CISCO-WIRELESS-P2P-BPI-MIB

All MIBs › CISCO-WIRELESS-P2P-BPI-MIB

Organization: Cisco Systems Inc.

Last Updated: 1999-05-18

Category: Vendor: Cisco Devices, Wireless and WLAN

Description: Manages Cisco wireless point-to-point Baseline Privacy Interface (BPI) encryption for secure links.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-WIRELESS-P2P-BPI-MIB?

CISCO-WIRELESS-P2P-BPI-MIB is a Cisco proprietary module that manages the Baseline Privacy Interface (BPI) encryption subsystem on Cisco point-to-point wireless radio cards, a specialization of the MCNS DOCSIS docsBpiMib for fixed wireless microwave links. It exposes configuration and state data for the security association between radio endpoints, including public key material, authorization state machines, and key lifetime timers. This makes it valuable for monitoring the software and security status of the link: administrators can track whether privacy/encryption is enabled, the current authorization state (authorized, unauthorized, key-reject), and countdown timers for key and authorization expiry to catch encryption failures before they cause a link outage. The module is explicitly derived from and dependent on the MCNS/DOCSIS docsBpiMib textual conventions used for cable modem BPI, adapted here for point-to-point radio links rather than cable plants. It is typically deployed on Cisco wireless bridge/backhaul radios used in point-to-point microwave links where encrypted, authenticated connectivity between two fixed radio units must be continuously verified. Engineers can download the CISCO-WIRELESS-P2P-BPI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-WIRELESS-P2P-BPI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco point-to-point wireless bridge/backhaul radio

Monitoring Examples

An administrator polling cwrBpiRsBaseTable/cwrBpiRsBaseEntry can read cwrBpiRsPrivacyEnable to confirm encryption is active and cwrBpiRsAuthState to see whether the radio is currently authorized. Watching cwrBpiRsAuthExpires and cwrBpiRsAuthGraceTime alongside cwrBpiRsTEKGraceTime reveals whether a key renegotiation is imminent or overdue. If cwrBpiRsAuthState drops out of the authorized state while cwrBpiRsAuthWaitTimeout or cwrBpiRsReauthWaitTimeout counters climb, that signals a failed re-authorization handshake that will soon break the encrypted link.

What Can Be Monitored

privacy/encryption enable state
authorization state
public key
key sequence number
authorization expiry timer
authorization grace time
TEK grace time
authorization wait timeout

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TimeInterval
TruthValue

How to Use in IPNetwork Monitor

Example using cwrBpiRsAuthRequests OID:

