IPSEC-SPD-MIB

Q: What does IPSEC-SPD-MIB let me verify on a VPN gateway or firewall?

It exposes IPsec Security Policy Database configuration: ingress/egress policy group names, endpoint-to-group mappings with direction and interface bindings, and the ordered contents of policy groups that determine how traffic is matched against IPsec policies.

Q: How would an administrator use this MIB to audit IPsec policy configuration?

Per RFC 4807, an administrator can poll spdEndGroupDirection and spdEndGroupInterface to confirm which security policy group is bound to which interface and direction, and check row status and last-changed timestamps to catch unexpected policy changes, complementing companion MIBs that track the actual IPsec Security Associations and IKE state.

All MIBs › IPSEC-SPD-MIB

Organization: IETF IP Security Policy Working Group

Last Updated: 2007-02-07

Category: VPN and Security

Description:

Defines managed objects for configuring IPsec Security Policy Database (SPD) entries via SNMP.

Imported Objects

From DIFFSERV-MIB

IfDirection
diffServMIBMultiFieldClfrGroup	OBJECT-GROUP
diffServMultiFieldClfrNextFree	OBJECT-TYPE

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32
mib-2

From SNMPv2-TC

RowStatus
StorageType
TEXTUAL-CONVENTION
TimeStamp
TruthValue
VariablePointer

What Is IPSEC-SPD-MIB?

IPSEC-SPD-MIB is an IETF standards-track MIB, published as the IPSEC-SPD-MIB RFC (RFC 4807), defining managed objects for configuring and inspecting an IPsec Security Policy Database (SPD), applicable anywhere IPsec security services are implemented -- hosts, gateways, firewalls, routers, or bump-in-the-wire devices. It exposes configuration data for security policy groups, including ingress/egress policy group names, endpoint-to-group mappings with direction and interface bindings, and the ordered contents of policy groups that determine how traffic is matched against IPsec policies. Its monitoring value is primarily software/configuration status: confirming which security policy group is bound to which interface and direction (spdEndGroupDirection, spdEndGroupInterface), verifying row status and last-changed timestamps to catch unexpected policy changes, rather than hardware environmental data. It explicitly depends on and complements companion IPsec MIBs for Security Associations and IKE, since the SPD determines which traffic is subject to those associations. It is deployed on any IPsec-capable network device -- security gateways, firewalls, VPN concentrators, or hosts -- where administrators need to audit or provision IPsec policy configuration via SNMP.

IPNetwork Monitor allows you to monitor SNMP objects defined in IPSEC-SPD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

security policy group assignment per interface/direction
policy group row status
policy configuration last-changed timestamp
policy group contents/ordering
ingress/egress policy group naming

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
IPsec-capable gateway, firewall, router, or host

Monitoring Examples

An administrator would poll spdEndpointToGroupTable/spdEndpointToGroupEntry to check spdEndGroupInterface and spdEndGroupDirection, confirming which policy group (spdEndGroupName) is applied to a given interface for ingress or egress traffic, and cross-reference spdIngressPolicyGroupName/spdEgressPolicyGroupName for the overall device-level policy assignment. Checking spdEndGroupLastChanged alongside spdEndGroupRowStatus can reveal whether a security policy group was recently and perhaps unexpectedly modified, which combined with spdGroupContentsTable would show exactly which policy rules changed.

