CISCO-SECY-EXT-MIB

All MIBs › CISCO-SECY-EXT-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2016-12-15

Category: Cisco Devices, VPN and Security

Description: Extends IEEE 802.1AE MACsec management for Cisco-specific MAC Security encryption and key agreement parameters.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-SECY-EXT-MIB?

CISCO-SECY-EXT-MIB extends the standard IEEE8021-SECY-MIB to add Cisco-specific statistics and parameters for IEEE 802.1AE MACsec (MAC Security), the Layer 2 encryption and key-agreement standard. It belongs to Cisco's network security/switching feature area covering link-layer encryption on switches and routers. The data it exposes is detailed performance/fault counters for MACsec-protected links: receive/transmit control-packet counts, transform-error packets, tagged-control packets, and per-secure-channel statistics such as unused security associations. This MIB is used to monitor the software/hardware status of MACsec encryption processing, surfacing transform errors and control-packet anomalies that indicate a failing or misconfigured MACsec session rather than general chassis health. It has an explicit, stated dependency on IEEE8021-SECY-MIB, which it extends rather than replaces, and it is deployed on Cisco switches and routers with MACsec-capable interfaces securing point-to-point or campus/WAN links. Engineers can download the CISCO-SECY-EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-SECY-EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco switches and routers with MACsec-capable interfaces

Monitoring Examples

An operator polls cseSecyStatsExtTable/cseSecyStatsExtEntry to check cseSecyStatsRxTransformErrPkts and cseSecyStatsTxTransformErrPkts on a MACsec-secured interface, where a nonzero or rising count indicates decryption/encryption failures, often from a key mismatch. The cseSecyTxSCStatsExtTable exposes cseSecyTxSCStatsSANotInUse to show whether a configured security association channel is actually carrying traffic. cseSecyIfRxStatsTable/cseSecyIfRxStatsEntry aggregates per-interface receive statistics, letting an admin confirm cseSecyStatsRxControlPkts and cseSecyStatsRxTaggedCtrlPkts are within expected bounds for MACsec key-exchange traffic.

What Can Be Monitored

MACsec transform (encryption/decryption) errors
MACsec control packet counts (rx/tx)
tagged control packet counts
security association (SA) usage per secure channel
per-interface MACsec receive statistics

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From HCNUM-TC

CounterBasedGauge64

From IEEE8021-SECY-MIB

secyIfInterfaceIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using cseSecyStatsRxTransformErrPkts OID:

