All MIBs › IPSEC-TUN-MON-MIB
Organization: IETF IPsec Working Group
Last Updated: 2000-10-04
Description: IPSEC-TUN-MON-MIB module
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is IPSEC-TUN-MON-MIB?
IPSEC-TUN-MON-MIB is an IETF IPsec Working Group MIB monitoring logical IPsec channels and tunnels at an entity-wide level. Its global counters report current, total (cumulative), and deleted counts for both channels and tunnels, while its channel table (keyed by channel entry) records channel type and local endpoint address. As a protocol-status MIB it lets an administrator gauge overall IPsec tunnel churn (how many tunnels have been created/torn down over time) alongside the currently active count, useful for spotting tunnel instability. It is deployed on IPsec-capable routers, VPN gateways, and firewalls. Engineers can download the IPSEC-TUN-MON-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in IPSEC-TUN-MON-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- IPsec-capable routers, VPN gateways, and firewalls
Monitoring Examples
An administrator compares totalTunnels against currentTunnels over time to gauge whether an unusually high tunnel-churn rate (frequent creation/deletion) indicates an underlying IPsec stability problem.
What Can Be Monitored
- current/total/deleted IPsec channel and tunnel counts
This MIB depends on
Related MIBs
Imported Objects
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
| IsakmpCookie |
From SNMPv2-SMI
| Counter32 | |
| Counter64 | |
| Gauge32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-IDENTITY | |
| OBJECT-TYPE | |
| Unsigned32 | |
| experimental |
From SNMPv2-TC
| TEXTUAL-CONVENTION | |
| TruthValue |
How to Use in IPNetwork Monitor
Example using totalChannels OID:
Select an IPsec-capable router/VPN gateway/firewall (tunnel/channel churn counters) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type totalChannels into the Find box to locate it in the OID tree, then select it and click OK. The total number of channels created by the entity since system boot. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ipsecTunMonModule | 1.3.6.1.3.1010 | The MIB module to describe logical IPsec channel and tunnel objects, and entity level objects and events associated with these objects. | ||
| ipsecTunnelMonitorMIB | 1.3.6.1.3.1010.1 | This is the base object identifier for all branches. | ||
| channelObjects | 1.3.6.1.3.1010.1.1 | This is the base object identifier for all channel related objects. | ||
| channelTables | 1.3.6.1.3.1010.1.1.1 | This is the base object identifier for all objects which are tables for channels. | ||
| ipsecChannelTable | 1.3.6.1.3.1010.1.1.1.1 | not-accessible | The (conceptual) table containing information on control channels. The number of rows in this table is, at a minimum, the same as the number of IKE SAs that have the same phase 1 ID pairs. Additional rows for channels without active phase 1 SAs may also appear in the table. The maximum number of rows is implementation dependent. | |
| ipsecChannelEntry | 1.3.6.1.3.1010.1.1.1.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular control channel. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IPS ipsecChannelType | 1.3.6.1.3.1010.1.1.1.1.1.1 | IpsecChanOrTunType | not-accessible | The type of control channel represented by this row. This is an implementation dependent value, used to assist in controlling how channels are sorted. |
| U32 ipsecChannelLocalEndpoint | 1.3.6.1.3.1010.1.1.1.1.1.2 | Unsigned32 | not-accessible | The index value of the row of the IKE Monitoring MIB's endpoint table corresponding to the local endpoint. |
| U32 ipsecChannelRemoteEndpoint | 1.3.6.1.3.1010.1.1.1.1.1.3 | Unsigned32 | not-accessible | The index value of the row of the IKE Monitoring MIB's endpoint table corresponding to the remote endpoint. |
| G32 ipsecChannelCurrentSAs | 1.3.6.1.3.1010.1.1.1.1.1.4 | Gauge32 | read-only | The number of IKE SAs that are currently active that make up this channel. This value may be 0 if the channel has not yet been set up, or the implementation does not require the existence of IKE SAs for the channel to exist, or if the channel is considered a permanent entry in the table by the implementation. This value should not include SA establishment attempts in progress. |
