IEEE8021-DEVID-MIB

All MIBs › IEEE8021-DEVID-MIB

Organization: IEEE 802.1 Working Group

Last Updated: 2018-07-15

Category: Standard: IEEE 802, VPN and Security

Description: IEEE 802.1 MIB for Device Identity (802.1AR) managing secure device identity certificates and enrollment in Ethernet networks.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is IEEE8021-DEVID-MIB?

This is a vendor-neutral IEEE 802.1AR standards MIB for managing Secure Device Identity (DevID) modules on network equipment, covering initial and locally significant device identity certificates used for authentication. It exposes a DevID module capability table (whether the module supports, generates, or inserts locally significant DevIDs) and a certificate table listing fingerprints, public key info, and enable/disable state for each identity certificate. Rather than physical hardware sensor data, its status monitoring is security/identity oriented: whether a device's DevID certificate and key are enabled, and whether it is an Initial or Local DevID, underpinning secure authentication (e.g., 802.1X/MACsec) rather than physical health. As an IEEE 802.1 standard it is designed to be implemented alongside other 802.1 security and access-control MIBs such as IEEE8021X-PAE-MIB. It is typically deployed on enterprise switches, routers, or other network infrastructure supporting hardware-rooted device identity for zero-touch provisioning or certificate-based network access control. Engineers implementing or auditing this functionality typically reference the IEEE8021-DEVID-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in IEEE8021-DEVID-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, IEEE 802.1AR standards-based MIB, not tied to a specific manufacturer
enterprise switches/routers with hardware-rooted device identity (TPM/secure element)

Monitoring Examples

An administrator would walk devIDModuleTable to check devIDModuleSupportsLDevIDs and devIDModuleGeneratesLDevIDKeys, confirming a device's cryptographic module can issue locally significant identities. They would then inspect devIDCertTable, checking devIDCertEnabled and devIDCertKeyEnabled to confirm the active identity certificate (flagged via devIDCertIDevID) is enabled, and compare devIDCertFingerprint/devIDCertPublicKeyInfoFprint against expected values to detect a certificate substitution or provisioning error.

What Can Be Monitored

DevID module capabilities (support/generation/insertion of local DevIDs)
certificate enabled/disabled state
key enabled state
certificate fingerprint
Initial vs Local DevID designation

Imported Objects

From ENTITY-MIB

PhysicalIndex
entPhysicalIndex	OBJECT-TYPE

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using devIDStatisticKeyGenerationCount OID:

