IPSEC-SA-MON-MIB

All MIBs › IPSEC-SA-MON-MIB

Organization: IETF IPsec Working Group

Last Updated: 1999-10-21

Category: Domain: Security, Standard: IETF, Technology: VPN, VPN and Security

Description: IETF IPsec security association monitoring MIB providing SNMP objects for tracking IKE and IPsec SA establishment and lifetime.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is IPSEC-SA-MON-MIB?

IPSEC-SA-MON-MIB is an IETF-standard MIB intended to describe generic IPsec objects along with entity-level objects and notifications for monitoring IKE and IPsec Security Association (SA) establishment and lifetime. Conceptually it covers the state and lifecycle of SAs negotiated between IPsec peers, including establishment events and expiration/lifetime tracking. In a monitoring context such a MIB would be used to confirm that VPN tunnels' security associations are being negotiated and renewed successfully, flagging failed negotiations or unexpectedly short-lived SAs as signs of configuration or connectivity problems. It depends on the shared IPsec/IKE textual conventions (e.g. IPSEC-FLOW-MIB-TC) for its typed fields. It is typically deployed on VPN gateways, firewalls, and IPsec-terminating routers in site-to-site or remote-access VPN infrastructure. Engineers implementing or auditing this functionality typically reference the IPSEC-SA-MON-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in IPSEC-SA-MON-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
IPsec/IKE VPN gateway or firewall

Monitoring Examples

No concrete object or table names were supplied for this module (sample_objects is empty), so a specific polling example naming real objects cannot be honestly constructed. Conceptually an operator would expect to monitor SA counts, establishment failures, and remaining lifetime per tunnel, but no such object names can be confirmed from the available data.

Imported Objects

From IF-MIB

ifIndex

OBJECT-TYPE

From IPSEC-ISAKMP-IKE-DOI-TC

IpsecDoiAhTransform
IpsecDoiAuthAlgorithm
IpsecDoiEncapsulationMode
IpsecDoiEspTransform
IpsecDoiIdentType
IpsecDoiIpcompTransform
IpsecDoiSecProtocolId

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32
experimental

From SNMPv2-TC

TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using ipsecSaEspInAccSeconds OID:

Select a device implementing IPSEC-SA-MON-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ipsecSaEspInAccSeconds into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of seconds accumulated against the SA's expiration by time. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in seconds), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ipsecSaMonModule	1.3.6.1.3.98			The MIB module to describe generic IPsec objects, and entity level objects and events for those types.
ipsecSaMonitorMIB	1.3.6.1.3.98.1			This is the base object identifier for all IPsec branches.
saTables	1.3.6.1.3.98.1.1			This is the base object identifier for all SA tables.
ipsecSaEspInTable	1.3.6.1.3.98.1.1.1		not-accessible	The (conceptual) table containing information on IPsec inbound ESP SAs. There should be one row for every inbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent.
ipsecSaEspInEntry	1.3.6.1.3.98.1.1.1.1		not-accessible	An entry (conceptual row) containing the information on a particular IPsec inbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table.
ADR ipsecSaEspInAddress	1.3.6.1.3.98.1.1.1.1.1	IpsecIpv6Address	read-only	The destination address of the SA. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
U32 ipsecSaEspInSpi	1.3.6.1.3.98.1.1.1.1.2	Unsigned32	read-only	The security parameters index of the SA.
IPS ipsecSaEspInDestId	1.3.6.1.3.98.1.1.1.1.3	IpsecRawId	read-only	The destination identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during SA creation negotiation.
IPS ipsecSaEspInDestIdType	1.3.6.1.3.98.1.1.1.1.4	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaEspInDestId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
IPS ipsecSaEspInSourceId	1.3.6.1.3.98.1.1.1.1.5	IpsecRawId	read-only	The source identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during SA creation negotiation.
IPS ipsecSaEspInSourceIdType	1.3.6.1.3.98.1.1.1.1.6	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaEspInSourceId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
I32 ipsecSaEspInProtocol	1.3.6.1.3.98.1.1.1.1.7	Integer32	read-only	The transport-layer protocol number that this SA carries, or 0 if it carries any protocol.
I32 ipsecSaEspInDestPort	1.3.6.1.3.98.1.1.1.1.8	Integer32	read-only	The destination port number of the protocol that this SA carries, or 0 if it carries any port number.
I32 ipsecSaEspInSourcePort	1.3.6.1.3.98.1.1.1.1.9	Integer32	read-only	The source port number of the protocol that this SA carries, or 0 if it carries any port number.
IPS ipsecSaEspInCreator	1.3.6.1.3.98.1.1.1.1.10	IpsecSaCreatorIdent	read-only	The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method.
IPS ipsecSaEspInEncapsulation	1.3.6.1.3.98.1.1.1.1.11	IpsecDoiEncapsulationMode	read-only	The type of encapsulation used by this SA.
IPS ipsecSaEspInEncAlg	1.3.6.1.3.98.1.1.1.1.12	IpsecDoiEspTransform	read-only	A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used.
U32 ipsecSaEspInEncKeyLength	1.3.6.1.3.98.1.1.1.1.13	Unsigned32	read-only	The length of the encryption key in bits used for the algorithm specified in the 'ipsecSaEspInEncAlg' object. It may be 0 if the key length is implicit in the specified algorithm or there is no encryption specified.
IPS ipsecSaEspInAuthAlg	1.3.6.1.3.98.1.1.1.1.14	IpsecDoiAuthAlgorithm	read-only	A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used.
U32 ipsecSaEspInAuthKeyLength	1.3.6.1.3.98.1.1.1.1.15	Unsigned32	read-only	The length of the authentication key in bits used for the algorithm specified in the 'ipsecSaEspInAuthAlg'. It may be 0 if the key length is implicit in the specified algorithm or there is no authentication specified.
U32 ipsecSaEspInRepWinSize	1.3.6.1.3.98.1.1.1.1.16	Unsigned32	read-only	The size of the anti-replay window used by this SA, or 0 if anti-replay checking is not being done.
U32 ipsecSaEspInLimitSeconds	1.3.6.1.3.98.1.1.1.1.17	Unsigned32	read-only	The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated.
U32 ipsecSaEspInLimitKbytes	1.3.6.1.3.98.1.1.1.1.18	Unsigned32	read-only	The maximum traffic in kilobytes that the SA is allowed to process, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated.
C32 ipsecSaEspInAccSecondsEx	1.3.6.1.3.98.1.1.1.1.19	Counter32	read-only	The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed.
C32 ipsecSaEspInAccKbytes	1.3.6.1.3.98.1.1.1.1.20	Counter32	read-only	The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in kilobytes. This value may be 0 if the SA does not expire based on traffic.
C64 ipsecSaEspInUserOctets	1.3.6.1.3.98.1.1.1.1.21	Counter64	read-only	The amount of user level traffic measured in bytes handled by the SA. This is the number of bytes of the decrypted IP packet, including the original IP header of that decrypted packet. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit due to padding or other protocol specific overhead.
C64 ipsecSaEspInPackets	1.3.6.1.3.98.1.1.1.1.22	Counter64	read-only	The number of packets handled by the SA.
C32 ipsecSaEspInDecryptErrors	1.3.6.1.3.98.1.1.1.1.23	Counter32	read-only	The number of packets discarded by the SA due to detectable decryption errors. Not all decryption errors are detectable within SA processing, so this count should not be considered definitive.