| C32 ipsecChannelTotalSAs | 1.3.6.1.3.1010.1.1.1.1.1.5 | Counter32 | read-only | The total number of IKE SAs that are part of this channel that have been created in the entity since boot time. This value should not include failed SA establishment attempts. |
| C32 ipsecChannelDeletedSAs | 1.3.6.1.3.1010.1.1.1.1.1.6 | Counter32 | read-only | The total number of IKE SAs that are part of this channel that have been deleted in the entity since boot time. The sum of 'ipsecChannelCurrentSAs' and this value should equal ipsecChannelTotalSAs. |
| C32 ipsecChannelTimeUpSeconds | 1.3.6.1.3.1010.1.1.1.1.1.7 | Counter32 | read-only | The total number of seconds since there has been at least one valid IKE SA supporting the channel. In other words, the number of seconds since the value of 'ipsecChannelCurrentSAs' changed from 0 to any other value. |
| C32 ipsecChannelTimeDownSeconds | 1.3.6.1.3.1010.1.1.1.1.1.8 | Counter32 | read-only | The total number of seconds since the last valid IKE SA supporting the channel was deleted. In other words, the number of seconds since the value of 'ipsecChannelCurrentSAs' changed to 0 from any other value. |
| C32 ipsecChannelInboundOctets | 1.3.6.1.3.1010.1.1.1.1.1.9 | Counter32 | read-only | The amount of traffic measured in bytes received by the channel. This is the sum of 'saInOctets' from the 'saEntry' of each IKE SA in 'saTable' that is part of this channel. |
| C32 ipsecChannelOutboundOctets | 1.3.6.1.3.1010.1.1.1.1.1.10 | Counter32 | read-only | The amount of traffic measured in bytes sent by the channel. This is the sum of 'saOutOctets' from the 'saEntry' of each IKE SA in 'saTable' that is part of this channel. |
| C32 ipsecChannelInboundPackets | 1.3.6.1.3.1010.1.1.1.1.1.11 | Counter32 | read-only | The total number of packets received by the channel. This is the sum of 'saInPackets' from the 'saEntry' of each IKE SA in 'saTable' that is part of this channel. |
| C32 ipsecChannelOutboundPackets | 1.3.6.1.3.1010.1.1.1.1.1.12 | Counter32 | read-only | The total number of packets sent by the channel. This is the sum of 'saOutPackets' from the 'saEntry' of each IKE SA in 'saTable' that is part of this channel. |
| C32 ipsecChannelReceiveErrors | 1.3.6.1.3.1010.1.1.1.1.1.13 | Counter32 | read-only | The total number of receive errors incurred in the channel. This is the sum of all receive errors from the 'saEntry' of each IKE SA in 'saTable' that is part of this channel. |
| C32 ipsecChannelSendErrors | 1.3.6.1.3.1010.1.1.1.1.1.14 | Counter32 | read-only | The total number of send errors incurred in the channel. This is the sum of all send errors from the 'saEntry' of each IKE SA in 'saTable' that is part of this channel. |
| G32 ipsecChannelCurrentTunnels | 1.3.6.1.3.1010.1.1.1.1.1.15 | Gauge32 | read-only | The number of IPsec tunnels that are currently active that were created by this channel. This value should not include tunnel establishment attempts that are in progress. |
| C32 ipsecChannelTotalTunnels | 1.3.6.1.3.1010.1.1.1.1.1.16 | Counter32 | read-only | The total number of IPsec tunnels that have been created in the entity by this channel since boot time. This value should not include failed tunnel establishment attempts. |
| C32 ipsecChannelDeletedTunnels | 1.3.6.1.3.1010.1.1.1.1.1.17 | Counter32 | read-only | The total number of IPsec tunnels that have been deleted by this channel in the entity since boot time. The sum of 'ipsecChannelCurrentTunnels' and this value should equal 'ipsecChannelTotalTunnels'. |
| C64 ipsecChannelTunnelInboundOctets | 1.3.6.1.3.1010.1.1.1.1.1.18 | Counter64 | read-only | The amount of traffic measured in bytes received by all tunnels created by the channel. |
| C64 ipsecChannelTunnelOutboundOctets | 1.3.6.1.3.1010.1.1.1.1.1.19 | Counter64 | read-only | The amount of traffic measured in bytes sent by all tunnels created by the channel. |
| C64 ipsecChannelTunnelInboundPackets | 1.3.6.1.3.1010.1.1.1.1.1.20 | Counter64 | read-only | The total number of packets received by all tunnels created by the channel. |
| C64 ipsecChannelTunnelOutboundPackets | 1.3.6.1.3.1010.1.1.1.1.1.21 | Counter64 | read-only | The total number of packets sent by all tunnels created by the channel. |
