All MIBs › ENTERASYS-IPSEC-NOTIFICATION-MIB
Organization: Enterasys Networks, Inc
Last Updated: 2011-02-28
Category: Domain: Security, Technology: VPN, VPN and Security, Vendor: Enterasys/Cabletron
Description: Enterasys Networks MIB defining SNMP notifications for monitoring IPsec security association events on routers.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is ENTERASYS-IPSEC-NOTIFICATION-MIB?
ENTERASYS-IPSEC-NOTIFICATION-MIB is a proprietary Enterasys Networks MIB defining SNMP notifications for IPsec-related security events on Enterasys routers, such as packets discarded due to IPsec policy violations. It exposes notification-payload objects carrying the timestamp, SPI (Security Parameter Index), protocol, and source/destination address details of the triggering event, alongside a configuration object to enable the discarded-packet notification. Its monitoring focus is security fault/event detection rather than general hardware or performance data: it lets an administrator be alerted in near real time when IPsec traffic is being dropped, which can indicate a misconfigured tunnel, an expired security association, or a potential attack. It supplements standard IPsec functionality on the device rather than an IETF IPsec MIB standard, being purely a vendor notification layer. It is deployed on Enterasys/Extreme Networks routers terminating IPsec VPN tunnels where security-event visibility is required, and administrators typically start with an ENTERASYS-IPSEC-NOTIFICATION-MIB download to load the notification definitions into their SNMP trap receiver.
IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-IPSEC-NOTIFICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Enterasys/Extreme Networks router (IPsec VPN endpoint)
Monitoring Examples
An administrator would set etsysIpSecDiscardedPacketEnabled to enable the notification, then rely on the resulting trap to deliver etsysIpSecTime, etsysIpSecSPI, etsysIpSecProtocol, etsysIpSecSourceAddress, and etsysIpSecDestinationAddress whenever the router discards an IPsec packet, letting the operator immediately identify which security association and peer was involved. A sudden burst of these notifications from the same etsysIpSecSourceAddress could indicate a expired/mismatched SA or an active attack against the VPN endpoint. This MIB is purely event/notification-driven rather than exposing polled counters.
What Can Be Monitored
- IPsec discarded-packet notifications
- SPI of affected security association
- source/destination address of discarded packet
- discarded-packet notification enable state
Imported Objects
From ENTERASYS-MIB-NAMES
| etsysModules | OBJECT-IDENTITY |
From IF-MIB
| InterfaceIndex | |
| ifIndex | OBJECT-TYPE |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| DateAndTime | |
| DisplayString | |
| TEXTUAL-CONVENTION | |
| TruthValue |
OIDs
RFC description
Manages IPSec security notifications and events on Enterasys routers monitoring tunnel and key management.
Start monitoring Enterasys Networks router/Layer 3 switch (legacy, later Extreme Networks) (IPsec VPN endpoint, security event traps) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.