All MIBs › IKE-MON-MIB
Organization: IETF IPsec Working Group
Last Updated: 1999-10-21
Description: IKE-MON-MIB module
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is IKE-MON-MIB?
IKE-MON-MIB is a vendor-neutral MIB for monitoring the Internet Key Exchange (IKE) protocol, the control-plane component used to negotiate IPsec VPN tunnels. It exposes data about IKE Phase 1 security associations (SAs), the negotiated security association suites (encryption/authentication/DH group combinations), and entity-level statistics and events for the IKE process. In terms of monitoring, it is primarily a software/protocol-status MIB: it lets an administrator track whether IKE SAs are established, how many are active, and whether SA negotiation failures or other IKE-related fault events are occurring. It is closely tied to the IPsec/IKE protocol suite defined in IETF RFCs and typically complements an IPsec SA MIB tracking the resulting Phase 2 data-plane tunnels. It is typically deployed on VPN gateways, firewalls, or routers that terminate IPsec VPN tunnels, giving operators visibility into the health of VPN key-exchange operations, which is exactly what IKE-MON-MIB SNMP monitoring is designed to provide.
IPNetwork Monitor allows you to monitor SNMP objects defined in IKE-MON-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- VPN gateway / firewall / router terminating IPsec tunnels
- vendor-neutral, standards-based MIB, not tied to a specific manufacturer
Monitoring Examples
No concrete object names were provided for this module, but per its stated purpose it would expose an IKE Phase 1 SA table (tracking peer identity, negotiated SA suite, and SA state) plus counters or notifications for SA setup failures. An administrator would poll such a table to confirm expected VPN peers have active Phase 1 SAs and would watch for SA-failure events indicating misconfigured pre-shared keys or certificate problems.
What Can Be Monitored
- IKE Phase 1 security association state
- negotiated SA suite (encryption/auth/DH group)
- count of active IKE SAs
- IKE SA failure/fault events
This MIB depends on
Related MIBs
Imported Objects
| IkeAuthMethod | |
| IkeEncryptionAlgorithm | |
| IkeExchangeType | |
| IkeGroupDescription | |
| IkeHashAlgorithm | |
| IkeNotifyMessageType | |
| IkePrf | |
| IpsecDoiIdentType | |
| IpsecDoiSecProtocolId | |
| IpsecDoiTransformIdent |
From IPSEC-SA-MON-MIB
| IpsecIpv6Address | |
| IpsecRawId |
| saInitiatorCookie | OBJECT-TYPE |
| saLocalIpAddress | OBJECT-TYPE |
| saLocalUdpPort | OBJECT-TYPE |
| saRemoteIpAddress | OBJECT-TYPE |
| saRemoteUdpPort | OBJECT-TYPE |
| saResponderCookie | OBJECT-TYPE |
From SNMPv2-SMI
| Counter32 | |
| Counter64 | |
| Gauge32 | |
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-IDENTITY | |
| OBJECT-TYPE | |
| Unsigned32 | |
| experimental |
From SNMPv2-TC
| TruthValue |
| stnTmpProtocols | OBJECT-IDENTITY |
How to Use in IPNetwork Monitor
Example using saAccKbytes OID:
Select a device implementing IKE-MON-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type saAccKbytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of kilobytes the SA has encrypted that count against any lifetime restriction based on traffic. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in kilobytes), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ikeMonModule | 1.3.6.1.4.1.3551.4.1.16 | The MIB module to describe IKE phase 1 SAs, security association suites, and entity level objects and events for those types. | ||
| ikeMonMIBObjects | 1.3.6.1.4.1.3551.4.1.16.1 | This is the base object identifier for all IKE monitoring MIB branches. | ||
| ikePhase1Objects | 1.3.6.1.4.1.3551.4.1.16.1.1 | This is the base object identifier for IKE phase 1 objects. | ||
| ikeTables | 1.3.6.1.4.1.3551.4.1.16.1.1.1 | This is the base object identifier for the IKE phase 1 security associations table. | ||
| ikeSaTable | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1 | not-accessible | The (conceptual) table containing the IKE SAs. The number of rows is the same as the number of IKE phase 2 SAs that are in the process of being negotiated or are negotiated in the entity. Phrased another way, there is a row in this table for each row in 'saTable' for which 'saDoi' is 'ipsecDOI(1)'. The maximum number of rows is implementation dependent. | |
| ikeSaEntry | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular IKE SA. There is an entry in this table for each 'saEntry' in which which 'saDoi' is 'ipsecDOI(1)'. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IKE saAuthMethod | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.1 | IkeAuthMethod | read-only | The authentication method used to authenticate the peers. Note that this does not include the specific method of extended authentication if extended authentication is used. |
| IPS saPeerIdType | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.2 | IpsecDoiIdentType | read-only | The type of ID used by the peer that negotiated this SA. |
| IPS saPeerId | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.3 | IpsecRawId | read-only | The ID of the used by the peer that negotiated this SA. |
| OCT saPeerCertSerialNum | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.4 | OCTET STRING | read-only | The serial number of the certificate of the peer this SA was negotiated with. This object has no meaning if a certificate was not used in authenticating the peer. |
| OCT saPeerCertIssuer | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.5 | OCTET STRING | read-only | The issuer name of the certificate of the peer this control channel was negotiated with. This object has no meaning if a certificate was not used in authenticating the peer. |