| C32 ipsecChannelTunnelReceiveErrors | 1.3.6.1.3.1010.1.1.1.1.1.22 | Counter32 | read-only | The total number of receive errors incurred in all tunnels created by the channel. |
| C32 ipsecChannelTunnelSendErrors | 1.3.6.1.3.1010.1.1.1.1.1.23 | Counter32 | read-only | The total number of send errors incurred in all tunnels created the channel. |
| ipsecChannelSaTable | 1.3.6.1.3.1010.1.1.1.2 | not-accessible | The (conceptual) table containing information on which IKE SAs are used in channels. The number of rows is the same as the number of IKE SAs in the entity. The maximum number of rows is implementation dependent. | |
| ipsecChannelSaEntry | 1.3.6.1.3.1010.1.1.1.2.1 | not-accessible | An entry (conceptual row) containing the identifiers of a specific IKE SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| U32 ipsecChannelSaIndex | 1.3.6.1.3.1010.1.1.1.2.1.1 | Unsigned32 | not-accessible | A unique value, greater than zero, for each IKE SA in the channel. It is recommended that values are assigned contiguously starting from 1. |
| IPt ipsecChannelSaLocalIpAddrType | 1.3.6.1.3.1010.1.1.1.2.1.2 | InetAddressType | read-only | The type of the local address used to negotiate the IKE SA in the channel. (The value of 'saIkeLocalIpAddressType' from 'ikeMonModule' for this row.) |
| IP ipsecChannelSaLocalIpAddress | 1.3.6.1.3.1010.1.1.1.2.1.3 | InetAddress | read-only | The local address used to negotiate the IKE SA in the channel. (The value of 'saIkeLocalIpAddress' from 'ikeMonModule' for this row.) |
| IPt ipsecChannelSaRemoteIpAddrType | 1.3.6.1.3.1010.1.1.1.2.1.4 | InetAddressType | read-only | The type of the remote address used to negotiate the IKE SA in the channel. (The value of 'saIkeRemoteIpAddressType' from 'ikeMonModule' for this row.) |
| IP ipsecChannelSaRemoteIpAddress | 1.3.6.1.3.1010.1.1.1.2.1.5 | InetAddress | read-only | The remote address used to negotiate the IKE SA in the channel. (The value of 'saIkeRemoteIpAddress' from 'ikeMonModule' for this row.) |
| ISA ipsecChannelSaInitiatorCookie | 1.3.6.1.3.1010.1.1.1.2.1.6 | IsakmpCookie | read-only | The value of the cookie used by the initiator for the IKE SA in the channel. (The value of 'saIkeInitiatorCookie' from 'ikeMonModule' for this row.) |
| ISA ipsecChannelSaResponderCookie | 1.3.6.1.3.1010.1.1.1.2.1.7 | IsakmpCookie | read-only | The value of the cookie used by the responder for the IKE SA in the channel. (The value of 'saIkeResponderCookie' from 'ikeMonModule' for this row.) |
| ipsecChanAggTable | 1.3.6.1.3.1010.1.1.1.3 | not-accessible | The optional (conceptual) table containing information on aggregate statistics for the channel types. The number of rows is the same as the number of channel types supported by the entity. The maximum number of rows is implementation dependent. | |
| ipsecChanAggEntry | 1.3.6.1.3.1010.1.1.1.3.1 | not-accessible | An entry (conceptual row) containing the aggregate statistics for a specific channel type. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IPS ipsecChanAggType | 1.3.6.1.3.1010.1.1.1.3.1.1 | IpsecChanOrTunType | not-accessible | The type of control channel for which this row aggregrates statistics. |
| G32 ipsecChanAggCurrentChannels | 1.3.6.1.3.1010.1.1.1.3.1.2 | Gauge32 | read-only | The number of channels that are currently active that are of the specified type. This value should not include channel establishment attempts in progress. |
| C32 ipsecChanAggTotalChannels | 1.3.6.1.3.1010.1.1.1.3.1.3 | Counter32 | read-only | The total number of channels of this type that have been created in the entity since boot time. This value should not include failed channel establishment attempts. |
| C32 ipsecChanAggDeletedChannels | 1.3.6.1.3.1010.1.1.1.3.1.4 | Counter32 | read-only | The total number of channels of this type that have been deleted in the entity since boot time. The sum of 'ipsecChanAggCurrentChannels' and this value should equal 'ipsecChanAggTotalChannels'. |