C32 ipsecSaEspInAuthErrors	1.3.6.1.3.98.1.1.1.1.24	Counter32	read-only	The number of packets discarded by the SA due to authentication errors.
C32 ipsecSaEspInReplayErrors	1.3.6.1.3.98.1.1.1.1.25	Counter32	read-only	The number of packets discarded by the SA due to replay errors.
C32 ipsecSaEspInPolicyErrors	1.3.6.1.3.98.1.1.1.1.26	Counter32	read-only	The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid.
C32 ipsecSaEspInPadErrors	1.3.6.1.3.98.1.1.1.1.27	Counter32	read-only	The number of packets discarded by the SA due to pad value errors. Implementations that do not check this must not support this object.
C32 ipsecSaEspInOtherReceiveErrors	1.3.6.1.3.98.1.1.1.1.28	Counter32	read-only	The number of packets discarded by the SA due to errors other than decryption, authentication, replay errors or, when supported, invalid padding errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element.
ipsecSaAhInTable	1.3.6.1.3.98.1.1.2		not-accessible	The (conceptual) table containing information on IPsec inbound AH SAs. There should be one row for every inbound AH security association that exists in the entity. The maximum number of rows is implementation dependent.
ipsecSaAhInEntry	1.3.6.1.3.98.1.1.2.1		not-accessible	An entry (conceptual row) containing the information on a particular IPsec inbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table.
ADR ipsecSaAhInAddress	1.3.6.1.3.98.1.1.2.1.1	IpsecIpv6Address	read-only	The destination address of the SA. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
U32 ipsecSaAhInSpi	1.3.6.1.3.98.1.1.2.1.2	Unsigned32	read-only	The security parameters index of the SA.
IPS ipsecSaAhInDestId	1.3.6.1.3.98.1.1.2.1.3	IpsecRawId	read-only	The destination identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during SA creation negotiation, or the equivalent process.
IPS ipsecSaAhInDestIdType	1.3.6.1.3.98.1.1.2.1.4	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaAhInDestId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
IPS ipsecSaAhInSourceId	1.3.6.1.3.98.1.1.2.1.5	IpsecRawId	read-only	The source identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during SA creation negotiation or the equivelant process.
IPS ipsecSaAhInSourceIdType	1.3.6.1.3.98.1.1.2.1.6	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaAhInSourceId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
I32 ipsecSaAhInProtocol	1.3.6.1.3.98.1.1.2.1.7	Integer32	read-only	The transport-layer protocol number that this SA carries, or 0 if it carries any protocol.
I32 ipsecSaAhInDestPort	1.3.6.1.3.98.1.1.2.1.8	Integer32	read-only	The destination port number of the protocol that this SA carries, or 0 if it carries any port number.
I32 ipsecSaAhInSourcePort	1.3.6.1.3.98.1.1.2.1.9	Integer32	read-only	The source port number of the protocol that this SA carries, or 0 if it carries any port number.
IPS ipsecSaAhInCreator	1.3.6.1.3.98.1.1.2.1.10	IpsecSaCreatorIdent	read-only	The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method.
IPS ipsecSaAhInEncapsulation	1.3.6.1.3.98.1.1.2.1.11	IpsecDoiEncapsulationMode	read-only	The type of encapsulation used by this SA.
IPS ipsecSaAhInAuthAlg	1.3.6.1.3.98.1.1.2.1.12	IpsecDoiAhTransform	read-only	A unique value representing the hash algorithm applied to traffic carried by this SA.
U32 ipsecSaAhInAuthKeyLength	1.3.6.1.3.98.1.1.2.1.13	Unsigned32	read-only	The length of the authentication key in bits used for the algorithm specified in the 'ipsecSaAhInAuthAlg' object. It may be 0 if the key length is implicit in the specified algorithm.
U32 ipsecSaAhInRepWinSize	1.3.6.1.3.98.1.1.2.1.14	Unsigned32	read-only	The size of the anti-replay window used by this SA, or 0 if anti-replay checking is not being done.
U32 ipsecSaAhInLimitSeconds	1.3.6.1.3.98.1.1.2.1.15	Unsigned32	read-only	The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated.
U32 ipsecSaAhInLimitKbytes	1.3.6.1.3.98.1.1.2.1.16	Unsigned32	read-only	The maximum traffic in bytes that the SA is allowed to process, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated.
C32 ipsecSaAhInAccSeconds	1.3.6.1.3.98.1.1.2.1.17	Counter32	read-only	The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed.
C32 ipsecSaAhInAccKbytes	1.3.6.1.3.98.1.1.2.1.18	Counter32	read-only	The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in kilobytes. This value may be 0 if the SA does not expire based on traffic.
C64 ipsecSaAhInUserOctets	1.3.6.1.3.98.1.1.2.1.19	Counter64	read-only	The amount of user level traffic measured in bytes handled by the SA. This is the number of bytes of the de-processed IP packet, including the original IP header of that de- processed packet. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit due to padding or other protocol specific overhead.
C64 ipsecSaAhInPackets	1.3.6.1.3.98.1.1.2.1.20	Counter64	read-only	The number of packets handled by the SA.
C32 ipsecSaAhInAuthErrors	1.3.6.1.3.98.1.1.2.1.21	Counter32	read-only	The number of packets discarded by the SA due to authentication errors.
C32 ipsecSaAhInReplayErrors	1.3.6.1.3.98.1.1.2.1.22	Counter32	read-only	The number of packets discarded by the SA due to replay errors.
C32 ipsecSaAhInPolicyErrors	1.3.6.1.3.98.1.1.2.1.23	Counter32	read-only	The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid.