OIDs

OID symbolic	OID numeric	Type	Access	Description
I32 spdAcceptAction	1.3.6.1.2.1.153.1.13.3	Integer32	read-only	This Scalar indicates that a packet MUST be accepted (pass-through) and SHOULD NOT have action/packet logging.
I32 spdAcceptActionLog	1.3.6.1.2.1.153.1.13.4	Integer32	read-only	This scalar indicates that a packet MUST be accepted (pass-through) and SHOULD have action/packet logging.
NUM spdActionExecuted	1.3.6.1.2.1.153.2.1.1	VariablePointer	accessible-for-notify	Points to the action instance that was executed that resulted in the notification being sent.
spdActionLoggingObjectGroup	1.3.6.1.2.1.153.3.2.12			This group is made up of all the Notification objects for this MIB.
NTF spdActionNotification	1.3.6.1.2.1.153.2.0.1			Notification that an action was executed by a rule. Only actions with logging enabled will result in this notification getting sent. The object includes the spdActionExecuted object, which will indicate which action was executed within the scope of the rule. Additionally, the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress objects are included to indicate the packet source and destination of the packet that triggered the action. Finally, the spdIPEndpointAddType, spdIPEndpointAddress, and spdPacketDirection objects indicate which interface the executed action was associated with, and if the packet was ingress or egress through the endpoint. A spdActionNotification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate. Note that compound actions with multiple executed sub-actions may result in multiple notifications being sent from a single rule execution.
spdActionNotificationGroup	1.3.6.1.2.1.153.3.2.13			This group is made up of all the Notifications for this MIB.
spdActions	1.3.6.1.2.1.153.4
INT spdCompActExecutionStrategy	1.3.6.1.2.1.153.1.11.1.2	INTEGER	read-create	This object indicates how the sub-actions are executed based on the success of the actions as they finish executing. doAll - run each sub-action regardless of the exit status of the previous action. This parent action is always considered to have acted successfully. doUntilSuccess - run each sub-action until one succeeds, at which point stop processing the sub-actions within this parent compound action. If one of the sub-actions did execute successfully, this parent action is also considered to have executed successfully. doUntilFailure - run each sub-action until one fails, at which point stop processing the sub-actions within this compound action. If any sub-action fails, the result of this parent action is considered to have failed.
TIM spdCompActLastChanged	1.3.6.1.2.1.153.1.11.1.3	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STR spdCompActName	1.3.6.1.2.1.153.1.11.1.1	SnmpAdminString	not-accessible	This is an administratively assigned name of this compound action.
ROW spdCompActRowStatus	1.3.6.1.2.1.153.1.11.1.5	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once a row in the spdCompoundActionTable has been made active, this object MUST NOT be set to destroy without first destroying all the contained rows listed in the spdSubactionsTable.
STO spdCompActStorageType	1.3.6.1.2.1.153.1.11.1.4	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STR spdCompFiltDescription	1.3.6.1.2.1.153.1.5.1.2	SnmpAdminString	read-create	A user definable string. This field MAY be used for your administrative tracking purposes.
TIM spdCompFiltLastChanged	1.3.6.1.2.1.153.1.5.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
SPD spdCompFiltLogicType	1.3.6.1.2.1.153.1.5.1.3	SpdBooleanOperator	read-create	Indicates whether the sub-component filters of this compound filter are functionally ANDed or ORed together.
STR spdCompFiltName	1.3.6.1.2.1.153.1.5.1.1	SnmpAdminString	not-accessible	A user definable string. This value is used as an index into this table.
ROW spdCompFiltRowStatus	1.3.6.1.2.1.153.1.5.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once active, it MUST NOT have its value changed if any active rows in the spdRuleDefinitionTable are currently pointing at this row.
STO spdCompFiltStorageType	1.3.6.1.2.1.153.1.5.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
spdCompliances	1.3.6.1.2.1.153.3.1
spdCompoundActionEntry	1.3.6.1.2.1.153.1.11.1		not-accessible	A row in the spdCompoundActionTable.
spdCompoundActionGroup	1.3.6.1.2.1.153.3.2.11			The IPsec Policy Compound Action Table and Actions In Compound Action Table Group.
spdCompoundActionTable	1.3.6.1.2.1.153.1.11		not-accessible	Table used to allow multiple actions to be associated with a rule. It uses the spdSubactionsTable to do this. The rows from spdSubactionsTable that are partially indexed by spdCompActName form the set of compound actions to be performed. The spdCompActExecutionStrategy column in this table indicates how those actions are processed.
spdCompoundFilterEntry	1.3.6.1.2.1.153.1.5.1		not-accessible	An entry in the spdCompoundFilterTable. Each entry in this table represents a compound filter. A filter defined by this table is considered to have a TRUE return value if and only if: spdCompFiltLogicType is AND and all of the sub-filters associated with it, as defined in the spdSubfiltersTable, are all true themselves (after applying any required negation, as defined by the ficFilterIsNegated object). spdCompFiltLogicType is OR and at least one of the sub-filters associated with it, as defined in the spdSubfiltersTable, is true itself (after applying any required negation, as defined by the ficFilterIsNegated object.
spdCompoundFilterGroup	1.3.6.1.2.1.153.3.2.5			This group is made up of objects from the IPsec Policy Compound Filter Table and Sub-Filter Table Group.
spdCompoundFilterTable	1.3.6.1.2.1.153.1.5		not-accessible	A table defining compound filters and their associated parameters. A row in this table can be pointed to by a spdRuleDefFilter object.
spdConfigObjects	1.3.6.1.2.1.153.1
spdConformanceObjects	1.3.6.1.2.1.153.3
I32 spdDropAction	1.3.6.1.2.1.153.1.13.1	Integer32	read-only	This scalar indicates that a packet MUST be dropped and SHOULD NOT have action/packet logging.
I32 spdDropActionLog	1.3.6.1.2.1.153.1.13.2	Integer32	read-only	This scalar indicates that a packet MUST be dropped and SHOULD have action/packet logging.
STR spdEgressPolicyGroupName	1.3.6.1.2.1.153.1.1.2	SnmpAdminString	read-write	This object indicates the policy group containing the global system policy that is to be applied on egress packets (i.e., packets leaving an interface and entering a network) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates that no system-wide policy exists and the default policy of 'drop' SHOULD be executed for egress packets until one is imposed by either this object or by the endpoint processing a given packet. This object MUST be persistent
IFD spdEndGroupDirection	1.3.6.1.2.1.153.1.2.1.1	IfDirection	not-accessible	This object indicates which direction of packets crossing the interface are associated with which spdEndGroupName object. Ingress packets, or packets into the device match when this value is inbound(1). Egress packets or packets out of the device match when this value is outbound(2).
NUM spdEndGroupInterface	1.3.6.1.2.1.153.1.2.1.2	InterfaceIndex	not-accessible	This value matches the IF-MIB's ifTable's ifIndex column and indicates the interface associated with a given endpoint. This object can be used to uniquely identify an endpoint that a set of policy groups are applied to.
TIM spdEndGroupLastChanged	1.3.6.1.2.1.153.1.2.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STR spdEndGroupName	1.3.6.1.2.1.153.1.2.1.3	SnmpAdminString	read-create	The policy group name to apply at this endpoint. The value of the spdEndGroupName object is then used as an index into the spdGroupContentsTable to come up with a list of rules that MUST be applied at this endpoint.
ROW spdEndGroupRowStatus	1.3.6.1.2.1.153.1.2.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object is considered 'notReady' and MUST NOT be set to active until one or more active rows exist within the spdGroupContentsTable for the group referenced by the spdEndGroupName object.
STO spdEndGroupStorageType	1.3.6.1.2.1.153.1.2.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
spdEndpointGroup	1.3.6.1.2.1.153.3.2.1			This group is made up of objects from the IPsec Policy Endpoint Table.
spdEndpointToGroupEntry	1.3.6.1.2.1.153.1.2.1		not-accessible	A mapping assigning a policy group to an endpoint.
spdEndpointToGroupTable	1.3.6.1.2.1.153.1.2		not-accessible	This table maps policies (groupings) onto an endpoint (interface). A policy group assigned to an endpoint is then used to control access to the network traffic passing through that endpoint. If an endpoint has been configured with a policy group and no rule within that policy group matches that packet, the default action in this case SHALL be to drop the packet. If no policy group has been assigned to an endpoint, then the policy group specified by spdIngressPolicyGroupName MUST be used on traffic inbound from the network through that endpoint, and the policy group specified by spdEgressPolicyGroupName MUST be used for traffic outbound to the network through that endpoint.
STR spdGroupContComponentName	1.3.6.1.2.1.153.1.3.1.5	SnmpAdminString	read-create	The name of the policy rule or subgroup contained within this row, as indicated by the spdGroupContComponentType object.
INT spdGroupContComponentType	1.3.6.1.2.1.153.1.3.1.4	INTEGER	read-create	Indicates whether the spdGroupContComponentName object is the name of another group defined within the spdGroupContentsTable or is the name of a rule defined within the spdRuleDefinitionTable.
spdGroupContentsEntry	1.3.6.1.2.1.153.1.3.1		not-accessible	Defines a given sub-component within a policy group. A sub-component is either a rule or another group as indicated by spdGroupContComponentType and referenced by spdGroupContComponentName.
spdGroupContentsGroup	1.3.6.1.2.1.153.3.2.2			This group is made up of objects from the IPsec Policy Group Contents Table.
spdGroupContentsTable	1.3.6.1.2.1.153.1.3		not-accessible	This table contains a list of rules and/or subgroups contained within a given policy group. For a given value of spdGroupContName, the set of rows sharing that value forms a 'group'. The rows in a group MUST be processed according to the value of the spdGroupContPriority object in each row. The processing MUST be executed starting with the lowest value of spdGroupContPriority and in ascending order thereafter. If an action is executed as the result of the processing of a row in a group, the processing of further rows in that group MUST stop. Iterating to the next policy group row by finding the next largest spdGroupContPriority object SHALL only be done if no actions were run while processing the current row for a given packet.
NUM spdGroupContFilter	1.3.6.1.2.1.153.1.3.1.3	VariablePointer	read-create	spdGroupContFilter points to a filter that is evaluated to determine whether the spdGroupContComponentName within this row is exercised. Managers can use this object to classify groups of rules, or subgroups, together in order to achieve a greater degree of control and optimization over the execution order of the items within the group. If the filter evaluates to false, the rule or subgroup will be skipped and the next rule or subgroup will be evaluated instead. This value can be used to indicate a scalar or row in a table. When indicating a row in a table, this value MUST point to the first column instance in that row. An example usage of this object would be to limit a group of rules to executing only when the IP packet being processed is designated to be processed by IKE. This effectively creates a group of IKE-specific rules. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB: diffServMultiFieldClfrTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter spdIpsoHeaderFilterTable Implementations MAY choose to provide support for other filter tables or scalars. If this column is set to a VariablePointer value, which references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, a row in this table is applied to a packet and the value of this column in that row references a non-existent or non-supported object, the packet MUST be dropped.
TIM spdGroupContLastChanged	1.3.6.1.2.1.153.1.3.1.6	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STR spdGroupContName	1.3.6.1.2.1.153.1.3.1.1	SnmpAdminString	not-accessible	The administrative name of the group associated with this row. A 'group' is formed by all the rows in this table that have the same value of this object.
I32 spdGroupContPriority	1.3.6.1.2.1.153.1.3.1.2	Integer32	not-accessible	The priority (sequence number) of the sub-component in a group that this row represents. This value indicates the order that each row of this table MUST be processed from low to high. For example, a row with a priority of 0 is processed before a row with a priority of 1, a 1 before a 2, etc.
ROW spdGroupContRowStatus	1.3.6.1.2.1.153.1.3.1.8	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object MUST NOT be set to active until the row to which the spdGroupContComponentName points to exists and is active. If active, this object MUST remain active unless one of the following two conditions are met: I. No active row in spdEndpointToGroupTable exists that references this row's group (i.e., indicate this row's spdGroupContName). II. Or at least one other active row in this table has a matching spdGroupContName. If neither condition is met, an attempt to set this row to something other than active MUST result in an inconsistentValue error.
STO spdGroupContStorageType	1.3.6.1.2.1.153.1.3.1.7	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
spdGroups	1.3.6.1.2.1.153.3.2
STR spdIngressPolicyGroupName	1.3.6.1.2.1.153.1.1.1	SnmpAdminString	read-write	This object indicates the global system policy group that is to be applied on ingress packets (i.e., arriving at an interface from a network) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates that no system-wide policy exists and the default policy of 'drop' SHOULD be executed for ingress packets until one is imposed by either this object or by the endpoint processing a given packet. This object MUST be persistent
IP spdIPDestinationAddress	1.3.6.1.2.1.153.2.1.7	InetAddress	accessible-for-notify	Contains the destination address of the packet that triggered the notification. The format of this object is specified by the spdIPDestinationType object.
IPt spdIPDestinationType	1.3.6.1.2.1.153.2.1.6	InetAddressType	accessible-for-notify	Contains the destination address type of the packet that triggered the notification.
IP spdIPEndpointAddress	1.3.6.1.2.1.153.2.1.3	InetAddress	accessible-for-notify	Contains the interface address for the interface that the notification triggering packet is passing through. The format of this object is specified by the spdIPEndpointAddType object.
IPt spdIPEndpointAddType	1.3.6.1.2.1.153.2.1.2	InetAddressType	accessible-for-notify	Contains the address type for the interface that the notification triggering packet is passing through.
TIM spdIpOffFiltLastChanged	1.3.6.1.2.1.153.1.8.1.5	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STR spdIpOffFiltName	1.3.6.1.2.1.153.1.8.1.1	SnmpAdminString	not-accessible	The administrative name for this filter.
U32 spdIpOffFiltOffset	1.3.6.1.2.1.153.1.8.1.2	Unsigned32	read-create	This is the byte offset from the front of the entire IP packet where the value or arithmetic comparison is done. A value of '0' indicates the first byte of the packet header. If this value is greater than the length of the packet, the filter represented by this row should be considered to fail.
ROW spdIpOffFiltRowStatus	1.3.6.1.2.1.153.1.8.1.7	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
STO spdIpOffFiltStorageType	1.3.6.1.2.1.153.1.8.1.6	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
INT spdIpOffFiltType	1.3.6.1.2.1.153.1.8.1.3	INTEGER	read-create	This defines the various tests that are used when evaluating a given filter. The various tests definable in this table are as follows: equal: - Tests if the OCTET STRING, 'spdIpOffFiltValue', matches a value in the packet starting at the given offset in the packet and comparing the entire OCTET STRING of 'spdIpOffFiltValue'. Any values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. notEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', does not match a value in the packet starting at the given offset in the packet and comparing to the entire OCTET STRING of 'spdIpOffFiltValue'. Any values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticLess: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than ('=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticGreater: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically greater than ('>') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticLessOrEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than or equal to ('<=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'.
OCT spdIpOffFiltValue	1.3.6.1.2.1.153.1.8.1.4	OCTET STRING	read-create	spdIpOffFiltValue is used for match comparisons of a packet at spdIpOffFiltOffset.
spdIpOffsetFilterEntry	1.3.6.1.2.1.153.1.8.1		not-accessible	A definition of a particular filter.
spdIPOffsetFilterGroup	1.3.6.1.2.1.153.3.2.7			This group is made up of objects from the IPsec Policy IP Offset Filter Table.
spdIpOffsetFilterTable	1.3.6.1.2.1.153.1.8		not-accessible	This table contains a list of filter definitions to be used within the spdRuleDefinitionTable or the spdSubfiltersTable. This type of filter is used to compare an administrator specified octet string to the octets at a particular location in a packet.
