CISCO-LWAPP-TRUSTSEC-MIB

All MIBs › CISCO-LWAPP-TRUSTSEC-MIB

Organization: Cisco Systems Inc.

Last Updated: 2017-02-10

Category: Security

Description: Manages Cisco TrustSec security group tagging policies on LWAPP-controlled wireless infrastructure.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-LWAPP-TRUSTSEC-MIB?

CISCO-LWAPP-TRUSTSEC-MIB configures and monitors Cisco TrustSec (CTS) security group tagging on LWAPP-controlled wireless infrastructure, allowing network devices to authenticate, authorize, and tag traffic for hop-by-hop encryption and access control. It belongs to the Cisco enterprise wireless security technology area, exposing configuration objects for device identity/credentials, security group tag assignment, and SXP (SGT Exchange Protocol) peer relationships between the controller/access points and TrustSec-aware switches. It is primarily a configuration and status MIB—tracking whether TrustSec and inline tagging are enabled (clCtsEnableStatus, clCtsInlineTagEnableStatus) and the operational state and row status of each SXP peer session—rather than exposing classic hardware sensors, though SXP peer session status functions as a software connectivity health indicator. It depends on the broader Cisco TrustSec architecture and related device-identity/EAP-FAST authentication standards referenced in its description. This MIB is deployed on Cisco wireless LAN controllers and access points participating in a TrustSec-secured campus network alongside TrustSec-capable switches. Engineers can download the CISCO-LWAPP-TRUSTSEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-LWAPP-TRUSTSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco wireless LAN controller
Cisco TrustSec-capable access point

Monitoring Examples

A security operations team polls clCtsApSxpPeerTable/clCtsApSxpPeerEntry to check clCtsApSxpPeerRowStatus and clCtsApSxpPeerMode for each configured SXP peer, confirming the wireless controller's SGT-to-IP bindings are being properly exchanged with a downstream switch. If clCtsEnableStatus is enabled but an SXP peer entry shows an inactive row status, that indicates a broken TrustSec propagation path that would let untagged traffic slip past policy enforcement.

What Can Be Monitored

TrustSec/inline tagging enable status
device ID and credential configuration
security group tag assignment
SXP peer connection status and mode

