All MIBs › IPSEC-MIB
Organization: IETF IPSec Working Group
Last Updated: 1999-01-25
Category: Domain: Security, Standard: IETF, Technology: VPN, VPN and Security
Description: IETF IPsec MIB providing SNMP management objects for monitoring IPsec security associations, policies, and tunnel statistics.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is IPSEC-MIB?
IPSEC-MIB is a vendor-neutral IETF standards MIB providing generic managed objects for IPsec, covering both general/entity-level IPsec configuration and IPsec-related event/notification objects. It is intended to expose the categories of data needed to track IPsec deployment at a device level: security association and policy configuration, and fault/event conditions related to IPsec processing. Its monitoring value is centered on software/protocol status -- confirming IPsec security associations are established and healthy, and that IPsec-related faults are surfaced as SNMP events -- rather than hardware sensors. As a generic IPsec MIB it is meant to work alongside more specific IPsec policy and IKE MIBs (such as IPSEC-IKEACTION-MIB) for full security-policy management. Deployment context is any IPsec-capable router, firewall, or VPN gateway where tunnel and SA health needs to be monitored via SNMP. Engineers implementing or auditing this functionality typically reference the IPSEC-MIB RFC/standard documentation for the authoritative specification.
IPNetwork Monitor allows you to monitor SNMP objects defined in IPSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- vendor-neutral, standards-based MIB, not tied to a specific manufacturer
- IPsec-capable routers, firewalls, and VPN gateways
Monitoring Examples
No sample object names were provided in the source extract for this module, so specific table or object identifiers cannot be responsibly invented. Based on the module description ('generic IPSec objects, and entity level IPSec objects and events'), a realistic scenario would be polling security-association state to detect tunnels that have failed to establish or have expired, and watching for IPsec-related event notifications. Without concrete object names, further detail would be speculative.
This MIB depends on
Related MIBs
Imported Objects
From SNMPv2-SMI
| Counter32 | |
| Counter64 | |
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 | |
| experimental |
From SNMPv2-TC
| DateAndTime | |
| TruthValue |
How to Use in IPNetwork Monitor
Example using ipsecProtSuiteInboundTraffic OID:
Select a device implementing IPSEC-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ipsecProtSuiteInboundTraffic into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The amount of user level traffic measured in bytes handled by the protection suite in the inbound direction. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in bytes), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ipsecMIB | 1.3.6.1.3.500 | The MIB module to describe generic IPSec objects, and entity level IPSec objects and events. | ||
| ipsecMIBObjects | 1.3.6.1.3.500.1 | |||
| ipsec | 1.3.6.1.3.500.1.1 | |||
| ipsecProtSuiteTable | 1.3.6.1.3.500.1.1.1 | not-accessible | The (conceptual) table containing information on IPSec protection suites. | |
| ipsecProtSuiteEntry | 1.3.6.1.3.500.1.1.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular IPSec protection suite. | |
| I32 ipsecProtSuiteIndex | 1.3.6.1.3.500.1.1.1.1.1 | Integer32 | read-only | A unique value, greater than zero, for each IPSec protection suite. It is recommended that values are assigned contiguously starting from 1. |