spdIpsecSystemPolicyNameGroup	1.3.6.1.2.1.153.3.2.3			This group is made up of objects represent the System Policy Group Names.
spdIpsoHeaderFilterEntry	1.3.6.1.2.1.153.1.10.1		not-accessible	A definition of a particular filter.
spdIpsoHeaderFilterGroup	1.3.6.1.2.1.153.3.2.9			This group is made up of objects from the IPsec Policy IPSO Header Filter Table.
spdIpsoHeaderFilterTable	1.3.6.1.2.1.153.1.10		not-accessible	This table contains a list of IPSO header filter definitions to be used within the spdRuleDefinitionTable or the spdSubfiltersTable. IPSO headers and their values are described in RFC 1108.
INT spdIpsoHeadFiltClassification	1.3.6.1.2.1.153.1.10.1.3	INTEGER	read-create	This object indicates the IPSO classification header field value that the packet MUST have for this row to evaluate to 'true'. The values of these enumerations are defined by RFC 1108.
TIM spdIpsoHeadFiltLastChanged	1.3.6.1.2.1.153.1.10.1.5	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STR spdIpsoHeadFiltName	1.3.6.1.2.1.153.1.10.1.1	SnmpAdminString	not-accessible	The administrative name for this filter.
INT spdIpsoHeadFiltProtectionAuth	1.3.6.1.2.1.153.1.10.1.4	INTEGER	read-create	This object indicates the IPSO protection authority header field value that the packet MUST have for this row to evaluate to 'true'. The values of these enumerations are defined by RFC 1108. Hence the reason the SMIv2 convention of not using 0 in enumerated lists is violated here.
ROW spdIpsoHeadFiltRowStatus	1.3.6.1.2.1.153.1.10.1.7	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. However, this object MUST NOT be set to active if the requirements of the spdIpsoHeadFiltType object are not met. Specifically, if the spdIpsoHeadFiltType bit for classification(0) is set, the spdIpsoHeadFiltClassification column MUST have a valid value for the row status to be set to active. If the spdIpsoHeadFiltType bit for protectionAuthority(1) is set, the spdIpsoHeadFiltProtectionAuth column MUST have a valid value for the row status to be set to active. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
STO spdIpsoHeadFiltStorageType	1.3.6.1.2.1.153.1.10.1.6	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
BIT spdIpsoHeadFiltType	1.3.6.1.2.1.153.1.10.1.2	Bits	read-create	This object indicates which of the IPSO header field a packet is filtered on for this row. If this object is set to classification(0), the spdIpsoHeadFiltClassification object indicates how the packet is filtered. If this object is set to protectionAuthority(1), the spdIpsoHeadFiltProtectionAuth object indicates how the packet is filtered.
IP spdIPSourceAddress	1.3.6.1.2.1.153.2.1.5	InetAddress	accessible-for-notify	Contains the source address of the packet that triggered the notification. The format of this object is specified by the spdIPSourceType object.
IPt spdIPSourceType	1.3.6.1.2.1.153.2.1.4	InetAddressType	accessible-for-notify	Contains the source address type of the packet that triggered the notification.
spdLocalConfigObjects	1.3.6.1.2.1.153.1.1
spdLoggingCompliance	1.3.6.1.2.1.153.3.1.2			The compliance statement for SNMP entities that support sending notifications when actions are invoked.
spdMIB	1.3.6.1.2.1.153			This MIB module defines configuration objects for managing IPsec Security Policies. In general, this MIB can be implemented anywhere IPsec security services exist (e.g., bump-in-the-wire, host, gateway, firewall, router, etc.). Copyright (C) The IETF Trust (2007). This version of this MIB module is part of RFC 4807; see the RFC itself for full legal notices.
spdNotificationObjects	1.3.6.1.2.1.153.2
spdNotifications	1.3.6.1.2.1.153.2.0
spdNotificationVariables	1.3.6.1.2.1.153.2.1
IFD spdPacketDirection	1.3.6.1.2.1.153.2.1.8	IfDirection	accessible-for-notify	Indicates if the packet that triggered the action in questions was ingress (inbound) or egress (outbound).
NTF spdPacketNotification	1.3.6.1.2.1.153.2.0.2			Notification that a packet passed through a Security Association (SA). Only SAs created by actions with packet logging enabled will result in this notification getting sent. The objects sent MUST include the spdActionExecuted, which will indicate which action was executed within the scope of the rule. Additionally, the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress objects MUST be included to indicate the packet source and destination of the packet that triggered the action. The spdIPEndpointAddType, spdIPEndpointAddress, and spdPacketDirection objects are included to indicate which endpoint the packet was associated with. Finally, spdPacketPart is included to enable sending a variable sized part of the front of the packet with the size dependent on the value of the object of TC syntax 'SpdIPPacketLogging', which indicated that logging should be done. A spdPacketNotification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate. An action notification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate.
OCT spdPacketPart	1.3.6.1.2.1.153.2.1.9	OCTET STRING	accessible-for-notify	spdPacketPart is the front part of the full IP packet that triggered this notification. The initial size limit is determined by the smaller of the size, indicated by: I. The value of the object with the TC syntax 'SpdIPPacketLogging' that indicated the packet SHOULD be logged and II. The size of the triggering packet. The final limit is determined by the SNMP packet size when sending the notification. The maximum size that can be included will be the smaller of the initial size, given the above, and the length that will fit in a single SNMP notification packet after the rest of the notification's objects and any other necessary packet data (headers encoding, etc.) have been included in the packet.
NUM spdRuleDefAction	1.3.6.1.2.1.153.1.4.1.5	VariablePointer	read-create	This column points to the action to be taken. It MAY, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable ipsaSaPreconfiguredActionTable ipiaIkeActionTable ipiaIpsecActionTable It MAY also point to one of the scalar objects beneath spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error MUST be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
SPD spdRuleDefAdminStatus	1.3.6.1.2.1.153.1.4.1.6	SpdAdminStatus	read-create	Indicates whether the current rule definition is considered active. If the value is enabled, the rule MUST be evaluated when processing packets. If the value is disabled, the packet processing MUST continue as if this rule's filter had effectively failed.
STR spdRuleDefDescription	1.3.6.1.2.1.153.1.4.1.2	SnmpAdminString	read-create	A user defined string. This field MAY be used for administrative tracking purposes.
NUM spdRuleDefFilter	1.3.6.1.2.1.153.1.4.1.3	VariablePointer	read-create	spdRuleDefFilter points to a filter that is used to evaluate whether the action associated with this row is executed or not. The action will only execute if the filter referenced by this object evaluates to TRUE after first applying any negation required by the spdRuleDefFilterNegated object. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB. Implementations MAY choose to provide support for other filter tables or scalars as well: diffServMultiFieldClfrTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter If this column is set to a VariablePointer value, which references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
T/F spdRuleDefFilterNegated	1.3.6.1.2.1.153.1.4.1.4	TruthValue	read-create	spdRuleDefFilterNegated specifies whether or not the results of the filter referenced by the spdRuleDefFilter object is negated.
spdRuleDefinitionEntry	1.3.6.1.2.1.153.1.4.1		not-accessible	A row defining a particular rule definition. A rule definition binds a filter pointer to an action pointer.
spdRuleDefinitionGroup	1.3.6.1.2.1.153.3.2.4			This group is made up of objects from the IPsec Policy Rule Definition Table.
spdRuleDefinitionTable	1.3.6.1.2.1.153.1.4		not-accessible	This table defines a rule by associating a filter or a set of filters to an action to be executed.
TIM spdRuleDefLastChanged	1.3.6.1.2.1.153.1.4.1.7	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STR spdRuleDefName	1.3.6.1.2.1.153.1.4.1.1	SnmpAdminString	not-accessible	spdRuleDefName is the administratively assigned name of the rule referred to by the spdGroupContComponentName object.
ROW spdRuleDefRowStatus	1.3.6.1.2.1.153.1.4.1.9	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object MUST NOT be set to active until the containing conditions, filters, and actions have been defined. Once active, it MUST remain active until no active policyGroupContents entries are referencing it. A failed attempt to do so MUST return an inconsistentValue error.
STO spdRuleDefStorageType	1.3.6.1.2.1.153.1.4.1.8	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
spdRuleFilterFullCompliance	1.3.6.1.2.1.153.3.1.1			The compliance statement for SNMP entities that include an IPsec MIB implementation with Endpoint, Rules, and filters support. When this MIB is implemented with support for read-create, then such an implementation can claim full compliance. Such devices can then be both monitored and configured with this MIB.
spdRuleFilterReadOnlyCompliance	1.3.6.1.2.1.153.3.1.3			The compliance statement for SNMP entities that include an IPsec MIB implementation with Endpoint, Rules, and filters support. If this MIB is implemented without support for read-create (i.e., in read-only), it is not in full compliance, but it can claim read-only compliance. Such a device can then be monitored, but cannot be configured with this MIB.
spdStaticActionGroup	1.3.6.1.2.1.153.3.2.10			This group is made up of objects from the IPsec Policy Static Actions.
spdStaticActions	1.3.6.1.2.1.153.1.13
spdStaticFilterGroup	1.3.6.1.2.1.153.3.2.6			The static filter group. Currently this is just a true filter.
spdStaticFilters	1.3.6.1.2.1.153.1.7
spdSubactionsEntry	1.3.6.1.2.1.153.1.12.1		not-accessible	A row containing a reference to a given compound-action sub-action.
spdSubactionsTable	1.3.6.1.2.1.153.1.12		not-accessible	This table contains a list of the sub-actions within a given compound action. Compound actions executing these actions MUST execute them in series based on the spdSubActPriority value, with the lowest value executing first.
TIM spdSubActLastChanged	1.3.6.1.2.1.153.1.12.1.3	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
I32 spdSubActPriority	1.3.6.1.2.1.153.1.12.1.1	Integer32	not-accessible	The priority of a given sub-action within a compound action. The order in which sub-actions MUST be executed are based on the value from this column, with the lowest numeric value executing first (i.e., priority 0 before priority 1, 1 before 2, etc.).
ROW spdSubActRowStatus	1.3.6.1.2.1.153.1.12.1.5	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active unless one of the following two conditions are met. An attempt to set it to anything other than active while the following conditions are not met MUST result in an inconsistentValue error. The two conditions are: I. No active row in the spdCompoundActionTable exists which has a matching spdCompActName. II. Or, at least one other active row in this table has a matching spdCompActName.
STO spdSubActStorageType	1.3.6.1.2.1.153.1.12.1.4	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
NUM spdSubActSubActionName	1.3.6.1.2.1.153.1.12.1.2	VariablePointer	read-create	This column points to the action to be taken. It MAY, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable - Allowing recursion ipsaSaPreconfiguredActionTable ipiaIkeActionTable ipiaIpsecActionTable It MAY also point to one of the scalar objects beneath spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error MUST be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
spdSubfiltersEntry	1.3.6.1.2.1.153.1.6.1		not-accessible	An entry in the spdSubfiltersTable. There is an entry in this table for each sub-filter of all compound filters present in the spdCompoundFilterTable.
spdSubfiltersTable	1.3.6.1.2.1.153.1.6		not-accessible	This table defines a list of filters contained within a given compound filter defined in the spdCompoundFilterTable.
TIM spdSubFiltLastChanged	1.3.6.1.2.1.153.1.6.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
I32 spdSubFiltPriority	1.3.6.1.2.1.153.1.6.1.1	Integer32	not-accessible	The priority of a given filter within a compound filter. The order of execution is from lowest to highest priority value (i.e., priority 0 before priority 1, 1 before 2, etc.). Implementations MAY choose to follow this ordering, as set by the manager that created the rows. This can allow a manager to intelligently construct filter lists such that faster filters are evaluated first.
ROW spdSubFiltRowStatus	1.3.6.1.2.1.153.1.6.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object cannot be made active until a filter referenced by the spdSubFiltSubfilter object is both defined and active. An attempt to do so MUST result in an inconsistentValue error. If active, this object MUST remain active unless one of the following two conditions are met: I. No active row in the SpdCompoundFilterTable exists that has a matching spdCompFiltName. II. Or, at least one other active row in this table has a matching spdCompFiltName. If neither condition is met, an attempt to set this row to something other than active MUST result in an inconsistentValue error.
STO spdSubFiltStorageType	1.3.6.1.2.1.153.1.6.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
NUM spdSubFiltSubfilter	1.3.6.1.2.1.153.1.6.1.2	VariablePointer	read-create	The OID of the contained filter. The value of this object is a VariablePointer that references the filter to be included in this compound filter. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB. Implementations MAY choose to provide support for other filter tables or scalars as well: diffServMultiFieldClfrTable spdIpsoHeaderFilterTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter If this column is set to a VariablePointer value that references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
T/F spdSubFiltSubfilterIsNegated	1.3.6.1.2.1.153.1.6.1.3	TruthValue	read-create	Indicates whether or not the result of applying this sub-filter is negated.
OCT spdTimeFiltDayOfMonthMask	1.3.6.1.2.1.153.1.9.1.4	OCTET STRING	read-create	Defines which days of the month the current time is valid for. It is a sequence of 64 BITS, where each BIT represents a corresponding day of the month in forward or reverse order. Starting from the left-most bit, the first 31 bits identify the day of the month, counting from the beginning of the month. The following 31 bits (bits 32-62) indicate the day of the month, counting from the end of the month. For months with fewer than 31 days, the bits that correspond to the non-existent days of that month are ignored (e.g., for non-leap year Februarys, bits 29-31 and 60-62 are ignored). This column evaluates to 'true' if the current day of the month's bit is set. For example, a value of 0X'80 00 00 01 00 00 00 00' indicates that this column evaluates to true on the first and last days of the month. The last two bits in the string MUST be zero.
BIT spdTimeFiltDayOfWeekMask	1.3.6.1.2.1.153.1.9.1.5	Bits	read-create	A bit mask that defines which days of the week that the current time is valid for. This column evaluates to 'true' if the current day of the week's bit is set.
spdTimeFilterEntry	1.3.6.1.2.1.153.1.9.1		not-accessible	A row describing a given time frame for which a policy is filtered on to activate or deactivate the rule. If all the column objects in a row are true for the current time, the row evaluates as 'true'. More explicitly, the time matching column objects in a row MUST be logically ANDed together to form the boolean true/false for the row.
spdTimeFilterGroup	1.3.6.1.2.1.153.3.2.8			This group is made up of objects from the IPsec Policy Time Filter Table.
spdTimeFilterTable	1.3.6.1.2.1.153.1.9		not-accessible	Defines a table of filters that can be used to effectively enable or disable policies based on a valid time range.
TIM spdTimeFiltLastChanged	1.3.6.1.2.1.153.1.9.1.7	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
BIT spdTimeFiltMonthOfYearMask	1.3.6.1.2.1.153.1.9.1.3	Bits	read-create	A bit mask that indicates acceptable months of the year. This column evaluates to 'true' if the current month's bit is set.
STR spdTimeFiltName	1.3.6.1.2.1.153.1.9.1.1	SnmpAdminString	not-accessible	An administratively assigned name for this filter.
SPD spdTimeFiltPeriod	1.3.6.1.2.1.153.1.9.1.2	SpdTimePeriod	read-create	The valid time period for this filter. This column is considered 'true' if the current time is within the range of this object.
ROW spdTimeFiltRowStatus	1.3.6.1.2.1.153.1.9.1.9	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
STO spdTimeFiltStorageType	1.3.6.1.2.1.153.1.9.1.8	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
SPD spdTimeFiltTimeOfDayMask	1.3.6.1.2.1.153.1.9.1.6	SpdTimePeriod	read-create	Indicates the start and end time of the day for which this filter evaluates to true. The date portions of the spdTimePeriod TC are ignored for purposes of evaluating this mask, and only the time-specific portions are used. This column evaluates to 'true' if the current time of day is within the range of the start and end times of the day indicated by this object.
I32 spdTrueFilter	1.3.6.1.2.1.153.1.7.1	Integer32	read-only	This scalar indicates a (automatic) true result for a filter. That is, this is a filter that is always true; it is useful for adding as a default filter for a default action or a set of actions.
spdTrueFilterInstance	1.3.6.1.2.1.153.1.7.1.0