C32 ipsecSaAhInOtherReceiveErrors	1.3.6.1.3.98.1.1.2.1.24	Counter32	read-only	The number of packets discarded by the SA due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the authentication element.
ipsecSaIpcompInTable	1.3.6.1.3.98.1.1.3		not-accessible	The (conceptual) table containing information on IPsec inbound IPcomp SAs. There should be one row for every inbound IPcomp (security) association that exists in the entity. The maximum number of rows is implementation dependent.
ipsecSaIpcompInEntry	1.3.6.1.3.98.1.1.3.1		not-accessible	An entry (conceptual row) containing the information on a particular IPsec inbound IPcomp SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table.
ADR ipsecSaIpcompInAddress	1.3.6.1.3.98.1.1.3.1.1	IpsecIpv6Address	read-only	The destination address of the SA. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
IPS ipsecSaIpcompInCpi	1.3.6.1.3.98.1.1.3.1.2	IpsecDoiIpcompTransform	read-only	The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform.
IPS ipsecSaIpcompInDestId	1.3.6.1.3.98.1.1.3.1.3	IpsecRawId	read-only	The destination identifier of the SA. It may be 0 if unknown or if the SA uses transport mode, or 0 if this SA is used with multiple SAs in security association suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchanged during SA creation negotiation, or the equivalent process.
IPS ipsecSaIpcompInDestIdType	1.3.6.1.3.98.1.1.3.1.4	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaIpcompInDestId'. It may be 0 if unknown or if the SA uses transport mode, or if this SA is used with multiple SAs in security association suites.
IPS ipsecSaIpcompInSourceId	1.3.6.1.3.98.1.1.3.1.5	IpsecRawId	read-only	The source identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in security association suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchanged during SA creation negotiation, or the equivalent process.
IPS ipsecSaIpcompInSourceIdType	1.3.6.1.3.98.1.1.3.1.6	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaIpcompInSourceId'. It may be 0 if unknown or if the SA uses transport mode encapsulation, or if this SA is used with multiple SAs in security association suites.
I32 ipsecSaIpcompInProtocol	1.3.6.1.3.98.1.1.3.1.7	Integer32	read-only	The transport-layer protocol number that this SA carries, or 0 if it carries any protocol.
I32 ipsecSaIpcompInDestPort	1.3.6.1.3.98.1.1.3.1.8	Integer32	read-only	The destination port number of the protocol that this SA carries, or 0 if it carries any port number.
I32 ipsecSaIpcompInSourcePort	1.3.6.1.3.98.1.1.3.1.9	Integer32	read-only	The source port number of the protocol that this SA carries, or 0 if it carries any port number.
IPS ipsecSaIpcompInCreator	1.3.6.1.3.98.1.1.3.1.10	IpsecSaCreatorIdent	read-only	The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method.
IPS ipsecSaIpcompInEncapsulation	1.3.6.1.3.98.1.1.3.1.11	IpsecDoiEncapsulationMode	read-only	The type of encapsulation used by this SA.
IPS ipsecSaIpcompInDecompAlg	1.3.6.1.3.98.1.1.3.1.12	IpsecDoiIpcompTransform	read-only	A unique value representing the decompression algorithm applied to traffic.
C32 ipsecSaIpcompInSeconds	1.3.6.1.3.98.1.1.3.1.13	Counter32	read-only	The number of seconds that the SA has existed.
C64 ipsecSaIpcompInUserOctets	1.3.6.1.3.98.1.1.3.1.14	Counter64	read-only	The amount of user level traffic measured in bytes handled by the SA. This is the number of bytes of the uncompressed IP packet, including the original IP header of that uncompressed packet. Packets which are not decompressed by the SA are not counted in this total.
C64 ipsecSaIpcompInPackets	1.3.6.1.3.98.1.1.3.1.15	Counter64	read-only	The number of packets handled by the SA.
C32 ipsecSaIpcompInDecompErrors	1.3.6.1.3.98.1.1.3.1.16	Counter32	read-only	The number of packets discarded by the SA due to decompression errors.
C32 ipsecSaIpcompInOtherReceiveErrors	1.3.6.1.3.98.1.1.3.1.17	Counter32	read-only	The number of packets discarded by the SA due to errors other than decompression errors. This may include packets dropped due to a lack of receive buffers, and packets dropped due to congestion at the decompression element.
ipsecSaEspOutTable	1.3.6.1.3.98.1.1.4		not-accessible	The (conceptual) table containing information on IPsec Outbound ESP SAs. There should be one row for every outbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent.
ipsecSaEspOutEntry	1.3.6.1.3.98.1.1.4.1		not-accessible	An entry (conceptual row) containing the information on a particular IPsec Outbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table.
ADR ipsecSaEspOutAddress	1.3.6.1.3.98.1.1.4.1.1	IpsecIpv6Address	read-only	The destination address of the SA. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
U32 ipsecSaEspOutSpi	1.3.6.1.3.98.1.1.4.1.2	Unsigned32	read-only	The security parameters index of the SA.
IPS ipsecSaEspOutSourceId	1.3.6.1.3.98.1.1.4.1.3	IpsecRawId	read-only	The source identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations, or the equivalent process.
IPS ipsecSaEspOutSourceIdType	1.3.6.1.3.98.1.1.4.1.4	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaEspOutSourceId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
IPS ipsecSaEspOutDestId	1.3.6.1.3.98.1.1.4.1.5	IpsecRawId	read-only	The destination identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations or the equivalent process.