| OCT ipsecProtSuiteLocalAddress | 1.3.6.1.3.500.1.1.1.1.2 | OCTET STRING | read-only | The local IP address used by the protection suite. The size of this object is 4 if the address is an IPv4 address, or 16 if the address is an IPv6 address. |
| OCT ipsecProtSuiteRemoteAddress | 1.3.6.1.3.500.1.1.1.1.3 | OCTET STRING | read-only | The peer IP address used by the protection suite. The size of this object is 4 if the address is an IPv4 address, or 16 if the address is an IPv6 address. |
| U32 ipsecProtSuiteInboundEspSpi | 1.3.6.1.3.500.1.1.1.1.4 | Unsigned32 | read-only | The value of the SPI for the inbound protection suite that provides the ESP security service, or zero if ESP is not used. |
| U32 ipsecProtSuiteOutboundEspSpi | 1.3.6.1.3.500.1.1.1.1.5 | Unsigned32 | read-only | The value of the SPI for the outbound protection suite that provides the ESP security service, or zero if ESP is not used. |
| U32 ipsecProtSuiteInboundAhSpi | 1.3.6.1.3.500.1.1.1.1.6 | Unsigned32 | read-only | The value of the SPI for the inbound protection suite that provides the AH security service, or zero if AH is not used. |
| U32 ipsecProtSuiteOutboundAhSpi | 1.3.6.1.3.500.1.1.1.1.7 | Unsigned32 | read-only | The value of the SPI for the outbound protection suite that provides the AH security service, or zero if AH is not used. |
| INT ipsecProtSuiteInboundCompCpi | 1.3.6.1.3.500.1.1.1.1.8 | INTEGER | read-only | The value of the CPI for the inbound protection suite that provides IP compression, or zero if IPCOMP is not used. |
| INT ipsecProtSuiteOutboundCompCpi | 1.3.6.1.3.500.1.1.1.1.9 | INTEGER | read-only | The value of the CPI for the outbound protection suite that provides IP compression, or zero if IPCOMP is not used. |
| OCT ipsecProtSuiteLocalId | 1.3.6.1.3.500.1.1.1.1.10 | OCTET STRING | read-only | The local identifier of the protection suite, or 0 if unknown or if the protection suite uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| U32 ipsecProtSuiteLocalIdType | 1.3.6.1.3.500.1.1.1.1.11 | Unsigned32 | read-only | The type of identifier presented by 'ipsecTunnelLocalId', or 0 if unknown or if the protection suite uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| OCT ipsecProtSuiteRemoteId | 1.3.6.1.3.500.1.1.1.1.12 | OCTET STRING | read-only | The remote identifier of the protection suite, or 0 if unknown or if the protection suite uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| U32 ipsecProtSuiteRemoteIdType | 1.3.6.1.3.500.1.1.1.1.13 | Unsigned32 | read-only | The type of identifier presented by 'ipsecTunnelRemoteId', or 0 if unknown or if the protection suite uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| I32 ipsecProtSuiteProtocol | 1.3.6.1.3.500.1.1.1.1.14 | Integer32 | read-only | The IP protocol number that this protection suite carries, or 0 if it carries any protocol. |
| I32 ipsecProtSuiteLocalPort | 1.3.6.1.3.500.1.1.1.1.15 | Integer32 | read-only | The local UDP or TCP port number that this protection suite carries, or 0 if it carries any port number. |
| I32 ipsecProtSuiteRemotePort | 1.3.6.1.3.500.1.1.1.1.16 | Integer32 | read-only | The remote UDP or TCP port number that this protection suite carries, or 0 if it carries any port number. |
| I32 ipsecProtSuiteDifHelGroupDesc | 1.3.6.1.3.500.1.1.1.1.17 | Integer32 | read-only | A unique value representing the Diffie-Hellman group description used to set up this protection suite, or 0 if the description is unknown. Specific values are used as described in the ISAKMP Class Values of Group Description from Appendix A of [IKE]. |