Select a device implementing IEEE8021-DEVID-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type devIDStatisticKeyGenerationCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of LDevID key pairs generated by the module. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ieee8021DevIDMIB	1.3.111.2.802.1.1.17			The MIB module for managing an IEEE 802.1AR DevID (Secure Device Identifier) Module. A DevID comprises: a DevID secret (a private key) stored confidentially by the DevID module and accessible only through operations provided by the module; a DevID certificate containing the corresponding public key and a subject name that identifies the device; and a (possibly null) certificate chain. Use of the DevID module signing operations allows the device to prove possession of the DevID secret, and thus assert its identity in authentication protocols. An initial IDevID provided by the device supplier can be used directly or can be used to provision one or more locally significant LDevIDs that reflect authorization decisions by the local network administrator with certificate fields that record those decisions. An SNMP agent can manage a network element comprising one or many devices. They can include component (such as individual line cards in a chassis) or aggregate devices (such as the chassis and its current complement of cards). In each case a DevID module binds DevIDs secrets and certificates to the device whose identity they can be used to assert: they remain attached to a component device if it is removed from the network element, and are not retained by the SNMP agent. The entPhysicalIndex defined by the ENTITY-MIB identifies each device managed by the agent and is used to index tables of managed objects for each device with a DevID module, so ENTITY-MIB objects are correlated with and can supplement DevID information cryptographically bound to the device. The initial version of this ieee8021DevIDMIB used the object name prefix 'devID' rather than 'ieee8021DevI' as recommended by RFC 4181. The 'devID' prefix has been retained for backwards compatibility and internal consistency.
devIDMIBNotifications	1.3.111.2.802.1.1.17.0
devIDMIBObjects	1.3.111.2.802.1.1.17.1
devIDGlobalMIBObjects	1.3.111.2.802.1.1.17.1.1
devIDMgmtMIBObjects	1.3.111.2.802.1.1.17.1.2
U32 devIDPublicKeyCount	1.3.111.2.802.1.1.17.1.2.1	Unsigned32	read-only	The total number of DevID public keys installed in the module. Obsolete: the number of currently installed keys is the number of DevIDCertEntry's with the module's entPhysicalIndex and distinct devIDCertPublicKeyInfoFprint values, the maximum number can be an implementation dependent function of the keys' signature suites and the storage occupied by certificates and certificate chains.
devIDPublicKeyTable	1.3.111.2.802.1.1.17.1.2.2		not-accessible	A table containing the public key, the keys keyIndex, a value indicating if the key is enabled. This allows the administrator to determine the DevID keys installed in the DevID module. The maximum number of entries in this table is limited by the value of devIDPublicKeyCount. Obsolete: the public keys that have been installed and may be used can be obtained from the subjectPublicKeyInfo field in each of the DevIDCertEntry's devIDCert object.
devIDPublicKeyEntry	1.3.111.2.802.1.1.17.1.2.2.1		not-accessible	An entry containing DevID public key, the keys keyIndex, a value indicating if the key is enabled. Obsolete: the public keys that have been installed and may be used can be obtained from the subjectPublicKeyInfo field in each of the DevIDCertEntry's devIDCert object. The table entry indexing did not support multiple key pairs per entPhysicalIndex.
U32 devIDPublicKeyIndex	1.3.111.2.802.1.1.17.1.2.2.1.1	Unsigned32	not-accessible	All keys are indexed internally with this object. The value of this object is within 0..devIDPublicKeyCount. This is the keyIndex and operations on keys will use the keyIndex to address a specific key. The IDevID key shall only be at index 0. Any error retrieving a key will be displayed in devIDPublicKeyErrStatus. Obsolete: the potential indexes are close packed forcing index reuse not under the agents control so reading the index from the devIDCredentialTable and then using it with this object may not retrieve the intended key.
T/F devIDPublicKeyEnabled	1.3.111.2.802.1.1.17.1.2.2.1.2	TruthValue	read-write	The enable/disable state of this public key. This setting persists across restarts. Obsolete with table.
OID devIDPublicKeyAlgorithm	1.3.111.2.802.1.1.17.1.2.2.1.3	DevIDAlgorithmIdentifier	read-only	The DevID PublicKey Algorithm field shall indicate the public key algorithm identifier. This object identifies the public key algorithm as either rsaEncryption or idecPublicKey. Obsolete along with table. The AlgorithmIdentifier is not necessarily a complete description of the signature suite (parameters in subjectPublicKeyInfo may also be required), full information is in the devIDCert in the devIDCertTable using X.509 OIDs so avoiding generating new OIDs for this MIB and removing the need for future MIB updates as new signature suites are added.