| IPS saLocalIdType | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.6 | IpsecDoiIdentType | read-only | The type of ID used by the local entity that negotiated this SA. |
| IPS saLocalId | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.7 | IpsecRawId | read-only | The ID of the used by the local entity that negotiated this SA. |
| IKE saEncAlg | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.8 | IkeEncryptionAlgorithm | read-only | The encryption algorithm used to protect this SA. |
| U32 saEncKeyLength | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.9 | Unsigned32 | read-only | The length of the encryption key in bits used for the algorithm specified in the 'saEncAlg' object. It may be 0 if the key length is implicit in the specified algorithm. |
| IKE saHashAlg | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.10 | IkeHashAlgorithm | read-only | The hash algorithm used to protect this SA. |
| U32 saHashKeyLength | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.11 | Unsigned32 | read-only | The length of the encryption key in bits used for the algorithm specified in the 'saHashAlg' object. It may be 0 if the key length is implicit in the specified algorithm. |
| IKE saPRF | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.12 | IkePrf | read-only | The pseudo-random function used by this SA, or 0 if the HMAC version of the negotiated hash algorithm is used as a pseudo-random function. |
| IKE saOakleyGroupDesc | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.13 | IkeGroupDescription | read-only | The group number used to generate the Diffie-Hellman key pair when setting up the SA, or 0 if none of the defined groups was used. If this value is 0, the 'saOakleyGroup' must not also be OBJECT IDENTIFIER { 0 0 }. |
| OID saOakleyGroup | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.14 | OBJECT IDENTIFIER | read-only | The object identifier of the Oakley group row that was used if a well-known group was not used to generate the Diffie- Hellman key pair for this SA. If a well-known group was used, the value should be set to the OBJECT IDENTIFIER { 0 0 }. For example, if the group is a MODP group, the value of this object is the object identifier of 'modpGroupIndex' of the appropriate row ('modpGroupEntry') in 'modpGroupTable'. |
| U32 saLimitSeconds | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.15 | Unsigned32 | read-only | The maximum number of seconds the SA is allowed to exist, or 0 if there is no time-based limit on the existence of the SA. The display value is limited to 4,294,967,295 seconds (more than 136 years); values greater than that value will be truncated. |
| U32 saLimitKbytes | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.16 | Unsigned32 | read-only | The maximum number of kilobytes the SA is allowed to encrypt before it expires, or 0 if there is no traffic-by- byte-based limit on the existence of the SA. The display value is limited to 4,294,967,295 kilobytes (more than 4,194,304 Mbyte ); values greater than that value will be truncated. |
| U32 saLimitKeyUses | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.17 | Unsigned32 | read-only | The maximum number of times the SA is allowed to provide keying material from its own Diffie-Hellman exchange before it expires, or 0 if there is no keying material-based limit on the existence of the SA. |
| C32 saAccKbytesEx | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.18 | Counter32 | read-only | The number of kilobytes the SA has encrypted that count against any lifetime restriction based on traffic. This value may be 0 if there is no such restriction. |
| C32 saKeyUses | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.19 | Counter32 | read-only | The number of times the SA is has provided keying material derived from its own original Diffie-Hellman exchange. |
| C32 saCreatedSuites | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.20 | Counter32 | read-only | The total number of SA suites that this SA has successfully created. In other words, the total number of successful quick mode exchanges multiplied by the number of SA payloads in each of those exchanges. |
| C32 saDeletedSuites | 1.3.6.1.4.1.3551.4.1.16.1.1.1.1.1.21 | Counter32 | read-only | The total number of SA suites that this SA has sent or received SA suite delete notifications for. When delete notifications are sent or received for more than one SA in an SA suite, this number shall be decremented by one, and not by the number SAs in the suite that were deleted. |
| saByCreatorsTable | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2 | not-accessible | The (conceptual) table that sorts the IKE phase 1 SAs by the endpoint identifiers. The number of rows in this table is the same as the number of IKE phase 1 SAs in the entity. | |
| saByCreatorsEntry | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1 | not-accessible | An entry (conceptual row) referencing a particular IKE phase 1 SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IPS saByCreatorsLocalIdType | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.1 | IpsecDoiIdentType | read-only | The type of ID used by the local entity that negotiated this SA. |
| IPS saByCreatorsLocalId | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.2 | IpsecRawId | read-only | The ID of the used by the local entity that negotiated this SA. |
| IPS saByCreatorsPeerIdType | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.3 | IpsecDoiIdentType | read-only | The type of ID used by the remote entity that negotiated this SA. |
| IPS saByCreatorsPeerId | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.4 | IpsecRawId | read-only | The ID of the used by the remote entity that negotiated this SA. |