| I32 ipsecProtSuiteDifHelGroupType | 1.3.6.1.3.500.1.1.1.1.18 | Integer32 | read-only | A unique value representing the Diffie-Hellman group type used to set up this protection suite, or 0 if the type is unknown. Specific values are used as described in the ISAKMP Class Values of Group Type from Appendix A of [IKE]. |
| T/F ipsecProtSuitePFS | 1.3.6.1.3.500.1.1.1.1.19 | TruthValue | read-only | 'true' if the protection suite was created using perfect forward secrect. |
| INT ipsecProtSuiteEncapsulation | 1.3.6.1.3.500.1.1.1.1.20 | INTEGER | read-only | The type of encapsulation used by this protection suite. |
| I32 ipsecProtSuiteEspEncAlg | 1.3.6.1.3.500.1.1.1.1.21 | Integer32 | read-only | A unique value representing the encryption algorithm applied to traffic carried by this protection suite if it uses ESP or 0 if there is no encryption applied by ESP or if ESP is not used. Specific values are taken from section 4.4.4 of [IPDOI]. |
| U32 ipsecProtSuiteEspEncKeyLength | 1.3.6.1.3.500.1.1.1.1.22 | Unsigned32 | read-only | The length of the encryption key in bits used for the algorithm specified in the 'ipsecTunnelEspEncAlg' object, or 0 if the key length is implicit in the specified algorithm or there is no encryption specified. |
| I32 ipsecProtSuiteEspAuthAlg | 1.3.6.1.3.500.1.1.1.1.23 | Integer32 | read-only | A unique value representing the hash algorithm applied to traffic carried by this protection suite if it uses ESP or 0 if there is no authentication applied by ESP or if ESP is not used. Specific values are taken from the Authentication Algorithm attribute values of Section 4.5 of [IPDOI]. |
| I32 ipsecProtSuiteAhAuthAlg | 1.3.6.1.3.500.1.1.1.1.24 | Integer32 | read-only | A unique value representing the hash algorithm applied to traffic carried by this protection suite if it uses AH or 0 if AH is not used. Specific values are taken from Section 4.4.3 of [IPDOI]. |
| I32 ipsecProtSuiteCompAlg | 1.3.6.1.3.500.1.1.1.1.25 | Integer32 | read-only | A unique value representing the compression algorithm applied to traffic carried by this protection suite if it uses IPCOMP. Specific values are taken from Section 4.4.5 of [IPDOI]. |
| DAT ipsecProtSuiteCreationTime | 1.3.6.1.3.500.1.1.1.1.26 | DateAndTime | read-only | The date and time that the current protection suite was set up. |
| OCT ipsecProtSuiteTimeLimit | 1.3.6.1.3.500.1.1.1.1.27 | OCTET STRING | read-only | The maximum lifetime in seconds of the protection suite, or 0 if there is no time constraint on its expiration. |
| OCT ipsecProtSuiteTrafficLimit | 1.3.6.1.3.500.1.1.1.1.28 | OCTET STRING | read-only | The maximum traffic in 1024-byte blocks that the protection suite is allowed to support, or 0 if there is no traffic constraint on its expiration. |
| OCT ipsecProtSuiteInTrafficCount | 1.3.6.1.3.500.1.1.1.1.29 | OCTET STRING | read-only | The amount of inbound traffic accumulated that counts against the protection suite's expiration by traffic limitation, measured in 1024-byte blocks. This value may be 0 if the protection suite does not expire based on traffic. In the case of multiple SAs within a protection suite, this value is the maximum of any traffic accumulation values applied to any of the individual SAs within the protection suite. |
| OCT ipsecProtSuiteOutTrafficCount | 1.3.6.1.3.500.1.1.1.1.30 | OCTET STRING | read-only | The amount of outbound traffic accumulated that counts against the protection suite's expiration by traffic limitation, measured in 1024-byte blocks. This value may be 0 if the protection suite does not expire based on traffic. In the case of multiple SAs within a protection suite, this value is the maximum of any traffic accumulation values applied to any of the individual SAs within the protection suite. |