IPS ipsecSaEspOutDestIdType	1.3.6.1.3.98.1.1.4.1.6	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaEspOutDestId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
I32 ipsecSaEspOutProtocol	1.3.6.1.3.98.1.1.4.1.7	Integer32	read-only	The transport-layer protocol number that this SA carries, or 0 if it carries any protocol.
I32 ipsecSaEspOutSourcePort	1.3.6.1.3.98.1.1.4.1.8	Integer32	read-only	The source port number of the protocol that this SA carries, or 0 if it carries any port number.
I32 ipsecSaEspOutDestPort	1.3.6.1.3.98.1.1.4.1.9	Integer32	read-only	The destination port number of the protocol that this SA carries, or 0 if it carries any port number.
IPS ipsecSaEspOutCreator	1.3.6.1.3.98.1.1.4.1.10	IpsecSaCreatorIdent	read-only	The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method.
IPS ipsecSaEspOutEncapsulation	1.3.6.1.3.98.1.1.4.1.11	IpsecDoiEncapsulationMode	read-only	The type of encapsulation used by this SA.
IPS ipsecSaEspOutEncAlg	1.3.6.1.3.98.1.1.4.1.12	IpsecDoiEspTransform	read-only	A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used.
U32 ipsecSaEspOutEncKeyLength	1.3.6.1.3.98.1.1.4.1.13	Unsigned32	read-only	The length of the encryption key in bits used for the algorithm specified in the 'ipsecSaEspOutEncAlg' object. It may be 0 if the key length is implicit in the specified algorithm or there is no encryption specified.
IPS ipsecSaEspOutAuthAlg	1.3.6.1.3.98.1.1.4.1.14	IpsecDoiAuthAlgorithm	read-only	A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used.
U32 ipsecSaEspOutAuthKeyLength	1.3.6.1.3.98.1.1.4.1.15	Unsigned32	read-only	The length of the authentication key in bits used for the algorithm specified in the 'ipsecSaEspOutAuthAlg' object. It may be 0 if the key length is implicit in the specified algorithm or there is no authentication specified.
U32 ipsecSaEspOutLimitSeconds	1.3.6.1.3.98.1.1.4.1.16	Unsigned32	read-only	The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated.
U32 ipsecSaEspOutLimitKbytes	1.3.6.1.3.98.1.1.4.1.17	Unsigned32	read-only	The maximum traffic in bytes that the SA is allowed to process, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated.
C32 ipsecSaEspOutAccSeconds	1.3.6.1.3.98.1.1.4.1.18	Counter32	read-only	The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed.
C32 ipsecSaEspOutAccKbytes	1.3.6.1.3.98.1.1.4.1.19	Counter32	read-only	The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in kilobytes. This value may be 0 if the SA does not expire based on traffic.
C64 ipsecSaEspOutUserOctets	1.3.6.1.3.98.1.1.4.1.20	Counter64	read-only	The amount of user level traffic measured in bytes handled by the SA. This is the number of bytes of the unencrypted IP packet, including the original IP header of that unencrypted packet. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit due to padding or other protocol specific overhead.
C64 ipsecSaEspOutPackets	1.3.6.1.3.98.1.1.4.1.21	Counter64	read-only	The number of packets handled by the SA.
C32 ipsecSaEspOutSendErrors	1.3.6.1.3.98.1.1.4.1.22	Counter32	read-only	The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers.
ipsecSaAhOutTable	1.3.6.1.3.98.1.1.5		not-accessible	The (conceptual) table containing information on IPsec Outbound AH SAs. There should be one row for every outbound AH security association that exists in the entity. The maximum number of rows is implementation dependent.
ipsecSaAhOutEntry	1.3.6.1.3.98.1.1.5.1		not-accessible	An entry (conceptual row) containing the information on a particular IPsec Outbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table.
ADR ipsecSaAhOutAddress	1.3.6.1.3.98.1.1.5.1.1	IpsecIpv6Address	read-only	The destination address of the SA. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
U32 ipsecSaAhOutSpi	1.3.6.1.3.98.1.1.5.1.2	Unsigned32	read-only	The security parameters index of the SA.
IPS ipsecSaAhOutSourceId	1.3.6.1.3.98.1.1.5.1.3	IpsecRawId	read-only	The source identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations, or the equivalent process.
IPS ipsecSaAhOutSourceIdType	1.3.6.1.3.98.1.1.5.1.4	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaAhOutSourceId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
IPS ipsecSaAhOutDestId	1.3.6.1.3.98.1.1.5.1.5	IpsecRawId	read-only	The destination identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during phase 2 negotiations, or the equivalent process.
IPS ipsecSaAhOutDestIdType	1.3.6.1.3.98.1.1.5.1.6	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaAhOutDestId'. It may be 0 if unknown or if the SA uses transport mode encapsulation.
I32 ipsecSaAhOutProtocol	1.3.6.1.3.98.1.1.5.1.7	Integer32	read-only	The transport-layer protocol number that this SA carries, or 0 if it carries any protocol.
I32 ipsecSaAhOutSourcePort	1.3.6.1.3.98.1.1.5.1.8	Integer32	read-only	The source port number of the protocol that this SA carries, or 0 if it carries any port number.
I32 ipsecSaAhOutDestPort	1.3.6.1.3.98.1.1.5.1.9	Integer32	read-only	The destination port number of the protocol that this SA carries, or 0 if it carries any port number.
IPS ipsecSaAhOutCreator	1.3.6.1.3.98.1.1.5.1.10	IpsecSaCreatorIdent	read-only	The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method.