Select a Cisco switches and routers with MACsec-capable interface as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cseSecyStatsRxTransformErrPkts into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of transform error packets received on this interface. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoSecyExtMIB	1.3.6.1.4.1.9.9.835			A MIB module for extending IEEE8021-SECY-MIB.
ciscoSecyExtMIBNotifs	1.3.6.1.4.1.9.9.835.0
ciscoSecyExtMIBObjects	1.3.6.1.4.1.9.9.835.1
ciscoSecyExtMIBStatsObjects	1.3.6.1.4.1.9.9.835.1.1
cseSecyStatsExtTable	1.3.6.1.4.1.9.9.835.1.1.1		not-accessible	This table provides the additional statistics information of each SecY supported by the MAC security entity.
cseSecyStatsExtEntry	1.3.6.1.4.1.9.9.835.1.1.1.1		not-accessible	An entry containing counters for statistics or diagnosis for a SecY.
C64 cseSecyStatsRxTransformErrPktsEx	1.3.6.1.4.1.9.9.835.1.1.1.1.1	Counter64	read-only	The number of transform error packets received on this interface.
C64 cseSecyStatsRxControlPkts	1.3.6.1.4.1.9.9.835.1.1.1.1.2	Counter64	read-only	The number of control packets received on this interface.
C64 cseSecyStatsRxTaggedCtrlPkts	1.3.6.1.4.1.9.9.835.1.1.1.1.3	Counter64	read-only	The number of tagged control packets received on this interface.
C64 cseSecyStatsTxTransformErrPkts	1.3.6.1.4.1.9.9.835.1.1.1.1.4	Counter64	read-only	The number of tranform error packets transmitted via this interface.
C64 cseSecyStatsTxControlPkts	1.3.6.1.4.1.9.9.835.1.1.1.1.5	Counter64	read-only	The number of control packets transmitted via this interface.
cseSecyTxSCStatsExtTable	1.3.6.1.4.1.9.9.835.1.1.2		not-accessible	A table contains additional statistics information for each transmitting SC in the MAC security entity.
cseSecyTxSCStatsExtEntry	1.3.6.1.4.1.9.9.835.1.1.2.1		not-accessible	An entry containing statistics information of a transmitting SC.
C64 cseSecyTxSCStatsSANotInUse	1.3.6.1.4.1.9.9.835.1.1.2.1.1	Counter64	read-only	The number of SA not in use for this transmitting SC.
cseSecyIfRxStatsTable	1.3.6.1.4.1.9.9.835.1.1.3		not-accessible	A table contains the RX statistics information for each MAC security capable interface.
cseSecyIfRxStatsEntry	1.3.6.1.4.1.9.9.835.1.1.3.1		not-accessible	An entry containing the RX statistics information of a MAC Security capable interface.
C64 cseSecyIfRxUnicastUncontrolledPkts	1.3.6.1.4.1.9.9.835.1.1.3.1.1	Counter64	read-only	The number of unicast uncontrolled packets received via this interface.
C64 cseSecyIfRxMulticastUncontrolledPkts	1.3.6.1.4.1.9.9.835.1.1.3.1.2	Counter64	read-only	The number of multicast uncontrolled packets received via this interface.
C64 cseSecyIfRxBroadcastUncontrolledPkts	1.3.6.1.4.1.9.9.835.1.1.3.1.3	Counter64	read-only	The number of broadcast uncontrolled packets received via this interface.
C64 cseSecyIfRxUncontrolledPktsDrop	1.3.6.1.4.1.9.9.835.1.1.3.1.4	Counter64	read-only	The number of uncontrolled packets drop received via this interface.
C64 cseSecyIfRxUncontrolledPktsError	1.3.6.1.4.1.9.9.835.1.1.3.1.5	Counter64	read-only	The number of uncontrolled packets error received via this interface.
C64 cseSecyIfRxUnicastControlledPkts	1.3.6.1.4.1.9.9.835.1.1.3.1.6	Counter64	read-only	The number of unicast controlled packets received via this interface.
C64 cseSecyIfRxMulticastControlledPkts	1.3.6.1.4.1.9.9.835.1.1.3.1.7	Counter64	read-only	The number of multicast controlled packets received via this interface.
C64 cseSecyIfRxBroadcastControlledPkts	1.3.6.1.4.1.9.9.835.1.1.3.1.8	Counter64	read-only	The number of broadcast controlled packets received via this interface.
C64 cseSecyIfRxControlledPktsDrop	1.3.6.1.4.1.9.9.835.1.1.3.1.9	Counter64	read-only	The number of controlled packets drop received via this interface.
C64 cseSecyIfRxControlledPktsError	1.3.6.1.4.1.9.9.835.1.1.3.1.10	Counter64	read-only	The number of controlled packets error received via this interface.
C64 cseSecyIfRxUncontrolledOctets	1.3.6.1.4.1.9.9.835.1.1.3.1.11	Counter64	read-only	The number of uncontrolled octets received via this interface.
C64 cseSecyIfRxControlledOctets	1.3.6.1.4.1.9.9.835.1.1.3.1.12	Counter64	read-only	The number of controlled octets received via this interface.
NUM cseSecyIfRxUncontrolledPktRate	1.3.6.1.4.1.9.9.835.1.1.3.1.13	CounterBasedGauge64	read-only	The number of uncontrolled packets per second received via this interface.
NUM cseSecyIfRxUncontrolledOctetRate	1.3.6.1.4.1.9.9.835.1.1.3.1.14	CounterBasedGauge64	read-only	The number of uncontrolled byte per second received via this interface.