| U32 saByCreatorsIndex | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.5 | Unsigned32 | read-only | A unique value, greater than zero, for each IKE phase 1 SA that exists between the two endpoints. It is recommended that values are assigned contiguously starting from 1. |
| OID saIkeLocalIpAddress | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.6 | OBJECT IDENTIFIER | read-only | The 'saLocalIpAddress' of the phase 1 SA for this row. |
| OID saIkeRemoteIpAddress | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.7 | OBJECT IDENTIFIER | read-only | The 'saRemoteIpAddress' of the phase 1 SA for this row. |
| OID saIkeInitiatorCookie | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.8 | OBJECT IDENTIFIER | read-only | The 'saInitiatorCookie' of the phase 1 SA for this row. |
| OID saIkeResponderCookie | 1.3.6.1.4.1.3551.4.1.16.1.1.1.2.1.9 | OBJECT IDENTIFIER | read-only | The 'saResponderCookie' of the phase 1 SA for this row. |
| exchangeTable | 1.3.6.1.4.1.3551.4.1.16.1.1.1.3 | not-accessible | The (conceptual) table containing the exchanges used. There should be one row for every exchange attempt that has occurred using a phase 1 security association that exists in the entity. The maximum number of rows is implementation dependent. | |
| exchangeEntry | 1.3.6.1.4.1.3551.4.1.16.1.1.1.3.1 | not-accessible | An entry (conceptual row) containing the information on a particular exchange used in an SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IKE exchangeType | 1.3.6.1.4.1.3551.4.1.16.1.1.1.3.1.1 | IkeExchangeType | read-only | The type of the exchange for which the statistics of this row apply. |
| C32 exchangeTotalCount | 1.3.6.1.4.1.3551.4.1.16.1.1.1.3.1.2 | Counter32 | read-only | The total number of complete exchanges of the type performed using the SA, as either initiator or as responder. If there were failed attempts to initiate exchanges, this value is not equal to the sum of 'exchangeInitiatedCount' and 'exchangeRespondedCount'. |
| C32 exchangeInitiatedCount | 1.3.6.1.4.1.3551.4.1.16.1.1.1.3.1.3 | Counter32 | read-only | The total number of exchanges of the type attempted using the SA as initiator. This includes exchange that failed or were incomplete |
| C32 exchangeRespondedCount | 1.3.6.1.4.1.3551.4.1.16.1.1.1.3.1.4 | Counter32 | read-only | The total number of complete exchanges of the type performed using the SA as responder. |
| ikeGlobals | 1.3.6.1.4.1.3551.4.1.16.1.1.2 | This is the base object identifier for all objects which are global values for IKE. | ||
| G32 ikeCurrentSAs | 1.3.6.1.4.1.3551.4.1.16.1.1.2.1 | Gauge32 | read-only | The current number of IKE SAs in the entity. |
| G32 ikeCurrentInitiatedSAs | 1.3.6.1.4.1.3551.4.1.16.1.1.2.2 | Gauge32 | read-only | The current number of IKE SAs successfully negotiated in the entity that were initiated by the entity. |
| G32 ikeCurrentRespondedSAs | 1.3.6.1.4.1.3551.4.1.16.1.1.2.3 | Gauge32 | read-only | The current number of IKE SAs successfully negotiated in the entity that were initiated by the peer entity. |
| C32 ikeTotalSAs | 1.3.6.1.4.1.3551.4.1.16.1.1.2.4 | Counter32 | read-only | The total number of IKE SAs successfully negotiated in the entity since boot time. |
| C32 ikeTotalInitiatedSAs | 1.3.6.1.4.1.3551.4.1.16.1.1.2.5 | Counter32 | read-only | The total number of IKE SAs successfully negotiated in the entity since boot time that were initiated by the entity. |
| C32 ikeTotalRespondedSAs | 1.3.6.1.4.1.3551.4.1.16.1.1.2.6 | Counter32 | read-only | The total number of IKE SAs successfully negotiated in the entity since boot time that were initiated by the peer entity. |
| C32 ikeTotalAttempts | 1.3.6.1.4.1.3551.4.1.16.1.1.2.7 | Counter32 | read-only | The total number of IKE SAs negotiation attempts made since boot time. This includes successful negotiations. |
| C32 ikeTotalSaInitAttempts | 1.3.6.1.4.1.3551.4.1.16.1.1.2.8 | Counter32 | read-only | The total number of IKE SAs negotiation attempts made where the entity was the initiator since boot time. This includes successful negotiations. |
| C32 ikeTotalSaRespAttempts | 1.3.6.1.4.1.3551.4.1.16.1.1.2.9 | Counter32 | read-only | The total number of IKE SAs negotiation attempts made where the entity was the responder since boot time. This includes successful negotiations. |
| ikeTrafStats | 1.3.6.1.4.1.3551.4.1.16.1.1.3 | This is the base object identifier for all objects which are global values for IKE. | ||
| C32 ikeTotalInPackets | 1.3.6.1.4.1.3551.4.1.16.1.1.3.1 | Counter32 | read-only | The total number of IKE packets received by the entity since boot time, including re-transmissions and un-encrypted packets. |
| C32 ikeTotalOutPackets | 1.3.6.1.4.1.3551.4.1.16.1.1.3.2 | Counter32 | read-only | The total number of IKE packets sent by the entity since boot time, including re-transmissions and un-encrypted packets. |
| C64 ikeTotalInOctets | 1.3.6.1.4.1.3551.4.1.16.1.1.3.3 | Counter64 | read-only | The total amount of IKE traffic received by the entity since boot time, measured in bytes, including any re- transmitted packets received, and including encrypted and un-encrypted packets. |
| C64 ikeTotalOutOctets | 1.3.6.1.4.1.3551.4.1.16.1.1.3.4 | Counter64 | read-only | The total amount of IKE traffic sent by the entity since boot time, measured in bytes, including any re-transmissions and including encrypted and un-encrypted packets. |
| ikeErrors | 1.3.6.1.4.1.3551.4.1.16.1.1.4 | This is the base object identifier for all objects which are global values for IKE. | ||
