All MIBs › IPSEC-IPSECACTION-MIB
Organization: IETF IP Security Policy Working Group
Last Updated: 2006-10-17
Category: Domain: Security, Standard: IETF, VPN and Security
Description: IETF IPsec action MIB defining SNMP objects for IPsec security policy action rules including encryption and authentication parameters.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is IPSEC-IPSECACTION-MIB?
IPSEC-IPSECACTION-MIB is an IETF standards-track MIB (from draft-ietf-ipsp-ipsecaction-mib, part of the IPsec Security Policy Database framework alongside IPSEC-SPD-MIB) that defines the "action" objects invoked when IPsec policy rules match traffic — the concrete AH/ESP/IPComp transform and lifetime parameters applied to a security association. Its central ipsaSaPreconfiguredActionTable ties an action name and direction (ipsaSaPreActActionName, ipsaSaPreActSADirection) to lifetime limits (ipsaSaPreActActionLifetimeSec/KB), DF-bit handling, and references into per-protocol transform tables — ipsaAhTransformTable, ipsaEspTransformTable, and ipsaIpcompTransformTable — which carry algorithm identifiers, key lengths, replay-window sizes, and RowStatus/StorageType lifecycle objects. It depends on IPSEC-SPD-MIB for the policy rules that invoke these actions and on SNMP-FRAMEWORK-MIB/INET-ADDRESS-MIB for administrative naming and addressing conventions. It is deployed on IPsec gateways and hosts implementing SNMP-manageable IPsec policy, and administrators consulting standards documentation for the IPSEC-IPSECACTION-MIB RFC use it to understand how configured security actions map to negotiated SA parameters.
IPNetwork Monitor allows you to monitor SNMP objects defined in IPSEC-IPSECACTION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- vendor-neutral, standards-based MIB (IETF draft-ietf-ipsp-ipsecaction-mib), not tied to a specific manufacturer — applies to IPsec-capable gateways and hosts
Monitoring Examples
An operator polls ipsaSaPreconfiguredActionTable to review ipsaSaPreActESPTransformName and ipsaSaPreActActionLifetimeSec for a given action, then cross-checks ipsaEspTransformTable for the referenced cipher and key length; an action row with an ipsaSaPreActRowStatus other than active, or a transform whose replay-window size looks misconfigured, would indicate an IPsec policy action that will fail to negotiate or provide inadequate protection.
What Can Be Monitored
- preconfigured SA action table entries
- AH/ESP/IPComp transform parameters
- SA lifetime (seconds/KB) limits
- replay protection window size
- action/transform row status and storage type
This MIB depends on
Related MIBs
Imported Objects
From DIFFSERV-MIB
| IfDirection |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From IPSEC-SPD-MIB
| SpdAdminStatus | |
| SpdIPPacketLogging | |
| spdActions | OBJECT-IDENTITY |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| RowStatus | |
| StorageType | |
| TEXTUAL-CONVENTION | |
| TimeStamp | |
| TruthValue |
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| IPS ipsaAhTranAlgorithm | 1.3.6.1.2.1.153.4.1.1.2.1.4 | IpsecDoiAuthAlgorithm | read-create | This object specifies the AH algorithm for this transform. |
| TIM ipsaAhTranLastChanged | 1.3.6.1.2.1.153.4.1.1.2.1.7 | TimeStamp | read-only | The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value. |
| U32 ipsaAhTranMaxLifetimeKB | 1.3.6.1.2.1.153.4.1.1.2.1.3 | Unsigned32 | read-create | ipsaAhTranMaxLifetimeKB specifies how long in kilobytes the security association derived from this transform SHOULD be used. |
| U32 ipsaAhTranMaxLifetimeSec | 1.3.6.1.2.1.153.4.1.1.2.1.2 | Unsigned32 | read-create | ipsaAhTranMaxLifetimeSec specifies how long in seconds the security association derived from this transform SHOULD be used. A value of 0 indicates that the default lifetime of 8 hours SHOULD be used. |