| C64 ipsecProtSuiteInboundTrafficEx | 1.3.6.1.3.500.1.1.1.1.31 | Counter64 | read-only | The amount of user level traffic measured in bytes handled by the protection suite in the inbound direction. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit. |
| C64 ipsecProtSuiteOutboundTraffic | 1.3.6.1.3.500.1.1.1.1.32 | Counter64 | read-only | The amount of user level traffic measured in bytes handled by the protection suite in the outbound direction. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit. |
| C64 ipsecProtSuiteInboundPackets | 1.3.6.1.3.500.1.1.1.1.33 | Counter64 | read-only | The number of packets handled by the protection suite in the inbound direction. |
| C64 ipsecProtSuiteOutboundPackets | 1.3.6.1.3.500.1.1.1.1.34 | Counter64 | read-only | The number of packets handled by the protection suite in the outbound direction. |
| C32 ipsecProtSuiteDecryptErrors | 1.3.6.1.3.500.1.1.1.1.35 | Counter32 | read-only | The number of inbound packets discarded by the protection suite due to decryption errors. |
| C32 ipsecProtSuiteAuthErrors | 1.3.6.1.3.500.1.1.1.1.36 | Counter32 | read-only | The number of inbound packets discarded by the protection suite due to authentication errors. This includes hash failures in both ESP and AH. |
| C32 ipsecProtSuiteReplayErrors | 1.3.6.1.3.500.1.1.1.1.37 | Counter32 | read-only | The number of inbound packets discarded by the protection suite due to replay errors. This includes replay failures both ESP and AH. |
| C32 ipsecProtSuitePolicyErrors | 1.3.6.1.3.500.1.1.1.1.38 | Counter32 | read-only | The number of inbound packets discarded by the protection suite due to policy errors. |
| C32 ipsecProtSuiteOtherReceiveErrors | 1.3.6.1.3.500.1.1.1.1.39 | Counter32 | read-only | The number of inbound packets discarded by the protection suite due to errors other than decryption, authentication or replay errors. This may include decompression errors or errors due to a lack of receive buffers. |
| C32 ipsecProtSuiteSendErrors | 1.3.6.1.3.500.1.1.1.1.40 | Counter32 | read-only | The number of outbound packets discarded by the protection suite due to any error. This may include compression errors or errors due to a lack of transmit buffers. |
| ipsecIkeSaTable | 1.3.6.1.3.500.1.1.2 | not-accessible | The (conceptual) table containing information on IPSec's IKE SAs. | |
| ipsecIkeSaEntry | 1.3.6.1.3.500.1.1.2.1 | not-accessible | An entry (conceptual row) containing the information on a particular IKE SA. | |
| I32 ipsecIkeSaIndex | 1.3.6.1.3.500.1.1.2.1.1 | Integer32 | read-only | A unique value, greater than zero, for each phase 1 SA. It is recommended that values are assigned contiguously starting from 1. The value for each entry must remain constant at least from one re-initialization of entity's network management system to the next re-initialization. |
| OCT ipsecIkeSaInitiatorCookie | 1.3.6.1.3.500.1.1.2.1.2 | OCTET STRING | read-only | The value of the cookie used by the initiator for the phase 1 SA. |
| OCT ipsecIkeSaResponderCookie | 1.3.6.1.3.500.1.1.2.1.3 | OCTET STRING | read-only | The value of the cookie used by the responder for the phase 1 SA. |
| OCT ipsecIkeSaLocalIpAddress | 1.3.6.1.3.500.1.1.2.1.4 | OCTET STRING | read-only | The local IP address used to negotiated the SA. The size of the object is 4 if the address is an IPv4 address and 16 if an IPv6 address. |
| INT ipsecIkeSaLocalPortNumber | 1.3.6.1.3.500.1.1.2.1.5 | INTEGER | read-only | The local UDP port number that this SA was negotiated with. |
| I32 ipsecIkeSaLocalIdType | 1.3.6.1.3.500.1.1.2.1.8 | Integer32 | read-only | The type of ID used by the local end of this SA. Specific values are used as described in Section 4.6.2.1 of [IPDOI]. |