IPS ipsecSaAhOutEncapsulation	1.3.6.1.3.98.1.1.5.1.11	IpsecDoiEncapsulationMode	read-only	The type of encapsulation used by this SA.
IPS ipsecSaAhOutAuthAlg	1.3.6.1.3.98.1.1.5.1.12	IpsecDoiAhTransform	read-only	A unique value representing the hash algorithm applied to traffic carried by this SA.
U32 ipsecSaAhOutAuthKeyLength	1.3.6.1.3.98.1.1.5.1.13	Unsigned32	read-only	The length of the authentication key in bits used for the algorithm specified in the 'ipsecSaAhOutAuthAlg' object. It may be 0 if the key length is implicit in the specified algorithm.
U32 ipsecSaAhOutLimitSeconds	1.3.6.1.3.98.1.1.5.1.14	Unsigned32	read-only	The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated.
U32 ipsecSaAhOutLimitKbytes	1.3.6.1.3.98.1.1.5.1.15	Unsigned32	read-only	The maximum traffic in bytes that the SA is allowed to process, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated.
C32 ipsecSaAhOutAccSeconds	1.3.6.1.3.98.1.1.5.1.16	Counter32	read-only	The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed.
C32 ipsecSaAhOutAccKbytes	1.3.6.1.3.98.1.1.5.1.17	Counter32	read-only	The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in kilobytes. This value may be 0 if the SA does not expire based on traffic.
C64 ipsecSaAhOutUserOctets	1.3.6.1.3.98.1.1.5.1.18	Counter64	read-only	The amount of user level traffic measured in bytes handled by the SA. This is the number of bytes of the unprocessed IP packet, including the original IP header of that unprocessed packet. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit due to padding or other protocol specific overhead.
C64 ipsecSaAhOutPackets	1.3.6.1.3.98.1.1.5.1.19	Counter64	read-only	The number of packets handled by the SA.
C32 ipsecSaAhOutSendErrors	1.3.6.1.3.98.1.1.5.1.20	Counter32	read-only	The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers.
ipsecSaIpcompOutTable	1.3.6.1.3.98.1.1.6		not-accessible	The (conceptual) table containing information on IPsec Outbound IPcomp SAs. There should be one row for every outbound IPcomp (security) association that exists in the entity. The maximum number of rows is implementation dependent.
ipsecSaIpcompOutEntry	1.3.6.1.3.98.1.1.6.1		not-accessible	An entry (conceptual row) containing the information on a particular IPsec Outbound IPcomp SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table.
ADR ipsecSaIpcompOutAddress	1.3.6.1.3.98.1.1.6.1.1	IpsecIpv6Address	read-only	The destination address of the SA. If the IPcomp SA is shared across multiple SAs in security association suites, this value may be 0. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
IPS ipsecSaIpcompOutCpi	1.3.6.1.3.98.1.1.6.1.2	IpsecDoiIpcompTransform	read-only	The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform.
IPS ipsecSaIpcompOutSourceId	1.3.6.1.3.98.1.1.6.1.3	IpsecRawId	read-only	The source identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation, or if this SA is used with multiple SAs in security association suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations or the equivalent process.
IPS ipsecSaIpcompOutSourceIdType	1.3.6.1.3.98.1.1.6.1.4	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaIpcompOutSourceId'. It may be 0 if unknown or if the SA uses transport mode encapsulation, or if this SA is used with multiple SAs in security association suites.
IPS ipsecSaIpcompOutDestId	1.3.6.1.3.98.1.1.6.1.5	IpsecRawId	read-only	The destination identifier of the SA. It may be 0 if unknown or if the SA uses transport mode encapsulation, or if this SA is used with multiple SAs in security association suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations or the equivalent process.
IPS ipsecSaIpcompOutDestIdType	1.3.6.1.3.98.1.1.6.1.6	IpsecDoiIdentType	read-only	The type of identifier presented by 'ipsecSaIpcompOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in security association suites.
I32 ipsecSaIpcompOutProtocol	1.3.6.1.3.98.1.1.6.1.7	Integer32	read-only	The transport-layer protocol number that this SA carries, or 0 if it carries any protocol.
I32 ipsecSaIpcompOutSourcePort	1.3.6.1.3.98.1.1.6.1.8	Integer32	read-only	The source port number of the protocol that this SA carries, or 0 if it carries any port number.
I32 ipsecSaIpcompOutDestPort	1.3.6.1.3.98.1.1.6.1.9	Integer32	read-only	The destination port number of the protocol that this SA carries, or 0 if it carries any port number.
IPS ipsecSaIpcompOutCreator	1.3.6.1.3.98.1.1.6.1.10	IpsecSaCreatorIdent	read-only	The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method.
IPS ipsecSaIpcompOutEncapsulation	1.3.6.1.3.98.1.1.6.1.11	IpsecDoiEncapsulationMode	read-only	The type of encapsulation used by this SA.
IPS ipsecSaIpcompOutCompAlg	1.3.6.1.3.98.1.1.6.1.12	IpsecDoiIpcompTransform	read-only	A unique value representing the compression algorithm applied to traffic.
C32 ipsecSaIpcompOutSeconds	1.3.6.1.3.98.1.1.6.1.13	Counter32	read-only	The number of seconds that the SA has existed.
C64 ipsecSaIpcompOutUserOctets	1.3.6.1.3.98.1.1.6.1.14	Counter64	read-only	The amount of user level traffic measured in bytes handled by the SA. This is the number of bytes of the decompressed IP packet, including the original IP header of that decompressed packet.