| STR ipsaAhTranName | 1.3.6.1.2.1.153.4.1.1.2.1.1 | SnmpAdminString | not-accessible | This object contains the name of this AH transform. This row will be referred to by an ipsaIpsecTransformsEntry. |
| T/F ipsaAhTranReplayProtection | 1.3.6.1.2.1.153.4.1.1.2.1.5 | TruthValue | read-create | ipsaAhTranReplayProtection indicates whether or not anti replay service is to be provided by this SA. |
| U32 ipsaAhTranReplayWindowSize | 1.3.6.1.2.1.153.4.1.1.2.1.6 | Unsigned32 | read-create | ipsaAhTranReplayWindowSize indicates the size, in bits, of the replay window to use if replay protection is true for this transform. The window size is assumed to be a power of two. If Replay Protection is false, this value can be ignored. |
| ROW ipsaAhTranRowStatus | 1.3.6.1.2.1.153.4.1.1.2.1.9 | RowStatus | read-create | This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error. |
| ipsaAhTransformEntry | 1.3.6.1.2.1.153.4.1.1.2.1 | not-accessible | This entry contains the attributes of one AH transform. | |
| ipsaAhTransformTable | 1.3.6.1.2.1.153.4.1.1.2 | not-accessible | This table lists all the AH transforms which can be used to build IPsec proposals. | |
| STO ipsaAhTranStorageType | 1.3.6.1.2.1.153.4.1.1.2.1.8 | StorageType | read-create | The storage type for this row. Rows in this table which were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable. |
| ipsaCompliances | 1.3.6.1.2.1.153.4.1.3.1 | |||
| ipsaConfigObjects | 1.3.6.1.2.1.153.4.1.1 | |||
| ipsaConformanceObjects | 1.3.6.1.2.1.153.4.1.3 | |||
| SPD ipsaCredAdminStatus | 1.3.6.1.2.1.153.4.1.1.5.1.7 | SpdAdminStatus | read-create | Indicates whether this credential is considered active. Rows with a disabled status MUST NOT be used for any purpose, including IKE or IPSEC processing. For credentials whose size does not execeed the maximum size for the ipsaCredCredential, it MAY be set to enabled during row creation. For larger credentials, it SHOULD be left as disabled until all rows have been uploaded to the ipsaCredSegmentTable. |
| OCT ipsaCredCredential | 1.3.6.1.2.1.153.4.1.1.5.1.3 | OCTET STRING | read-create | This object represents the credential value. If the size of the credential is greater than 1024, the credential MUST be configured via the ipsaCredSegmentTable. For credential type where the disclosure of the credential would compromise the credential (e.g. shared secrets), when this object is accessed for reading, it MUST return a null length (0 length) string and MUST NOT return the configured credential. |
| ipsaCredentialEntry | 1.3.6.1.2.1.153.4.1.1.5.1 | not-accessible | A row in the ipsaCredentialTable. | |
| ipsaCredentialSegmentEntry | 1.3.6.1.2.1.153.4.1.1.6.1 | not-accessible | A row in the ipsaCredentialSegmentTable. | |
| ipsaCredentialSegmentTable | 1.3.6.1.2.1.153.4.1.1.6 | not-accessible | A table of credential segments. This table is used for credentials which are larger than the maximum size allowed for ipsaCredCredential. | |
| ipsaCredentialTable | 1.3.6.1.2.1.153.4.1.1.5 | not-accessible | A table of credential values. Example of Credentials are shared secrets, certificates or kerberos tickets. | |
| TIM ipsaCredLastChanged | 1.3.6.1.2.1.153.4.1.1.5.1.8 | TimeStamp | read-only | The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value. |
| STR ipsaCredMngName | 1.3.6.1.2.1.153.4.1.1.5.1.5 | SnmpAdminString | read-create | This value is used as an index into the ipsaIpsecCredMngServiceTable. For IDs that have no credential management service, this value is left blank. |
| STR ipsaCredName | 1.3.6.1.2.1.153.4.1.1.5.1.1 | SnmpAdminString | not-accessible | This object represents the name for an entry in this table. |
| OCT ipsaCredRemoteID | 1.3.6.1.2.1.153.4.1.1.5.1.6 | OCTET STRING | read-create | This object represents the Identification (e.g. user name) of the user of the key information on the remote site. If there is no ID associated with this credential, the value of this object SHOULD be the null string. |