| OCT ipsecIkeSaLocalId | 1.3.6.1.3.500.1.1.2.1.9 | OCTET STRING | read-only | The ID of the local host that negotiated this SA. The length may require truncation under some conditions. |
| OCT ipsecIkeSaPeerIpAddress | 1.3.6.1.3.500.1.1.2.1.10 | OCTET STRING | read-only | The IP address of the peer that this SA was negotiated with. The size of the object is 4 if the address is an IPv4 address and 16 if it is an IPv6 address. |
| INT ipsecIkeSaPeerPortNumber | 1.3.6.1.3.500.1.1.2.1.11 | INTEGER | read-only | The UDP port number of the peer that this SA was negotiated with. |
| I32 ipsecIkeSaAuthMethod | 1.3.6.1.3.500.1.1.2.1.12 | Integer32 | read-only | The authentication method used to authenticate the peer. Note that this does not include the specific method of authentication if extended authenticated is used. Specific values are used as described in the ISAKMP Class Values of Authentication Method from Appendix A of [IKE]. |
| I32 ipsecIkeSaPeerIdType | 1.3.6.1.3.500.1.1.2.1.13 | Integer32 | read-only | The type of ID used by the peer. Specific values are used as described in Section 4.6.2.1 of [IPDOI]. |
| OCT ipsecIkeSaPeerId | 1.3.6.1.3.500.1.1.2.1.14 | OCTET STRING | read-only | The ID of the peer this SA was negotiated with. The length may require truncation under some conditions. |
| OCT ipsecIkeSaPeerCertSerialNum | 1.3.6.1.3.500.1.1.2.1.15 | OCTET STRING | read-only | The serial number of the certificate of the peer this SA was negotiated with. This object has no meaning if a certificate was not used in authenticating the peer. |
| OCT ipsecIkeSaPeerCertIssuer | 1.3.6.1.3.500.1.1.2.1.16 | OCTET STRING | read-only | The issuer of the certificate of the peer this SA was negotiated with. This object has no meaning if a certificate was not used in authenticating the peer. |
| INT ipsecIkeSaEncAlg | 1.3.6.1.3.500.1.1.2.1.17 | INTEGER | read-only | A unique value representing the encryption algorithm applied to traffic carried by this SA. Specific values are used as described in the ISAKMP Class Values of Encryption Algorithms from Appendix A of [IKE]. |
| I32 ipsecIkeSaEncKeyLength | 1.3.6.1.3.500.1.1.2.1.18 | Integer32 | read-only | The length of the encryption key in bits used for algorithm specified in the ipsecIkeSaEncAlg object or 0 if the key length is implicit in the specified algorithm. |
| I32 ipsecIkeSaHashAlg | 1.3.6.1.3.500.1.1.2.1.19 | Integer32 | read-only | A unique value representing the hash algorithm applied to traffic carried by this SA. Specific values are used as described in the ISAKMP Class Values of Hash Algorithms from Appendix A of [IKE]. |
| I32 ipsecIkeSaDifHelGroupDesc | 1.3.6.1.3.500.1.1.2.1.20 | Integer32 | read-only | A unique value representing the Diffie-Hellman group description used or 0 if the group is unknown. Specific values are used as described in the ISAKMP Class Values of Group Description from Appendix A of [IKE]. |
| I32 ipsecIkeSaDifHelGroupType | 1.3.6.1.3.500.1.1.2.1.21 | Integer32 | read-only | A unique value representing the Diffie-Hellman group type used or 0 if the group is unknown. Specific values are used as described in the ISAKMP Class Values of Group Type from Appendix A of [IKE]. |
| I32 ipsecIkeSaDifHelFieldSize | 1.3.6.1.3.500.1.1.2.1.22 | Integer32 | read-only | The field size, in bits, of the Diffie-Hellman group used to generate the key-pair, or 0 if unknown. |
| I32 ipsecIkeSaPRF | 1.3.6.1.3.500.1.1.2.1.23 | Integer32 | read-only | The pseudo-random functions used, or 0 if not used or if unknown. Specific values are used as described in the ISAKMP Class Values of PRF from Appendix A of [IKE] (which specifies none at the present time). |