Select a Cisco point-to-point wireless bridge/backhaul radio (legacy) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cwrBpiRsAuthRequests into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the count of times the Radio Slave has transmitted an Authorization Request message. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoWirelessP2pBpiMIB	1.3.6.1.4.1.9.9.135			This is the MIB Module for the Baseline Privacy Interface (BPI) at Point to Point Wireless Radio Card. This is a specialization on the MCNS docsBpiMib for Cisco Wireless point to point communication links.
cwrBpiBasicCompliance	1.3.6.1.4.1.9.9.135.3.1.1			The compliance statement for devices which implement the Cisco Wireless Radio point to point Baseline Privacy Interface.
cwrBpiCompliances	1.3.6.1.4.1.9.9.135.3.1
cwrBpiConformance	1.3.6.1.4.1.9.9.135.3
cwrBpiGroups	1.3.6.1.4.1.9.9.135.3.2
cwrBpiMIBObjects	1.3.6.1.4.1.9.9.135.1
cwrBpiNotification	1.3.6.1.4.1.9.9.135.2
cwrBpiRmAuthEntry	1.3.6.1.4.1.9.9.135.1.2.1.1		not-accessible	An entry containing objects describing attributes of one authorization association. The Radio master MUST create one entry per Radio Slave per MAC interface, based on the receipt of an Authorization Request message, and MUST not delete the entry before the Radio Slave authorization permanently expires.
INT cwrBpiRmAuthInvalidErrorCode	1.3.6.1.4.1.9.9.135.1.2.1.1.10	INTEGER	read-only	Error-Code in most recent Authorization Invalid message transmitted to the Radio Slave. On bootup, this has value no-information(0). At all other times, this object reflects the error code transmitted
STR cwrBpiRmAuthInvalidErrorString	1.3.6.1.4.1.9.9.135.1.2.1.1.11	DisplayString	read-only	Display-String in most recent Authorization Invalid message transmitted to the Radio Slave. This is a zero length string if no Authorization Invalid message has been transmitted to the Radio Slave.
T/F cwrBpiRmAuthPrivacyEnable	1.3.6.1.4.1.9.9.135.1.2.1.1.1	TruthValue	read-write	This object identifies whether the Master Radio is provisioned to use Encryption or not.
NUM cwrBpiRmAuthRsExpires	1.3.6.1.4.1.9.9.135.1.2.1.1.4	TimeInterval	read-only	The number of seconds left before the current authorization for this Radio Slave expires. If this Radio Slave does not have an active authorization, then the value is zero.
C32 cwrBpiRmAuthRsInvalids	1.3.6.1.4.1.9.9.135.1.2.1.1.9	Counter32	read-only	Count of times the Radio Master has transmitted an Authorization Invalid message to this Radio Slave.
INT cwrBpiRmAuthRsKeySequenceNumber	1.3.6.1.4.1.9.9.135.1.2.1.1.3	INTEGER	read-only	The authorization key sequence number for this Radio Slave.
INT cwrBpiRmAuthRsLifetime	1.3.6.1.4.1.9.9.135.1.2.1.1.5	INTEGER	read-write	Lifetime, in seconds, the Radio Master assigns to an authorization key for this Radio Slave. NOTE: When installed in the field, this variable should NEVER be set below 86400 which is the lower limit by standard. This variable accepts a wider range to facilitate testing.
OCT cwrBpiRmAuthRsPublicKey	1.3.6.1.4.1.9.9.135.1.2.1.1.2	OCTET STRING	read-only	Public key of the Radio Slave encoded as an ASN.1 SubjectPublicKeyInfo object as defined in the RSA Encryption Standard (PKCS #1) [RSA1]. This is a zero-length string if the Radio Master does not retain the public key.
C32 cwrBpiRmAuthRsReplies	1.3.6.1.4.1.9.9.135.1.2.1.1.8	Counter32	read-only	Count of times the Radio master has transmitted an Authorization Reply message to this Radio Slave.
C32 cwrBpiRmAuthRsRequests	1.3.6.1.4.1.9.9.135.1.2.1.1.7	Counter32	read-only	Count of times the Radio Master has received an Authorization Request message from this Radio Slave.
T/F cwrBpiRmAuthRsReset	1.3.6.1.4.1.9.9.135.1.2.1.1.6	TruthValue	read-write	Setting this object to True(1) causes the Radio Master to invalidate the current Radio Slave authorization key, to transmit an Authorization Invalid message to the Radio Slave, and to invalidate the unicast TEK associated with this Radio Slave authorization. Reading this object always returns False
cwrBpiRmAuthTable	1.3.6.1.4.1.9.9.135.1.2.1		not-accessible	Describes the attributes of each Radio Master authorization association. The Radio master maintains one authorization association with each Baseline Privacy-enabled Radio Slave on each Radio Master MAC interface.
cwrBpiRmGroup	1.3.6.1.4.1.9.9.135.3.2.2			A collection of objects providing Radio Master BPI status and control.
C32 cwrBpiRmKeyReplies	1.3.6.1.4.1.9.9.135.1.2.2.1.7	Counter32	read-only	Count of times the Radio master has transmitted a Key Reply message.
C32 cwrBpiRmKeyRequests	1.3.6.1.4.1.9.9.135.1.2.2.1.6	Counter32	read-only	Count of times the Radio Master has received a Key Request message.
cwrBpiRmObjects	1.3.6.1.4.1.9.9.135.1.2