| ROW ipsaCredRowStatus | 1.3.6.1.2.1.153.4.1.1.5.1.10 | RowStatus | read-create | This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error. |
| I32 ipsaCredSegIndex | 1.3.6.1.2.1.153.4.1.1.6.1.1 | Integer32 | not-accessible | This object represents the segment number for this segment. By default, each segment will be 1024 octets. However, when this table is accessed using a context of 'ipsa4096', 'ipsa8192' or 'ipsa16384' a segment size of 4096, 8192 or 16384 (respectively) will be used instead. The number of rows which need to be retrieved or set can be calculated by obtaining the value of the ipsaCredSize column from the corresponding ipsaCredentialTable row and dividing it by the segment size. |
| TIM ipsaCredSegLastChanged | 1.3.6.1.2.1.153.4.1.1.6.1.3 | TimeStamp | read-only | The value of sysUpTime when this credential was last modified or created either through SNMP SETs or by some other external means. Note that the last changed type will be the same for all segemnts of the credential. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value. |
| ROW ipsaCredSegRowStatus | 1.3.6.1.2.1.153.4.1.1.6.1.5 | RowStatus | read-create | This object indicates the conceptual status of this row. The segment of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error. |
| STO ipsaCredSegStorageType | 1.3.6.1.2.1.153.4.1.1.6.1.4 | StorageType | read-only | The storage type for this row. This object is read-only. Rows in this table have the same value as the ipsaCrendStorageType for the corresponding row in the ipsaCredentialTable. For a storage type of permanent, none of the columns have to be writable. |
| OCT ipsaCredSegValue | 1.3.6.1.2.1.153.4.1.1.6.1.2 | OCTET STRING | read-create | This object represents one segment of the credential. By default, each complete segment will be 1024 octets. (The last row for a given credential might be smaller, if the credential size is not a multiple of the segment size). An implementation MAY optionally support segment sizes of 256, 4096, 8192 or the full object size when this table is is accessed using a context of 'ipsaCred256', 'ipsaCred4096', 'ipsaCred8192' or 'ipsaCredFull' (respectively). The number of rows which need to be retrieved or set can be calculated by obtaining the value of the ipsaCredSize column from the corresponding ipsaCredentialTable row and dividing it by the segment size. |
| I32 ipsaCredSize | 1.3.6.1.2.1.153.4.1.1.5.1.4 | Integer32 | read-only | This value represents the size of the credential. If this value is greater than 1024, the ipsaCreCredential column will return an empty (0 length) string. In this case, the value of the credential is retrived from the ipsaCredSegmentTable. For credential type where the disclosure of the credential would compromise the credential (e.g. shared secrets), when this object is accessed for reading, it MUST return a value of 0 and MUST NOT return the size credential. |
| STO ipsaCredStorageType | 1.3.6.1.2.1.153.4.1.1.5.1.9 | StorageType | read-create | The storage type for this row. Rows in this table which were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable. |
| IPS ipsaCredType | 1.3.6.1.2.1.153.4.1.1.5.1.2 | IpsaCredentialType | read-create | This object represents the type of the credential for this row. |
| U32 ipsaEspTranCipherKeyLength | 1.3.6.1.2.1.153.4.1.1.3.1.5 | Unsigned32 | read-create | This object specifies, in bits, the key length for the ESP cipher algorithm. |
| U32 ipsaEspTranCipherKeyRounds | 1.3.6.1.2.1.153.4.1.1.3.1.6 | Unsigned32 | read-create | This object specifies the number of key rounds for the ESP cipher algorithm. |
| IPS ipsaEspTranCipherTransformId | 1.3.6.1.2.1.153.4.1.1.3.1.4 | IpsecDoiEspTransform | read-create | This object specifies the transform ID of the ESP cipher algorithm. |
