CISCOSB-SECSD-MIB

All MIBs › CISCOSB-SECSD-MIB

Organization: Cisco Small Business

Last Updated: 2011-08-31

Category: VPN and Security, Vendor: RADLAN/Cisco SB

Description: Manages Cisco Small Business security storm-control and denial-of-service protection features.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCOSB-SECSD-MIB?

CISCOSB-SECSD-MIB (Security Sensitive Data) is a private Cisco Small Business MIB that manages access permissions to sensitive configuration data, such as usernames and passwords, across the device's different management channels (CLI, Web/HTTP, and others). It is fundamentally a configuration/security-policy MIB rather than a performance-counter one, providing tables and scalars that control which management channels are permitted to display or handle sensitive credential data. Its relevance to device status monitoring is as a security-posture check: an administrator can audit which channels currently expose or restrict sensitive data handling, catching a misconfiguration that leaves credentials visible over an insecure channel as opposed to tracking uptime or resource load. It is a vendor-private MIB with no formal dependency on standard IETF MIBs, layered on top of Cisco Small Business's CLI/Web management framework. It is deployed on Cisco Small Business switches and routers wherever administrators need to govern how sensitive credential data is exposed via management interfaces. Engineers can download the CISCOSB-SECSD-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCOSB-SECSD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Small Business switch
Cisco Small Business router

Monitoring Examples

No specific object or table names were supplied for this module (sample_objects is empty), so a concrete polling walkthrough can't be grounded in real identifiers. In practice an administrator would expect to check per-channel (CLI/Web/other) settings controlling whether sensitive data such as usernames and passwords are masked or restricted, and would treat an unexpectedly permissive setting on a given channel as a security exposure to remediate.

What Can Be Monitored

per-channel sensitive data access restriction status
CLI/Web management channel security configuration