| T/F ipsecIkeSaPFS | 1.3.6.1.3.500.1.1.2.1.24 | TruthValue | read-only | A value that indicates that perfect forward secrecy is used for all IPSec SAs created by this IKE SA. |
| DAT ipsecIkeSaTimeStart | 1.3.6.1.3.500.1.1.2.1.25 | DateAndTime | read-only | The date and time that the SA was set up. |
| OCT ipsecIkeSaTimeLimit | 1.3.6.1.3.500.1.1.2.1.26 | OCTET STRING | read-only | The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. |
| OCT ipsecIkeSaTrafficLimit | 1.3.6.1.3.500.1.1.2.1.27 | OCTET STRING | read-only | The maximum traffic in 1024-byte blocks that the SA is allowed to carry, or 0 if there is no traffic constraint on its expiration. |
| C64 ipsecIkeSaInboundTraffic | 1.3.6.1.3.500.1.1.2.1.28 | Counter64 | read-only | The amount traffic measured in bytes handled in the SA in the inbound direction. |
| C64 ipsecIkeSaOutboundTraffic | 1.3.6.1.3.500.1.1.2.1.29 | Counter64 | read-only | The amount traffic measured in bytes handled in the SA in the outbound direction. |
| C32 ipsecIkeSaInboundPackets | 1.3.6.1.3.500.1.1.2.1.30 | Counter32 | read-only | The number of packets handled in the SA in the inbound direction. |
| C32 ipsecIkeSaOutboundPackets | 1.3.6.1.3.500.1.1.2.1.31 | Counter32 | read-only | The number of packets handled in the SA in the outbound direction. |
| C32 ipsecIkeProtSuitesCreated | 1.3.6.1.3.500.1.1.2.1.32 | Counter32 | read-only | The total number of phase 2 protection suites created by the SA. |
| C32 ipsecIkeProtSuitesDeleted | 1.3.6.1.3.500.1.1.2.1.33 | Counter32 | read-only | The total number of phase 2 protection suites deleted by the SA. |
| C32 ipsecIkeSaDecryptErrors | 1.3.6.1.3.500.1.1.2.1.34 | Counter32 | read-only | The number of inbound packets discarded by the phase1 SA due to decryption errors. |
| C32 ipsecIkeSaAuthErrors | 1.3.6.1.3.500.1.1.2.1.35 | Counter32 | read-only | The number of inbound packets discarded by the phase 1 SA due to authentication errors. |
| C32 ipsecIkeSaOtherReceiveErrors | 1.3.6.1.3.500.1.1.2.1.36 | Counter32 | read-only | The number of inbound packets discarded by the phase 1 SA due to errors other than decryption or authentication errors. This may include errors due to a lack of receive buffers. |
| C32 ipsecIkeSaSendErrors | 1.3.6.1.3.500.1.1.2.1.37 | Counter32 | read-only | The number of outbound packets discarded by the phase 1 SA due to any error. This may include errors due to a lack of transmit buffers. |
| ipsecTrapsA | 1.3.6.1.3.500.1.1.3 | |||
| ipsecTraps | 1.3.6.1.3.500.1.1.3.0 | |||
| NTF ipsecTrapIkeNegFailure | 1.3.6.1.3.500.1.1.3.0.1 | An attempt to negotiate a phase 1 SA failed. | ||
| NTF ipsecTrapInvalidCookie | 1.3.6.1.3.500.1.1.3.0.2 | IKE packets with invalid cookies were detected from the specified peer. Implementations SHOULD send one trap per peer (within a reasonable time period, rather than sending one trap per packet. | ||
| NTF ipsecTrapIpsecNegFailure | 1.3.6.1.3.500.1.1.3.0.3 | An attempt to negotiate a phase 2 protection suite within the specified IKE SA failed. | ||
| NTF ipsecTrapIpsecAuthFailure | 1.3.6.1.3.500.1.1.3.0.4 | IPSec packets with invalid hashes were found in the specified protection suite. Implementations SHOULD send one trap per protection suite (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF ipsecTrapIpsecReplayFailure | 1.3.6.1.3.500.1.1.3.0.5 | IPSec packets with invalid sequence numbers were found in the specified protection suite. Implementations SHOULD send one trap per protection suite (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF ipsecTrapIpsecPolicyFailure | 1.3.6.1.3.500.1.1.3.0.6 | IPSec packets carrying packets with invalid selectors for the specified protection suite were found. Implementations SHOULD send one trap per protection suite (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF ipsecTrapInvalidSpi | 1.3.6.1.3.500.1.1.3.0.7 | ESP, AH or IPCOMP packets with unknown SPIs (or CPIs) were detected from the specified peer. Implementations SHOULD send one trap per peer (within a reasonable time period), rather than sending one trap per packet. | ||
