GB15629dot11-WAPI-MIB

All MIBs › GB15629dot11-WAPI-MIB

Organization: China Broadband Wireless IP Standard Group.

Last Updated: 2007-05-21

Category: Technology: Wireless

Description: China Broadband Wireless IP Standard MIB for WLAN Authentication and Privacy Infrastructure (WAPI) management.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is GB15629dot11-WAPI-MIB?

GB15629dot11-WAPI-MIB implements the management objects for WAPI (WLAN Authentication and Privacy Infrastructure), the wireless LAN security mechanism defined by the Chinese national standard GB 15629.11, an alternative to IEEE 802.11i/WPA used in networks required to comply with that standard. It exposes configuration and status for the WAPI security module on a wireless access point or controller, governing certificate-based authentication and encryption for WLAN clients rather than general traffic or hardware sensor data. Its monitoring value is centered on the software/security state of the wireless access point: whether the WAPI module is enabled, its authentication/certificate configuration, and the state of client associations secured under WAPI, which matters for confirming regulatory-compliant wireless security is actually active. It is a standards-derived MIB tied specifically to the GB 15629.11 WAPI standard rather than to IEEE 802.11, so devices supporting it typically also implement other 802.11-related MIBs for general WLAN management. It is deployed on wireless access points and controllers sold into the Chinese market where WAPI compliance is mandated. Engineers can download the GB15629dot11-WAPI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in GB15629dot11-WAPI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

WLAN access point/controller compliant with the Chinese GB 15629.11 WAPI standard

Monitoring Examples

No specific object or table names were extracted for this module, so a concrete polling scenario cannot be grounded in real identifiers; in general use, an administrator would query the WAPI configuration objects to confirm the module is enabled and that certificate-based authentication parameters are correctly provisioned before trusting client associations as WAPI-secured.

What Can Be Monitored

WAPI module enabled/disabled state
WAPI authentication/certificate configuration
WAPI-secured client association status

Imported Objects

From RFC1213-MIB

ifIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
TruthValue

How to Use in IPNetwork Monitor

Example using gb15629dot11wapiStatsWPIReplayCounters OID:

Select a WLAN access point/controller compliant with China's GB 15629.11 WAPI standard as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type gb15629dot11wapiStatsWPIReplayCounters into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of WPI MPDUs discarded by the replay mechanism. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
member_body	1.2
cn	1.2.156
bwips	1.2.156.11235
gb15629	1.2.156.11235.15629
gb15629_11	1.2.156.11235.15629.11
gb15629_11_mibs	1.2.156.11235.15629.11.1
gb15629dot11wapiMIB	1.2.156.11235.15629.11.1.1			Manage WAPI module.
wapiMIBObjects	1.2.156.11235.15629.11.1.1.1
gb15629dot11wapiConfigTable	1.2.156.11235.15629.11.1.1.1.1		not-accessible	The table containing WAPI configuration objects.
gb15629dot11wapiConfigEntry	1.2.156.11235.15629.11.1.1.1.1.1		not-accessible	An entry in the gb15629dot11wapiConfigTable.
I32 gb15629dot11wapiConfigVersion	1.2.156.11235.15629.11.1.1.1.1.1.1	Integer32	read-only	The highest WAPI version this entity supports.
T/F gb15629dot11wapiControlledAuthControl	1.2.156.11235.15629.11.1.1.1.1.1.2	TruthValue	read-only	This object indicates whether the entity enables authentication. When the value is FALSE, it shall indicate that authentication is not enabled on this entity, and the status of the controlled port is 'authenticated'. When the value is TURE, it shall indicate that authentication is enabled, and the status of controlled port is decided by gb15629dot11wapiControlledPortControl.
INT gb15629dot11wapiControlledPortControl	1.2.156.11235.15629.11.1.1.1.1.1.3	INTEGER	read-only	This object indicates the controlling type of the entity's port. This object is available when gb15629dot11wapiControlledAuthControl is TURE. When the value is zero, it means 'automatic', and the status of the controlled port is decided by authentication result. When the value is one, it means 'forcible unauthenticated', and the status of the controlled port is 'unauthenticated'.
T/F gb15629dot11wapiOptionImplemented	1.2.156.11235.15629.11.1.1.1.1.1.4	TruthValue	read-only	This object indicates whether the entity support WAPI. When the value is TURE, it shall indicate that the entity support WAPI. Otherwise, it shall indicate that the entity doesn't support WAPI.
T/F gb15629dot11wapiPreauthenticationImplemented	1.2.156.11235.15629.11.1.1.1.1.1.5	TruthValue	read-only	This object indicates whether the entity support WAPI preauthentication. This object can't be set to TURE, unless gb15629dot11wapiOptionImplemented is TURE.
T/F gb15629dot11wapiEnabled	1.2.156.11235.15629.11.1.1.1.1.1.6	TruthValue	read-write	When this object is set to TRUE, it shall indicate that WAPI is enabled on this entity. The entity will advertise the WAPI information element in its beacon and probe response frames.
T/F gb15629dot11wapiPreauthenticationEnabled	1.2.156.11235.15629.11.1.1.1.1.1.7	TruthValue	read-write	When this object is set to TRUE, it shall indicate that WAPI preauthentication is enabled on this entity. Otherwise, it shall indicate that WAPI preauthentication is disabled on this entity. This object requires that gb15629dot11WAPIEnabled also be set to TRUE.
U32 gb15629dot11wapiConfigUnicastKeysSupported	1.2.156.11235.15629.11.1.1.1.1.1.8	Unsigned32	read-only	This object indicates how many unicast keys the entity supports for WAPI.
INT gb15629dot11wapiConfigUnicastRekeyMethod	1.2.156.11235.15629.11.1.1.1.1.1.9	INTEGER	read-write	This object selects a mechanism for rekeying the WAPI USK. The default is time-based, once per day. Rekeying the USK is only applicable to an entity acting as a role of AE or ASUE.
U32 gb15629dot11wapiConfigUnicastRekeyTime	1.2.156.11235.15629.11.1.1.1.1.1.10	Unsigned32	read-write	The time in seconds after which the WAPI USK shall be refreshed. The timer shall start at the moment the USK was set using the MLME-SETWPIKEYS request primitive.