| IPS ipsaEspTranIntegrityAlgorithmId | 1.3.6.1.2.1.153.4.1.1.3.1.7 | IpsecDoiAuthAlgorithm | read-create | This object specifies the ESP integrity algorithm ID. |
| TIM ipsaEspTranLastChanged | 1.3.6.1.2.1.153.4.1.1.3.1.10 | TimeStamp | read-only | The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value. |
| U32 ipsaEspTranMaxLifetimeKB | 1.3.6.1.2.1.153.4.1.1.3.1.3 | Unsigned32 | read-create | ipsaEspTranMaxLifetimeKB specifies how long in kilobytes the security association derived from this transform is used. |
| U32 ipsaEspTranMaxLifetimeSec | 1.3.6.1.2.1.153.4.1.1.3.1.2 | Unsigned32 | read-create | ipsaEspTranMaxLifetimeSec specifies how long in seconds the security association derived from this transform SHOULD be used. A value of 0 indicates that the default lifetime of 8 hours SHOULD be used. |
| STR ipsaEspTranName | 1.3.6.1.2.1.153.4.1.1.3.1.1 | SnmpAdminString | not-accessible | The name of this particular espTransform be referred to by an ipsaIpsecTransformsEntry. |
| T/F ipsaEspTranReplayPrevention | 1.3.6.1.2.1.153.4.1.1.3.1.8 | TruthValue | read-create | ipsaEspTranReplayPrevention indicates whether or not anti-replay service is to be provided by this SA. |
| U32 ipsaEspTranReplayWindowSize | 1.3.6.1.2.1.153.4.1.1.3.1.9 | Unsigned32 | read-create | ipsaEspTranReplayWindowSize indicates the size, in bits, of the replay window to use if replay protection is true for this transform. The window size is assumed to be a power of two. If Replay Protection is false, this value can be ignored. |
| ROW ipsaEspTranRowStatus | 1.3.6.1.2.1.153.4.1.1.3.1.12 | RowStatus | read-create | This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by a row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error. |
| ipsaEspTransformEntry | 1.3.6.1.2.1.153.4.1.1.3.1 | not-accessible | This entry contains the attributes of one ESP transform. | |
| ipsaEspTransformTable | 1.3.6.1.2.1.153.4.1.1.3 | not-accessible | This table lists all the ESP transforms which can be used to build IPsec proposals | |
| STO ipsaEspTranStorageType | 1.3.6.1.2.1.153.4.1.1.3.1.11 | StorageType | read-create | The storage type for this row. Rows in this table which were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable. |
| ipsaGroups | 1.3.6.1.2.1.153.4.1.3.2 | |||
| IPS ipsaIpcompTranAlgorithm | 1.3.6.1.2.1.153.4.1.1.4.1.4 | IpsecDoiIpcompTransform | read-create | ipsaIpcompTranAlgorithm specifies the transform ID of the IP compression algorithm. |
| U32 ipsaIpcompTranDictionarySize | 1.3.6.1.2.1.153.4.1.1.4.1.5 | Unsigned32 | read-create | If the algorithm in ipsaIpcompTranAlgorithm requires a dictionary size configuration parameter, then this is the place to put it. This object specifies the log2 maximum size of the dictionary for the compression algorithm. |
| TIM ipsaIpcompTranLastChanged | 1.3.6.1.2.1.153.4.1.1.4.1.7 | TimeStamp | read-only | The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value. |
| U32 ipsaIpcompTranMaxLifetimeKB | 1.3.6.1.2.1.153.4.1.1.4.1.3 | Unsigned32 | read-create | ipsaIpcompTranMaxLifetimeKB specifies how long in kilobytes the security association derived from this transform SHOULD be used. |
| U32 ipsaIpcompTranMaxLifetimeSec | 1.3.6.1.2.1.153.4.1.1.4.1.2 | Unsigned32 | read-create | ipsaIpcompTranMaxLifetimeSec specifies how long in seconds the security association derived from this transform SHOULD be used. A value of 0 indicates that the default lifetime of 8 hours SHOULD be used. |
| STR ipsaIpcompTranName | 1.3.6.1.2.1.153.4.1.1.4.1.1 | SnmpAdminString | not-accessible | The name of this ipsaIpcompTransformEntry. |
| U32 ipsaIpcompTranPrivateAlgorithm | 1.3.6.1.2.1.153.4.1.1.4.1.6 | Unsigned32 | read-create | If ipsaIpcompTranPrivateAlgorithm has a value other zero, then it is up to the vendors implementation to determine the meaning of this field and substitute a data compression algorithm in place of ipsaIpcompTranAlgorithm. |