| ipsecIpsecStats | 1.3.6.1.3.500.1.1.4 | |||
| C64 ipsecIpsecTotalProtSuites | 1.3.6.1.3.500.1.1.4.1 | Counter64 | read-only | The total number of phase 2 protection suites established by the entity since boot time. |
| C64 ipsecIpsecNegFailures | 1.3.6.1.3.500.1.1.4.2 | Counter64 | read-only | The total number of phase 2 protection suite negotiations that failed that occurred in the entity since boot time. |
| C64 ipsecIpsecTotalInboundPackets | 1.3.6.1.3.500.1.1.4.3 | Counter64 | read-only | The total number of inbound packets carried on IPSec protection suites since boot time. |
| C64 ipsecIpsecTotalTransOutboundPackets | 1.3.6.1.3.500.1.1.4.4 | Counter64 | read-only | The total number of outbound packets carried on IPSec protection suites since boot time. |
| C64 ipsecIpsecTotalTransInboundTraffic | 1.3.6.1.3.500.1.1.4.5 | Counter64 | read-only | The total amount of inbound traffic carried on IPSec protection suites since boot time, measured in 1024-octet blocks. |
| C64 ipsecIpsecTotalTransOutboundTraffic | 1.3.6.1.3.500.1.1.4.6 | Counter64 | read-only | The total amount of outbound traffic carried on IPSec protection suites since boot time, measured in 1024-octet blocks. |
| ipsecIpsecErrorStats | 1.3.6.1.3.500.1.1.5 | |||
| C32 ipsecIpsecDecryptionErrors | 1.3.6.1.3.500.1.1.5.1 | Counter32 | read-only | The total number of packets received by the entity in the IPSec protection suites since boot time with decryption errors. |
| C32 ipsecIpsecAuthenticationErrors | 1.3.6.1.3.500.1.1.5.2 | Counter32 | read-only | The total number of packets received by the entity in the IPSec protection suites since boot time with authentication errors. This includes all packets in which the hash value is determined to be invalid. |
| C32 ipsecIpsecReplayErrors | 1.3.6.1.3.500.1.1.5.3 | Counter32 | read-only | The total number of packets received by the entity in the IPSec protection suites since boot time with replay errors. |
| C32 ipsecIpsecPolicyErrors | 1.3.6.1.3.500.1.1.5.4 | Counter32 | read-only | The total number of packets received by the entity in the IPSec protection suites since boot time and discarded due to policy errors. This includes packets that had selectors that were invalid for the SA or protection suite that carried them. |
| C32 ipsecIpsecOtherReceiveErrors | 1.3.6.1.3.500.1.1.5.5 | Counter32 | read-only | The total number of packets received by the entity in the IPSec protection suites since boot time and discarded due to errors not due to decryption, authentication, replay or policy. |
| C32 ipsecIpsecSendErrors | 1.3.6.1.3.500.1.1.5.6 | Counter32 | read-only | The total number of packets to be sent by the entity in the IPSec protection suites since boot time and discarded due to errors. |
| C32 ipsecUnknownSpiErrors | 1.3.6.1.3.500.1.1.5.7 | Counter32 | read-only | The total number of packets received by the entity since boot time with SPIs or CPIs that were not valid. |
| ipsecIkeStats | 1.3.6.1.3.500.1.1.6 | |||
| C64 ipsecIkeTotalSAs | 1.3.6.1.3.500.1.1.6.1 | Counter64 | read-only | The total number of phase 1 SAs successfully established by the entity since boot time. |