| C32 ikeTotalInitFailures | 1.3.6.1.4.1.3551.4.1.16.1.1.4.1 | Counter32 | read-only | The total number of attempts to initiate an IKE phase 1 SA that failed since boot time, when there was a response from the peer entity. This value may be used to detect clogging or denial-of- service attacks. |
| C32 ikeTotalInitNoResponses | 1.3.6.1.4.1.3551.4.1.16.1.1.4.2 | Counter32 | read-only | The total number of attempts to initiate an IKE phase 1 SA that failed since boot time, when there was no response from the peer entity. This should only be incremented if the peer does not repond to the first packet of attempted negotiations. |
| C32 ikeTotalRespFailures | 1.3.6.1.4.1.3551.4.1.16.1.1.4.3 | Counter32 | read-only | The total number of attempts to initiate an IKE phase 1 SA that failed since boot time, when the initiation attempt came for the peer entity. |
| ikeTrapControl | 1.3.6.1.4.1.3551.4.1.16.1.1.5 | This is the base object identifier for all trap controls for the IKE phase 1 SA portion of this MIB. | ||
| T/F ikeNegFailureTrapEnable | 1.3.6.1.4.1.3551.4.1.16.1.1.5.1 | TruthValue | read-write | Indicates whether ikeNegFailure traps should be generated. |
| ikeTraps | 1.3.6.1.4.1.3551.4.1.16.1.1.6 | This is the base object identifier for all traps for the IKE phase 1 SA portion of this MIB. | ||
| NTF ikeNegFailure | 1.3.6.1.4.1.3551.4.1.16.1.1.6.1 | An attempt to negotiate a phase 1 IKE SA failed. The notification type sent or received is also sent as part of the trap, along with the current value of the total negotiation error counters for ISAKMP. | ||
| ikeNotifications | 1.3.6.1.4.1.3551.4.1.16.1.1.7 | This is the base object identifier for all notification objects of this MIB. | ||
| notifyCountTable | 1.3.6.1.4.1.3551.4.1.16.1.1.7.1 | not-accessible | The (conceptual) table containing information on IPSec notify message counts. Rows are created in this table for every notification type that has been sent or received by the entity. This table MAY be sparsely populated; that is, rows for which the count is 0 may be absent. | |
| notifyCountEntry | 1.3.6.1.4.1.3551.4.1.16.1.1.7.1.1 | not-accessible | An entry (conceptual row) containing the total number of occurrences of a notify message. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IPS notifyProtocol | 1.3.6.1.4.1.3551.4.1.16.1.1.7.1.1.1 | IpsecDoiSecProtocolId | read-only | The value representing a protocol for which the notify was used. |
| IKE notifyType | 1.3.6.1.4.1.3551.4.1.16.1.1.7.1.1.2 | IkeNotifyMessageType | read-only | The value representing a specific ISAKMP notify message, or 0 if unknown. Values are assigned from the set of notify message types as defined in Section 3.14.1 of [ISAKMP], and enhanced by the IPsec DOI. In addition, the value 0 may be used for this object when the object is used as a trap cause, and the cause is unknown. |
| C32 notifySentCount | 1.3.6.1.4.1.3551.4.1.16.1.1.7.1.1.3 | Counter32 | read-only | The total number of times the specific notify message has been sent by the entity since system boot. |
| C32 notifyReceivedCount | 1.3.6.1.4.1.3551.4.1.16.1.1.7.1.1.4 | Counter32 | read-only | The total number of times the specific notify message has been received by the entity since system boot. |
| phase2Objects | 1.3.6.1.4.1.3551.4.1.16.1.2 | This is the base object identifier for IKE phase 2 objects, including the suite and phase 2 SA tables. | ||
| suiteTables | 1.3.6.1.4.1.3551.4.1.16.1.2.1 | This is the base object identifier for the suite table. | ||
| suiteTable | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1 | not-accessible | The (conceptual) table containing the phase 2 suites. The number of rows in this table is the same as the number of suites in the entity. The maximum number of rows is implementation dependent. | |
| suiteEntry | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular phase 2 SA suite. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| U32 suiteIndex | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.1 | Unsigned32 | read-only | A unique value, greater than zero, for each SA suite. It is recommended that values are assigned contiguously starting from 1. |
| ADR suiteLocalAddress | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.2 | IpsecIpv6Address | read-only | The address used by the local entity that negotiated the SA suite. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'. |
| ADR suiteRemoteAddress | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.3 | IpsecIpv6Address | read-only | The address used by the remote entity that negotiated the SA suite. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'. |
| IPS suitePhase1RemoteIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.4 | IpsecDoiIdentType | read-only | The type of ID used by the remote entity that negotiated this suite. |
| IPS suitePhase1RemoteId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.5 | IpsecRawId | read-only | The ID of the remote entity that negotiated this suite. |
| IPS suitePhase1LocalIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.6 | IpsecDoiIdentType | read-only | The type of ID used by the local entity that negotiated this suite. |
| IPS suitePhase1LocalId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.7 | IpsecRawId | read-only | The ID of the local entity that negotiated this suite. |