STR devIDPublicKeyPubkeySHA1Hash	1.3.111.2.802.1.1.17.1.2.2.1.4	SnmpAdminString	read-only	The SHA1 Hash of this DevID public key. Obsolete with table. DevIDFingerprint used in new table objects to provided allow hash flexibility without MIB update.
DEV devIDPublicKeyErrStatus	1.3.111.2.802.1.1.17.1.2.2.1.5	DevIDErrorStatus	read-only	Displays the status of an operation on the public key. The default value is none which means no error, indicating a successful operation. Obsolete: DevID module service interface operations are not visible in this MIB so this object provides no clue as to what has failed and does not specify whether it is cleared by subsequent successful operations. If keys or certs are unusable they should not be visible to SNMP or appear not enabled. In both cases this read-only MIB cannot diagnose or repair. SNMP operations already have their own error codes.
U32 devIDCredentialCount	1.3.111.2.802.1.1.17.1.2.3	Unsigned32	read-only	This gives the total number of DevID credentials installed in the DevID module. Obsolete: Object is not indexed by entPhysicalIndex so is not a per module count if the agent is managing multiple devices. Changes as component devices are added or removed are not meaningful without other information. Per module counts can be obtained by interrogating the devIDCertTable.
devIDCredentialTable	1.3.111.2.802.1.1.17.1.2.4		not-accessible	A table of current DevID credentials, where for each certificate the following are indicated: sha1 hash of the certificate, section7 defined fields of cert serial number, issuer, subject, HardwareModuleName, and public key. Obsolete: the ASN.1 encoding of a certificate is already defined elsewhere, there is no need to require a device to decode the certificate into a different ASN.1 structure, and picking particular field might omit problematic extensions in particular certificates.
devIDCredentialEntry	1.3.111.2.802.1.1.17.1.2.4.1		not-accessible	An entry containing DevID Credential information. Obsolete: Table entries are not indexed by entPhysicalIndex.
U32 devIDCredentialIndex	1.3.111.2.802.1.1.17.1.2.4.1.1	Unsigned32	not-accessible	All credentials are indexed internally with this object. The value of this object is in [0..devIDCredentialCount]. Operations on credentials will use the credentialIndex to address a specific credential. The IDevID credential shall only be at index 0. Additional operations on credentials use the credentialIndex to address a specific credential. Obsolete: The SNP agent does not control or monitor individual DevID service operations, an SNMP agent can manage a system that comprises multiple devices identified by the ENTITY-MIB and more than one of those devices can have a DevID module with an IDevID.
T/F devIDCredentialEnabled	1.3.111.2.802.1.1.17.1.2.4.1.2	TruthValue	read-write	The enable/disable state of this credential. This setting persists across restarts. Obsolete with table.
STR devIDCredentialSHA1Hash	1.3.111.2.802.1.1.17.1.2.4.1.3	SnmpAdminString	read-only	The SHA1 Hash of this DevID credential. Obsolete with table.
STR devIDCredentialSerialNumber	1.3.111.2.802.1.1.17.1.2.4.1.4	SnmpAdminString	read-only	The serial number of the credential. Obsolete with table.
STR devIDCredentialIssuer	1.3.111.2.802.1.1.17.1.2.4.1.5	SnmpAdminString	read-only	The issuer field of the credential. Obsolete with table.
STR devIDCredentialSubject	1.3.111.2.802.1.1.17.1.2.4.1.6	SnmpAdminString	read-only	The subject field of the credential. Obsolete with table.
STR devIDCredentialSubjectAltName	1.3.111.2.802.1.1.17.1.2.4.1.7	SnmpAdminString	read-only	The subjectaltname field of the credential. Obsolete with table.
PHY devIDCredentialEntityIndex	1.3.111.2.802.1.1.17.1.2.4.1.8	PhysicalIndex	read-only	This refers to the entPhysicalIndex in entPhysicalTable to identify the associated physical entity. Obsolete with table.
U32 devIDCredentialPubkeyIndex	1.3.111.2.802.1.1.17.1.2.4.1.9	Unsigned32	read-only	Has the appropriate devIDPublicKeyIndex value from devIDPublicKeyTable to identify the public key information. Obsolete with table.
DEV devIDCredentialErrStatus	1.3.111.2.802.1.1.17.1.2.4.1.10	DevIDErrorStatus	read-only	The displays the status of an operation on the credential. The default value is none which means no error, indicating a successful operation. Obsolete with table.
devIDStatisticsTable	1.3.111.2.802.1.1.17.1.2.5		not-accessible	Counts of selected operations for each DevID module.
devIDStatisticsEntry	1.3.111.2.802.1.1.17.1.2.5.1		not-accessible	Counts of selected operations for a DevID module.
C32 devIDStatisticKeyGenerationCountEx	1.3.111.2.802.1.1.17.1.2.5.1.1	Counter32	read-only	The number of LDevID key pairs generated by the module. Discontinuities at system restart and counter rollover.
C32 devIDStatisticKeyInsertionCount	1.3.111.2.802.1.1.17.1.2.5.1.2	Counter32	read-only	The number of LDevID key pairs inserted into the module. Discontinuities occur at system restart and counter rollover.
C32 devIDStatisticKeyDeletionCount	1.3.111.2.802.1.1.17.1.2.5.1.3	Counter32	read-only	The number of LDevID key pairs deleted by the module. Discontinuities occur at system restart and counter rollover.