C64 ipsecSaIpcompOutOutputOctets	1.3.6.1.3.98.1.1.6.1.15	Counter64	read-only	The amount of traffic measured in bytes output by the SA. This includes byte counts from packets compressed by the SA and also packets not modified by the SA. This object can be divided into the 'ipsecSaIpcompOutUserOctets' object to get a compression performance metric for the SA.
C64 ipsecSaIpcompOutPackets	1.3.6.1.3.98.1.1.6.1.16	Counter64	read-only	The number of packets handled by the SA. This includes packets that were both compressed and not compressed.
saStatistics	1.3.6.1.3.98.1.2			This is the base object identifier for all objects which are global counters for IPsec security associations.
G32 ipsecEspCurrentInboundSAs	1.3.6.1.3.98.1.2.1	Gauge32	read-only	The current number of inbound ESP SAs in the entity.
C32 ipsecEspTotalInboundSAs	1.3.6.1.3.98.1.2.2	Counter32	read-only	The total number of inbound ESP SAs created in the entity since boot time.
G32 ipsecEspCurrentOutboundSAs	1.3.6.1.3.98.1.2.3	Gauge32	read-only	The current number of outbound ESP SAs in the entity.
C32 ipsecEspTotalOutboundSAs	1.3.6.1.3.98.1.2.4	Counter32	read-only	The total number of outbound ESP SAs created in the entity since boot time.
G32 ipsecAhCurrentInboundSAs	1.3.6.1.3.98.1.2.5	Gauge32	read-only	The current number of inbound AH SAs in the entity.
C32 ipsecAhTotalInboundSAs	1.3.6.1.3.98.1.2.6	Counter32	read-only	The total number of inbound AH SAs created in the entity since boot time.
G32 ipsecAhCurrentOutboundSAs	1.3.6.1.3.98.1.2.7	Gauge32	read-only	The current number of outbound AH SAs in the entity.
C32 ipsecAhTotalOutboundSAs	1.3.6.1.3.98.1.2.8	Counter32	read-only	The total number of outbound AH SAs created in the entity since boot time.
G32 ipsecIpcompCurrentInboundSAs	1.3.6.1.3.98.1.2.9	Gauge32	read-only	The current number of inbound IPcomp SAs in the entity.
C32 ipsecIpcompTotalInboundSAs	1.3.6.1.3.98.1.2.10	Counter32	read-only	The total number of inbound IPcomp SAs created in the entity since boot time.
G32 ipsecIpcompCurrentOutboundSAs	1.3.6.1.3.98.1.2.11	Gauge32	read-only	The current number of outbound IPcomp SAs in the entity.
C32 ipsecIpcompTotalOutboundSAs	1.3.6.1.3.98.1.2.12	Counter32	read-only	The total number of outbound IPcomp SAs created in the entity since boot time.
saErrors	1.3.6.1.3.98.1.3			This is the base object identifier for all objects which are global error counters for IPsec security associations.
C32 ipsecDecryptionErrors	1.3.6.1.3.98.1.3.1	Counter32	read-only	The total number of packets received by the entity in SAs since boot time with detectable decryption errors. Not all decryption errors are detectable within SA processing, so this count should not be considered definitive.
C32 ipsecAuthenticationErrors	1.3.6.1.3.98.1.3.2	Counter32	read-only	The total number of packets received by the entity in SAs since boot time with authentication errors. This includes all packets in which the hash value is determined to be invalid, for both ESP and AH SAs.
C32 ipsecReplayErrors	1.3.6.1.3.98.1.3.3	Counter32	read-only	The total number of packets received by the entity in SAs since boot time with replay errors.
C32 ipsecPolicyErrors	1.3.6.1.3.98.1.3.4	Counter32	read-only	The total number of packets received by the entity in SAs since boot time and discarded due to policy errors. This includes packets that had selectors that were invalid for the SA that carried them, and also includes packets that arrived at the entity in the clear and that should have been protected by IPsec or should have been dropped.
C32 ipsecOtherReceiveErrors	1.3.6.1.3.98.1.3.5	Counter32	read-only	The total number of packets received by the entity in SAs since boot time and discarded due to errors not due to decryption, authentication, replay or policy.
C32 ipsecSendErrors	1.3.6.1.3.98.1.3.6	Counter32	read-only	The total number of packets to be sent by the entity in SAs since boot time and discarded due to errors.
C32 ipsecUnknownSpiErrors	1.3.6.1.3.98.1.3.7	Counter32	read-only	The total number of packets received by the entity since boot time with SPIs or CPIs that were not valid.
saTraps	1.3.6.1.3.98.1.4			This is the base object identifier for all objects which are traps for IPsec security associations.
NTF espAuthFailureTrap	1.3.6.1.3.98.1.4.0.1			IPsec packets with invalid hashes were found in an inbound ESP SA. The total number of authentication errors accumulated is sent for the specific row of the 'ipsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet.
NTF ahAuthFailureTrap	1.3.6.1.3.98.1.4.0.2			IPsec packets with invalid hashes were found in an inbound AH SA. The total number of authentication errors accumulated is sent for the specific row of the 'ipsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet.
NTF espReplayFailureTrap	1.3.6.1.3.98.1.4.0.3			IPsec packets with invalid sequence numbers were found in an inbound ESP SA. The total number of replay errors accumulated is sent for the specific row of the 'ipsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet.
NTF ahReplayFailureTrap	1.3.6.1.3.98.1.4.0.4			IPsec packets with invalid sequence numbers were found in the specified AH SA. The total number of replay errors accumulated is sent for the specific row of the 'ipsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet.