U32 gb15629dot11wapiConfigUnicastRekeyPackets	1.2.156.11235.15629.11.1.1.1.1.1.11	Unsigned32	read-write	A packet count (in 1000s of packets) after which the WAPI USK shall be refreshed. The packet counter shall start at the moment the USK was set using the MLME-SETKEYS request primitive and it shall count all packets encrypted using the current USK.
OCT gb15629dot11wapiConfigMulticastCipher	1.2.156.11235.15629.11.1.1.1.1.1.12	OCTET STRING	read-write	This object indicates the multicast cipher suite selector the entity must use. The multicast cipher suite in the WAPI information element shall take its value from this variable. It consists of an OUI (the first 3 octets) and a cipher suite identifier (the last octet).
INT gb15629dot11wapiConfigMulticastRekeyMethod	1.2.156.11235.15629.11.1.1.1.1.1.13	INTEGER	read-write	This object selects a mechanism for rekeying the WAPI MSK. The default is time-based, once per day. Rekeying the MSK is only applicable to an entity acting as a role of AE or ASUE.
U32 gb15629dot11wapiConfigMulticastRekeyTime	1.2.156.11235.15629.11.1.1.1.1.1.14	Unsigned32	read-write	The time in seconds after which the WAPI MSK shall be refreshed. The timer shall start at the moment the MSK was set using the MLME-SETWPIKEYS request primitive.
U32 gb15629dot11wapiConfigMulticastRekeyPackets	1.2.156.11235.15629.11.1.1.1.1.1.15	Unsigned32	read-write	A packet count (in 1000s of packets) after which the WAPI MSK shall be refreshed. The packet counter shall start at the moment the MSK was set using the MLME-SETKEYS request primitive and it shall count all packets encrypted using the current MSK.
T/F gb15629dot11wapiConfigMulticastRekeyStrict	1.2.156.11235.15629.11.1.1.1.1.1.16	TruthValue	read-write	This object signals that the MSK shall be refreshed whenever a STA leaves the BSS that possesses the MSK.
OCT gb15629dot11wapiConfigPSKValue	1.2.156.11235.15629.11.1.1.1.1.1.17	OCTET STRING	read-write	The PSK value when WAPI in PSK mode is the selected AKM suite. In that case, the BK will obtain its value from this object. This object is logically write-only. Reading this variable shall return unsuccessful status or null or zero.
STR gb15629dot11wapiConfigPSKPassPhrase	1.2.156.11235.15629.11.1.1.1.1.1.18	DisplayString	read-write	The PSK value when WAPI in PSK mode is the selected AKM suite, is configured by gb15629dot11wapiConfigPSKValue. An alternative manner of setting the PSK uses the password-to-key algorithm. This variable provides a means to enter a pass-phrase. When this object is written, the WAPI entity shall use the password-to-key algorithm to derive a preshared and populate gb15629dot11wapiConfigPSKValue with this key. This object is logically write-only. Reading this variable shall return unsuccessful status or null or zero.
U32 gb15629dot11wapiConfigCertificateUpdateCount	1.2.156.11235.15629.11.1.1.1.1.1.19	Unsigned32	read-write	The number of times message in the WAPI certificate authenticating handshake will be retried per certificate authenticating handshake attempt.
U32 gb15629dot11wapiConfigMulticastUpdateCount	1.2.156.11235.15629.11.1.1.1.1.1.20	Unsigned32	read-write	The number of times message in the WAPI multicast key handshake will be retried per MSK handshake attempt.
U32 gb15629dot11wapiConfigUnicastUpdateCount	1.2.156.11235.15629.11.1.1.1.1.1.21	Unsigned32	read-write	The number of times message in the WAPI unicast key handshake will be retried per 3-way handshake attempt.
U32 gb15629dot11wapiConfigMulticastCipherSize	1.2.156.11235.15629.11.1.1.1.1.1.22	Unsigned32	read-only	This object indicates the length in bits of the multicast cipher key. This should be 256 for SMS4. first 128 bits for encrypting, last 128 bits for integrity checking.
U32 gb15629dot11wapiConfigBKLifetime	1.2.156.11235.15629.11.1.1.1.1.1.23	Unsigned32	read-write	The maximum lifetime of a BK in the BK cache.
U32 gb15629dot11wapiConfigBKReauthThreshold	1.2.156.11235.15629.11.1.1.1.1.1.24	Unsigned32	read-write	The percentage of the BK lifetime that should expire before an reauthentication occurs.
U32 gb15629dot11wapiConfigSATimeout	1.2.156.11235.15629.11.1.1.1.1.1.25	Unsigned32	read-write	The maximum time a security association shall take to set up.