| ROW ipsaIpcompTranRowStatus | 1.3.6.1.2.1.153.4.1.1.4.1.9 | RowStatus | read-create | This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error. |
| ipsaIpcompTransformEntry | 1.3.6.1.2.1.153.4.1.1.4.1 | not-accessible | This entry contains the attributes of one IP compression transform. | |
| ipsaIpcompTransformTable | 1.3.6.1.2.1.153.4.1.1.4 | not-accessible | This table lists all the IP compression transforms which can be used to build IPsec proposals during negotiation of a phase 2 SA. | |
| STO ipsaIpcompTranStorageType | 1.3.6.1.2.1.153.4.1.1.4.1.8 | StorageType | read-create | The storage type for this row. Rows in this table which were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable. |
| ipsaIPsecCompliance | 1.3.6.1.2.1.153.4.1.3.1.1 | The compliance statement for SNMP entities that include an IPsec MIB implementation and supports IPsec actions. There are a number of INDEX objects that cannot be represented in the form of OBJECT clauses in SMIv2, but for which we have the following compliance requirements, expressed in OBJECT clause form in this description clause: -- OBJECT ipsaPeerIdAddressType -- SYNTAX InetAddressType { ipv4(1), ipv6(2) } -- DESCRIPTION -- Only support for global IPv4 and IPv6 address -- types is required. -- -- OBJECT ipsaPeerIdAddress -- SYNTAX InetAddress (SIZE(4|16)) -- DESCRIPTION -- Only support for global IPv4 and IPv6 address -- types is required. -- | ||
| ipsaMIB | 1.3.6.1.2.1.153.4.1 | The MIB module defines IPsec actions for managing IPsec Security Policy. Copyright (C) The Internet Society (2006). This version of this MIB module is part of RFC XXXX, see the RFC itself for full legal notices. | ||
| ipsaNotificationObjects | 1.3.6.1.2.1.153.4.1.2 | |||
| ipsaNotifications | 1.3.6.1.2.1.153.4.1.2.0 | |||
| ipsaNotificationVariables | 1.3.6.1.2.1.153.4.1.2.1 | |||
| IP ipsaPeerIdAddress | 1.3.6.1.2.1.153.4.1.1.7.1.6 | InetAddress | read-create | The property PeerAddress specifies the IP address of the peer. The format is specified by the ipsaPeerIdAddressType. |
| IPt ipsaPeerIdAddressType | 1.3.6.1.2.1.153.4.1.1.7.1.5 | InetAddressType | read-create | The property ipsaPeerIdAddressType specifies the format of the ipsaPeerIdAddress property value. |
| STR ipsaPeerIdCredentialName | 1.3.6.1.2.1.153.4.1.1.7.1.7 | SnmpAdminString | read-create | This value is used as an index into the ipsaCredentialTable to look up the actual credential value and other credential information. For peer IDs that have no associated credential information, this value is left blank. |
| ipsaPeerIdentityEntry | 1.3.6.1.2.1.153.4.1.1.7.1 | not-accessible | peerIdentity matches a peer's identity to its address. | |
| ipsaPeerIdentityTable | 1.3.6.1.2.1.153.4.1.1.7 | not-accessible | PeerIdentity is used to represent the identities that are used for peers to identify themselves in IKE phase I/II negotiations. PeerIdentityTable aggregates the table entries that provide mappings between identities and their addresses. | |
| TIM ipsaPeerIdLastChanged | 1.3.6.1.2.1.153.4.1.1.7.1.8 | TimeStamp | read-only | The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value. |
| STR ipsaPeerIdName | 1.3.6.1.2.1.153.4.1.1.7.1.1 | SnmpAdminString | not-accessible | This is an administratively assigned value that, together with ipsaPeerIdPriority, uniquely identifies an entry in this table. |
| I32 ipsaPeerIdPriority | 1.3.6.1.2.1.153.4.1.1.7.1.2 | Integer32 | not-accessible | This object, along with ipsaPeerIdName, uniquely identifies an entry in this table. The priority also indicates the ordering of peer gateways from which to initiate or accept SAs. The priority value is ordered from low to high. For example, a row with a priority of 0 is used before a row with a priority of 1, a 1 before a 2, etc.... |