Imported Objects

From CISCO-LWAPP-AP-MIB

cLApSysMacAddress

OBJECT-TYPE

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TRUSTSEC-TC-MIB

CtsSecurityGroupTag

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoLwappTrustSecMIB	1.3.6.1.4.1.9.9.836			This MIB module is for the configuration of a network device on the Cisco Trusted Security (TrustSec) system. TrustSec secures a network fabric by authenticating and authorizing each device connecting to the network, allowing for the encryption, authentication and replay protection of data traffic on a hop by hop basis. Glossary : TrustSec - Cisco Trusted Security EAP-FAST - Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling (RFC 4851) PAC - Protected Access Credential A credential dynamically downloaded from the Access Control Server. ACS - Access Control Server SGT - Security Group Tag SXP - SGT Exchange Protocol. A tag identifying its source, assigned to a packet on ingress to a TrustSec cloud, and used to determine security and other policy to be applied to it along its path through the cloud. This MIB module is for the configuration and status query of SGT Exchange Protocol over TCP (SXPoTCP) feature of the device on the Cisco's Trusted Security (TrustSec) system. Security Group Tag (SGT) identifying its source, assigned to a packet on ingress to a TrustSec cloud, and used to determine security and other policy to be applied to it along its path through the cloud.
clCtsMIBNotifs	1.3.6.1.4.1.9.9.836.0
clCtsTableMIBObjects	1.3.6.1.4.1.9.9.836.1
clCtsApSxpPeerTable	1.3.6.1.4.1.9.9.836.1.1		not-accessible	A list of SXP peers configured on this device. It is a list of IP addresses of respective SXP connection peers configured for this device. SXP peers exchange security group tags information of clients through SxpV4 protocol.
cLCtsApSxpPeerEntry	1.3.6.1.4.1.9.9.836.1.1.1		not-accessible	An entry containing management information of a particular SXP peers.
IPt clCtsApSxpPeerIpType	1.3.6.1.4.1.9.9.836.1.1.1.1	InetAddressType	not-accessible	The type of Internet address of the peer SXP device.
IP clCtsApSxpPeerIp	1.3.6.1.4.1.9.9.836.1.1.1.2	InetAddress	not-accessible	The Internet address of the SXP peer device. The type of this address is determined by the value of cLCtsApSxpPeerIpType object.
INT clCtsApSxpMode	1.3.6.1.4.1.9.9.836.1.1.1.3	INTEGER	read-create	This object specifies the device mode of this SXP connection. A value of 'speaker' indicates that device will acts as the speaker in this SXP connection. A value of 'listener' indicates that device will acts as the listener in this SXP connection. A value of 'both' indicates that device will acts as both speaker and listener making it a Bi-directional SXP connection.
INT clCtsApSxpPeerPassword	1.3.6.1.4.1.9.9.836.1.1.1.4	INTEGER	read-create	This object specifies to configure the password of the sxp peer device.
ROW clCtsApSxpPeerRowStatus	1.3.6.1.4.1.9.9.836.1.1.1.5	RowStatus	read-create	This object specifies the conceptual status of the row.
clCtsMIBConform	1.3.6.1.4.1.9.9.836.2
clCtsMIBCompliances	1.3.6.1.4.1.9.9.836.2.1
clCtsMIBCompliance	1.3.6.1.4.1.9.9.836.2.1.1			The compliance statement for the SNMP entities that implement the ciscoLwappTrustSecMIB module.
clCtsMIBGroups	1.3.6.1.4.1.9.9.836.2.2
clCtsGroup	1.3.6.1.4.1.9.9.836.2.2.1			This collection of objects represents the information about the general attributes of Trustsec.
clCtsGlobalMIBObjects	1.3.6.1.4.1.9.9.836.3
CTS clCtsSecurityGroupTagId	1.3.6.1.4.1.9.9.836.3.1	CtsSecurityGroupTag	read-write	This object specifies user to specify the SGT for the packets originating from this device. A value of zero for this object indicates that no SGT has been configured.
STR clCtsDeviceId	1.3.6.1.4.1.9.9.836.3.2	SnmpAdminString	read-write	This object specifies the identifier for the device. This identifier and the device password (specified by clCtsDevicePassword) are used together by the Cisco Trusted Security feature for authenticating the device. The object may not be set to a zero length string. The system will return a zero length string for this object either when there is no value configured for this object or TrustSec credentials for the device have been cleared by setting clCtsCredentialsClearAll to 'true'.
STR clCtsDevicePassword	1.3.6.1.4.1.9.9.836.3.3	SnmpAdminString	read-write	This object specifies user to specify the password for the device. This password and the device identifier (specified by clCtsDeviceId) are used together by the Cisco Trusted Security feature for authenticating the device. The object may not be set to a zero length string. When read, this object always returns the value of a zero-length octet string.
T/F clCtsInlineTagEnableStatus	1.3.6.1.4.1.9.9.836.3.4	TruthValue	read-write	This object specifies whether the inline tagging option is Enabled or disabled. A 'true' value indicates that inline tagging option is enabled. A 'false' value indicates that inline tagging option is disabled.
T/F clCtsEnableStatus	1.3.6.1.4.1.9.9.836.3.6	TruthValue	read-write	This object specifies whether the CTS option is Enabled or disabled. A value of 'true' indicates that CTS is enabled. A value of 'false' indicates that CTS is disabled.

RFC description

Cisco TrustSec (Trusted Security) network fabric configuration for wireless LAN access points including SGT management.

Start monitoring Cisco wireless LAN controllers and access points with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-LWAPP-TRUSTSEC-MIB

What Is CISCO-LWAPP-TRUSTSEC-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description