ENTERASYS-TLS-MIB

All MIBs › ENTERASYS-TLS-MIB

Organization: Enterasys Networks, Inc

Last Updated: 2002-11-14

Category: Domain: Security, VPN and Security, Vendor: Enterasys/Cabletron

Description: Enterasys Networks Transport Layer Security (TLS/SSL) MIB for configuring encrypted management session parameters on embedded systems.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-TLS-MIB?

ENTERASYS-TLS-MIB is an Enterasys Networks vendor MIB for configuring Transport Layer Security (TLS/SSL, per RFC 2246) on the device's own embedded management interface, enabling encrypted, authenticated management sessions (e.g., HTTPS) on the switch itself. It exposes configuration and connection-tracking objects such as whether TLS is enabled, the number of current soft/hard TLS connections versus the configured maximum, connection idle timeout, the HTTPS management port, and key management controls (key generation trigger, admin/operational key type, signature type). Its monitoring value is software/security-service status: administrators check whether the secure management service is enabled and healthy, how many active/hard TLS sessions exist relative to the configured maximum (catching resource exhaustion that would prevent new secure logins), and whether key/certificate parameters match policy. It is a self-contained Enterasys enterprise security MIB implementing a subset of full TLS management, explicitly built for embedded systems rather than general host-based TLS stacks. It is deployed on Enterasys (later Extreme Networks) enterprise switches wherever secure, encrypted management access (HTTPS) to the device itself is required. Engineers can download the ENTERASYS-TLS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-TLS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys (Extreme Networks) enterprise Ethernet switch

Monitoring Examples

An administrator checks etsysTlsEnabled and etsysTlsHttpsPort to confirm secure management is active on the expected port, and compares etsysTlsNumHardConnects against etsysTlsMaxHardConnects to catch a switch that's rejecting new secure management sessions because it has hit its connection limit. etsysTlsKeepOpenTimeout is reviewed when sessions seem to disconnect too quickly, and etsysTlsAdminKeyType/etsysTlsOperKeyType/etsysTlsSignatureType are checked during a security audit to confirm the switch's key and signature algorithm meet current policy. etsysTlsGenerateKeys can be triggered to force regeneration of the device's management keys as part of a certificate rotation.

What Can Be Monitored

TLS/HTTPS management service enable state
current soft/hard TLS connection counts
maximum hard connection limit
connection idle timeout
HTTPS management port
key/signature type configuration