NUM cseSecyIfRxControlledPktRate	1.3.6.1.4.1.9.9.835.1.1.3.1.15	CounterBasedGauge64	read-only	The number of controlled packets per second received via this interface.
NUM cseSecyIfRxControlledOctetRate	1.3.6.1.4.1.9.9.835.1.1.3.1.16	CounterBasedGauge64	read-only	The number of controlled byte per second received via this interface.
cseSecyIfTxStatsTable	1.3.6.1.4.1.9.9.835.1.1.4		not-accessible	A table contains the TX statistics information for each MAC security capable interface.
cseSecyIfTxStatsEntry	1.3.6.1.4.1.9.9.835.1.1.4.1		not-accessible	An entry containing the TX statistics information of a MAC Security capable interface.
C64 cseSecyIfTxUnicastUncontrolledPkts	1.3.6.1.4.1.9.9.835.1.1.4.1.1	Counter64	read-only	The number of unicast uncontrolled packets transmitted via this interface.
C64 cseSecyIfTxMulticastUncontrolledPkts	1.3.6.1.4.1.9.9.835.1.1.4.1.2	Counter64	read-only	The number of multicast uncontrolled packets transmitted via this interface.
C64 cseSecyIfTxBroadcastUncontrolledPkts	1.3.6.1.4.1.9.9.835.1.1.4.1.3	Counter64	read-only	The number of broadcast uncontrolled packets transmitted via this interface.
C64 cseSecyIfTxUncontrolledPktsDrop	1.3.6.1.4.1.9.9.835.1.1.4.1.4	Counter64	read-only	The number of uncontrolled packets drop transmitted via this interface.
C64 cseSecyIfTxUncontrolledPktsError	1.3.6.1.4.1.9.9.835.1.1.4.1.5	Counter64	read-only	The number of uncontrolled packets error transmitted via this interface.
C64 cseSecyIfTxUnicastControlledPkts	1.3.6.1.4.1.9.9.835.1.1.4.1.6	Counter64	read-only	The number of unicast controlled packets transmitted via this interface.
C64 cseSecyIfTxMulticastControlledPkts	1.3.6.1.4.1.9.9.835.1.1.4.1.7	Counter64	read-only	The number of multicast controlled packets transmitted via this interface.
C64 cseSecyIfTxBroadcastControlledPkts	1.3.6.1.4.1.9.9.835.1.1.4.1.8	Counter64	read-only	The number of broadcast controlled packets transmitted via this interface.
C64 cseSecyIfTxControlledPktsDrop	1.3.6.1.4.1.9.9.835.1.1.4.1.9	Counter64	read-only	The number of controlled packets drop transmitted via this interface.
C64 cseSecyIfTxControlledPktsError	1.3.6.1.4.1.9.9.835.1.1.4.1.10	Counter64	read-only	The number of controlled packets error transmitted via this interface.
C64 cseSecyIfTxUncontrolledOctets	1.3.6.1.4.1.9.9.835.1.1.4.1.11	Counter64	read-only	The number of uncontrolled octets transmitted via this interface.
C64 cseSecyIfTxControlledOctets	1.3.6.1.4.1.9.9.835.1.1.4.1.12	Counter64	read-only	The number of controlled octets transmitted via this interface.
C64 cseSecyIfTxCommonOctets	1.3.6.1.4.1.9.9.835.1.1.4.1.13	Counter64	read-only	The number of common octets transmitted via this interface.
NUM cseSecyIfTxUncontrolledPktRate	1.3.6.1.4.1.9.9.835.1.1.4.1.14	CounterBasedGauge64	read-only	The number of uncontrolled packets per second transmitted via this interface.
NUM cseSecyIfTxUncontrolledOctetRate	1.3.6.1.4.1.9.9.835.1.1.4.1.15	CounterBasedGauge64	read-only	The number of uncontrolled byte per second transmitted via this interface.
NUM cseSecyIfTxControlledPktRate	1.3.6.1.4.1.9.9.835.1.1.4.1.16	CounterBasedGauge64	read-only	The number of controlled packets per second transmitted via this interface.
NUM cseSecyIfTxControlledOctetRate	1.3.6.1.4.1.9.9.835.1.1.4.1.17	CounterBasedGauge64	read-only	The number of controlled byte per second transmitted via this interface.
ciscoSecyExtMIBConform	1.3.6.1.4.1.9.9.835.2
ciscoSecyExtMIBCompliances	1.3.6.1.4.1.9.9.835.2.1
cseSecyExtMIBCompliance	1.3.6.1.4.1.9.9.835.2.1.1			The compliance statement for CISCO-SECY-EXT-MIB. containing default object groups.
ciscoSecyExtMIBGroups	1.3.6.1.4.1.9.9.835.2.2
cseSecyStatsExtGroup	1.3.6.1.4.1.9.9.835.2.2.1			A collection of objects providing additional SecY statistics information.
cseSecyTxSCStatsExtGroup	1.3.6.1.4.1.9.9.835.2.2.2			A collection of objects providing the addtional transmitting SC Statistics information.
cseSecyIfRxStatsGroup	1.3.6.1.4.1.9.9.835.2.2.3			A collection of objects providing the Rx statistics for the MAC security capable interface.
cseSecyIfTxStatsGroup	1.3.6.1.4.1.9.9.835.2.2.4			A collection of objects providing the Tx statistics for the MAC security capable interface.

RFC description

Extends IEEE 802.1AE MAC Security (MACsec) MIB with additional statistics and diagnostic counters.

Start monitoring Cisco switches and routers with MACsec-capable interfaces with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-SECY-EXT-MIB