Imported Objects

From CISCOSB-MIB

switch001

MODULE-IDENTITY

From P-BRIDGE-MIB

EnabledStatus

From SNMPv2-SMI

OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlSecSd	1.3.6.1.4.1.9.6.1.101.209			The private MIB module definition for Security Sensitive Data (SSD), contains the MIB tables and scalars to manage the access through the different management channels as CLI, WEB and others, for sensitive data as user names and passwords in system.
STR rlSecSdConfigurationFileDigest	1.3.6.1.4.1.9.6.1.101.209.9	DisplayString	read-write	SSD configuration file integrity digest, auxiliary action scalar for internal system using during configuration download.
STR rlSecSdConfigurationFileSsdDigest	1.3.6.1.4.1.9.6.1.101.209.8	DisplayString	read-write	SSD block in configuration file integrity digest, auxiliary action scalar for internal system using during configuration download.
INT rlSecSdCurrentSessionId	1.3.6.1.4.1.9.6.1.101.209.4	INTEGER	read-only	Get the current SSD management channel identifier, used to get information from rlSecSdMngSessionsTable.
STR rlSecSdFileIndicator	1.3.6.1.4.1.9.6.1.101.209.10	DisplayString	read-write	Retrieve configuration file SSD indicator. set value: configuration file name. get value: Exclude, Encrypted, Plaintext
INT rlSecSdFileIntegrityControl	1.3.6.1.4.1.9.6.1.101.209.7	INTEGER	read-write	File integrity control provides a validation of configuration file. enable - Validate the configuration file digest when downloading the file to startup configuration. disable - Do not validate.
INT rlSecSdFilePassphraseControl	1.3.6.1.4.1.9.6.1.101.209.6	INTEGER	read-write	File Passphrase control provides an additional level of protection on passphrase and configurations. restricted - a device restricts its passphrase from being inserted into a configuration file. unrestricted - (default) a device will include its passphrase when creating a configuration file.
RLS rlSecSdMngSessionChannel	1.3.6.1.4.1.9.6.1.101.209.2.2.4	RlSecSdChannelType	read-only	Contains the Security Sensitive Data management session channel type as described in RlSecSdChannelType.
INT rlSecSdMngSessionId	1.3.6.1.4.1.9.6.1.101.209.2.2.1	INTEGER	read-only	Contains the Security Sensitive Data management session identifier, rlSecSdCurrentSessionId is used to get the current management session identifier
rlSecSdMngSessionsEntry	1.3.6.1.4.1.9.6.1.101.209.2.2		not-accessible	An entry in the rlSecSdMngSessionsTable.
rlSecSdMngSessionsTable	1.3.6.1.4.1.9.6.1.101.209.2		not-accessible	The table holding Security Sensitive Data management sessions. Allowing to get management channel, user name, user level.
INT rlSecSdMngSessionUserLevel	1.3.6.1.4.1.9.6.1.101.209.2.2.2	INTEGER	read-only	Contains the Security Sensitive Data management session user access level.
STR rlSecSdMngSessionUserName	1.3.6.1.4.1.9.6.1.101.209.2.2.3	DisplayString	read-write	Contains the Security Sensitive Data management session user name.
STR rlSecSdPassPhrase	1.3.6.1.4.1.9.6.1.101.209.5	DisplayString	read-write	Set the passphrase for the SSD encryptyption / decryption key. on set, passphrase is in plain text format. on get, passphrase is encrypted.
RLS rlSecSdRuleChannel	1.3.6.1.4.1.9.6.1.101.209.1.1.3	RlSecSdChannelType	read-write	Contains the Rule management channel type as described in RlSecSdChannelType. secure-xml-snmp and insecure-xml-snmp management channels have no include-encrypted capability thus their rlSecSdRulePermitRead and rlSecSdRuleRead can have only RlSecSdAccessType values of exclude or include-decrypted.
T/F rlSecSdRuleIsDefault	1.3.6.1.4.1.9.6.1.101.209.1.1.6	TruthValue	read-only	true - Rule has created by the by the system. false - Rule has created by the user.
RLS rlSecSdRuleOwner	1.3.6.1.4.1.9.6.1.101.209.1.1.7	RlSecSdRuleOwnerType	read-write	Contains the current Rule ownership as defined in RlSecSdRuleOwnerType. when rlSecSdRuleIsDefault is true, rlSecSdRuleOwner allowed to change default rule to user rule and vice versa.
RLS rlSecSdRulePermitRead	1.3.6.1.4.1.9.6.1.101.209.1.1.5	RlSecSdPermitAccessType	read-write	Contains the Rule maximum permission access level as described in RlSecSdPermitAccessType.
RLS rlSecSdRuleRead	1.3.6.1.4.1.9.6.1.101.209.1.1.4	RlSecSdAccessType	read-write	Contains the Rule default read access level as described in RlSecSdAccessType, must be lower or equal access from rlSecSdRulePermitRead
rlSecSdRulesEntry	1.3.6.1.4.1.9.6.1.101.209.1.1		not-accessible	An entry in the rlSecSdRulesTable.
rlSecSdRulesTable	1.3.6.1.4.1.9.6.1.101.209.1		not-accessible	The table holding the Security Sensitive Data access rules per: user name / user level and management channel. Allow to add/edit/remove Security Sensitive Data rules.
ROW rlSecSdRuleStatus	1.3.6.1.4.1.9.6.1.101.209.1.1.8	RowStatus	read-write	The status of a table entry. It is used to Add/Edit/Delete an entry from this table.
RLS rlSecSdRuleUser	1.3.6.1.4.1.9.6.1.101.209.1.1.1	RlSecSdRuleUserType	read-write	Contains the Rule user type as described in RlSecSdRuleUserType.
STR rlSecSdRuleUserName	1.3.6.1.4.1.9.6.1.101.209.1.1.2	DisplayString	read-write	Contains the Rule user name when rlSecSdRuleUser value is user-name, Otherwise it contains an empty string
RLS rlSecSdSessionControl	1.3.6.1.4.1.9.6.1.101.209.3	RlSecSdSessionAccessType	read-write	Action scalar which set the default read access of Security Sensitive Data. Affect only on session which from this scalar is configured. Scalar Get value is the default-display/read of the session which from this scalar is retrieved.

RFC description

Cisco Small Business (SB) vendor-private MIB defining security services and threat defense (SD) capabilities.

Start monitoring Cisco Small Business switch/router with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCOSB-SECSD-MIB

What Is CISCOSB-SECSD-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description