T/F cwrBpiRmTEKEncryptionNegotiated	1.3.6.1.4.1.9.9.135.1.2.2.1.1	TruthValue	read-only	This identifies whether this TEK service is using encryption or not. Encryption may not be in use even though cwrBpiRmAuthPrivacyEnable is provisioned. This is possible if the master is not configured for privacy or it's not running an encryption capable image.
cwrBpiRmTEKEntry	1.3.6.1.4.1.9.9.135.1.2.2.1		not-accessible	An entry containing objects describing attributes of one TEK service on a particular Radio Master MAC interface. The Radio Master MUST create one entry per TEK Service per MAC interface, based on the receipt of an Key Request message, and MUST not delete the entry before the Radio Slave authorization for that TEK Service permanently expires.
NUM cwrBpiRmTEKExpiresNew	1.3.6.1.4.1.9.9.135.1.2.2.1.4	TimeInterval	read-only	The number of seconds left to expire for the newest active key for this TEK association. If this TEK association has no active keys then this value will be zero.
NUM cwrBpiRmTEKExpiresOld	1.3.6.1.4.1.9.9.135.1.2.2.1.3	TimeInterval	read-only	The number of seconds left to expire for the oldest active key for this TEK association. If this TEK associateion has no active key then the value will be zero.
INT cwrBpiRmTEKInvalidErrorCode	1.3.6.1.4.1.9.9.135.1.2.2.1.9	INTEGER	read-only	Error-Code in most recent TEK Invalid message sent in association with this TEK service. On bootup, this has value no-information(0). At all other times, this object reflects the error code received
STR cwrBpiRmTEKInvalidErrorString	1.3.6.1.4.1.9.9.135.1.2.2.1.10	DisplayString	read-only	Display-String in the most recent TEK Invalid message sent in ssociation with this BPI TEK service. This is a zero length string if no TEK Invalid message has been received since reboot.
C32 cwrBpiRmTEKInvalids	1.3.6.1.4.1.9.9.135.1.2.2.1.8	Counter32	read-only	Count of times the Radio Master has transmitted a TEK Invalid message.
INT cwrBpiRmTEKLifetime	1.3.6.1.4.1.9.9.135.1.2.2.1.2	INTEGER	read-write	Lifetime, in seconds, the Radio Master assigns to keys for this TEK association. NOTE: When installed in the field, this variable should NEVER be set below 1800 which is the lower limit by standard. This variable accepts a wider range to facilitate testing.
T/F cwrBpiRmTEKReset	1.3.6.1.4.1.9.9.135.1.2.2.1.5	TruthValue	read-write	Setting this object to TRUE causes the Radio Master to invalidate the current active TEK(s) (plural due to key transition periods), and to generate a new TEK. Reading this object always returns FALSE.
cwrBpiRmTEKTable	1.3.6.1.4.1.9.9.135.1.2.2		not-accessible	Describes the attributes of each Radio Slave Traffic Encryption Key (TEK) association. The Radio master maintains one TEK association for the Radio Slave.
NUM cwrBpiRsAuthExpires	1.3.6.1.4.1.9.9.135.1.1.1.1.5	TimeInterval	read-only	The number of seconds left before the current authorization for this FSM expires. If the Radio Slave does not have an active authorization, then this value is 0.
INT cwrBpiRsAuthGraceTime	1.3.6.1.4.1.9.9.135.1.1.1.1.7	INTEGER	read-write	Grace time for an authorization key. A Radio Slave is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires. The value of this object cannot be changed while the authorization state machine is running. NOTE: When installed in the field, this variable should NEVER be set below 300 which is the lower limit by standard. This variable accepts a wider range to facilitate testing.
INT cwrBpiRsAuthInvalidErrorCode	1.3.6.1.4.1.9.9.135.1.1.1.1.16	INTEGER	read-only	Error-Code in most recent Authorization Invalid message received by the Radio Slave. On bootup, this has value no-information(0). At all other times, this object reflects the error code received
STR cwrBpiRsAuthInvalidErrorString	1.3.6.1.4.1.9.9.135.1.1.1.1.17	DisplayString	read-only	Display-String in most recent Authorization Invalid message received by the Radio Slave. This is a zero length string if no Authorization Invalid message has been received since reboot.
C32 cwrBpiRsAuthInvalids	1.3.6.1.4.1.9.9.135.1.1.1.1.15	Counter32	read-only	Count of times the Radio Slave has received an Authorization Invalid message.
INT cwrBpiRsAuthKeySequenceNumber	1.3.6.1.4.1.9.9.135.1.1.1.1.4	INTEGER	read-only	The authorization key sequence number for this FSM.
C32 cwrBpiRsAuthReplies	1.3.6.1.4.1.9.9.135.1.1.1.1.14	Counter32	read-only	Count of times the Radio Slave has received an Authorization Reply message.
C32 cwrBpiRsAuthRequestsEx	1.3.6.1.4.1.9.9.135.1.1.1.1.13	Counter32	read-only	Count of times the Radio Slave has transmitted an Authorization Request message.
T/F cwrBpiRsAuthReset	1.3.6.1.4.1.9.9.135.1.1.1.1.6	TruthValue	read-write	Setting this object to TRUE generates a Reauthorize event in the authorization FSM, as described in section 4.1.2.3.4 of the Baseline Privacy Interface Specification. Reading this object always returns FALSE.
INT cwrBpiRsAuthState	1.3.6.1.4.1.9.9.135.1.1.1.1.3	INTEGER	read-only	The state of the Radio Slave authorization FSM. The start state indicates that FSM is in its initial state.