| ROW ipsaPeerIdRowStatus | 1.3.6.1.2.1.153.4.1.1.7.1.10 | RowStatus | read-create | This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error. |
| STO ipsaPeerIdStorageType | 1.3.6.1.2.1.153.4.1.1.7.1.9 | StorageType | read-create | The storage type for this row. Rows in this table which were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable. |
| IPS ipsaPeerIdType | 1.3.6.1.2.1.153.4.1.1.7.1.3 | IpsecDoiIdentType | read-create | ipsaPeerIdType is an enumeration identifying the type of the Identity value. |
| IPS ipsaPeerIdValue | 1.3.6.1.2.1.153.4.1.1.7.1.4 | IpsaIdentityFilter | read-create | ipsaPeerIdValue contains an Identity filter to be used to match against the identity payload in an IKE request, or blank otherwise. If this value matches the value in the identity payload, the credential for the peer can be found using the ipsaPeerIdCredentialName as an index into the credential table. |
| ipsaPreconfiguredGroup | 1.3.6.1.2.1.153.4.1.3.2.1 | This group is the set of objects that support preconfigured IPsec actions. These objects are from The Preconfigured Action Table. This group also includes objects from the shared tables: Peer Identity Table, Credential Table, Credential Management Service Table and the AH, ESP, and IPComp Transform Tables. | ||
| STR ipsaSaPreActActionDescription | 1.3.6.1.2.1.153.4.1.1.1.1.3 | SnmpAdminString | read-create | An administratively assigned string which can be used to describe what the action does. |
| U32 ipsaSaPreActActionLifetimeKB | 1.3.6.1.2.1.153.4.1.1.1.1.5 | Unsigned32 | read-create | ipsaSaPreActActionLifetimeKB specifies how long the security association derived from this action is used. After this value in KiloBytes has passed through the security association, this SA SHOULD be destroyed. Note: the actual lifetime of the preconfigured SA will be the lesser of the value of this object and of the value of the MaxLifetimeKB property of the associated transform. The default value, '0', indicates no kilobyte limit. |
| U32 ipsaSaPreActActionLifetimeSec | 1.3.6.1.2.1.153.4.1.1.1.1.4 | Unsigned32 | read-create | ipsaSaPreActActionLifetimeSec specifies how long in seconds the security association derived from this action is used. The default lifetime is 8 hours. Note: the actual lifetime of the preconfigured SA will be the lesser of the value of this object and of the value of the MaxLifetimeSecs property of the associated transform. A value of 0 indicates no time limit on the lifetime of the SA. |
| STR ipsaSaPreActActionName | 1.3.6.1.2.1.153.4.1.1.1.1.1 | SnmpAdminString | not-accessible | This object contains the name of this SaPreconfiguredActionEntry. |
| IPS ipsaSaPreActActionType | 1.3.6.1.2.1.153.4.1.1.1.1.9 | IpsecDoiEncapsulationMode | read-create | This object specifies the encapsulation mode to use for the preconfigured SA: tunnel or transport mode. |
| STR ipsaSaPreActAHSharedSecretName | 1.3.6.1.2.1.153.4.1.1.1.1.12 | SnmpAdminString | read-create | This object contains a name value to be used as an index into the ipsaCredentialTable which holds the pertinent keying information for the AH SA. |
| I32 ipsaSaPreActAHSPI | 1.3.6.1.2.1.153.4.1.1.1.1.10 | Integer32 | read-create | This object represents the SPI value for the AH SA. |
| STR ipsaSaPreActAHTransformName | 1.3.6.1.2.1.153.4.1.1.1.1.11 | SnmpAdminString | read-create | This object is the name of the AH transform to use as an index into the AHTransformTable. A zero length value indicates no transform of this type is used. |
| INT ipsaSaPreActDFHandling | 1.3.6.1.2.1.153.4.1.1.1.1.8 | INTEGER | read-create | This object specifies how to process the DF bit in packets sent through the preconfigured SA. This object is not used for transport SAs. |