| IPS suiteRemoteId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.8 | IpsecRawId | read-only | The remote identifier of the SAs in the suite. It may be 0 if unknown or if the suite uses transport mode encapsulation. This corresponds to the destination identifier of outbound SAs in the suite, and to the source identifier of inbound SAs in the suite. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| IPS suiteRemoteIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.9 | IpsecDoiIdentType | read-only | The type of ID used for 'suiteRemoteId'. It may be 0 if unknown or if the suite uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| IPS suiteLocalId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.10 | IpsecRawId | read-only | The local identifier of the SAs in the suite. It may be 0 if unknown or if the suite uses transport mode encapsulation. This corresponds to the source identifier of outbound SAs in the suite, and to the destination identifier of inbound SAs in the suite. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| IPS suiteLocalIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.11 | IpsecDoiIdentType | read-only | The type of ID used for 'suiteLocalId'. It may be 0 if unknown or if the suite uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| I32 suiteProtocol | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.12 | Integer32 | read-only | The transport-layer protocol number that this suite carries, or 0 if it carries any protocol. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| I32 suiteRemotePort | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.13 | Integer32 | read-only | The remote port number of the protocol that this suite carries, or 0 if it carries any port number. This corresponds to the destination port number of outbound SAs in the suite, and to the source port number of inbound SAs in the suite. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| I32 suiteLocalPort | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.14 | Integer32 | read-only | The local port number of the protocol that this SA carries, or 0 if it carries any port number. This corresponds to the source port number of outbound SAs in the suite, and to the destination port number of inbound SAs in the suite. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations |
| IKE suiteOakleyGroupDesc | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.15 | IkeGroupDescription | read-only | The group number used to generate the Diffie-Hellman key pair when setting up the SA, or 0 if none of the well known groups was used, or if perfect forward secrecy was not used. |
| OID suiteOakleyGroup | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.16 | OBJECT IDENTIFIER | read-only | The table index value of the Oakley group row that was used if a well-known group was not used to generate the Diffie- Hellman key pair for this SA. If a well-known group was used, or if perfect forward secrecy was not used, the value should be set to the OBJECT IDENTIFIER { 0 0 }. |
| C32 suiteLifeSeconds | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.17 | Counter32 | read-only | The number of seconds that the SA has existed. |
| C64 suiteInUserOctets | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.18 | Counter64 | read-only | The amount of user level traffic measured in bytes handled by the suite in the inbound direction. This is the same as the user level traffic of the inner most inbound SA in the suite. Note that if the inner-most SA is a shared IPcomp SA, then this value may be difficult to calculate. |
| C64 suiteInPackets | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.19 | Counter64 | read-only | The number of inbound packets handled by the suite. This is the same as the number of packets handled by any one of the inbound SAs in the suite. |
| C64 suiteOutUserOctets | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.20 | Counter64 | read-only | The amount of user level traffic measured in bytes handled by the suite in the outbound direction. This is the same as the user level traffic of the inner most outbound SA in the suite. Note that if the inner most SA is a shared IPcomp SA, then this value may be difficult to calculate. |
| C64 suiteOutPackets | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.21 | Counter64 | read-only | The number of outbound packets handled by the suite. This is the same as the number of packets handled by any one of the outbound SAs in the suite. |
| C32 suiteSendErrors | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.22 | Counter32 | read-only | The number of outbound packets discarded by the suite due to any error. This is the same as the sum of all errors of all outbound SAs in the suite. |
| C32 suiteReceiveErrors | 1.3.6.1.4.1.3551.4.1.16.1.2.1.1.1.23 | Counter32 | read-only | The number of inbound packets discarded by the suite due to any error. This is the same as the sum of all errors of all inbound SAs in the suite. |
| phase2SaTable | 1.3.6.1.4.1.3551.4.1.16.1.2.1.2 | not-accessible | The (conceptual) table containing ID information for the phase 2 SAs that are part of suites. The number of rows in this table is the same as the number of unidirectional phase 2 IPsec SA pairs that are created as part of suites. The maximum number of rows is implementation dependent. | |
| phase2SaEntry | 1.3.6.1.4.1.3551.4.1.16.1.2.1.2.1 | not-accessible | An entry (conceptual row) containing the information on a particular phase 2 SA within a suite. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| U32 saOrder | 1.3.6.1.4.1.3551.4.1.16.1.2.1.2.1.1 | Unsigned32 | read-only | The position within the suite of the pair of SAs indicated by this row. A value of 1 is used to represent the outer-most SA pair. The outer-most SA of any given packet has its header next to the outer IP header of the processed packet, while the inner-most SA has its header nearest the data of the unprocessed packet. (Note that the IPcomp header may be missing in actual usage if a particular packet was not compressed.) This value should be monotonically increasing for every SA pair in a suite. The maximum value is implementation dependent, but will generally not exceed three. |