| C64 ipsecChanAggInboundOctets | 1.3.6.1.3.1010.1.1.1.3.1.5 | Counter64 | read-only | The total amount of traffic measured in bytes received by all channels of this type. This is the sum of 'ipsecChannelInboundOctets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C64 ipsecChanAggOutboundOctets | 1.3.6.1.3.1010.1.1.1.3.1.6 | Counter64 | read-only | The total amount of traffic measured in bytes sent by all channels of this type. This is the sum of 'ipsecChannelOutboundOctets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C64 ipsecChanAggInboundPackets | 1.3.6.1.3.1010.1.1.1.3.1.7 | Counter64 | read-only | The total number of packets received by all channels of this type. This is the sum of 'ipsecChannelInboundPackets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C64 ipsecChanAggOutboundPackets | 1.3.6.1.3.1010.1.1.1.3.1.8 | Counter64 | read-only | The total number of packets sent by all channels of this type. This is the sum of 'ipsecChannelOutboundPackets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C32 ipsecChanAggReceiveErrors | 1.3.6.1.3.1010.1.1.1.3.1.9 | Counter32 | read-only | The total number of receive errors incurred by all channels of this type. This is the sum of 'ipsecChannelReceiveErrors' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C32 ipsecChanAggSendErrors | 1.3.6.1.3.1010.1.1.1.3.1.10 | Counter32 | read-only | The total number of send errors incurred by all channels of this type. This is the sum of 'ipsecChannelSendErrors' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| G32 ipsecChanAggCurrentTunnels | 1.3.6.1.3.1010.1.1.1.3.1.11 | Gauge32 | read-only | The current number of active IPsec tunnels that have been created by all channels of this type. This is the sum of 'ipsecChannelCurrentTunnels' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C32 ipsecChanAggTotalTunnels | 1.3.6.1.3.1010.1.1.1.3.1.12 | Counter32 | read-only | The total number of IPsec tunnels that have been created by all channels of this type. This is the sum of 'ipsecChannelTotalTunnels' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C32 ipsecChanAggDeletedTunnels | 1.3.6.1.3.1010.1.1.1.3.1.13 | Counter32 | read-only | The total number of IPsec tunnels that have been deleted by all channels of this type. This is the sum of 'ipsecChannelDeletedTunnels' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. The sum of 'ipsecChanAggCurrentTunnels' and this value should equal 'ipsecChanAggTotalTunnels'. |
| C64 ipsecChanAggTnlInboundOctets | 1.3.6.1.3.1010.1.1.1.3.1.14 | Counter64 | read-only | The amount of traffic measured in bytes received by all tunnels created by all channels of this type. This is the sum of 'ipsecChannelTunnelInboundOctets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C64 ipsecChanAggTnlOutboundOctets | 1.3.6.1.3.1010.1.1.1.3.1.15 | Counter64 | read-only | The amount of traffic measured in bytes sent by all tunnels created by all channels of this type. This is the sum of 'ipsecChannelTunnelOutboundOctets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C64 ipsecChanAggTnlInboundPackets | 1.3.6.1.3.1010.1.1.1.3.1.16 | Counter64 | read-only | The total number of packets received by all tunnels created by all channels of this type. This is the sum of 'ipsecChannelTunnelInboundPackets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C64 ipsecChanAggTnlOutboundPackets | 1.3.6.1.3.1010.1.1.1.3.1.17 | Counter64 | read-only | The total number of packets sent by all tunnels created by all channels of this type. This is the sum of 'ipsecChannelTunnelOutboundPackets' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C32 ipsecChanAggTnlReceiveErrors | 1.3.6.1.3.1010.1.1.1.3.1.18 | Counter32 | read-only | The total number of receive errors incurred in all tunnels created by all channels of this type. This is the sum of 'ipsecChannelTunnelReceiveErrors' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| C32 ipsecChanAggTnlSendErrors | 1.3.6.1.3.1010.1.1.1.3.1.19 | Counter32 | read-only | The total number of send errors incurred in all tunnels created by all channels of this type. This is the sum of 'ipsecChannelTunnelSendErrors' from the 'ipsecChannelEntry' of each channel in 'ipsecChannelTable' that is of this type. |
| channelStats | 1.3.6.1.3.1010.1.1.2 | This is the base object identifier for all objects which are global (non-error) counters for channels. | ||
| G32 currentChannels | 1.3.6.1.3.1010.1.1.2.1 | Gauge32 | read-only | The total number of channels currently in existence in the entity. This is the same as the number of rows in the channel table, whether there are IKE SAs for each row or not. |