OID symbolic	OID numeric	Type	Access	Description
spdMIB	1.3.6.1.2.1.153			This MIB module defines configuration objects for managing IPsec Security Policies. In general, this MIB can be implemented anywhere IPsec security services exist (e.g., bump-in-the-wire, host, gateway, firewall, router, etc.). Copyright (C) The IETF Trust (2007). This version of this MIB module is part of RFC 4807; see the RFC itself for full legal notices.
spdConfigObjects	1.3.6.1.2.1.153.1
spdLocalConfigObjects	1.3.6.1.2.1.153.1.1
STR spdIngressPolicyGroupName	1.3.6.1.2.1.153.1.1.1	SnmpAdminString	read-write	This object indicates the global system policy group that is to be applied on ingress packets (i.e., arriving at an interface from a network) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates that no system-wide policy exists and the default policy of 'drop' SHOULD be executed for ingress packets until one is imposed by either this object or by the endpoint processing a given packet. This object MUST be persistent
STR spdEgressPolicyGroupName	1.3.6.1.2.1.153.1.1.2	SnmpAdminString	read-write	This object indicates the policy group containing the global system policy that is to be applied on egress packets (i.e., packets leaving an interface and entering a network) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates that no system-wide policy exists and the default policy of 'drop' SHOULD be executed for egress packets until one is imposed by either this object or by the endpoint processing a given packet. This object MUST be persistent
spdEndpointToGroupTable	1.3.6.1.2.1.153.1.2		not-accessible	This table maps policies (groupings) onto an endpoint (interface). A policy group assigned to an endpoint is then used to control access to the network traffic passing through that endpoint. If an endpoint has been configured with a policy group and no rule within that policy group matches that packet, the default action in this case SHALL be to drop the packet. If no policy group has been assigned to an endpoint, then the policy group specified by spdIngressPolicyGroupName MUST be used on traffic inbound from the network through that endpoint, and the policy group specified by spdEgressPolicyGroupName MUST be used for traffic outbound to the network through that endpoint.
spdEndpointToGroupEntry	1.3.6.1.2.1.153.1.2.1		not-accessible	A mapping assigning a policy group to an endpoint.
IFD spdEndGroupDirection	1.3.6.1.2.1.153.1.2.1.1	IfDirection	not-accessible	This object indicates which direction of packets crossing the interface are associated with which spdEndGroupName object. Ingress packets, or packets into the device match when this value is inbound(1). Egress packets or packets out of the device match when this value is outbound(2).
NUM spdEndGroupInterface	1.3.6.1.2.1.153.1.2.1.2	InterfaceIndex	not-accessible	This value matches the IF-MIB's ifTable's ifIndex column and indicates the interface associated with a given endpoint. This object can be used to uniquely identify an endpoint that a set of policy groups are applied to.
STR spdEndGroupName	1.3.6.1.2.1.153.1.2.1.3	SnmpAdminString	read-create	The policy group name to apply at this endpoint. The value of the spdEndGroupName object is then used as an index into the spdGroupContentsTable to come up with a list of rules that MUST be applied at this endpoint.
TIM spdEndGroupLastChanged	1.3.6.1.2.1.153.1.2.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdEndGroupStorageType	1.3.6.1.2.1.153.1.2.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdEndGroupRowStatus	1.3.6.1.2.1.153.1.2.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object is considered 'notReady' and MUST NOT be set to active until one or more active rows exist within the spdGroupContentsTable for the group referenced by the spdEndGroupName object.
spdGroupContentsTable	1.3.6.1.2.1.153.1.3		not-accessible	This table contains a list of rules and/or subgroups contained within a given policy group. For a given value of spdGroupContName, the set of rows sharing that value forms a 'group'. The rows in a group MUST be processed according to the value of the spdGroupContPriority object in each row. The processing MUST be executed starting with the lowest value of spdGroupContPriority and in ascending order thereafter. If an action is executed as the result of the processing of a row in a group, the processing of further rows in that group MUST stop. Iterating to the next policy group row by finding the next largest spdGroupContPriority object SHALL only be done if no actions were run while processing the current row for a given packet.
spdGroupContentsEntry	1.3.6.1.2.1.153.1.3.1		not-accessible	Defines a given sub-component within a policy group. A sub-component is either a rule or another group as indicated by spdGroupContComponentType and referenced by spdGroupContComponentName.
STR spdGroupContName	1.3.6.1.2.1.153.1.3.1.1	SnmpAdminString	not-accessible	The administrative name of the group associated with this row. A 'group' is formed by all the rows in this table that have the same value of this object.
I32 spdGroupContPriority	1.3.6.1.2.1.153.1.3.1.2	Integer32	not-accessible	The priority (sequence number) of the sub-component in a group that this row represents. This value indicates the order that each row of this table MUST be processed from low to high. For example, a row with a priority of 0 is processed before a row with a priority of 1, a 1 before a 2, etc.
NUM spdGroupContFilter	1.3.6.1.2.1.153.1.3.1.3	VariablePointer	read-create	spdGroupContFilter points to a filter that is evaluated to determine whether the spdGroupContComponentName within this row is exercised. Managers can use this object to classify groups of rules, or subgroups, together in order to achieve a greater degree of control and optimization over the execution order of the items within the group. If the filter evaluates to false, the rule or subgroup will be skipped and the next rule or subgroup will be evaluated instead. This value can be used to indicate a scalar or row in a table. When indicating a row in a table, this value MUST point to the first column instance in that row. An example usage of this object would be to limit a group of rules to executing only when the IP packet being processed is designated to be processed by IKE. This effectively creates a group of IKE-specific rules. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB: diffServMultiFieldClfrTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter spdIpsoHeaderFilterTable Implementations MAY choose to provide support for other filter tables or scalars. If this column is set to a VariablePointer value, which references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, a row in this table is applied to a packet and the value of this column in that row references a non-existent or non-supported object, the packet MUST be dropped.
INT spdGroupContComponentType	1.3.6.1.2.1.153.1.3.1.4	INTEGER	read-create	Indicates whether the spdGroupContComponentName object is the name of another group defined within the spdGroupContentsTable or is the name of a rule defined within the spdRuleDefinitionTable.
STR spdGroupContComponentName	1.3.6.1.2.1.153.1.3.1.5	SnmpAdminString	read-create	The name of the policy rule or subgroup contained within this row, as indicated by the spdGroupContComponentType object.
TIM spdGroupContLastChanged	1.3.6.1.2.1.153.1.3.1.6	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdGroupContStorageType	1.3.6.1.2.1.153.1.3.1.7	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdGroupContRowStatus	1.3.6.1.2.1.153.1.3.1.8	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object MUST NOT be set to active until the row to which the spdGroupContComponentName points to exists and is active. If active, this object MUST remain active unless one of the following two conditions are met: I. No active row in spdEndpointToGroupTable exists that references this row's group (i.e., indicate this row's spdGroupContName). II. Or at least one other active row in this table has a matching spdGroupContName. If neither condition is met, an attempt to set this row to something other than active MUST result in an inconsistentValue error.
spdRuleDefinitionTable	1.3.6.1.2.1.153.1.4		not-accessible	This table defines a rule by associating a filter or a set of filters to an action to be executed.
spdRuleDefinitionEntry	1.3.6.1.2.1.153.1.4.1		not-accessible	A row defining a particular rule definition. A rule definition binds a filter pointer to an action pointer.
STR spdRuleDefName	1.3.6.1.2.1.153.1.4.1.1	SnmpAdminString	not-accessible	spdRuleDefName is the administratively assigned name of the rule referred to by the spdGroupContComponentName object.
STR spdRuleDefDescription	1.3.6.1.2.1.153.1.4.1.2	SnmpAdminString	read-create	A user defined string. This field MAY be used for administrative tracking purposes.
NUM spdRuleDefFilter	1.3.6.1.2.1.153.1.4.1.3	VariablePointer	read-create	spdRuleDefFilter points to a filter that is used to evaluate whether the action associated with this row is executed or not. The action will only execute if the filter referenced by this object evaluates to TRUE after first applying any negation required by the spdRuleDefFilterNegated object. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB. Implementations MAY choose to provide support for other filter tables or scalars as well: diffServMultiFieldClfrTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter If this column is set to a VariablePointer value, which references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
T/F spdRuleDefFilterNegated	1.3.6.1.2.1.153.1.4.1.4	TruthValue	read-create	spdRuleDefFilterNegated specifies whether or not the results of the filter referenced by the spdRuleDefFilter object is negated.
NUM spdRuleDefAction	1.3.6.1.2.1.153.1.4.1.5	VariablePointer	read-create	This column points to the action to be taken. It MAY, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable ipsaSaPreconfiguredActionTable ipiaIkeActionTable ipiaIpsecActionTable It MAY also point to one of the scalar objects beneath spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error MUST be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
SPD spdRuleDefAdminStatus	1.3.6.1.2.1.153.1.4.1.6	SpdAdminStatus	read-create	Indicates whether the current rule definition is considered active. If the value is enabled, the rule MUST be evaluated when processing packets. If the value is disabled, the packet processing MUST continue as if this rule's filter had effectively failed.
TIM spdRuleDefLastChanged	1.3.6.1.2.1.153.1.4.1.7	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdRuleDefStorageType	1.3.6.1.2.1.153.1.4.1.8	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdRuleDefRowStatus	1.3.6.1.2.1.153.1.4.1.9	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object MUST NOT be set to active until the containing conditions, filters, and actions have been defined. Once active, it MUST remain active until no active policyGroupContents entries are referencing it. A failed attempt to do so MUST return an inconsistentValue error.
spdCompoundFilterTable	1.3.6.1.2.1.153.1.5		not-accessible	A table defining compound filters and their associated parameters. A row in this table can be pointed to by a spdRuleDefFilter object.
spdCompoundFilterEntry	1.3.6.1.2.1.153.1.5.1		not-accessible	An entry in the spdCompoundFilterTable. Each entry in this table represents a compound filter. A filter defined by this table is considered to have a TRUE return value if and only if: spdCompFiltLogicType is AND and all of the sub-filters associated with it, as defined in the spdSubfiltersTable, are all true themselves (after applying any required negation, as defined by the ficFilterIsNegated object). spdCompFiltLogicType is OR and at least one of the sub-filters associated with it, as defined in the spdSubfiltersTable, is true itself (after applying any required negation, as defined by the ficFilterIsNegated object.
STR spdCompFiltName	1.3.6.1.2.1.153.1.5.1.1	SnmpAdminString	not-accessible	A user definable string. This value is used as an index into this table.
STR spdCompFiltDescription	1.3.6.1.2.1.153.1.5.1.2	SnmpAdminString	read-create	A user definable string. This field MAY be used for your administrative tracking purposes.
SPD spdCompFiltLogicType	1.3.6.1.2.1.153.1.5.1.3	SpdBooleanOperator	read-create	Indicates whether the sub-component filters of this compound filter are functionally ANDed or ORed together.
TIM spdCompFiltLastChanged	1.3.6.1.2.1.153.1.5.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdCompFiltStorageType	1.3.6.1.2.1.153.1.5.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdCompFiltRowStatus	1.3.6.1.2.1.153.1.5.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once active, it MUST NOT have its value changed if any active rows in the spdRuleDefinitionTable are currently pointing at this row.
spdSubfiltersTable	1.3.6.1.2.1.153.1.6		not-accessible	This table defines a list of filters contained within a given compound filter defined in the spdCompoundFilterTable.
spdSubfiltersEntry	1.3.6.1.2.1.153.1.6.1		not-accessible	An entry in the spdSubfiltersTable. There is an entry in this table for each sub-filter of all compound filters present in the spdCompoundFilterTable.
I32 spdSubFiltPriority	1.3.6.1.2.1.153.1.6.1.1	Integer32	not-accessible	The priority of a given filter within a compound filter. The order of execution is from lowest to highest priority value (i.e., priority 0 before priority 1, 1 before 2, etc.). Implementations MAY choose to follow this ordering, as set by the manager that created the rows. This can allow a manager to intelligently construct filter lists such that faster filters are evaluated first.
NUM spdSubFiltSubfilter	1.3.6.1.2.1.153.1.6.1.2	VariablePointer	read-create	The OID of the contained filter. The value of this object is a VariablePointer that references the filter to be included in this compound filter. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB. Implementations MAY choose to provide support for other filter tables or scalars as well: diffServMultiFieldClfrTable spdIpsoHeaderFilterTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter If this column is set to a VariablePointer value that references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
T/F spdSubFiltSubfilterIsNegated	1.3.6.1.2.1.153.1.6.1.3	TruthValue	read-create	Indicates whether or not the result of applying this sub-filter is negated.
TIM spdSubFiltLastChanged	1.3.6.1.2.1.153.1.6.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdSubFiltStorageType	1.3.6.1.2.1.153.1.6.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdSubFiltRowStatus	1.3.6.1.2.1.153.1.6.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object cannot be made active until a filter referenced by the spdSubFiltSubfilter object is both defined and active. An attempt to do so MUST result in an inconsistentValue error. If active, this object MUST remain active unless one of the following two conditions are met: I. No active row in the SpdCompoundFilterTable exists that has a matching spdCompFiltName. II. Or, at least one other active row in this table has a matching spdCompFiltName. If neither condition is met, an attempt to set this row to something other than active MUST result in an inconsistentValue error.
spdStaticFilters	1.3.6.1.2.1.153.1.7
I32 spdTrueFilter	1.3.6.1.2.1.153.1.7.1	Integer32	read-only	This scalar indicates a (automatic) true result for a filter. That is, this is a filter that is always true; it is useful for adding as a default filter for a default action or a set of actions.
spdTrueFilterInstance	1.3.6.1.2.1.153.1.7.1.0
spdIpOffsetFilterTable	1.3.6.1.2.1.153.1.8		not-accessible	This table contains a list of filter definitions to be used within the spdRuleDefinitionTable or the spdSubfiltersTable. This type of filter is used to compare an administrator specified octet string to the octets at a particular location in a packet.
spdIpOffsetFilterEntry	1.3.6.1.2.1.153.1.8.1		not-accessible	A definition of a particular filter.
STR spdIpOffFiltName	1.3.6.1.2.1.153.1.8.1.1	SnmpAdminString	not-accessible	The administrative name for this filter.
U32 spdIpOffFiltOffset	1.3.6.1.2.1.153.1.8.1.2	Unsigned32	read-create	This is the byte offset from the front of the entire IP packet where the value or arithmetic comparison is done. A value of '0' indicates the first byte of the packet header. If this value is greater than the length of the packet, the filter represented by this row should be considered to fail.
INT spdIpOffFiltType	1.3.6.1.2.1.153.1.8.1.3	INTEGER	read-create	This defines the various tests that are used when evaluating a given filter. The various tests definable in this table are as follows: equal: - Tests if the OCTET STRING, 'spdIpOffFiltValue', matches a value in the packet starting at the given offset in the packet and comparing the entire OCTET STRING of 'spdIpOffFiltValue'. Any values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. notEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', does not match a value in the packet starting at the given offset in the packet and comparing to the entire OCTET STRING of 'spdIpOffFiltValue'. Any values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticLess: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than ('=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticGreater: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically greater than ('>') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticLessOrEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than or equal to ('<=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'.