| IPS saProtocol | 1.3.6.1.4.1.3551.4.1.16.1.2.1.2.1.2 | IpsecDoiTransformIdent | read-only | The protocol of the inbound/outbound SA pair indicated by this row of the table. |
| U32 saInSpi | 1.3.6.1.4.1.3551.4.1.16.1.2.1.2.1.3 | Unsigned32 | read-only | The security parameters index of the inbound SA of the inbound/outbound SA pair. If the protocol of the SA pair is IPcomp, this value is the CPI. This value is used with the value of 'suiteLocalAddress' from the row indexed by 'suiteIndex' to create a SPI/address pair that uniquely identifies the inbound SA used in this SA suite. This can then be used to look up the SA in the appropriate inbound SA table, based on 'saProtocol'. |
| U32 saOutSpi | 1.3.6.1.4.1.3551.4.1.16.1.2.1.2.1.4 | Unsigned32 | read-only | The security parameters index of the outbound SA of the inbound/outbound SA pair. If the protocol of the SA pair is IPcomp, this value is the CPI. This value is used with the value of 'suiteLocalAddress' from the row indexed by 'suiteIndex' to create a SPI/address pair that uniquely identifies the outbound SA used in this SA suite. This can then be used to look up the SA in the appropriate outbound SA table, based on 'saProtocol'. |
| suiteByCreatorsTable | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3 | not-accessible | The (conceptual) table that sorts the SA suites by the endpoint identifiers. The number of rows in this table is the same as the number of suites in the entity. | |
| suiteByCreatorsEntry | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3.1 | not-accessible | An entry (conceptual row) referencing a particular suite. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IPS suiteByCreatorsP1LocalIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3.1.1 | IpsecDoiIdentType | read-only | The type of ID used by the local entity that negotiated this suite. |
| IPS suiteByCreatorsP1LocalId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3.1.2 | IpsecRawId | read-only | The ID of the local entity that negotiated this suite. |
| IPS suiteByCreatorsP1RemoteIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3.1.3 | IpsecDoiIdentType | read-only | The type of ID used by the remote entity that negotiated this suite. |
| IPS suiteByCreatorsP1RemoteId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3.1.4 | IpsecRawId | read-only | The ID of the remote entity that negotiated this suite. |
| U32 suiteByCreatorsIndex | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3.1.5 | Unsigned32 | read-only | A unique value, greater than zero, for each SA suite that is between the two endpoints. It is recommended that values are assigned contiguously starting from 1 for each SA suite between the two endpoints. |
| OID suiteByCreatorsRef | 1.3.6.1.4.1.3551.4.1.16.1.2.1.3.1.6 | OBJECT IDENTIFIER | read-only | The value of 'suiteIndex' in the row ('suiteEntry') of the 'suiteTable' to which this row refers. |
| suiteBySelectorsTable | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4 | not-accessible | The (conceptual) table that sorts the suites by the selectors. The number of rows in this table is the same as the number of suites in the entity. | |
| suiteBySelectorsEntry | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1 | not-accessible | An entry (conceptual row) referencing a particular suite. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IPS suiteBySelectorsLocalId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.1 | IpsecRawId | read-only | The local identifier of the selector of the suite. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| IPS suiteBySelectorsLocalIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.2 | IpsecDoiIdentType | read-only | The type of ID used for 'suiteBySelectorsLocalId'. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| IPS suiteBySelectorsRemoteId | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.3 | IpsecRawId | read-only | The remote identifier of the selector of the suite. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| IPS suiteBySelectorsRemoteIdType | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.4 | IpsecDoiIdentType | read-only | The type of ID used for 'suiteBySelectorsRemoteId'. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| I32 suiteBySelectorsProtocol | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.5 | Integer32 | read-only | The transport-layer protocol number that this suite carries, or 0 if it carries any protocol. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| I32 suiteBySelectorsLocalPort | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.6 | Integer32 | read-only | The local port number of the protocol that this suite carries, or 0 if it carries any port number. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations. |
| I32 suiteBySelectorsRemotePort | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.7 | Integer32 | read-only | The remote port number of the protocol that this SA carries, or 0 if it carries any port number. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations |
| U32 suiteBySelectorsIndex | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.8 | Unsigned32 | read-only | A unique value, greater than zero, for each SA suite that the same selectors. It is recommended that values are assigned contiguously starting from 1. |
| OID suiteBySelectorsRef | 1.3.6.1.4.1.3551.4.1.16.1.2.1.4.1.9 | OBJECT IDENTIFIER | read-only | The value of 'suiteIndex' in the row ('suiteEntry') of the 'suiteTable' to which this row refers. |