| C32 totalChannelsEx | 1.3.6.1.3.1010.1.1.2.2 | Counter32 | read-only | The total number of channels created by the entity since system boot. Channel creation is defined as the addition of a row to the channel table, whether an IKE SA was created at the same time or not. |
| C32 deletedChannels | 1.3.6.1.3.1010.1.1.2.3 | Counter32 | read-only | The total number of channels deleted by the entity. Channel deletion is defined as the removal of a row from the channel table, independent of the existence of the IKE SAs that may have supported it. Note that the sum of 'currentChannels' and 'deletedChannels' is equal to 'totalChannels'. |
| channelErrors | 1.3.6.1.3.1010.1.1.3 | This is the base object identifier for all objects which are global error counters for channels. | ||
| channelTraps | 1.3.6.1.3.1010.1.1.4 | This is the base object identifier for all objects which are traps for channels. | ||
| NTF channelUp | 1.3.6.1.3.1010.1.1.4.1 | The specified channel is now up. (In other words, the number of current IKE SAs supporting the channel has changed from zero to a non-zero value.) | ||
| NTF channelDown | 1.3.6.1.3.1010.1.1.4.2 | The specified channel is now down. (In other words, the number of current IKE SAs supporting the channel has changed to zero from a non-zero value.) | ||
| channelTrapObjects | 1.3.6.1.3.1010.1.1.5 | This is the base object identifier for objects which are used as part of traps for channels. | ||
| U32 channelTrapLocalEndpoint | 1.3.6.1.3.1010.1.1.5.1 | Unsigned32 | accessible-for-notify | The index to an endpoint that is the local endpoint of a channel in a trap. |
| U32 channelTrapRemoteEndpoint | 1.3.6.1.3.1010.1.1.5.2 | Unsigned32 | accessible-for-notify | The index to an endpoint that is the remote endpoint of a channel in a trap. |
| channelTrapControl | 1.3.6.1.3.1010.1.1.6 | This is the base object identifier for all objects which are trap controls for channel traps. | ||
| T/F channelUpTrapEnable | 1.3.6.1.3.1010.1.1.6.1 | TruthValue | read-write | Indicates whether channelUp traps should be generated. |
| T/F channelDownTrapEnable | 1.3.6.1.3.1010.1.1.6.2 | TruthValue | read-write | Indicates whether channelDown traps should be generated. |
| channelGroups | 1.3.6.1.3.1010.1.1.7 | This is the base object identifier for all objects which describe the groups in the channel part of this MIB. | ||
| channelConformance | 1.3.6.1.3.1010.1.1.8 | This is the base object identifier for all objects which describe the conformance in the channel part of this MIB. | ||
| tunnelObjects | 1.3.6.1.3.1010.1.2 | This is the base object identifier for all tunnel related objects. | ||
| tunnelTables | 1.3.6.1.3.1010.1.2.1 | This is the base object identifier for all objects which are tables for tunnels. | ||
| ipsecTunnelTable | 1.3.6.1.3.1010.1.2.1.1 | not-accessible | The (conceptual) table containing information on IPsec SA suite-based tunnels. The number of rows is, at a minimum, the same as the number of IPsec SA suites in the entity that have identical selectors. Additional rows for tunnels without active IPsec SA suites may also appear in the table. The maximum number of rows is implementation dependent. | |
| ipsecTunnelEntry | 1.3.6.1.3.1010.1.2.1.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular tunnel. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IPS ipsecTunnelType | 1.3.6.1.3.1010.1.2.1.1.1.1 | IpsecChanOrTunType | not-accessible | The type of tunnel represented by this row. This is an implementation dependent value, used to assist in controlling how tunnels are sorted. |
| U32 ipsecTunnelId | 1.3.6.1.3.1010.1.2.1.1.1.2 | Unsigned32 | not-accessible | The index value of the selector table row that contains the selectors that are the identity of this tunnel. Specifically, this is the value of 'selectorIndex' from the appropriate row ('selectorEntry') from the table 'selectorTable' from the MIB 'ipsecMonModule'. (NOTE: Should this be an OBJECT IDENTIFIER instead?) |
| IPt ipsecTunnelLocalIpAddrType | 1.3.6.1.3.1010.1.2.1.1.1.3 | InetAddressType | read-only | The type of address used by the local endpoint of the tunnel. |
| IP ipsecTunnelLocalIpAddress | 1.3.6.1.3.1010.1.2.1.1.1.4 | InetAddress | read-only | The address used by the local endpoint of the tunnel. |