| C64 ipsecIkeNegFailures | 1.3.6.1.3.500.1.1.6.2 | Counter64 | read-only | The total number of phase 1 SA negotiations that failed that occurred in the entity since boot time. |
| C64 ipsecIkeTotalInboundPackets | 1.3.6.1.3.500.1.1.6.3 | Counter64 | read-only | The total number of inbound packets carried on phase 1 SAs since boot time. |
| C64 ipsecIkeTotalTransOutboundPackets | 1.3.6.1.3.500.1.1.6.4 | Counter64 | read-only | The total number of outbound packets carried on phase 1 SAs since boot time. |
| C64 ipsecIkeTotalTransInboundTraffic | 1.3.6.1.3.500.1.1.6.5 | Counter64 | read-only | The total amount of inbound traffic carried on phase 1 SAs since boot time, measured in 1024-octet blocks. |
| C64 ipsecIkeTotalTransOutboundTraffic | 1.3.6.1.3.500.1.1.6.6 | Counter64 | read-only | The total amount of outbound traffic carried on phase 1 SAs since boot time, measured in 1024-octet blocks. |
| ipsecIkeErrorStats | 1.3.6.1.3.500.1.1.7 | |||
| C32 ipsecIkeProtocolErrors | 1.3.6.1.3.500.1.1.7.1 | Counter32 | read-only | The total number of packets received by the entity since boot time with IKE protocol errors. This includes packets with invalid cookies, but does not include errors that are associated with specific IKE SAs. |
| C32 ipsecIkeDecryptionErrors | 1.3.6.1.3.500.1.1.7.2 | Counter32 | read-only | The total number of packets received by the entity in the IPSec protection suites since boot time with decryption errors. |
| C32 ipsecIkeAuthenticationErrors | 1.3.6.1.3.500.1.1.7.3 | Counter32 | read-only | The total number of packets received by the entity in the IPSec protection suites since boot time with authentication errors. This includes all packets in which the hash value is determined to be invalid. |
| C32 ipsecIkeOtherReceiveErrors | 1.3.6.1.3.500.1.1.7.4 | Counter32 | read-only | The total number of packets received by the entity in phase 1 SAs since boot time and discarded due to errors not due to decryption or authentication. |
| C32 ipsecIkeSendErrors | 1.3.6.1.3.500.1.1.7.5 | Counter32 | read-only | The total number of packets to be sent by the entity in phase 1 SAs since boot time and discarded due to errors. |
| ipsecNotifications | 1.3.6.1.3.500.1.1.8 | |||
| C64 ipsecNotifyMessageTotalCount | 1.3.6.1.3.500.1.1.8.1 | Counter64 | read-only | The total number of all types of notify messages sent or received by the entity since boot time. It is the sum of all occurrences in the 'ipsecNotifyCountTable'. |
| ipsecNotifyCountTable | 1.3.6.1.3.500.1.1.8.2 | not-accessible | The (conceptual) table containing information on IPSec notify message counts. This table MAY be sparsely populated; that is, rows for which the count is 0 may be absent. | |
| ipsecNotifyCountEntry | 1.3.6.1.3.500.1.1.8.2.1 | not-accessible | An entry (conceptual row) containing the total number of occurrences of a notify message. | |
| INT ipsecNotifyMessage | 1.3.6.1.3.500.1.1.8.2.1.1 | INTEGER | read-only | The value representing a specific IPSec notify message, or 0 if unknown. Values are assigned from the set of notify message types as defined in Section 3.14.1 of [ISAKMP]. In addition, the value 0 may be used for this object when the object is used as a trap cause, and the cause is unknown. |
| C32 ipsecNotifyMessageCount | 1.3.6.1.3.500.1.1.8.2.1.2 | Counter32 | read-only | The total number of times the specific notify message has been received or sent by the entity since system boot. |
RFC description
Monitors IPSec protection suites, tunnel status, and security association statistics.
Start monitoring Vendor-neutral IETF standard (IPsec-capable router/firewall/VPN gateway) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.