| ipsecSaInSuiteTable | 1.3.6.1.4.1.3551.4.1.16.1.2.1.5 | not-accessible | The (conceptual) table that allows determination of which suite a particular phase 2 SA is in. The number of rows in this table is the same as the number of phase 2 SAs in the entity. | |
| ipsecSaInSuiteEntry | 1.3.6.1.4.1.3551.4.1.16.1.2.1.5.1 | not-accessible | An entry (conceptual row) referencing a particular phase 2 SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| ADR ipsecSaInSuiteDestAddress | 1.3.6.1.4.1.3551.4.1.16.1.2.1.5.1.1 | IpsecIpv6Address | read-only | The destination address of the IPsec phase 2 SA to which this row refers. |
| IPS ipsecSaInSuiteProtocol | 1.3.6.1.4.1.3551.4.1.16.1.2.1.5.1.2 | IpsecDoiSecProtocolId | read-only | The security protocol of the IPsec phase 2 SA to which this row refers. |
| U32 ipsecSaInSuiteSpi | 1.3.6.1.4.1.3551.4.1.16.1.2.1.5.1.3 | Unsigned32 | read-only | The SPI value of the IPsec phase 2 SA to which this row refers. If the value of 'ipsecSaInSuiteProtocol' is 'protoIpcomp(4)', then this is the CPI of the SA. |
| OID ipsecSaInSuiteRef | 1.3.6.1.4.1.3551.4.1.16.1.2.1.5.1.4 | OBJECT IDENTIFIER | read-only | The value of 'suiteIndex' in the row ('suiteEntry') of the 'suiteTable' to which this row refers. This is the suite that uses this SA. |
| suiteGlobals | 1.3.6.1.4.1.3551.4.1.16.1.2.2 | This is the base object identifier for all objects which are global values for suites. | ||
| C32 totalSuites | 1.3.6.1.4.1.3551.4.1.16.1.2.2.1 | Counter32 | read-only | The total number of suites created by the entity since system boot. |
| G32 currentSuites | 1.3.6.1.4.1.3551.4.1.16.1.2.2.2 | Gauge32 | read-only | The total number of suites currently in existence in the entity. |
| suiteTrafStats | 1.3.6.1.4.1.3551.4.1.16.1.2.3 | This is the base object identifier for all objects which are global counters for suite traffic statistics. | ||
| C64 suiteTotalInUserKbytes | 1.3.6.1.4.1.3551.4.1.16.1.2.3.1 | Counter64 | read-only | The total amount of user level traffic carried by all suites in the entity since boot time, measured in kilobytes, in the inbound direction. This is the sum of the 'suiteInUserOctets' column for all suite rows created since boot time. |
| C64 suiteTotalInPackets | 1.3.6.1.4.1.3551.4.1.16.1.2.3.2 | Counter64 | read-only | The total number of packets carried by all suites in the entity since boot time in the inbound direction. This is the sum of the 'suiteInPackets' column for all suite rows created since boot time. |
| C64 suiteTotalOutUserKbytes | 1.3.6.1.4.1.3551.4.1.16.1.2.3.3 | Counter64 | read-only | The total amount of user level traffic carried by all suites in the entity since boot time, measured in kilobytes, in the outbound direction. This is the sum of the 'suiteOutUserOctets' column for all suite rows created since boot time. |
| C64 suiteTotalOutPackets | 1.3.6.1.4.1.3551.4.1.16.1.2.3.4 | Counter64 | read-only | The total number of packets carried by all suites in the entity since boot time, in the outbound direction. This is the sum of the 'suiteOutPackets' column for all suite rows created since boot time. |
| suiteErrors | 1.3.6.1.4.1.3551.4.1.16.1.2.4 | This is the base object identifier for all objects which are global error counters for suites. | ||
| C32 suiteInitFailures | 1.3.6.1.4.1.3551.4.1.16.1.2.4.1 | Counter32 | read-only | The total number of attempts to initiate an suite that failed since boot time, when the attempt was initiated locally. |
| C32 suiteRespondFailures | 1.3.6.1.4.1.3551.4.1.16.1.2.4.2 | Counter32 | read-only | The total number of attempts to initiate an suite that failed since boot time, when the attempt was initiated by the peer entity. |
| suiteTrapControl | 1.3.6.1.4.1.3551.4.1.16.1.2.5 | This is the base object identifier for all trap controls for the suite portion of this MIB. | ||
| T/F suiteNegFailureTrapEnable | 1.3.6.1.4.1.3551.4.1.16.1.2.5.1 | TruthValue | read-write | Indicates whether 'suiteNegFailure' traps should be generated. |
| suiteTraps | 1.3.6.1.4.1.3551.4.1.16.1.2.6 | This is the base object identifier for all traps for the suite portion of this MIB. | ||
| NTF suiteNegFailure | 1.3.6.1.4.1.3551.4.1.16.1.2.6.1 | An attempt to negotiate a phase 2 SA suite for the specified selectors failed. The current total failure counts are passed as well as the notification type sent or received as part of the failure. | ||
| oakleyObjects | 1.3.6.1.4.1.3551.4.1.16.1.3 | This is the base object identifier for Oakley groups. | ||
| modpGroupTable | 1.3.6.1.4.1.3551.4.1.16.1.3.1 | not-accessible | The (conceptual) table containing Oakley MODP groups that are not well known that the entity has negotiated or knows about. There should be one row for every Oakley MODP group negotiated or supported by the entity that is not a well- known group. The maximum number of rows is implementation dependent. | |
| modpGroupEntry | 1.3.6.1.4.1.3551.4.1.16.1.3.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular Oakley MODP group. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| U32 modpGroupIndex | 1.3.6.1.4.1.3551.4.1.16.1.3.1.1.1 | Unsigned32 | read-only | A unique value, greater than zero, for each Oakley MODP group. It is recommended that values are assigned contiguously starting from 1. The value for each MODP group must remain constant at least from one re-initialization of entity's network management system to the next re-initialization. |
| U32 modpFieldSize | 1.3.6.1.4.1.3551.4.1.16.1.3.1.1.2 | Unsigned32 | read-only | The size of a field element, in bits. |
| OCT modpPrime | 1.3.6.1.4.1.3551.4.1.16.1.3.1.1.3 | OCTET STRING | read-only | The prime of the MODP group. |
| OCT modpGenerator | 1.3.6.1.4.1.3551.4.1.16.1.3.1.1.4 | OCTET STRING | read-only | The generator value of the MODP group. |