| IPt ipsecTunnelRemoteIpAddrType | 1.3.6.1.3.1010.1.2.1.1.1.5 | InetAddressType | read-only | The type of address used by the remote endpoint of the tunnel. |
| IP ipsecTunnelRemoteIpAddress | 1.3.6.1.3.1010.1.2.1.1.1.6 | InetAddress | read-only | The address used by the remote endpoint of the tunnel. |
| U32 ipsecTunnelLocalEndpoint | 1.3.6.1.3.1010.1.2.1.1.1.7 | Unsigned32 | read-only | The index of the local endpoint that negotiated this tunnel. It is the value of 'endpointIndex' from the correct row ('IkeEndpointEntry') of the 'ikeEndpointTable' from 'ikeMonModule'. (NOTE: Should this be an OBJECT IDENTIFIER instead?) |
| U32 ipsecTunnelRemoteEndpoint | 1.3.6.1.3.1010.1.2.1.1.1.8 | Unsigned32 | read-only | The index of the remote endpoint that negotiated this tunnel. It is the value of 'endpointIndex' from the correct row ('IkeEndpointEntry') of the 'ikeEndpointTable' from 'ikeMonModule'. |
| G32 ipsecTunnelCurrentSaSuites | 1.3.6.1.3.1010.1.2.1.1.1.9 | Gauge32 | read-only | The number of phase 2 SA suites that are currently active that make up this tunnel. This value may be 0 if the tunnel has not yet been set up, or the implementation does not require the existence of phase 2 SA suites for the tunnel to exist, or if the tunnel is considered a permanent entry in the table by the implementation. This value should not include phase 2 SA suite establishment attempts in progress. |
| C32 ipsecTunnelTotalSaSuites | 1.3.6.1.3.1010.1.2.1.1.1.10 | Counter32 | read-only | The total number of phase 2 SA suites that are part of this tunnel that have been created in the entity since boot time. This value should not include failed phase 2 SA suite establishment attempts. |
| C32 ipsecTunnelDeletedSaSuites | 1.3.6.1.3.1010.1.2.1.1.1.11 | Counter32 | read-only | The total number of phase 2 SA suites that are part of this channel that have been deleted in the entity since boot time. The sum of 'ipsecTunnelCurrentSaSuites' and this value should equal 'ipsecTunnelTotalSaSuites'. |
| C32 ipsecTunnelTimeUpSeconds | 1.3.6.1.3.1010.1.2.1.1.1.12 | Counter32 | read-only | The total number of seconds since there has been at least one valid phase 2 SA suite supporting the channel. In other words, the number of seconds since the value of 'ipsecTunnelCurrentSaSuites' changed from 0 to any other value. |
| C32 ipsecTunnelTimeDownSeconds | 1.3.6.1.3.1010.1.2.1.1.1.13 | Counter32 | read-only | The total number of seconds since the last valid phase 2 SA suite supporting the channel was deleted. In other words, the number of seconds since the value of 'ipsecTunnelCurrentSaSuites' changed to 0 from any other value. |
| C64 ipsecTunnelTotalInboundOctets | 1.3.6.1.3.1010.1.2.1.1.1.14 | Counter64 | read-only | The total amount of traffic measured in bytes received by the tunnel. This is the sum of 'suiteInUserOctets' from the 'suiteEntry' of each phase 2 SA suite in 'suiteTable' that is part of this tunnel. |
| C64 ipsecTunnelTotalOutboundOctets | 1.3.6.1.3.1010.1.2.1.1.1.15 | Counter64 | read-only | The total amount of traffic measured in bytes sent by the tunnel. This is the sum of 'suiteOutUserOctets' from the 'suiteEntry' of each phase 2 SA suite in 'suiteTable' that is part of this tunnel. |
| C64 ipsecTunnelTotalInboundPackets | 1.3.6.1.3.1010.1.2.1.1.1.16 | Counter64 | read-only | The total number of packets received by the tunnel. This is the sum of 'suiteInPackets' from the 'suiteEntry' of each phase 2 SA suite in 'suiteTable' that is part of this tunnel. |
| C64 ipsecTunnelTotalOutboundPackets | 1.3.6.1.3.1010.1.2.1.1.1.17 | Counter64 | read-only | The total number of packets sent by the tunnel. This is the sum of 'suiteOutPackets' from the 'suiteEntry' of each phase 2 SA suite in 'suiteTable' that is part of this tunnel. |
| C32 ipsecTunnelSendErrors | 1.3.6.1.3.1010.1.2.1.1.1.18 | Counter32 | read-only | The total number of send errors in the tunnel. This is the sum of 'suiteSendErrors' from the 'suiteEntry' of each phase 2 SA suite in 'suiteTable' that is part of this tunnel. |
| C32 ipsecTunnelReceiveErrors | 1.3.6.1.3.1010.1.2.1.1.1.19 | Counter32 | read-only | The total number of receive errors in the tunnel. This is the sum of 'suiteReceiveErrors' from the 'suiteEntry' of each phase 2 SA suite in 'suiteTable' that is part of this tunnel. |