OCT spdIpOffFiltValue	1.3.6.1.2.1.153.1.8.1.4	OCTET STRING	read-create	spdIpOffFiltValue is used for match comparisons of a packet at spdIpOffFiltOffset.
TIM spdIpOffFiltLastChanged	1.3.6.1.2.1.153.1.8.1.5	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdIpOffFiltStorageType	1.3.6.1.2.1.153.1.8.1.6	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdIpOffFiltRowStatus	1.3.6.1.2.1.153.1.8.1.7	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
spdTimeFilterTable	1.3.6.1.2.1.153.1.9		not-accessible	Defines a table of filters that can be used to effectively enable or disable policies based on a valid time range.
spdTimeFilterEntry	1.3.6.1.2.1.153.1.9.1		not-accessible	A row describing a given time frame for which a policy is filtered on to activate or deactivate the rule. If all the column objects in a row are true for the current time, the row evaluates as 'true'. More explicitly, the time matching column objects in a row MUST be logically ANDed together to form the boolean true/false for the row.
STR spdTimeFiltName	1.3.6.1.2.1.153.1.9.1.1	SnmpAdminString	not-accessible	An administratively assigned name for this filter.
SPD spdTimeFiltPeriod	1.3.6.1.2.1.153.1.9.1.2	SpdTimePeriod	read-create	The valid time period for this filter. This column is considered 'true' if the current time is within the range of this object.
BIT spdTimeFiltMonthOfYearMask	1.3.6.1.2.1.153.1.9.1.3	Bits	read-create	A bit mask that indicates acceptable months of the year. This column evaluates to 'true' if the current month's bit is set.
OCT spdTimeFiltDayOfMonthMask	1.3.6.1.2.1.153.1.9.1.4	OCTET STRING	read-create	Defines which days of the month the current time is valid for. It is a sequence of 64 BITS, where each BIT represents a corresponding day of the month in forward or reverse order. Starting from the left-most bit, the first 31 bits identify the day of the month, counting from the beginning of the month. The following 31 bits (bits 32-62) indicate the day of the month, counting from the end of the month. For months with fewer than 31 days, the bits that correspond to the non-existent days of that month are ignored (e.g., for non-leap year Februarys, bits 29-31 and 60-62 are ignored). This column evaluates to 'true' if the current day of the month's bit is set. For example, a value of 0X'80 00 00 01 00 00 00 00' indicates that this column evaluates to true on the first and last days of the month. The last two bits in the string MUST be zero.
BIT spdTimeFiltDayOfWeekMask	1.3.6.1.2.1.153.1.9.1.5	Bits	read-create	A bit mask that defines which days of the week that the current time is valid for. This column evaluates to 'true' if the current day of the week's bit is set.
SPD spdTimeFiltTimeOfDayMask	1.3.6.1.2.1.153.1.9.1.6	SpdTimePeriod	read-create	Indicates the start and end time of the day for which this filter evaluates to true. The date portions of the spdTimePeriod TC are ignored for purposes of evaluating this mask, and only the time-specific portions are used. This column evaluates to 'true' if the current time of day is within the range of the start and end times of the day indicated by this object.
TIM spdTimeFiltLastChanged	1.3.6.1.2.1.153.1.9.1.7	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdTimeFiltStorageType	1.3.6.1.2.1.153.1.9.1.8	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdTimeFiltRowStatus	1.3.6.1.2.1.153.1.9.1.9	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
spdIpsoHeaderFilterTable	1.3.6.1.2.1.153.1.10		not-accessible	This table contains a list of IPSO header filter definitions to be used within the spdRuleDefinitionTable or the spdSubfiltersTable. IPSO headers and their values are described in RFC 1108.
spdIpsoHeaderFilterEntry	1.3.6.1.2.1.153.1.10.1		not-accessible	A definition of a particular filter.
STR spdIpsoHeadFiltName	1.3.6.1.2.1.153.1.10.1.1	SnmpAdminString	not-accessible	The administrative name for this filter.
BIT spdIpsoHeadFiltType	1.3.6.1.2.1.153.1.10.1.2	Bits	read-create	This object indicates which of the IPSO header field a packet is filtered on for this row. If this object is set to classification(0), the spdIpsoHeadFiltClassification object indicates how the packet is filtered. If this object is set to protectionAuthority(1), the spdIpsoHeadFiltProtectionAuth object indicates how the packet is filtered.
INT spdIpsoHeadFiltClassification	1.3.6.1.2.1.153.1.10.1.3	INTEGER	read-create	This object indicates the IPSO classification header field value that the packet MUST have for this row to evaluate to 'true'. The values of these enumerations are defined by RFC 1108.
INT spdIpsoHeadFiltProtectionAuth	1.3.6.1.2.1.153.1.10.1.4	INTEGER	read-create	This object indicates the IPSO protection authority header field value that the packet MUST have for this row to evaluate to 'true'. The values of these enumerations are defined by RFC 1108. Hence the reason the SMIv2 convention of not using 0 in enumerated lists is violated here.
TIM spdIpsoHeadFiltLastChanged	1.3.6.1.2.1.153.1.10.1.5	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdIpsoHeadFiltStorageType	1.3.6.1.2.1.153.1.10.1.6	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdIpsoHeadFiltRowStatus	1.3.6.1.2.1.153.1.10.1.7	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. However, this object MUST NOT be set to active if the requirements of the spdIpsoHeadFiltType object are not met. Specifically, if the spdIpsoHeadFiltType bit for classification(0) is set, the spdIpsoHeadFiltClassification column MUST have a valid value for the row status to be set to active. If the spdIpsoHeadFiltType bit for protectionAuthority(1) is set, the spdIpsoHeadFiltProtectionAuth column MUST have a valid value for the row status to be set to active. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
spdCompoundActionTable	1.3.6.1.2.1.153.1.11		not-accessible	Table used to allow multiple actions to be associated with a rule. It uses the spdSubactionsTable to do this. The rows from spdSubactionsTable that are partially indexed by spdCompActName form the set of compound actions to be performed. The spdCompActExecutionStrategy column in this table indicates how those actions are processed.
spdCompoundActionEntry	1.3.6.1.2.1.153.1.11.1		not-accessible	A row in the spdCompoundActionTable.
STR spdCompActName	1.3.6.1.2.1.153.1.11.1.1	SnmpAdminString	not-accessible	This is an administratively assigned name of this compound action.
INT spdCompActExecutionStrategy	1.3.6.1.2.1.153.1.11.1.2	INTEGER	read-create	This object indicates how the sub-actions are executed based on the success of the actions as they finish executing. doAll - run each sub-action regardless of the exit status of the previous action. This parent action is always considered to have acted successfully. doUntilSuccess - run each sub-action until one succeeds, at which point stop processing the sub-actions within this parent compound action. If one of the sub-actions did execute successfully, this parent action is also considered to have executed successfully. doUntilFailure - run each sub-action until one fails, at which point stop processing the sub-actions within this compound action. If any sub-action fails, the result of this parent action is considered to have failed.
TIM spdCompActLastChanged	1.3.6.1.2.1.153.1.11.1.3	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdCompActStorageType	1.3.6.1.2.1.153.1.11.1.4	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdCompActRowStatus	1.3.6.1.2.1.153.1.11.1.5	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once a row in the spdCompoundActionTable has been made active, this object MUST NOT be set to destroy without first destroying all the contained rows listed in the spdSubactionsTable.
spdSubactionsTable	1.3.6.1.2.1.153.1.12		not-accessible	This table contains a list of the sub-actions within a given compound action. Compound actions executing these actions MUST execute them in series based on the spdSubActPriority value, with the lowest value executing first.
spdSubactionsEntry	1.3.6.1.2.1.153.1.12.1		not-accessible	A row containing a reference to a given compound-action sub-action.
I32 spdSubActPriority	1.3.6.1.2.1.153.1.12.1.1	Integer32	not-accessible	The priority of a given sub-action within a compound action. The order in which sub-actions MUST be executed are based on the value from this column, with the lowest numeric value executing first (i.e., priority 0 before priority 1, 1 before 2, etc.).
NUM spdSubActSubActionName	1.3.6.1.2.1.153.1.12.1.2	VariablePointer	read-create	This column points to the action to be taken. It MAY, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable - Allowing recursion ipsaSaPreconfiguredActionTable ipiaIkeActionTable ipiaIpsecActionTable It MAY also point to one of the scalar objects beneath spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error MUST be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
TIM spdSubActLastChanged	1.3.6.1.2.1.153.1.12.1.3	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
STO spdSubActStorageType	1.3.6.1.2.1.153.1.12.1.4	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
ROW spdSubActRowStatus	1.3.6.1.2.1.153.1.12.1.5	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active unless one of the following two conditions are met. An attempt to set it to anything other than active while the following conditions are not met MUST result in an inconsistentValue error. The two conditions are: I. No active row in the spdCompoundActionTable exists which has a matching spdCompActName. II. Or, at least one other active row in this table has a matching spdCompActName.
spdStaticActions	1.3.6.1.2.1.153.1.13
I32 spdDropAction	1.3.6.1.2.1.153.1.13.1	Integer32	read-only	This scalar indicates that a packet MUST be dropped and SHOULD NOT have action/packet logging.
I32 spdDropActionLog	1.3.6.1.2.1.153.1.13.2	Integer32	read-only	This scalar indicates that a packet MUST be dropped and SHOULD have action/packet logging.
I32 spdAcceptAction	1.3.6.1.2.1.153.1.13.3	Integer32	read-only	This Scalar indicates that a packet MUST be accepted (pass-through) and SHOULD NOT have action/packet logging.
I32 spdAcceptActionLog	1.3.6.1.2.1.153.1.13.4	Integer32	read-only	This scalar indicates that a packet MUST be accepted (pass-through) and SHOULD have action/packet logging.
spdNotificationObjects	1.3.6.1.2.1.153.2
spdNotifications	1.3.6.1.2.1.153.2.0
NTF spdActionNotification	1.3.6.1.2.1.153.2.0.1			Notification that an action was executed by a rule. Only actions with logging enabled will result in this notification getting sent. The object includes the spdActionExecuted object, which will indicate which action was executed within the scope of the rule. Additionally, the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress objects are included to indicate the packet source and destination of the packet that triggered the action. Finally, the spdIPEndpointAddType, spdIPEndpointAddress, and spdPacketDirection objects indicate which interface the executed action was associated with, and if the packet was ingress or egress through the endpoint. A spdActionNotification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate. Note that compound actions with multiple executed sub-actions may result in multiple notifications being sent from a single rule execution.
NTF spdPacketNotification	1.3.6.1.2.1.153.2.0.2			Notification that a packet passed through a Security Association (SA). Only SAs created by actions with packet logging enabled will result in this notification getting sent. The objects sent MUST include the spdActionExecuted, which will indicate which action was executed within the scope of the rule. Additionally, the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress objects MUST be included to indicate the packet source and destination of the packet that triggered the action. The spdIPEndpointAddType, spdIPEndpointAddress, and spdPacketDirection objects are included to indicate which endpoint the packet was associated with. Finally, spdPacketPart is included to enable sending a variable sized part of the front of the packet with the size dependent on the value of the object of TC syntax 'SpdIPPacketLogging', which indicated that logging should be done. A spdPacketNotification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate. An action notification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate.
spdNotificationVariables	1.3.6.1.2.1.153.2.1
NUM spdActionExecuted	1.3.6.1.2.1.153.2.1.1	VariablePointer	accessible-for-notify	Points to the action instance that was executed that resulted in the notification being sent.
IPt spdIPEndpointAddType	1.3.6.1.2.1.153.2.1.2	InetAddressType	accessible-for-notify	Contains the address type for the interface that the notification triggering packet is passing through.
IP spdIPEndpointAddress	1.3.6.1.2.1.153.2.1.3	InetAddress	accessible-for-notify	Contains the interface address for the interface that the notification triggering packet is passing through. The format of this object is specified by the spdIPEndpointAddType object.
IPt spdIPSourceType	1.3.6.1.2.1.153.2.1.4	InetAddressType	accessible-for-notify	Contains the source address type of the packet that triggered the notification.
IP spdIPSourceAddress	1.3.6.1.2.1.153.2.1.5	InetAddress	accessible-for-notify	Contains the source address of the packet that triggered the notification. The format of this object is specified by the spdIPSourceType object.
IPt spdIPDestinationType	1.3.6.1.2.1.153.2.1.6	InetAddressType	accessible-for-notify	Contains the destination address type of the packet that triggered the notification.
IP spdIPDestinationAddress	1.3.6.1.2.1.153.2.1.7	InetAddress	accessible-for-notify	Contains the destination address of the packet that triggered the notification. The format of this object is specified by the spdIPDestinationType object.
IFD spdPacketDirection	1.3.6.1.2.1.153.2.1.8	IfDirection	accessible-for-notify	Indicates if the packet that triggered the action in questions was ingress (inbound) or egress (outbound).
OCT spdPacketPart	1.3.6.1.2.1.153.2.1.9	OCTET STRING	accessible-for-notify	spdPacketPart is the front part of the full IP packet that triggered this notification. The initial size limit is determined by the smaller of the size, indicated by: I. The value of the object with the TC syntax 'SpdIPPacketLogging' that indicated the packet SHOULD be logged and II. The size of the triggering packet. The final limit is determined by the SNMP packet size when sending the notification. The maximum size that can be included will be the smaller of the initial size, given the above, and the length that will fit in a single SNMP notification packet after the rest of the notification's objects and any other necessary packet data (headers encoding, etc.) have been included in the packet.
spdConformanceObjects	1.3.6.1.2.1.153.3
spdCompliances	1.3.6.1.2.1.153.3.1
spdRuleFilterFullCompliance	1.3.6.1.2.1.153.3.1.1			The compliance statement for SNMP entities that include an IPsec MIB implementation with Endpoint, Rules, and filters support. When this MIB is implemented with support for read-create, then such an implementation can claim full compliance. Such devices can then be both monitored and configured with this MIB.
spdLoggingCompliance	1.3.6.1.2.1.153.3.1.2			The compliance statement for SNMP entities that support sending notifications when actions are invoked.
spdRuleFilterReadOnlyCompliance	1.3.6.1.2.1.153.3.1.3			The compliance statement for SNMP entities that include an IPsec MIB implementation with Endpoint, Rules, and filters support. If this MIB is implemented without support for read-create (i.e., in read-only), it is not in full compliance, but it can claim read-only compliance. Such a device can then be monitored, but cannot be configured with this MIB.
spdGroups	1.3.6.1.2.1.153.3.2
spdEndpointGroup	1.3.6.1.2.1.153.3.2.1			This group is made up of objects from the IPsec Policy Endpoint Table.
spdGroupContentsGroup	1.3.6.1.2.1.153.3.2.2			This group is made up of objects from the IPsec Policy Group Contents Table.
spdIpsecSystemPolicyNameGroup	1.3.6.1.2.1.153.3.2.3			This group is made up of objects represent the System Policy Group Names.
spdRuleDefinitionGroup	1.3.6.1.2.1.153.3.2.4			This group is made up of objects from the IPsec Policy Rule Definition Table.
spdCompoundFilterGroup	1.3.6.1.2.1.153.3.2.5			This group is made up of objects from the IPsec Policy Compound Filter Table and Sub-Filter Table Group.
spdStaticFilterGroup	1.3.6.1.2.1.153.3.2.6			The static filter group. Currently this is just a true filter.
spdIPOffsetFilterGroup	1.3.6.1.2.1.153.3.2.7			This group is made up of objects from the IPsec Policy IP Offset Filter Table.
spdTimeFilterGroup	1.3.6.1.2.1.153.3.2.8			This group is made up of objects from the IPsec Policy Time Filter Table.
spdIpsoHeaderFilterGroup	1.3.6.1.2.1.153.3.2.9			This group is made up of objects from the IPsec Policy IPSO Header Filter Table.
spdStaticActionGroup	1.3.6.1.2.1.153.3.2.10			This group is made up of objects from the IPsec Policy Static Actions.
spdCompoundActionGroup	1.3.6.1.2.1.153.3.2.11			The IPsec Policy Compound Action Table and Actions In Compound Action Table Group.
spdActionLoggingObjectGroup	1.3.6.1.2.1.153.3.2.12			This group is made up of all the Notification objects for this MIB.
spdActionNotificationGroup	1.3.6.1.2.1.153.3.2.13			This group is made up of all the Notifications for this MIB.
spdActions	1.3.6.1.2.1.153.4