NTF espPolicyFailureTrap	1.3.6.1.3.98.1.4.0.5			IPsec packets carrying packets with invalid selectors for the specified ESP SA were found. The total number of policy errors accumulated is sent for the specific row of the 'ipsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet.
NTF ahPolicyFailureTrap	1.3.6.1.3.98.1.4.0.6			IPsec packets carrying packets with invalid selectors for the specified AH SA were found. The total number of policy errors accumulated is sent for the specific row of the 'ipsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet.
NTF espInvalidSpiTrap	1.3.6.1.3.98.1.4.0.7			A packet with an unknown SPI was detected from the specified peer with the specified SPI using the specified protocol. The destination address of the received packet is specified by 'ipsecLocalAddress'. The value 'ifIndex' may be 0 if this optional linkage is unsupported. If the object 'ipsecSecurityProtocol' has the value for IPcomp, then the 'ipsecSPI' object is the CPI of the packet. Implementations SHOULD send one trap per peer (within a reasonable time period), rather than sending one trap per packet.
NTF otherPolicyFailureTrap	1.3.6.1.3.98.1.4.0.8			Clear packets were found that should not have been sent to the entity in the clear. The total number of policy errors accumulated by the entity is sent, along with the source and destination addresses of the packet that triggered the trap. Implementations SHOULD send one trap per source address pair (within a reasonable time period), rather than sending one trap per packet.
saTrapObjects	1.3.6.1.3.98.1.5			This is the base object identifier for objects which are used as part of traps.
IPS ipsecSecurityProtocol	1.3.6.1.3.98.1.5.1	IpsecDoiSecProtocolId	accessible-for-notify	A security protocol associated with the trap.
U32 ipsecSPI	1.3.6.1.3.98.1.5.2	Unsigned32	accessible-for-notify	An SPI associated with a trap. Where the security protocol associated with the trap is IPcomp, this value has a maximum of 65535.
ADR ipsecLocalAddress	1.3.6.1.3.98.1.5.3	IpsecIpv6Address	accessible-for-notify	A local IP address associated with the trap. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
ADR ipsecPeerAddress	1.3.6.1.3.98.1.5.4	IpsecIpv6Address	accessible-for-notify	A peer IP address associated with the trap. IPv4 entities will prefix the IP address with '0000:0000:0000:0000:0000:FFFF::'.
saTrapControl	1.3.6.1.3.98.1.6			This is the base object identifier for all objects which are trap controls for IPsec security associations.
T/F espAuthFailureTrapEnable	1.3.6.1.3.98.1.6.1	TruthValue	read-write	Indicates whether espAuthFailureTrap traps should be generated.
T/F ahAuthFailureTrapEnable	1.3.6.1.3.98.1.6.2	TruthValue	read-write	Indicates whether ahAuthFailureTrap traps should be generated.
T/F espReplayFailureTrapEnable	1.3.6.1.3.98.1.6.3	TruthValue	read-write	Indicates whether espReplayFailureTrap traps should be generated.
T/F ahReplayFailureTrapEnable	1.3.6.1.3.98.1.6.4	TruthValue	read-write	Indicates whether ahReplayFailureTrap traps should be generated.
T/F espPolicyFailureTrapEnable	1.3.6.1.3.98.1.6.5	TruthValue	read-write	Indicates whether espPolicyFailureTrap traps should be generated.
T/F ahPolicyFailureTrapEnable	1.3.6.1.3.98.1.6.6	TruthValue	read-write	Indicates whether ahPolicyFailureTrap traps should be generated.
T/F invalidSpiTrapEnable	1.3.6.1.3.98.1.6.7	TruthValue	read-write	Indicates whether invalidSpiTrap traps should be generated.
T/F otherPolicyFailureTrapEnable	1.3.6.1.3.98.1.6.8	TruthValue	read-write	Indicates whether otherPolicyFailureTrap traps should be generated.
saGroups	1.3.6.1.3.98.1.7			This is the base object identifier for all objects which describe the groups in this MIB.
ipsecSaEspGroup	1.3.6.1.3.98.1.7.1			A collection of objects that describe the state of the security associations of the ESP protocol.
ipsecSaAhGroup	1.3.6.1.3.98.1.7.2			A collection of objects that describe the state of the security associations of the AH protocol.
ipsecSaIpcompGroup	1.3.6.1.3.98.1.7.3			A collection of objects that describe the state of the security associations of the IPComp protocol.
ipsecSaErrorsGroup	1.3.6.1.3.98.1.7.4			A collection of objects providing global IPsec error counters.
ipsecSaFailureTrapEnableGroup	1.3.6.1.3.98.1.7.5			A collection of objects providing control over trap generation.
ipsecSaTrapArgumentGroup	1.3.6.1.3.98.1.7.6			A collection of objects used only as arguments in traps.
ipsecSaFailureTrapGroup	1.3.6.1.3.98.1.7.7			A collection of traps.
saConformance	1.3.6.1.3.98.1.8			This is the base object identifier for all objects which describe the conformance for this MIB.
ipsecSaMonitorCompliance	1.3.6.1.3.98.1.8.1			The compliance statement for SNMPv2 entities which implement the IPsec Monitoring MIB.

RFC description

Monitors IPsec Security Associations including tunnel endpoints, transform parameters, and cryptographic algorithm configurations for IPsec devices.

Start monitoring Vendor-neutral IETF standard (IPsec/IKE VPN gateway or firewall, SA lifecycle) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download IPSEC-SA-MON-MIB

What Is IPSEC-SA-MON-MIB?

Supported Devices

Monitoring Examples

This MIB depends on

Related MIBs

How to Use in IPNetwork Monitor

RFC description