| ipsecTunnelSuiteTable | 1.3.6.1.3.1010.1.2.1.2 | not-accessible | The (conceptual) table containing information on IPsec SA suites. The number of rows is the same as the number of IPsec SA suites in the entity. The maximum number of rows is implementation dependent. | |
| ipsecTunnelSuiteEntry | 1.3.6.1.3.1010.1.2.1.2.1 | not-accessible | An entry (conceptual row) containing the identifiers to a particular SA suite. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| U32 ipsecTunnelSuiteIndex | 1.3.6.1.3.1010.1.2.1.2.1.1 | Unsigned32 | not-accessible | A unique value, greater than zero, for each SA suite in the tunnel. It is recommended that values are assigned contiguously starting from 1. |
| OID ipsecTunnelSuiteReference | 1.3.6.1.3.1010.1.2.1.2.1.2 | OBJECT IDENTIFIER | read-only | The object identifier of the IPsec SA suite row that represents the IPsec SA suite in the tunnel. Specifically, the value of this object is the object identifier of 'suiteIndex' of the appropriate row ('SuiteEntry') in 'suiteTable' from 'ikeMonModule'. |
| ipsecTunAggTable | 1.3.6.1.3.1010.1.2.1.3 | not-accessible | The optional (conceptual) table containing information on aggregate statistics for the tunnel types. The number of rows is the same as the number of tunnel types supported by the entity. The maximum number of rows is implementation dependent. | |
| ipsecTunAggEntry | 1.3.6.1.3.1010.1.2.1.3.1 | not-accessible | An entry (conceptual row) containing the aggregate statistics for a specific tunnel type. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| G32 ipsecTunAggCurrentTunnels | 1.3.6.1.3.1010.1.2.1.3.1.1 | Gauge32 | read-only | The number of tunnels that are currently active that are of the specified type. This value should not include tunnel establishment attempts in progress. |
| C32 ipsecTunAggTotalTunnels | 1.3.6.1.3.1010.1.2.1.3.1.2 | Counter32 | read-only | The total number of tunnels of this type that have been created in the entity since boot time. This value should not include failed tunnel establishment attempts. |
| C32 ipsecTunAggDeletedTunnels | 1.3.6.1.3.1010.1.2.1.3.1.3 | Counter32 | read-only | The total number of tunnels of this type that have been deleted in the entity since boot time. The sum of 'ipsecTunAggCurrentTunnels' and this value should equal 'ipsecTunAggTotalTunnels'. |
| C64 ipsecTunAggInboundOctets | 1.3.6.1.3.1010.1.2.1.3.1.4 | Counter64 | read-only | The total amount of traffic measured in bytes received by all tunnels of this type. This is the sum of 'ipsecTunnelInboundOctets' from the 'ipsecTunnelEntry' of each tunnel in 'ipsecTunnelTable' that is of this type. |
| C64 ipsecTunAggOutboundOctets | 1.3.6.1.3.1010.1.2.1.3.1.5 | Counter64 | read-only | The total amount of traffic measured in bytes sent by all tunnels of this type. This is the sum of 'ipsecTunnelOutboundOctets' from the 'ipsecTunnelEntry' of each tunnel in 'ipsecTunnelTable' that is of this type. |
| C64 ipsecTunAggInboundPackets | 1.3.6.1.3.1010.1.2.1.3.1.6 | Counter64 | read-only | The total number of packets received by all tunnels of this type. This is the sum of 'ipsecTunnelInboundPackets' from the 'ipsecTunnelEntry' of each tunnel in 'ipsecTunnelTable' that is of this type. |
| C64 ipsecTunAggOutboundPackets | 1.3.6.1.3.1010.1.2.1.3.1.7 | Counter64 | read-only | The total number of packets sent by all tunnels of this type. This is the sum of 'ipsecTunnelOutboundPackets' from the 'ipsecTunnelEntry' of each tunnel in 'ipsecTunnelTable' that is of this type. |
| C32 ipsecTunAggSendErrors | 1.3.6.1.3.1010.1.2.1.3.1.8 | Counter32 | read-only | The total number of send errors incurred by all tunnels of this type. This is the sum of 'ipsecTunnelSendErrors' from the 'ipsecTunnelEntry' of each tunnel in 'ipsecTunnelTable' that is of this type. |
| C32 ipsecTunAggReceiveErrors | 1.3.6.1.3.1010.1.2.1.3.1.9 | Counter32 | read-only | The total number of receive errors incurred by all tunnels of this type. This is the sum of 'ipsecTunnelReceiveErrors' from the 'ipsecTunnelEntry' of each tunnel in 'ipsecTunnelTable' that is of this type. |
| tunnelBySelectorsTable | 1.3.6.1.3.1010.1.2.1.4 | not-accessible | The (conceptual) table that sorts the tunnels by the selectors. The number of rows in this table is the same as the number of tunnels in the entity. | |