INT cwrBpiRsAuthWaitTimeout	1.3.6.1.4.1.9.9.135.1.1.1.1.9	INTEGER	read-write	Authorize Wait Timeout. The value of this object cannot be changed while the authorization state machine is running.
cwrBpiRsBaseEntry	1.3.6.1.4.1.9.9.135.1.1.1.1		not-accessible	An entry containing objects describing attributes of one Slave Radio interface. An entry in this table exists for each ifEntry with an ifType of ciscoWirelessP2P.
cwrBpiRsBaseTable	1.3.6.1.4.1.9.9.135.1.1.1		not-accessible	Describes the basic and authorization-related Baseline Privacy attributes of each Slave Radio interface.
cwrBpiRsGroup	1.3.6.1.4.1.9.9.135.3.2.1			A collection of objects providing Radio Slave BPI status and control.
cwrBpiRsObjects	1.3.6.1.4.1.9.9.135.1.1
INT cwrBpiRsOpWaitTimeout	1.3.6.1.4.1.9.9.135.1.1.1.1.11	INTEGER	read-write	Operational Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running.
T/F cwrBpiRsPrivacyEnable	1.3.6.1.4.1.9.9.135.1.1.1.1.1	TruthValue	read-write	This object identifies whether the Slave Radio is provisioned to use Encryption or not.
OCT cwrBpiRsPublicKey	1.3.6.1.4.1.9.9.135.1.1.1.1.2	OCTET STRING	read-only	Public key of the Radio Slave encoded as an ASN.1 SubjectPublicKeyInfo object as defined in the RSA Encryption Standard (PKCS #1) [RSA1].
INT cwrBpiRsReauthWaitTimeout	1.3.6.1.4.1.9.9.135.1.1.1.1.10	INTEGER	read-write	Reauthorize Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running.
INT cwrBpiRsRekeyWaitTimeout	1.3.6.1.4.1.9.9.135.1.1.1.1.12	INTEGER	read-write	Rekey Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running.
C32 cwrBpiRsTEKAuthPends	1.3.6.1.4.1.9.9.135.1.1.2.1.8	Counter32	read-only	Count of times an Authorization Pending (Auth Pend) event occurred in this TEK Serivce FSM.
T/F cwrBpiRsTEKEncryptionNegotiated	1.3.6.1.4.1.9.9.135.1.1.2.1.1	TruthValue	read-only	This identifies whether this TEK service is using encryption or not. Encryption may not be in use even though cwrBpiRsPrivacyEnable is provisioned. This is possible if the remote is not configured for privacy or it's not running an encryption capable image.
cwrBpiRsTEKEntry	1.3.6.1.4.1.9.9.135.1.1.2.1		not-accessible	An entry containing objects describing the TEK attributes of one instantiated TEK service. There will be one such entry for every Radio Slave of a P2P link.
NUM cwrBpiRsTEKExpiresNew	1.3.6.1.4.1.9.9.135.1.1.2.1.4	TimeInterval	read-only	The number of seconds left to expire for the newest active key for this FSM. If this FSM has no active keys then this value will be zero.
NUM cwrBpiRsTEKExpiresOld	1.3.6.1.4.1.9.9.135.1.1.2.1.3	TimeInterval	read-only	The number of seconds left to expire for the oldest active key for this FSM. If this FSM has no active keys then this value will be zero.
INT cwrBpiRsTEKGraceTime	1.3.6.1.4.1.9.9.135.1.1.1.1.8	INTEGER	read-write	Grace time for a TEK. A Radio Slave is expected to start trying to get a new TEK beginning TEKGraceTime seconds before the TEK actually expires. The value of this object cannot be changed while the authorization state machine is running. NOTE: When installed in the field, this variable should NEVER be set below 300 which is the lower limit by standard. This variable accepts a wider range to facilitate testing.
INT cwrBpiRsTEKInvalidErrorCode	1.3.6.1.4.1.9.9.135.1.1.2.1.9	INTEGER	read-only	Error-Code in most recent TEK Invalid message received by this TEK service. On bootup, this has value no-information(0). At all other times, this object reflects the error code received
STR cwrBpiRsTEKInvalidErrorString	1.3.6.1.4.1.9.9.135.1.1.2.1.10	DisplayString	read-only	Display-String in most recent TEK Invalid message received by this TEK Service. This is a zero length string if no TEK Invalid message has been received since this TEK Service was started.
C32 cwrBpiRsTEKInvalids	1.3.6.1.4.1.9.9.135.1.1.2.1.7	Counter32	read-only	Count of times this TEK Service has received a TEK Invalid message.
C32 cwrBpiRsTEKKeyReplies	1.3.6.1.4.1.9.9.135.1.1.2.1.6	Counter32	read-only	Count of times this TEK Service has received a Key Reply message.
C32 cwrBpiRsTEKKeyRequests	1.3.6.1.4.1.9.9.135.1.1.2.1.5	Counter32	read-only	Count of times the this TEK Service has transmitted a Key Request message.
INT cwrBpiRsTEKState	1.3.6.1.4.1.9.9.135.1.1.2.1.2	INTEGER	read-only	The state of the indicated TEK FSM. The start(1) state indicates that FSM is in its initial state.
cwrBpiRsTEKTable	1.3.6.1.4.1.9.9.135.1.1.2		not-accessible	Describes the attributes of each Radio Slave Traffic Encryption Key (TEK) Service.

RFC description

Baseline Privacy Interface (BPI) for Cisco wireless point-to-point radio links encryption and authentication.

Start monitoring Cisco point-to-point wireless bridge/backhaul radio (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-WIRELESS-P2P-BPI-MIB