| T/F ipsaSaPreActDoActionLogging | 1.3.6.1.2.1.153.4.1.1.1.1.6 | TruthValue | read-create | ipsaSaPreActDoActionLogging specifies whether or not an audit message SHOULD be logged when a preconfigured SA is created. |
| SPD ipsaSaPreActDoPacketLogging | 1.3.6.1.2.1.153.4.1.1.1.1.7 | SpdIPPacketLogging | read-create | ipsaSaPreActDoPacketLogging specifies whether or not an audit message SHOULD be logged and if there is logging, how many bytes of the packet to place in the notification. |
| STR ipsaSaPreActESPAuthSecretName | 1.3.6.1.2.1.153.4.1.1.1.1.16 | SnmpAdminString | read-create | This object contains a name value to be used as an index into the ipsaCredentialTable which holds the pertinent keying information for the authentication algorithm of the ESP SA. |
| STR ipsaSaPreActESPEncSecretName | 1.3.6.1.2.1.153.4.1.1.1.1.15 | SnmpAdminString | read-create | This object contains a name value to be used as an index into the ipsaCredentialTable which holds the pertinent keying information for the encryption algorithm of the ESP SA. |
| I32 ipsaSaPreActESPSPI | 1.3.6.1.2.1.153.4.1.1.1.1.13 | Integer32 | read-create | This object represents the SPI value for the ESP SA. |
| STR ipsaSaPreActESPTransformName | 1.3.6.1.2.1.153.4.1.1.1.1.14 | SnmpAdminString | read-create | This object is the name of the ESP transform to use as an index into the ESPTransformTable. A zero length value indicates no transform of this type is used. |
| I32 ipsaSaPreActIPCompSPI | 1.3.6.1.2.1.153.4.1.1.1.1.17 | Integer32 | read-create | This object represents the SPI value for the IPComp SA. |
| STR ipsaSaPreActIPCompTransformName | 1.3.6.1.2.1.153.4.1.1.1.1.18 | SnmpAdminString | read-create | This object is the name of the IPComp transform to use as an index into the IPCompTransformTable. A zero length value indicates no transform of this type is used. |
| TIM ipsaSaPreActLastChanged | 1.3.6.1.2.1.153.4.1.1.1.1.20 | TimeStamp | read-only | The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value. |
| STR ipsaSaPreActPeerGatewayIdName | 1.3.6.1.2.1.153.4.1.1.1.1.19 | SnmpAdminString | read-create | This object indicates the peer id name of the peer gateway. This object can be used to look up the peer gateway address in the ipsaPeerIdentityTable. This object is only used when initiating a tunnel SA, and is not used for transport SAs. If ipsaSaPreActActionType specifies tunnel mode and this object is empty, the peer gateway is determined from the source or destination of the packet. |
| ROW ipsaSaPreActRowStatus | 1.3.6.1.2.1.153.4.1.1.1.1.22 | RowStatus | read-create | This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error. |
| IFD ipsaSaPreActSADirection | 1.3.6.1.2.1.153.4.1.1.1.1.2 | IfDirection | not-accessible | This object indicates whether a row applies to egress or ingress SAs |
| STO ipsaSaPreActStorageType | 1.3.6.1.2.1.153.4.1.1.1.1.21 | StorageType | read-create | The storage type for this row. Rows in this table which were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable. |
| ipsaSaPreconfiguredActionEntry | 1.3.6.1.2.1.153.4.1.1.1.1 | not-accessible | One entry in the ipsaSaPreconfiguredActionTable. | |
| ipsaSaPreconfiguredActionTable | 1.3.6.1.2.1.153.4.1.1.1 | not-accessible | This table is a list of non-negotiated IPsec actions (SAs) that can be performed and contains or indicates the data necessary to create such an SA. | |
| ipsaSharedGroup | 1.3.6.1.2.1.153.4.1.3.2.2 | This group includes objects from tables expected to be shared by other modules: Peer Identity Table, Credential Table, Credential Management Service Table and the AH, ESP, and IPComp Transform Tables. |
RFC description
IPsec security policy and actions management including packet logging and administrative status control.
Start monitoring Vendor-neutral IETF standard (IPsec gateway/host, security action parameters) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.