Bits (3)
BIT spdIpsoHeadFiltType	1.3.6.1.2.1.153.1.10.1.2	Bits	read-create	This object indicates which of the IPSO header field a packet is filtered on for this row. If this object is set to classification(0), the spdIpsoHeadFiltClassification object indicates how the packet is filtered. If this object is set to protectionAuthority(1), the spdIpsoHeadFiltProtectionAuth object indicates how the packet is filtered.
BIT spdTimeFiltDayOfWeekMask	1.3.6.1.2.1.153.1.9.1.5	Bits	read-create	A bit mask that defines which days of the week that the current time is valid for. This column evaluates to 'true' if the current day of the week's bit is set.
BIT spdTimeFiltMonthOfYearMask	1.3.6.1.2.1.153.1.9.1.3	Bits	read-create	A bit mask that indicates acceptable months of the year. This column evaluates to 'true' if the current month's bit is set.
IfDirection (2)
IFD spdEndGroupDirection	1.3.6.1.2.1.153.1.2.1.1	IfDirection	not-accessible	This object indicates which direction of packets crossing the interface are associated with which spdEndGroupName object. Ingress packets, or packets into the device match when this value is inbound(1). Egress packets or packets out of the device match when this value is outbound(2).
IFD spdPacketDirection	1.3.6.1.2.1.153.2.1.8	IfDirection	accessible-for-notify	Indicates if the packet that triggered the action in questions was ingress (inbound) or egress (outbound).
InetAddress (3)
IP spdIPDestinationAddress	1.3.6.1.2.1.153.2.1.7	InetAddress	accessible-for-notify	Contains the destination address of the packet that triggered the notification. The format of this object is specified by the spdIPDestinationType object.
IP spdIPEndpointAddress	1.3.6.1.2.1.153.2.1.3	InetAddress	accessible-for-notify	Contains the interface address for the interface that the notification triggering packet is passing through. The format of this object is specified by the spdIPEndpointAddType object.
IP spdIPSourceAddress	1.3.6.1.2.1.153.2.1.5	InetAddress	accessible-for-notify	Contains the source address of the packet that triggered the notification. The format of this object is specified by the spdIPSourceType object.
InetAddressType (3)
IPt spdIPDestinationType	1.3.6.1.2.1.153.2.1.6	InetAddressType	accessible-for-notify	Contains the destination address type of the packet that triggered the notification.
IPt spdIPEndpointAddType	1.3.6.1.2.1.153.2.1.2	InetAddressType	accessible-for-notify	Contains the address type for the interface that the notification triggering packet is passing through.
IPt spdIPSourceType	1.3.6.1.2.1.153.2.1.4	InetAddressType	accessible-for-notify	Contains the source address type of the packet that triggered the notification.
INTEGER (5)
INT spdCompActExecutionStrategy	1.3.6.1.2.1.153.1.11.1.2	INTEGER	read-create	This object indicates how the sub-actions are executed based on the success of the actions as they finish executing. doAll - run each sub-action regardless of the exit status of the previous action. This parent action is always considered to have acted successfully. doUntilSuccess - run each sub-action until one succeeds, at which point stop processing the sub-actions within this parent compound action. If one of the sub-actions did execute successfully, this parent action is also considered to have executed successfully. doUntilFailure - run each sub-action until one fails, at which point stop processing the sub-actions within this compound action. If any sub-action fails, the result of this parent action is considered to have failed.
INT spdGroupContComponentType	1.3.6.1.2.1.153.1.3.1.4	INTEGER	read-create	Indicates whether the spdGroupContComponentName object is the name of another group defined within the spdGroupContentsTable or is the name of a rule defined within the spdRuleDefinitionTable.
INT spdIpOffFiltType	1.3.6.1.2.1.153.1.8.1.3	INTEGER	read-create	This defines the various tests that are used when evaluating a given filter. The various tests definable in this table are as follows: equal: - Tests if the OCTET STRING, 'spdIpOffFiltValue', matches a value in the packet starting at the given offset in the packet and comparing the entire OCTET STRING of 'spdIpOffFiltValue'. Any values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. notEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', does not match a value in the packet starting at the given offset in the packet and comparing to the entire OCTET STRING of 'spdIpOffFiltValue'. Any values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticLess: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than ('=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticGreater: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically greater than ('>') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticLessOrEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than or equal to ('<=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'.
INT spdIpsoHeadFiltClassification	1.3.6.1.2.1.153.1.10.1.3	INTEGER	read-create	This object indicates the IPSO classification header field value that the packet MUST have for this row to evaluate to 'true'. The values of these enumerations are defined by RFC 1108.
INT spdIpsoHeadFiltProtectionAuth	1.3.6.1.2.1.153.1.10.1.4	INTEGER	read-create	This object indicates the IPSO protection authority header field value that the packet MUST have for this row to evaluate to 'true'. The values of these enumerations are defined by RFC 1108. Hence the reason the SMIv2 convention of not using 0 in enumerated lists is violated here.
Integer32 (8)
I32 spdAcceptAction	1.3.6.1.2.1.153.1.13.3	Integer32	read-only	This Scalar indicates that a packet MUST be accepted (pass-through) and SHOULD NOT have action/packet logging.
I32 spdAcceptActionLog	1.3.6.1.2.1.153.1.13.4	Integer32	read-only	This scalar indicates that a packet MUST be accepted (pass-through) and SHOULD have action/packet logging.
I32 spdDropAction	1.3.6.1.2.1.153.1.13.1	Integer32	read-only	This scalar indicates that a packet MUST be dropped and SHOULD NOT have action/packet logging.
I32 spdDropActionLog	1.3.6.1.2.1.153.1.13.2	Integer32	read-only	This scalar indicates that a packet MUST be dropped and SHOULD have action/packet logging.
I32 spdGroupContPriority	1.3.6.1.2.1.153.1.3.1.2	Integer32	not-accessible	The priority (sequence number) of the sub-component in a group that this row represents. This value indicates the order that each row of this table MUST be processed from low to high. For example, a row with a priority of 0 is processed before a row with a priority of 1, a 1 before a 2, etc.
I32 spdSubActPriority	1.3.6.1.2.1.153.1.12.1.1	Integer32	not-accessible	The priority of a given sub-action within a compound action. The order in which sub-actions MUST be executed are based on the value from this column, with the lowest numeric value executing first (i.e., priority 0 before priority 1, 1 before 2, etc.).
I32 spdSubFiltPriority	1.3.6.1.2.1.153.1.6.1.1	Integer32	not-accessible	The priority of a given filter within a compound filter. The order of execution is from lowest to highest priority value (i.e., priority 0 before priority 1, 1 before 2, etc.). Implementations MAY choose to follow this ordering, as set by the manager that created the rows. This can allow a manager to intelligently construct filter lists such that faster filters are evaluated first.
I32 spdTrueFilter	1.3.6.1.2.1.153.1.7.1	Integer32	read-only	This scalar indicates a (automatic) true result for a filter. That is, this is a filter that is always true; it is useful for adding as a default filter for a default action or a set of actions.
InterfaceIndex (1)
NUM spdEndGroupInterface	1.3.6.1.2.1.153.1.2.1.2	InterfaceIndex	not-accessible	This value matches the IF-MIB's ifTable's ifIndex column and indicates the interface associated with a given endpoint. This object can be used to uniquely identify an endpoint that a set of policy groups are applied to.
OCTET STRING (3)
OCT spdIpOffFiltValue	1.3.6.1.2.1.153.1.8.1.4	OCTET STRING	read-create	spdIpOffFiltValue is used for match comparisons of a packet at spdIpOffFiltOffset.
OCT spdPacketPart	1.3.6.1.2.1.153.2.1.9	OCTET STRING	accessible-for-notify	spdPacketPart is the front part of the full IP packet that triggered this notification. The initial size limit is determined by the smaller of the size, indicated by: I. The value of the object with the TC syntax 'SpdIPPacketLogging' that indicated the packet SHOULD be logged and II. The size of the triggering packet. The final limit is determined by the SNMP packet size when sending the notification. The maximum size that can be included will be the smaller of the initial size, given the above, and the length that will fit in a single SNMP notification packet after the rest of the notification's objects and any other necessary packet data (headers encoding, etc.) have been included in the packet.
OCT spdTimeFiltDayOfMonthMask	1.3.6.1.2.1.153.1.9.1.4	OCTET STRING	read-create	Defines which days of the month the current time is valid for. It is a sequence of 64 BITS, where each BIT represents a corresponding day of the month in forward or reverse order. Starting from the left-most bit, the first 31 bits identify the day of the month, counting from the beginning of the month. The following 31 bits (bits 32-62) indicate the day of the month, counting from the end of the month. For months with fewer than 31 days, the bits that correspond to the non-existent days of that month are ignored (e.g., for non-leap year Februarys, bits 29-31 and 60-62 are ignored). This column evaluates to 'true' if the current day of the month's bit is set. For example, a value of 0X'80 00 00 01 00 00 00 00' indicates that this column evaluates to true on the first and last days of the month. The last two bits in the string MUST be zero.
RowStatus (10)
ROW spdCompActRowStatus	1.3.6.1.2.1.153.1.11.1.5	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once a row in the spdCompoundActionTable has been made active, this object MUST NOT be set to destroy without first destroying all the contained rows listed in the spdSubactionsTable.
ROW spdCompFiltRowStatus	1.3.6.1.2.1.153.1.5.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once active, it MUST NOT have its value changed if any active rows in the spdRuleDefinitionTable are currently pointing at this row.
ROW spdEndGroupRowStatus	1.3.6.1.2.1.153.1.2.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object is considered 'notReady' and MUST NOT be set to active until one or more active rows exist within the spdGroupContentsTable for the group referenced by the spdEndGroupName object.
ROW spdGroupContRowStatus	1.3.6.1.2.1.153.1.3.1.8	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object MUST NOT be set to active until the row to which the spdGroupContComponentName points to exists and is active. If active, this object MUST remain active unless one of the following two conditions are met: I. No active row in spdEndpointToGroupTable exists that references this row's group (i.e., indicate this row's spdGroupContName). II. Or at least one other active row in this table has a matching spdGroupContName. If neither condition is met, an attempt to set this row to something other than active MUST result in an inconsistentValue error.
ROW spdIpOffFiltRowStatus	1.3.6.1.2.1.153.1.8.1.7	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
ROW spdIpsoHeadFiltRowStatus	1.3.6.1.2.1.153.1.10.1.7	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. However, this object MUST NOT be set to active if the requirements of the spdIpsoHeadFiltType object are not met. Specifically, if the spdIpsoHeadFiltType bit for classification(0) is set, the spdIpsoHeadFiltClassification column MUST have a valid value for the row status to be set to active. If the spdIpsoHeadFiltType bit for protectionAuthority(1) is set, the spdIpsoHeadFiltProtectionAuth column MUST have a valid value for the row status to be set to active. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
ROW spdRuleDefRowStatus	1.3.6.1.2.1.153.1.4.1.9	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object MUST NOT be set to active until the containing conditions, filters, and actions have been defined. Once active, it MUST remain active until no active policyGroupContents entries are referencing it. A failed attempt to do so MUST return an inconsistentValue error.