| OCT modpLPF | 1.3.6.1.4.1.3551.4.1.16.1.3.1.1.5 | OCTET STRING | read-only | The largest prime factor of the group size, or 0 if unspecified. |
| U32 modpStrength | 1.3.6.1.4.1.3551.4.1.16.1.3.1.1.6 | Unsigned32 | read-only | The strength of the group, which is approximately the number of key-bits protected, or 0 if unspecified. |
| ecpGroupTable | 1.3.6.1.4.1.3551.4.1.16.1.3.2 | not-accessible | The (conceptual) table containing Oakley ECP groups that are not well known that the entity has negotiated or knows about. There should be one row for every Oakley ECP group negotiated or supported by the entity that is not a well- known group. The maximum number of rows is implementation dependent. | |
| ecpGroupEntry | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1 | not-accessible | An entry (conceptual row) containing the information on a particular Oakley ECP group. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| U32 ecpGroupIndex | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.1 | Unsigned32 | read-only | A unique value, greater than zero, for each Oakley ECP group. It is recommended that values are assigned contiguously starting from 1. The value for each ECP group must remain constant at least from one re-initialization of entity's network management system to the next re-initialization. |
| U32 ecpFieldSize | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.2 | Unsigned32 | read-only | The size of a field element, in bits. |
| OCT ecpPrime | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.3 | OCTET STRING | read-only | The prime of the ECP group. |
| OCT ecpGeneratorOne | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.4 | OCTET STRING | read-only | The first generator value of the group. |
| OCT ecpGeneratorTwo | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.5 | OCTET STRING | read-only | The second generator value of the group. |
| OCT ecpParameterOne | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.6 | OCTET STRING | read-only | The first elliptic curve parameter value of the group. |
| OCT ecpParameterTwo | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.7 | OCTET STRING | read-only | The second elliptic curve parameter value of the group. |
| OCT ecpLPF | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.8 | OCTET STRING | read-only | The largest prime factor of the group size, or 0 if unspecified. |
| OCT ecpOrder | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.9 | OCTET STRING | read-only | The order of the group, or 0 if it is unspecified. |
| U32 ecpStrength | 1.3.6.1.4.1.3551.4.1.16.1.3.2.1.10 | Unsigned32 | read-only | The strength of the group, which is approximately the number of key-bits protected. |
| ec2nGroupTable | 1.3.6.1.4.1.3551.4.1.16.1.3.3 | not-accessible | The (conceptual) table containing Oakley EC2N groups that are not well known that the entity has negotiated or knows about. There should be one row for every Oakley group negotiated or supported by the entity that is not a well-known group. The maximum number of rows is implementation dependent. | |
| ec2nGroupEntry | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1 | not-accessible | An entry (conceptual row) containing the information on a particular Oakley EC2N group. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| U32 ec2nGroupIndex | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.1 | Unsigned32 | read-only | A unique value, greater than zero, for each Oakley EC2N group. It is recommended that values are assigned contiguously starting from 1. The value for each EC2N group must remain constant at least from one re-initialization of entity's network management system to the next re-initialization. |
| U32 ec2nDegree | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.2 | Unsigned32 | read-only | The degree of the irreducible polynomial. |
| OCT ec2nIrrPoly | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.3 | OCTET STRING | read-only | The prime or the irreducible field polynomial. |
| OCT ec2nGeneratorOne | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.4 | OCTET STRING | read-only | The first generator value of the group. |
| OCT ec2nGeneratorTwo | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.5 | OCTET STRING | read-only | The second generator value of the group. |
| OCT ec2nParameterOne | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.6 | OCTET STRING | read-only | The first elliptic curve parameter value of the group. |
| OCT ec2nParameterTwo | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.7 | OCTET STRING | read-only | The second elliptic curve parameter value of the group. |
| OCT ec2nLPF | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.8 | OCTET STRING | read-only | The largest prime factor of the group size, or 0 if unspecified. |
| OCT ec2nOrder | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.9 | OCTET STRING | read-only | The order of the group, or 0 if it is unspecified. |
| U32 ec2nStrength | 1.3.6.1.4.1.3551.4.1.16.1.3.3.1.10 | Unsigned32 | read-only | The strength of the group, which is approximately the number of key-bits protected, or 0 if it is unspecified. |
| ikeGroups | 1.3.6.1.4.1.3551.4.1.16.1.4 | This is the base object identifier for all objects which describe the groups in this MIB. | ||
| ikeConformance | 1.3.6.1.4.1.3551.4.1.16.1.5 | This is the base object identifier for all objects which describe the conformance for this MIB. |
RFC description
MIB for monitoring Internet Key Exchange (IKE) protocol operations, session establishment, and IPsec key management.
Start monitoring Vendor-neutral IETF standard (VPN gateway/firewall/router terminating IPsec tunnels) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.