. | ||
| NTF ciscoIPsecProvCryptomapAttached | 1.3.6.1.4.1.9.9.431.0.3 | A cryptomap set must be attached to an interface of the device in order for it to be operational. This trap is generated when the cryptomap set attached to an active interface of the managed entity. The contents of the notification includes: Size of the attached cryptomap set, Number of ISAKMP cryptomaps in the set and Number of Dynamic cryptomaps in the set. | ||
| NTF ciscoIPsecProvCryptomapDeleted | 1.3.6.1.4.1.9.9.431.0.2 | This notification is generated when a cryptomap is removed from the specified cryptomap set. Object 'cipsStaticCryptomapSetSize' contains the number of cryptomap entries after the deletion. | ||
| NTF ciscoIPsecProvCryptomapDetached | 1.3.6.1.4.1.9.9.431.0.4 | This trap is generated when a cryptomap set is detached from an interafce to which it was bound earlier. The context of the event identifies the size of the cryptomap set. | ||
| ciscoIPsecProvDynCryptomapGroup | 1.3.6.1.4.1.9.9.431.2.2.4 | A collection of objects modeling the configuration of IPsec dynamic cryptomap elements. | ||
| ciscoIPsecProvGlobalsGroup | 1.3.6.1.4.1.9.9.431.2.2.1 | A collection of objects providing Global IPSec policy monitoring capability to a IPsec capable VPN router. | ||
| ciscoIPsecProvInfoGroup | 1.3.6.1.4.1.9.9.431.2.2.9 | A collection of objects providing current IPsec configuration information on the managedentity. | ||
| ciscoIPsecProvisioningMIB | 1.3.6.1.4.1.9.9.431 | IPSec is the next-generation network layer crypto framework described in RFC2401-2411. This MIB defines the IPsec configurations. It may be used to view and provision IPsec-based VPNs. To create an IPsec tunnel, you need first configure Internet Key Exchange (IKE). IKE negotiates Security Associations with the peer for IPsec. To find out how to configure IKE, please see CISCO-IKE-CONFIGURATION-MIB for detail. Once you setup IKE, you will have to configure IPsec. To configure IPsec, you need perform following steps. 1. Create an IPsec transform set. A transform set describes a security protocol (AH or ESP) with its corresponding algorithms. For example, ESP with the DES cipher algorithm and HMAC-SHA for authentication. 2. Create a cryptomap and its peers. This will a) select data flows that need security processing and b) defines the policy for these flows and the crypto peer that traffic needs to go to. 3. Apply cryptomap to an interface A crypto map is applied to an egress interface. Outgoing data flows are protected by this cryptomap. Acronyms The following acronyms are used in this document: Static Cryptomap Template: A static cryptomap template (or static cryptomap) is a security template created for IPsec. A static cryptomap pulls together various parts to set up an IPsec security association which includes: - which traffic should be protected by IPsec - where IPsec protected traffic should be sent - the local address used for the the IPsec traffic - which transform sets should be applied to this traffic Dynamic Cryptomap Template: A dynamic cryptomap template (or a dynamic cryptomap) is essentially a crypto map entry without all the parameters configured. It acts as a policy template where the missing parameters are later dynamically configured (as the result of an IPsec negotiation) to match a peer's requirements. Cryptomap Set: A cryptomap set may contain multiple cryptomap templates which specify an IPsec policy. TED: Tunnel Endpoint Discovery protocol MIB Structure ------------- This MIB provides the operational information on Cisco's IPsec implementation of IPsec. This MIB delineates ISAKMP and IPsec configuration. This MIB deals only with IPsec (Phase-2) configuration. The following entities are managed: a) IPsec Global Parameters b) IPsec transform set definitions c) Cryptomap Group - Cryptomap Set Table - Cryptomap Table - CryptomapSet Transform Binding Table - CryptomapSet Peer Binding Table - CryptomapSet Interface Binding Table d) Notification Control Group e) Notifications Group | ||
| ciscoIPsecProvisioningMIBConform | 1.3.6.1.4.1.9.9.431.2 | |||
| ciscoIPsecProvisioningMIBNotifs | 1.3.6.1.4.1.9.9.431.0 | |||
| ciscoIPsecProvisioningMIBObjects | 1.3.6.1.4.1.9.9.431.1 | |||
| ciscoIPsecProvMIBCompliance | 1.3.6.1.4.1.9.9.431.2.1.1 | The compliance statement for entities which implement the Cisco IPsec Provisioning MIB. | ||
| ciscoIPsecProvMIBComplianceRev1 | 1.3.6.1.4.1.9.9.431.2.1.2 | The compliance statement for entities which implement the Cisco IPsec Provisioning MIB. | ||
| ciscoIPsecProvMIBCompliances | 1.3.6.1.4.1.9.9.431.2.1 | |||
| ciscoIPsecProvMIBGroups | 1.3.6.1.4.1.9.9.431.2.2 | |||
| ciscoIPsecProvNotifCntlGroup | 1.3.6.1.4.1.9.9.431.2.2.7 | A collection of objects providing IPsec Notification capability to a IPsec-capable router. It is mandatory to implement this set of objects pertaining to IOS notifications about IPSec activity. | ||
| ciscoIPsecProvNotifGroup | 1.3.6.1.4.1.9.9.431.2.2.8 | A collection of notification objects signaling changes to the IPsec configuration on the managed entity. | ||
| ciscoIPsecProvStCryptomapGroup | 1.3.6.1.4.1.9.9.431.2.2.3 | A collection of objects modeling static crypto configuration of the Static (fully specified) Cryptomap Sets on the managed entity. | ||
| ciscoIPsecProvTedCryptomapGroup | 1.3.6.1.4.1.9.9.431.2.2.5 | A collection of objects instrumenting the properties of the Cryptomaps using tunnel endpoint discovery protocol. | ||
| ciscoIPsecProvXformsGroup | 1.3.6.1.4.1.9.9.431.2.2.2 | A collection of objects modeling IPsec transform sets and transform set mappings. |
RFC description
Configures and monitors IPsec VPN tunnels, transform sets, and cryptomaps on Cisco routers.
Start monitoring Cisco VPN router/security appliance/concentrator with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.