| tunnelBySelectorsEntry | 1.3.6.1.3.1010.1.2.1.4.1 | not-accessible | An entry (conceptual row) referencing a particular tunnel. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| OCT tunnelBySelectorsHash | 1.3.6.1.3.1010.1.2.1.4.1.1 | OCTET STRING | not-accessible | The hash result of the full identifer of the tunnel. Precise definition to be completed. |
| U32 tunnelBySelectorsIndex | 1.3.6.1.3.1010.1.2.1.4.1.2 | Unsigned32 | not-accessible | A unique value, greater than zero, for each tunnel in the table where the hash results of the tunnel identifiers collide. It is recommended that values are assigned contiguously starting from 1. |
| U32 tunnelBySelectorsId | 1.3.6.1.3.1010.1.2.1.4.1.3 | Unsigned32 | read-only | The identifier of the tunnel. The value of this object is the index of the selector ('selectorIndex') row ('SelectorEntry') from the 'selectorTable' that identifies this tunnel. |
| IPS tunnelBySelectorsType | 1.3.6.1.3.1010.1.2.1.4.1.4 | IpsecChanOrTunType | read-only | The type assigned to the tunnel for which this row refers. |
| OID tunnelBySelectorsRef | 1.3.6.1.3.1010.1.2.1.4.1.5 | OBJECT IDENTIFIER | read-only | The object identifier of 'tunnelIndex' in the row ('tunnelEntry') of the 'tunnelTable' to which this row refers. |
| tunnelStats | 1.3.6.1.3.1010.1.2.2 | This is the base object identifier for all objects which are global (non-error) counters for tunnels. | ||
| G32 currentTunnels | 1.3.6.1.3.1010.1.2.2.1 | Gauge32 | read-only | The total number of tunnels currently in existence in the entity. This is the same as the number of rows in the tunnel table, whether there are IPsec SA suites for each row or not. |
| C32 totalTunnels | 1.3.6.1.3.1010.1.2.2.2 | Counter32 | read-only | The total number of tunnels created by the entity since system boot. Tunnel creation is defined as the addition of a row to the tunnel table, whether an IPsec SA was created at the same time or not. |
| C32 deletedTunnels | 1.3.6.1.3.1010.1.2.2.3 | Counter32 | read-only | The total number of tunnels deleted by the entity. Tunnel deletion is defined as the removal of a row from the tunnel table, independent of the existence of the phase 2 SA suites that may have supported it. Note that the sum of 'currentTunnels' and 'deletedTunnels' should is to 'totalTunnels'. |
| tunnelErrors | 1.3.6.1.3.1010.1.2.3 | This is the base object identifier for all objects which are global error counters for tunnels. | ||
| tunnelTraps | 1.3.6.1.3.1010.1.2.4 | This is the base object identifier for all objects which are traps for tunnels. | ||
| NTF tunnelUp | 1.3.6.1.3.1010.1.2.4.1 | The specified tunnel is now up. (In other words, the number of current phase 2 SA suites supporting the tunnel has changed from zero to a non-zero value.) | ||
| NTF tunnelDown | 1.3.6.1.3.1010.1.2.4.2 | The specified tunnel is now down. (In other words, the number of current phase 2 SA suites supporting the tunnel has changed to zero from a non-zero value.) | ||
| tunnelTrapObjects | 1.3.6.1.3.1010.1.2.5 | This is the base object identifier for objects which are used as part of traps for tunnels. | ||
| U32 tunnelTrapIdentifier | 1.3.6.1.3.1010.1.2.5.1 | Unsigned32 | accessible-for-notify | The index to a selector that is the identifier of a tunnel in a trap. |
| tunnelTrapControl | 1.3.6.1.3.1010.1.2.6 | This is the base object identifier for all objects which are trap controls for tunnel traps. | ||
| T/F tunnelUpTrapEnable | 1.3.6.1.3.1010.1.2.6.1 | TruthValue | read-write | Indicates whether tunnelUp traps should be generated. |
| T/F tunnelDownTrapEnable | 1.3.6.1.3.1010.1.2.6.2 | TruthValue | read-write | Indicates whether tunnelDown traps should be generated. |
| tunnelGroups | 1.3.6.1.3.1010.1.2.7 | This is the base object identifier for all objects which describe the groups in the tunnel part of this MIB. | ||
| tunnelConformance | 1.3.6.1.3.1010.1.2.8 | This is the base object identifier for all objects which describe the conformance in the tunnel part of this MIB. |
RFC description
Monitors IPsec tunnel and channel objects, tracking events and statistics for encryption tunnels.
Start monitoring IPsec-capable router/VPN gateway/firewall (tunnel/channel churn counters) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.