OCT gb15629dot11wapiAuthenticationSuiteSelected	1.2.156.11235.15629.11.1.1.1.1.1.26	OCTET STRING	read-only	The selector of the last AKM suite negotiated.
OCT gb15629dot11wapiUnicastCipherSelected	1.2.156.11235.15629.11.1.1.1.1.1.27	OCTET STRING	read-only	The selector of the last unicast cipher negotiated.
OCT gb15629dot11wapiMulticastCipherSelected	1.2.156.11235.15629.11.1.1.1.1.1.28	OCTET STRING	read-only	The selector of the last multicast cipher negotiated.
OCT gb15629dot11wapiBKIDUsed	1.2.156.11235.15629.11.1.1.1.1.1.29	OCTET STRING	read-only	The selector of the last BKID used in the last unicast cipher key handshake.
OCT gb15629dot11wapiAuthenticationSuiteRequested	1.2.156.11235.15629.11.1.1.1.1.1.30	OCTET STRING	read-only	The selector of the last AKM suite requested.
OCT gb15629dot11wapiUnicastCipherRequested	1.2.156.11235.15629.11.1.1.1.1.1.31	OCTET STRING	read-only	The selector of the last unicast cipher requested.
OCT gb15629dot11wapiMulticastCipherRequested	1.2.156.11235.15629.11.1.1.1.1.1.32	OCTET STRING	read-only	The selector of the last multicast cipher requested.
gb15629dot11wapiConfigUnicastCiphersTable	1.2.156.11235.15629.11.1.1.1.2		not-accessible	This table lists the unicast ciphers supported by this entity. It allows enabling and disabling of each unicast cipher by network management. The unicast cipher suite list in the WAPI information element is formed using the information in this table.
gb15629dot11wapiConfigUnicastCiphersEntry	1.2.156.11235.15629.11.1.1.1.2.1		not-accessible	The table entry, indexed by the interface index (or all interfaces) and the unicast cipher.
U32 gb15629dot11wapiConfigUnicastCipherIndex	1.2.156.11235.15629.11.1.1.1.2.1.1	Unsigned32	not-accessible	The auxiliary index into the gb15629dot11wapiConfigUnicastCiphersTable.
OCT gb15629dot11wapiConfigUnicastCipher	1.2.156.11235.15629.11.1.1.1.2.1.2	OCTET STRING	read-only	The selector of a supported unicast cipher. It consists of an OUI(the first 3 octets) and a cipher suite identifier (the last octet).
T/F gb15629dot11wapiConfigUnicastCipherEnabled	1.2.156.11235.15629.11.1.1.1.2.1.3	TruthValue	read-write	This object enables or disables the unicast cipher.
U32 gb15629dot11wapiConfigUnicastCipherSize	1.2.156.11235.15629.11.1.1.1.2.1.4	Unsigned32	read-only	This object indicates the length in bits of the unicast cipher key. This should be 256 for SMS4, first 128 bits for encrypting, last 128 bits for integrity checking.
gb15629dot11wapiConfigAuthenticationSuitesTable	1.2.156.11235.15629.11.1.1.1.3		not-accessible	This table lists the AKM suites supported by this entity. Each AKM suite can be individually enabled and disabled. The AKM suite list in the WAPI information element is formed using the information in this table.
gb15629dot11wapiConfigAuthenticationSuitesEntry	1.2.156.11235.15629.11.1.1.1.3.1		not-accessible	An entry (row) in the gb15629dot11wapiConfigAuthenticationSuitesTable.
U32 gb15629dot11wapiConfigAuthenticationSuiteIndex	1.2.156.11235.15629.11.1.1.1.3.1.1	Unsigned32	not-accessible	The auxiliary variable used as an index into the gb15629dot11wapiConfigAuthenticationSuitesTable.
OCT gb15629dot11wapiConfigAuthenticationSuite	1.2.156.11235.15629.11.1.1.1.3.1.2	OCTET STRING	read-only	The selector of an AKM suite. It consists of an OUI (the first 3 octets) and a cipher suite identifier (the last octet).
T/F gb15629dot11wapiConfigAuthenticationSuiteEnabled	1.2.156.11235.15629.11.1.1.1.3.1.3	TruthValue	read-write	This variable indicates the corresponding AKM suite is enabled or disabled.
gb15629dot11wapiStatsTable	1.2.156.11235.15629.11.1.1.1.4		not-accessible	This table maintains per-STA statistics in an WAPI. The entry with gb15629dot11wapiStatsSTAAddress set to FF-FF-FF-FF-FF-FF shall contain statistics for broadcast/multicast traffic.
gb15629dot11wapiStatsEntry	1.2.156.11235.15629.11.1.1.1.4.1		not-accessible	An entry in the gb15629dot11wapiStatsTable.