Imported Objects

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsysTlsMIB	1.3.6.1.4.1.5624.1.2.30			This MIB module defines a portion of the SNMP enterprise MIBs under Enterasys Networks' enterprise OID pertaining to Transport Layer Security (TLS) system [RFC2246] management functionality, specifically for embedded system implementations. This is a subset of the objects that would be required for a full-featured, host-based implementation. It provides configuration controls for Enterasys Networks' Secure Socket system management -- a feature that enhances system security by authenticating and encrypting the remote system management function.
etsysTlsObjects	1.3.6.1.4.1.5624.1.2.30.1
etsysTlsGeneralBranch	1.3.6.1.4.1.5624.1.2.30.1.1
INT etsysTlsEnabled	1.3.6.1.4.1.5624.1.2.30.1.1.1	INTEGER	read-write	Controls the operation of the Transport Layer Security server task on the embedded system. When enabled, the TLS server will accept connection requests and create a secure transport layer on which to transmit target system configuration data.
INT etsysTlsNumSoftConnects	1.3.6.1.4.1.5624.1.2.30.1.1.2	INTEGER	read-write	The soft limit for the maximum number of concurrent connections. If a new connection is initiated and it would exceed the soft limit, a '530 Service Unavailable' error will be reported to the client. Managed entities are free to enforce implementation specific limits on the upper limit of this object.
INT etsysTlsNumHardConnects	1.3.6.1.4.1.5624.1.2.30.1.1.3	INTEGER	read-write	The hard limit for the maximum number of concurrent connections. If a new connection is initiated and it would exceed the hard limit, the connection is closed unconditionally. Managed entities are free to enforce implementation specific limits on the upper limit of this object.
INT etsysTlsMaxHardConnects	1.3.6.1.4.1.5624.1.2.30.1.1.4	INTEGER	read-only	The maximum number of concurrent connections a platform supports. Allows managed entities to enforce implementation specific limits on the upper limit of the etsysTlsNumHardConnects object.
etsysTlsNetworkBranch	1.3.6.1.4.1.5624.1.2.30.1.2
INT etsysTlsKeepOpenTimeout	1.3.6.1.4.1.5624.1.2.30.1.2.1	INTEGER	read-write	How long in time a 'Keep-Alive' connection is kept open if new requests are not seen. The timeout is given in seconds.
INT etsysTlsHttpsPort	1.3.6.1.4.1.5624.1.2.30.1.2.2	INTEGER	read-write	The TCP port that the HTTPs server will listen to.
etsysTlsServerKeyBranch	1.3.6.1.4.1.5624.1.2.30.1.3
INT etsysTlsGenerateKeys	1.3.6.1.4.1.5624.1.2.30.1.3.1	INTEGER	read-write	Causes the host to generate a new key pair using the cipher algorithm currently selected in etsysTlsAdminKeyType. Note that this can be compute intensive on many platforms. The meaning of the values are as follows: notInitiated (1) On a write, this is a no-operation, on a read, it indicates that no key material generation operation has ever been initiated, at least since the last reset to factory defaults initialization of the managed entity. No key material exists. completed (2) On a write, this is a no-operation, on a read, this indicates that a key pair has been successfully generated. failed (3) On a write, this is a no-operation, on a read, it indicates that the key generation operation has failed. generate (4) On a write, this causes the managed entity to generate a new key pair, on a read, it indicates that the managed entity is still working on creating the new keys. completedPending (5) On a write, this is a no-operation, on a read, this indicates that a key pair has been successfully generated but its use is pending due to another required operation, such as a reboot.
INT etsysTlsAdminKeyType	1.3.6.1.4.1.5624.1.2.30.1.3.2	INTEGER	read-write	Determines the type of the key to be (re)created on the next key (re)creation operation. The etsysTlsOperKeyType object returns the type of key that is currently being used by the TLS server.
INT etsysTlsOperKeyType	1.3.6.1.4.1.5624.1.2.30.1.3.3	INTEGER	read-only	Indicates the type of the key pair currently in effect on the managed entity. The value of the etsysTlsAdminKeyType object is copied to the etsysTlsOperKeyType object upon successful completion of the (re)creation of a key pair.
INT etsysTlsSignatureType	1.3.6.1.4.1.5624.1.2.30.1.3.4	INTEGER	read-write	Denotes the signature method that is used for authenticating the exchange of keys. DSS (Digital Signature Standard) DSA (Digital Signature Algorithm, DSS compliant) RSA (Rivest, Shamir and Adelman) Sha (Secure Hash Algorithm) Md5 (Message Digest 5) dhAnon (1) - Anonymous Diffie Hellmen, no signatures dsaSha1 (2) - DSS , Sha-1 Hash dsaSha (3) - DSS signatures, Sha Hash rsaSha1 (4) - RSA signatures, Sha-1 Hash rsaMd2 (5) - RSA signatures, Md2 Hash rsaMd5 (6) - RSA signatures, Md5 Hash
etsysTlsConformance	1.3.6.1.4.1.5624.1.2.30.2
etsysTlsGroups	1.3.6.1.4.1.5624.1.2.30.2.1
etsysTlsBaseGroup	1.3.6.1.4.1.5624.1.2.30.2.1.1			A collection of objects providing configuration information for the TLS service.
etsysTlsCompliances	1.3.6.1.4.1.5624.1.2.30.2.2
etsysTlsCompliance	1.3.6.1.4.1.5624.1.2.30.2.2.1			The compliance statement for devices that support the Enterasys Secure Socket (TLS) MIB.

RFC description

Enterasys Transport Layer Security (TLS) configuration for secure system management.

Start monitoring Enterasys (Extreme Networks) Ethernet switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-TLS-MIB

What Is ENTERASYS-TLS-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description