ROW spdSubActRowStatus	1.3.6.1.2.1.153.1.12.1.5	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active unless one of the following two conditions are met. An attempt to set it to anything other than active while the following conditions are not met MUST result in an inconsistentValue error. The two conditions are: I. No active row in the spdCompoundActionTable exists which has a matching spdCompActName. II. Or, at least one other active row in this table has a matching spdCompActName.
ROW spdSubFiltRowStatus	1.3.6.1.2.1.153.1.6.1.6	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object cannot be made active until a filter referenced by the spdSubFiltSubfilter object is both defined and active. An attempt to do so MUST result in an inconsistentValue error. If active, this object MUST remain active unless one of the following two conditions are met: I. No active row in the SpdCompoundFilterTable exists that has a matching spdCompFiltName. II. Or, at least one other active row in this table has a matching spdCompFiltName. If neither condition is met, an attempt to set this row to something other than active MUST result in an inconsistentValue error.
ROW spdTimeFiltRowStatus	1.3.6.1.2.1.153.1.9.1.9	RowStatus	read-create	This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. If active, this object MUST remain active if it is referenced by an active row in another table. An attempt to set it to anything other than active while it is referenced by an active row in another table MUST result in an inconsistentValue error.
SnmpAdminString (13)
STR spdCompActName	1.3.6.1.2.1.153.1.11.1.1	SnmpAdminString	not-accessible	This is an administratively assigned name of this compound action.
STR spdCompFiltDescription	1.3.6.1.2.1.153.1.5.1.2	SnmpAdminString	read-create	A user definable string. This field MAY be used for your administrative tracking purposes.
STR spdCompFiltName	1.3.6.1.2.1.153.1.5.1.1	SnmpAdminString	not-accessible	A user definable string. This value is used as an index into this table.
STR spdEgressPolicyGroupName	1.3.6.1.2.1.153.1.1.2	SnmpAdminString	read-write	This object indicates the policy group containing the global system policy that is to be applied on egress packets (i.e., packets leaving an interface and entering a network) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates that no system-wide policy exists and the default policy of 'drop' SHOULD be executed for egress packets until one is imposed by either this object or by the endpoint processing a given packet. This object MUST be persistent
STR spdEndGroupName	1.3.6.1.2.1.153.1.2.1.3	SnmpAdminString	read-create	The policy group name to apply at this endpoint. The value of the spdEndGroupName object is then used as an index into the spdGroupContentsTable to come up with a list of rules that MUST be applied at this endpoint.
STR spdGroupContComponentName	1.3.6.1.2.1.153.1.3.1.5	SnmpAdminString	read-create	The name of the policy rule or subgroup contained within this row, as indicated by the spdGroupContComponentType object.
STR spdGroupContName	1.3.6.1.2.1.153.1.3.1.1	SnmpAdminString	not-accessible	The administrative name of the group associated with this row. A 'group' is formed by all the rows in this table that have the same value of this object.
STR spdIngressPolicyGroupName	1.3.6.1.2.1.153.1.1.1	SnmpAdminString	read-write	This object indicates the global system policy group that is to be applied on ingress packets (i.e., arriving at an interface from a network) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates that no system-wide policy exists and the default policy of 'drop' SHOULD be executed for ingress packets until one is imposed by either this object or by the endpoint processing a given packet. This object MUST be persistent
STR spdIpOffFiltName	1.3.6.1.2.1.153.1.8.1.1	SnmpAdminString	not-accessible	The administrative name for this filter.
STR spdIpsoHeadFiltName	1.3.6.1.2.1.153.1.10.1.1	SnmpAdminString	not-accessible	The administrative name for this filter.
STR spdRuleDefDescription	1.3.6.1.2.1.153.1.4.1.2	SnmpAdminString	read-create	A user defined string. This field MAY be used for administrative tracking purposes.
STR spdRuleDefName	1.3.6.1.2.1.153.1.4.1.1	SnmpAdminString	not-accessible	spdRuleDefName is the administratively assigned name of the rule referred to by the spdGroupContComponentName object.
STR spdTimeFiltName	1.3.6.1.2.1.153.1.9.1.1	SnmpAdminString	not-accessible	An administratively assigned name for this filter.
SpdAdminStatus (1)
SPD spdRuleDefAdminStatus	1.3.6.1.2.1.153.1.4.1.6	SpdAdminStatus	read-create	Indicates whether the current rule definition is considered active. If the value is enabled, the rule MUST be evaluated when processing packets. If the value is disabled, the packet processing MUST continue as if this rule's filter had effectively failed.
SpdBooleanOperator (1)
SPD spdCompFiltLogicType	1.3.6.1.2.1.153.1.5.1.3	SpdBooleanOperator	read-create	Indicates whether the sub-component filters of this compound filter are functionally ANDed or ORed together.
SpdTimePeriod (2)
SPD spdTimeFiltPeriod	1.3.6.1.2.1.153.1.9.1.2	SpdTimePeriod	read-create	The valid time period for this filter. This column is considered 'true' if the current time is within the range of this object.
SPD spdTimeFiltTimeOfDayMask	1.3.6.1.2.1.153.1.9.1.6	SpdTimePeriod	read-create	Indicates the start and end time of the day for which this filter evaluates to true. The date portions of the spdTimePeriod TC are ignored for purposes of evaluating this mask, and only the time-specific portions are used. This column evaluates to 'true' if the current time of day is within the range of the start and end times of the day indicated by this object.
StorageType (10)
STO spdCompActStorageType	1.3.6.1.2.1.153.1.11.1.4	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdCompFiltStorageType	1.3.6.1.2.1.153.1.5.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdEndGroupStorageType	1.3.6.1.2.1.153.1.2.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdGroupContStorageType	1.3.6.1.2.1.153.1.3.1.7	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdIpOffFiltStorageType	1.3.6.1.2.1.153.1.8.1.6	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdIpsoHeadFiltStorageType	1.3.6.1.2.1.153.1.10.1.6	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdRuleDefStorageType	1.3.6.1.2.1.153.1.4.1.8	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdSubActStorageType	1.3.6.1.2.1.153.1.12.1.4	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdSubFiltStorageType	1.3.6.1.2.1.153.1.6.1.5	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
STO spdTimeFiltStorageType	1.3.6.1.2.1.153.1.9.1.8	StorageType	read-create	The storage type for this row. Rows in this table that were created through an external process MAY have a storage type of readOnly or permanent. For a storage type of permanent, none of the columns have to be writable.
TimeStamp (10)
TIM spdCompActLastChanged	1.3.6.1.2.1.153.1.11.1.3	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdCompFiltLastChanged	1.3.6.1.2.1.153.1.5.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdEndGroupLastChanged	1.3.6.1.2.1.153.1.2.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdGroupContLastChanged	1.3.6.1.2.1.153.1.3.1.6	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdIpOffFiltLastChanged	1.3.6.1.2.1.153.1.8.1.5	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdIpsoHeadFiltLastChanged	1.3.6.1.2.1.153.1.10.1.5	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdRuleDefLastChanged	1.3.6.1.2.1.153.1.4.1.7	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdSubActLastChanged	1.3.6.1.2.1.153.1.12.1.3	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdSubFiltLastChanged	1.3.6.1.2.1.153.1.6.1.4	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TIM spdTimeFiltLastChanged	1.3.6.1.2.1.153.1.9.1.7	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means. If this row has not been modified since the last re-initialization of the network management subsystem, this object SHOULD have a zero value.
TruthValue (2)
T/F spdRuleDefFilterNegated	1.3.6.1.2.1.153.1.4.1.4	TruthValue	read-create	spdRuleDefFilterNegated specifies whether or not the results of the filter referenced by the spdRuleDefFilter object is negated.
T/F spdSubFiltSubfilterIsNegated	1.3.6.1.2.1.153.1.6.1.3	TruthValue	read-create	Indicates whether or not the result of applying this sub-filter is negated.
Unsigned32 (1)
U32 spdIpOffFiltOffset	1.3.6.1.2.1.153.1.8.1.2	Unsigned32	read-create	This is the byte offset from the front of the entire IP packet where the value or arithmetic comparison is done. A value of '0' indicates the first byte of the packet header. If this value is greater than the length of the packet, the filter represented by this row should be considered to fail.
VariablePointer (6)
NUM spdActionExecuted	1.3.6.1.2.1.153.2.1.1	VariablePointer	accessible-for-notify	Points to the action instance that was executed that resulted in the notification being sent.
NUM spdGroupContFilter	1.3.6.1.2.1.153.1.3.1.3	VariablePointer	read-create	spdGroupContFilter points to a filter that is evaluated to determine whether the spdGroupContComponentName within this row is exercised. Managers can use this object to classify groups of rules, or subgroups, together in order to achieve a greater degree of control and optimization over the execution order of the items within the group. If the filter evaluates to false, the rule or subgroup will be skipped and the next rule or subgroup will be evaluated instead. This value can be used to indicate a scalar or row in a table. When indicating a row in a table, this value MUST point to the first column instance in that row. An example usage of this object would be to limit a group of rules to executing only when the IP packet being processed is designated to be processed by IKE. This effectively creates a group of IKE-specific rules. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB: diffServMultiFieldClfrTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter spdIpsoHeaderFilterTable Implementations MAY choose to provide support for other filter tables or scalars. If this column is set to a VariablePointer value, which references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, a row in this table is applied to a packet and the value of this column in that row references a non-existent or non-supported object, the packet MUST be dropped.
NUM spdRuleDefAction	1.3.6.1.2.1.153.1.4.1.5	VariablePointer	read-create	This column points to the action to be taken. It MAY, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable ipsaSaPreconfiguredActionTable ipiaIkeActionTable ipiaIpsecActionTable It MAY also point to one of the scalar objects beneath spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error MUST be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
NUM spdRuleDefFilter	1.3.6.1.2.1.153.1.4.1.3	VariablePointer	read-create	spdRuleDefFilter points to a filter that is used to evaluate whether the action associated with this row is executed or not. The action will only execute if the filter referenced by this object evaluates to TRUE after first applying any negation required by the spdRuleDefFilterNegated object. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB. Implementations MAY choose to provide support for other filter tables or scalars as well: diffServMultiFieldClfrTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter If this column is set to a VariablePointer value, which references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
NUM spdSubActSubActionName	1.3.6.1.2.1.153.1.12.1.2	VariablePointer	read-create	This column points to the action to be taken. It MAY, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable - Allowing recursion ipsaSaPreconfiguredActionTable ipiaIkeActionTable ipiaIpsecActionTable It MAY also point to one of the scalar objects beneath spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error MUST be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
NUM spdSubFiltSubfilter	1.3.6.1.2.1.153.1.6.1.2	VariablePointer	read-create	The OID of the contained filter. The value of this object is a VariablePointer that references the filter to be included in this compound filter. The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB. Implementations MAY choose to provide support for other filter tables or scalars as well: diffServMultiFieldClfrTable spdIpsoHeaderFilterTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter If this column is set to a VariablePointer value that references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned. If, during packet processing, this column has a value that references a non-existent or non-supported object, the packet MUST be dropped.