C32 devIDStatisticCSRGenerationCount	1.3.111.2.802.1.1.17.1.2.5.1.4	Counter32	read-only	The number of Certificate Signing Requests (CSR, RFC2986) generated by the module. Discontinuities occur at system restart and counter rollover. Deprecated: the module does not necessarily have all the information to generate a meaningful CSR, and key and certificate insertion is not tied to prior CSR generation. If required the signing operation can generate a CSR though this is not required for LDevID insertion.
C32 devIDStatisticCredentialInsertionCount	1.3.111.2.802.1.1.17.1.2.5.1.5	Counter32	read-only	The number of LDevID credential insertions. Discontinuities occur at system restart and counter rollover.
C32 devIDStatisticCredentialDeletionCount	1.3.111.2.802.1.1.17.1.2.5.1.6	Counter32	read-only	The number of LDevID credential deletions. Discontinuities occur at system restart and counter rollover.
C32 devIDStatisticCertInsertionCount	1.3.111.2.802.1.1.17.1.2.5.1.7	Counter32	read-only	The number of LDevID certificate insertions. Discontinuities occur at system restart and counter rollover.
C32 devIDStatisticCertDeletionCount	1.3.111.2.802.1.1.17.1.2.5.1.8	Counter32	read-only	This number of LDevID certificate deletions. Discontinuities occur at system restart and counter rollover.
devIDModuleTable	1.3.111.2.802.1.1.17.1.2.6		not-accessible	A table of DevID module capabilities, which can differ for devices managed by the same SNMP agent.
devIDModuleEntry	1.3.111.2.802.1.1.17.1.2.6.1		not-accessible	DevID module capabilities, indexed by the ENTITY MIB's entPhysicalIndex.
T/F devIDModuleSupportsLDevIDs	1.3.111.2.802.1.1.17.1.2.6.1.1	TruthValue	read-only	True if the module supports the mandatory operations for LDevIDs.
T/F devIDModuleGeneratesLDevIDKeys	1.3.111.2.802.1.1.17.1.2.6.1.2	TruthValue	read-only	True if the module supports LDevID key generation.
T/F devIDModuleInsertsLDevIDKeys	1.3.111.2.802.1.1.17.1.2.6.1.3	TruthValue	read-only	True if the module supports LDevID key insertion.
devIDCertTable	1.3.111.2.802.1.1.17.1.2.7		not-accessible	A table of DevID certificates, indexed by entPhysicalIndex (identifying the DevID module to which the certificate belongs) and the certificate's fingerprint.
devIDCertEntry	1.3.111.2.802.1.1.17.1.2.7.1		not-accessible	DevID certificate objects, indexed by entPhysicalIndex and its devIDCertFingerprint.
NUM devIDCertFingerprint	1.3.111.2.802.1.1.17.1.2.7.1.1	DevIDFingerprint	not-accessible	A fingerprint of the DevID certificate, identifying the fingerprinting hash.
NUM devIDCertPublicKeyInfoFprint	1.3.111.2.802.1.1.17.1.2.7.1.2	DevIDFingerprint	read-only	A fingerprint of the DevID certificate's subjectPublicKeyInfo field, identifying the fingerprinting hash.
T/F devIDCertIDevID	1.3.111.2.802.1.1.17.1.2.7.1.3	TruthValue	read-only	True if this is an IDevID Certificate.
T/F devIDCertKeyEnabled	1.3.111.2.802.1.1.17.1.2.7.1.4	TruthValue	read-only	True if use of the DevID Secret for this certificate is enabled, allowing its use.
T/F devIDCertEnabled	1.3.111.2.802.1.1.17.1.2.7.1.5	TruthValue	read-only	True if the certificate can be used.
OCT devIDCert	1.3.111.2.802.1.1.17.1.2.7.1.6	OCTET STRING	read-only	The X.509 DevID certificate.
devIDChainTable	1.3.111.2.802.1.1.17.1.2.8		not-accessible	A table of DevID intermediate certificates, indexed by entPhysicalIndex (identifying the DevID module), devIDCertFingerprint (identifying the DevID certificate), and devIDChainCertIndex (identifying the certificate's position in the certificate chain, upwards from the DevID certificate).
devIDChainEntry	1.3.111.2.802.1.1.17.1.2.8.1		not-accessible	DevID intermediate certificate objects, indexed by entPhysicalIndex, DevID certificate fingerprint, and the certificate's position in the certificate chain.
U32 devIDChainCertIndex	1.3.111.2.802.1.1.17.1.2.8.1.1	Unsigned32	not-accessible	The position of this intermediate certificate in the certificate chain.
NUM devIDChainCertFingerprint	1.3.111.2.802.1.1.17.1.2.8.1.2	DevIDFingerprint	read-only	A fingerprint of the intermediate certificate, identifying the fingerprinting hash.
OCT devIDChainCert	1.3.111.2.802.1.1.17.1.2.8.1.3	OCTET STRING	read-only	The X.509 intermediate certificate in a certificate chain.
devIDStatsMIBObjects	1.3.111.2.802.1.1.17.1.3
devIDMIBConformance	1.3.111.2.802.1.1.17.2
devIDMIBCompliances	1.3.111.2.802.1.1.17.2.1
devIDMIBModuleCompliance	1.3.111.2.802.1.1.17.2.1.1			Module Compliance for DevID MIB-2009.
devIDMIBModuleCompliance2	1.3.111.2.802.1.1.17.2.1.2			Module Compliance for DevID MIB-2018.
devIDMIBGroups	1.3.111.2.802.1.1.17.2.2
devIDMIBObjectGroup	1.3.111.2.802.1.1.17.2.2.1			A collection of objects providing public key manageability, credential manageability and stats.
devIDMIBModuleGroup	1.3.111.2.802.1.1.17.2.2.2			DevID MIB objects describing module capabilities.
devIDMIBCertificateGroup	1.3.111.2.802.1.1.17.2.2.3			DevID MIB objects for DevID public key, certificate, and certificate chain inventory operations.
devIDMIBAuditGroup	1.3.111.2.802.1.1.17.2.2.4			DevID MIB objects supporting DevID operation auditing.

RFC description

Manages IEEE 802.1AR Secure Device Identifiers (DevIDs) for cryptographic device authentication and identity assertion in network elements.

Start monitoring Vendor-neutral IEEE 802.1AR standard (enterprise switch/router with secure device identity) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download IEEE8021-DEVID-MIB