U32 gb15629dot11wapiStatsIndex	1.2.156.11235.15629.11.1.1.1.4.1.1	Unsigned32	not-accessible	An auxiliary index into the gb15629dot11wapiStatsTable.
MAC gb15629dot11wapiStatsSTAAddress	1.2.156.11235.15629.11.1.1.1.4.1.2	MacAddress	read-only	The MAC address of the STA to which the statistics in this conceptual row belong.
U32 gb15629dot11wapiStatsVersion	1.2.156.11235.15629.11.1.1.1.4.1.3	Unsigned32	read-only	The WAPI version with which the STA associated.
T/F gb15629dot11wapiStatsControlledPortStatus	1.2.156.11235.15629.11.1.1.1.4.1.4	TruthValue	read-only	This object indicates the status of the authentication entity's controlled port. When the value is TURE, it means 'authenticated'. Otherwise, it means 'unauthenticated'.
OCT gb15629dot11wapiStatsSelectedUnicastCipher	1.2.156.11235.15629.11.1.1.1.4.1.5	OCTET STRING	read-only	The unicast cipher suite selector used during association.
C32 gb15629dot11wapiStatsWPIReplayCountersEx	1.2.156.11235.15629.11.1.1.1.4.1.6	Counter32	read-only	The number of WPI MPDUs discarded by the replay mechanism.
C32 gb15629dot11wapiStatsWPIDecryptableErrors	1.2.156.11235.15629.11.1.1.1.4.1.7	Counter32	read-only	The number of WPI MPDUs discarded because of unavailable cipher key when WPI-SMS4 decrypting.
C32 gb15629dot11wapiStatsWPIMICErrors	1.2.156.11235.15629.11.1.1.1.4.1.8	Counter32	read-only	The number of WPI MPDUs discarded because of MIC checking failure when WPI-SMS4 decrypting.
C32 gb15629dot11wapiStatsWAISignatureErrors	1.2.156.11235.15629.11.1.1.1.4.1.9	Counter32	read-only	This counter increases when the received WAI packets' signature is wrong.
C32 gb15629dot11wapiStatsWAIHMACErrors	1.2.156.11235.15629.11.1.1.1.4.1.10	Counter32	read-only	This counter increases when the received WAI packets' message authentication key checking error occurs.
C32 gb15629dot11wapiStatsWAIAuthenticationResultFailures	1.2.156.11235.15629.11.1.1.1.4.1.11	Counter32	read-only	This counter increases when the WAI authentication result is unsuccessful.
C32 gb15629dot11wapiStatsWAIDiscardCounters	1.2.156.11235.15629.11.1.1.1.4.1.12	Counter32	read-only	This counter increases when the received WAI packet is discarded.
C32 gb15629dot11wapiStatsWAITimeoutCounters	1.2.156.11235.15629.11.1.1.1.4.1.13	Counter32	read-only	This counter increases when the WAI packet overtime is detected.
C32 gb15629dot11wapiStatsWAIFormatErrors	1.2.156.11235.15629.11.1.1.1.4.1.14	Counter32	read-only	This counter increases when the WAI packets' format error occurs
C32 gb15629dot11wapiStatsWAICertificateHandshakeFailures	1.2.156.11235.15629.11.1.1.1.4.1.15	Counter32	read-only	This counter increases when the WAI certificate authenticates unsuccessfully.
C32 gb15629dot11wapiStatsWAIUnicastHandshakeFailures	1.2.156.11235.15629.11.1.1.1.4.1.16	Counter32	read-only	This counter increases when the WAI unicast cipher key negotiates unsuccessfully.
C32 gb15629dot11wapiStatsWAIMulticastHandshakeFailures	1.2.156.11235.15629.11.1.1.1.4.1.17	Counter32	read-only	This counter increases when the WAI multicast cipher key announces unsuccessfully.
wapiMIBConformance	1.2.156.11235.15629.11.1.1.2
gb15629dot11wapiGroups	1.2.156.11235.15629.11.1.1.2.1
gb15629dot11wapiBase	1.2.156.11235.15629.11.1.1.2.1.1			The gb15629dot11wapiBase object class provides the necessary support for managing WAPI functionality in the STA.
gb15629dot11wapiBKcachingGroup	1.2.156.11235.15629.11.1.1.2.1.2			The gb15629dot11wapiBKcachingGroup object class provides the necessary support for managing BK caching functionality in the STA
gb15629wapiCompliances	1.2.156.11235.15629.11.1.1.2.2
gb15629dot11wapiCompliance	1.2.156.11235.15629.11.1.1.2.2.1			The compliance statement for SNMPv2 entities that implement the WAPI MIB.

RFC description

Manages WAPI (WLAN Authentication and Privacy Infrastructure) configuration on Chinese standard 802.11 wireless devices.

Start monitoring WLAN access point/controller compliant with China's GB 15629.11 WAPI standard with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download GB15629dot11-WAPI-MIB