No type (51)
spdActionLoggingObjectGroup	1.3.6.1.2.1.153.3.2.12			This group is made up of all the Notification objects for this MIB.
NTF spdActionNotification	1.3.6.1.2.1.153.2.0.1			Notification that an action was executed by a rule. Only actions with logging enabled will result in this notification getting sent. The object includes the spdActionExecuted object, which will indicate which action was executed within the scope of the rule. Additionally, the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress objects are included to indicate the packet source and destination of the packet that triggered the action. Finally, the spdIPEndpointAddType, spdIPEndpointAddress, and spdPacketDirection objects indicate which interface the executed action was associated with, and if the packet was ingress or egress through the endpoint. A spdActionNotification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate. Note that compound actions with multiple executed sub-actions may result in multiple notifications being sent from a single rule execution.
spdActionNotificationGroup	1.3.6.1.2.1.153.3.2.13			This group is made up of all the Notifications for this MIB.
spdActions	1.3.6.1.2.1.153.4
spdCompliances	1.3.6.1.2.1.153.3.1
spdCompoundActionEntry	1.3.6.1.2.1.153.1.11.1		not-accessible	A row in the spdCompoundActionTable.
spdCompoundActionGroup	1.3.6.1.2.1.153.3.2.11			The IPsec Policy Compound Action Table and Actions In Compound Action Table Group.
spdCompoundActionTable	1.3.6.1.2.1.153.1.11		not-accessible	Table used to allow multiple actions to be associated with a rule. It uses the spdSubactionsTable to do this. The rows from spdSubactionsTable that are partially indexed by spdCompActName form the set of compound actions to be performed. The spdCompActExecutionStrategy column in this table indicates how those actions are processed.
spdCompoundFilterEntry	1.3.6.1.2.1.153.1.5.1		not-accessible	An entry in the spdCompoundFilterTable. Each entry in this table represents a compound filter. A filter defined by this table is considered to have a TRUE return value if and only if: spdCompFiltLogicType is AND and all of the sub-filters associated with it, as defined in the spdSubfiltersTable, are all true themselves (after applying any required negation, as defined by the ficFilterIsNegated object). spdCompFiltLogicType is OR and at least one of the sub-filters associated with it, as defined in the spdSubfiltersTable, is true itself (after applying any required negation, as defined by the ficFilterIsNegated object.
spdCompoundFilterGroup	1.3.6.1.2.1.153.3.2.5			This group is made up of objects from the IPsec Policy Compound Filter Table and Sub-Filter Table Group.
spdCompoundFilterTable	1.3.6.1.2.1.153.1.5		not-accessible	A table defining compound filters and their associated parameters. A row in this table can be pointed to by a spdRuleDefFilter object.
spdConfigObjects	1.3.6.1.2.1.153.1
spdConformanceObjects	1.3.6.1.2.1.153.3
spdEndpointGroup	1.3.6.1.2.1.153.3.2.1			This group is made up of objects from the IPsec Policy Endpoint Table.
spdEndpointToGroupEntry	1.3.6.1.2.1.153.1.2.1		not-accessible	A mapping assigning a policy group to an endpoint.
spdEndpointToGroupTable	1.3.6.1.2.1.153.1.2		not-accessible	This table maps policies (groupings) onto an endpoint (interface). A policy group assigned to an endpoint is then used to control access to the network traffic passing through that endpoint. If an endpoint has been configured with a policy group and no rule within that policy group matches that packet, the default action in this case SHALL be to drop the packet. If no policy group has been assigned to an endpoint, then the policy group specified by spdIngressPolicyGroupName MUST be used on traffic inbound from the network through that endpoint, and the policy group specified by spdEgressPolicyGroupName MUST be used for traffic outbound to the network through that endpoint.
spdGroupContentsEntry	1.3.6.1.2.1.153.1.3.1		not-accessible	Defines a given sub-component within a policy group. A sub-component is either a rule or another group as indicated by spdGroupContComponentType and referenced by spdGroupContComponentName.
spdGroupContentsGroup	1.3.6.1.2.1.153.3.2.2			This group is made up of objects from the IPsec Policy Group Contents Table.
spdGroupContentsTable	1.3.6.1.2.1.153.1.3		not-accessible	This table contains a list of rules and/or subgroups contained within a given policy group. For a given value of spdGroupContName, the set of rows sharing that value forms a 'group'. The rows in a group MUST be processed according to the value of the spdGroupContPriority object in each row. The processing MUST be executed starting with the lowest value of spdGroupContPriority and in ascending order thereafter. If an action is executed as the result of the processing of a row in a group, the processing of further rows in that group MUST stop. Iterating to the next policy group row by finding the next largest spdGroupContPriority object SHALL only be done if no actions were run while processing the current row for a given packet.
spdGroups	1.3.6.1.2.1.153.3.2
spdIpOffsetFilterEntry	1.3.6.1.2.1.153.1.8.1		not-accessible	A definition of a particular filter.
spdIPOffsetFilterGroup	1.3.6.1.2.1.153.3.2.7			This group is made up of objects from the IPsec Policy IP Offset Filter Table.
spdIpOffsetFilterTable	1.3.6.1.2.1.153.1.8		not-accessible	This table contains a list of filter definitions to be used within the spdRuleDefinitionTable or the spdSubfiltersTable. This type of filter is used to compare an administrator specified octet string to the octets at a particular location in a packet.
spdIpsecSystemPolicyNameGroup	1.3.6.1.2.1.153.3.2.3			This group is made up of objects represent the System Policy Group Names.
spdIpsoHeaderFilterEntry	1.3.6.1.2.1.153.1.10.1		not-accessible	A definition of a particular filter.
spdIpsoHeaderFilterGroup	1.3.6.1.2.1.153.3.2.9			This group is made up of objects from the IPsec Policy IPSO Header Filter Table.
spdIpsoHeaderFilterTable	1.3.6.1.2.1.153.1.10		not-accessible	This table contains a list of IPSO header filter definitions to be used within the spdRuleDefinitionTable or the spdSubfiltersTable. IPSO headers and their values are described in RFC 1108.
spdLocalConfigObjects	1.3.6.1.2.1.153.1.1
spdLoggingCompliance	1.3.6.1.2.1.153.3.1.2			The compliance statement for SNMP entities that support sending notifications when actions are invoked.
spdMIB	1.3.6.1.2.1.153			This MIB module defines configuration objects for managing IPsec Security Policies. In general, this MIB can be implemented anywhere IPsec security services exist (e.g., bump-in-the-wire, host, gateway, firewall, router, etc.). Copyright (C) The IETF Trust (2007). This version of this MIB module is part of RFC 4807; see the RFC itself for full legal notices.
spdNotificationObjects	1.3.6.1.2.1.153.2
spdNotifications	1.3.6.1.2.1.153.2.0
spdNotificationVariables	1.3.6.1.2.1.153.2.1
NTF spdPacketNotification	1.3.6.1.2.1.153.2.0.2			Notification that a packet passed through a Security Association (SA). Only SAs created by actions with packet logging enabled will result in this notification getting sent. The objects sent MUST include the spdActionExecuted, which will indicate which action was executed within the scope of the rule. Additionally, the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress objects MUST be included to indicate the packet source and destination of the packet that triggered the action. The spdIPEndpointAddType, spdIPEndpointAddress, and spdPacketDirection objects are included to indicate which endpoint the packet was associated with. Finally, spdPacketPart is included to enable sending a variable sized part of the front of the packet with the size dependent on the value of the object of TC syntax 'SpdIPPacketLogging', which indicated that logging should be done. A spdPacketNotification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate. An action notification SHOULD be limited to a maximum of one notification sent per minute for any action notifications that do not have any other configuration controlling their send rate.
spdRuleDefinitionEntry	1.3.6.1.2.1.153.1.4.1		not-accessible	A row defining a particular rule definition. A rule definition binds a filter pointer to an action pointer.
spdRuleDefinitionGroup	1.3.6.1.2.1.153.3.2.4			This group is made up of objects from the IPsec Policy Rule Definition Table.
spdRuleDefinitionTable	1.3.6.1.2.1.153.1.4		not-accessible	This table defines a rule by associating a filter or a set of filters to an action to be executed.
spdRuleFilterFullCompliance	1.3.6.1.2.1.153.3.1.1			The compliance statement for SNMP entities that include an IPsec MIB implementation with Endpoint, Rules, and filters support. When this MIB is implemented with support for read-create, then such an implementation can claim full compliance. Such devices can then be both monitored and configured with this MIB.
spdRuleFilterReadOnlyCompliance	1.3.6.1.2.1.153.3.1.3			The compliance statement for SNMP entities that include an IPsec MIB implementation with Endpoint, Rules, and filters support. If this MIB is implemented without support for read-create (i.e., in read-only), it is not in full compliance, but it can claim read-only compliance. Such a device can then be monitored, but cannot be configured with this MIB.
spdStaticActionGroup	1.3.6.1.2.1.153.3.2.10			This group is made up of objects from the IPsec Policy Static Actions.
spdStaticActions	1.3.6.1.2.1.153.1.13
spdStaticFilterGroup	1.3.6.1.2.1.153.3.2.6			The static filter group. Currently this is just a true filter.
spdStaticFilters	1.3.6.1.2.1.153.1.7
spdSubactionsEntry	1.3.6.1.2.1.153.1.12.1		not-accessible	A row containing a reference to a given compound-action sub-action.
spdSubactionsTable	1.3.6.1.2.1.153.1.12		not-accessible	This table contains a list of the sub-actions within a given compound action. Compound actions executing these actions MUST execute them in series based on the spdSubActPriority value, with the lowest value executing first.
spdSubfiltersEntry	1.3.6.1.2.1.153.1.6.1		not-accessible	An entry in the spdSubfiltersTable. There is an entry in this table for each sub-filter of all compound filters present in the spdCompoundFilterTable.
spdSubfiltersTable	1.3.6.1.2.1.153.1.6		not-accessible	This table defines a list of filters contained within a given compound filter defined in the spdCompoundFilterTable.
spdTimeFilterEntry	1.3.6.1.2.1.153.1.9.1		not-accessible	A row describing a given time frame for which a policy is filtered on to activate or deactivate the rule. If all the column objects in a row are true for the current time, the row evaluates as 'true'. More explicitly, the time matching column objects in a row MUST be logically ANDed together to form the boolean true/false for the row.
spdTimeFilterGroup	1.3.6.1.2.1.153.3.2.8			This group is made up of objects from the IPsec Policy Time Filter Table.
spdTimeFilterTable	1.3.6.1.2.1.153.1.9		not-accessible	Defines a table of filters that can be used to effectively enable or disable policies based on a valid time range.
spdTrueFilterInstance	1.3.6.1.2.1.153.1.7.1.0

FAQ

What does IPSEC-SPD-MIB let me verify on a VPN gateway or firewall?
It exposes IPsec Security Policy Database configuration: ingress/egress policy group names, endpoint-to-group mappings with direction and interface bindings, and the ordered contents of policy groups that determine how traffic is matched against IPsec policies.

How would an administrator use this MIB to audit IPsec policy configuration?
Per RFC 4807, an administrator can poll spdEndGroupDirection and spdEndGroupInterface to confirm which security policy group is bound to which interface and direction, and check row status and last-changed timestamps to catch unexpected policy changes, complementing companion MIBs that track the actual IPsec Security Associations and IKE state.

RFC description

IPsec Security Policy Database management (RFC 6207).

Start monitoring Vendor-neutral IETF standard, RFC 4807 (IPsec-capable gateway, firewall, router, or host) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download IPSEC-SPD-MIB

This MIB depends on

Related MIBs

What Is IPSEC-SPD-MIB?

What Can Be Monitored

Supported Devices

Monitoring Examples

FAQ

RFC description