ISAKMP-DOI-IND-MON-MIB

All MIBs › ISAKMP-DOI-IND-MON-MIB

Organization: IETF IPsec Working Group

Last Updated: 2000-07-10

Description: ISAKMP-DOI-IND-MON-MIB module

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ISAKMP-DOI-IND-MON-MIB?

This is an IETF-style MIB describing the DOI-independent (Domain of Interpretation-independent) portion of ISAKMP (Internet Security Association and Key Management Protocol) objects, intended for monitoring ISAKMP security-association negotiation. It would expose objects reflecting ISAKMP SA state, negotiation phases, and related counters common across all DOIs. It is used to monitor the software/protocol status of key-management negotiations, such as SA establishment or failure state, rather than physical hardware. As a DOI-independent monitoring MIB it is explicitly designed to be extended by DOI-specific MIBs (for example an IPsec DOI MIB) built on top of it. It is deployed on IPsec/VPN gateways and other IKE/ISAKMP-capable devices, where ISAKMP-DOI-IND-MON-MIB SNMP polling monitors key-management protocol health.

IPNetwork Monitor allows you to monitor SNMP objects defined in ISAKMP-DOI-IND-MON-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based IETF MIB, not tied to a specific manufacturer
IPsec/VPN gateways and IKE-capable devices

Monitoring Examples

No specific object or table names were provided in the source excerpt, so exact OIDs cannot be cited. Based on the module description, an admin would typically poll an ISAKMP SA table for negotiation state and failure counters to detect a peer that is repeatedly failing Phase 1 key-management negotiation.

Imported Objects

From AMTEC-MIB

amtec	OBJECT-IDENTITY
ike	OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From IPSEC-ISAKMP-IKE-DOI-TC

IsakmpDOI
IsakmpExchangeType

From RFC-1215

TRAP-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32
experimental

From SNMPv2-TC

TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using saTimeSeconds OID:

Select a device implementing ISAKMP-DOI-IND-MON-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type saTimeSeconds into the Find box to locate it in the OID tree, then select it and click OK. The number of seconds the SA has existed. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in seconds), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
NTF invalidCookieTrap	1.3.6.1.4.1.9999.0.24578			ISAKMP packets with invalid cookies were detected from the specified source, intended for the specified destination. The initiator and responder cookies are also sent with the trap. The current count is sent to allow the trap to accurately relfect dropped and throttled traps. Implementations SHOULD send one trap per peer (within a reasonable time period, rather than sending one trap per packet.
isakmpDoiIndMonModule	1.3.6.1.4.1.9999.1.2			The MIB module to describe the DOI-independent part of ISAKMP objects; to be used for monitoring purposes.
isakmpDoiIndMIBObjects	1.3.6.1.4.1.9999.1.2.1			This is the base object identifier for all ISAKMP branches.
isakmpSaTable	1.3.6.1.4.1.9999.1.2.1.1			This is the base object identifier for the security associations table.
saTable	1.3.6.1.4.1.9999.1.2.1.1.1		not-accessible	The (conceptual) table containing the DOI-independent portion of ISAKMP SAs. There should be one row for every phase 1 security association that exists in the entity that uses ISAKMP. The maximum number of rows is implementation dependent.
saEntry	1.3.6.1.4.1.9999.1.2.1.1.1.1		not-accessible	An entry (conceptual row) containing the DOI-independent information on a particular ISAKMP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table.
IPt saLocalIpAddressType	1.3.6.1.4.1.9999.1.2.1.1.1.1.1	InetAddressType	read-only	The type of the local address used to negotiate the ISAKMP phase 1 SA.
IP saLocalIpAddress	1.3.6.1.4.1.9999.1.2.1.1.1.1.2	InetAddress	read-only	The local address used to negotiate the ISAKMP phase 1 SA.
IPt saRemoteIpAddressType	1.3.6.1.4.1.9999.1.2.1.1.1.1.3	InetAddressType	read-only	The type of the remote address used to negotiate the ISAKMP phase 1 SA.
ADR saRemoteIpAddress	1.3.6.1.4.1.9999.1.2.1.1.1.1.4	InetAddressIPv4	read-only	The remote address used to negotiate the ISAKMP phase 1 SA.
ISA saInitiatorCookie	1.3.6.1.4.1.9999.1.2.1.1.1.1.5	IsakmpCookie	read-only	The value of the cookie used by the initiator for the ISAKMP phase 1 SA.
ISA saResponderCookie	1.3.6.1.4.1.9999.1.2.1.1.1.1.6	IsakmpCookie	read-only	The value of the cookie used by the responder for the ISAKMP phase 1 SA. Note that this value may be 0 if the ISAKMP phase 1 SA has been initiated but not responded to by the peer entity. It must never be 0 if this entry represents an ISAKMP phase 1 SA establishment attempt that has been initiated by the peer. This rule prevents index collisions in the (unlikely) event that two peers simultaneously initiate with the same cookie at the same time.
INT saLocalUdpPort	1.3.6.1.4.1.9999.1.2.1.1.1.1.7	INTEGER	read-only	The local UDP port number that this ISAKMP phase 1 SA was negotiated with.
INT saRemoteUdpPort	1.3.6.1.4.1.9999.1.2.1.1.1.1.8	INTEGER	read-only	The remote UDP port number that this ISAKMP phase 1 SA was negotiated with.
INT saPeerMajorVersion	1.3.6.1.4.1.9999.1.2.1.1.1.1.9	INTEGER	read-only	The major version number from the ISAKMP packet header used by the peer.
INT saPeerMinorVersion	1.3.6.1.4.1.9999.1.2.1.1.1.1.10	INTEGER	read-only	The minor version number from the ISAKMP packet header used by the peer.
ISA saDoi	1.3.6.1.4.1.9999.1.2.1.1.1.1.11	IsakmpDOI	read-only	The specific DOI value that this ISAKMP SA is using. Note that this value MAY be 0, as allowed by Section 3.4 of RFC 2408
T/F saLocallyInitiated	1.3.6.1.4.1.9999.1.2.1.1.1.1.12	TruthValue	read-only	This value is 'true' if the ISAKMP phase 1 SA was initiated by the local entity, and 'false' if initiated by the remote entity.
INT saStatus	1.3.6.1.4.1.9999.1.2.1.1.1.1.13	INTEGER	read-only	The status of the ISAKMP phase 1 SA. If the state is 'negotiating', it means that processing of the final packet of the phase 1 exchange is not yet complete. If the state is 'established', it means that processing of all packets associated with ISAKMP phase 1 SA negotation is complete, and the entities involved in the ISAKMP phase 1 SA are authenticated.
ISA saExchangeType	1.3.6.1.4.1.9999.1.2.1.1.1.1.14	IsakmpExchangeType	read-only	The exchange type used to negotiate the ISAKMP phase 1 SA.
C32 saTimeSecondsEx	1.3.6.1.4.1.9999.1.2.1.1.1.1.15	Counter32	read-only	The number of seconds the SA has existed. In other words, how old the SA is.
C32 saInPackets	1.3.6.1.4.1.9999.1.2.1.1.1.1.16	Counter32	read-only	The total number of packets received by the ISAKMP phase 1 SA, including un-encrypted packets used to negotiate the ISAKMP phase 1 SA, and any re-transmissions.
C32 saOutPackets	1.3.6.1.4.1.9999.1.2.1.1.1.1.17	Counter32	read-only	The total number of packets sent by the ISAKMP phase 1 SA, including un-encrypted packets used to negotiate the ISAKMP phase 1 SA, and any re-transmissions received.
C32 saInOctets	1.3.6.1.4.1.9999.1.2.1.1.1.1.18	Counter32	read-only	The amount of traffic measured in bytes received by the ISAKMP phase 1 SA. This includes encrypted and un-encrypted traffic used to negotiate the ISAKMP phase 1 SA, and any re- transmissions received.
C32 saOutOctets	1.3.6.1.4.1.9999.1.2.1.1.1.1.19	Counter32	read-only	The amount of traffic measured in bytes sent by the ISAKMP phase 1 SA. This includes encrypted and un-encrypted traffic used to negotiate the ISAKMP phase 1 SA, and any re- transmissions.
U32 saByCreatorsIndex	1.3.6.1.4.1.9999.1.2.1.1.1.1.20	Unsigned32	read-only	A unique value, greater than zero, for each IKE phase 1 SA that exists between the two endpoints. It is recommended that values are assigned contiguously starting from 1.
isakmpGlobals	1.3.6.1.4.1.9999.1.2.1.2			This is the base object identifier for all objects which are global values for ISAKMP.
INT isakmpMajorVersion	1.3.6.1.4.1.9999.1.2.1.2.1	INTEGER	read-only	The maximum major version number value capable of being supported by the entity.
INT isakmpMinorVersion	1.3.6.1.4.1.9999.1.2.1.2.2	INTEGER	read-only	The maximum minor version number value capable of being supported by the entity.
isakmpNegStats	1.3.6.1.4.1.9999.1.2.1.3			This is the base object identifier for all objects which are global counters for ISAKMP negotiation statistics.
G32 isakmpCurrentSAs	1.3.6.1.4.1.9999.1.2.1.3.1	Gauge32	read-only	The current number of ISAKMP SAs in the entity.
G32 isakmpCurrentInitiatedSAs	1.3.6.1.4.1.9999.1.2.1.3.2	Gauge32	read-only	The current number of ISAKMP SAs successfully negotiated in the entity that were initiated by the entity.
G32 isakmpCurrentRespondedSAs	1.3.6.1.4.1.9999.1.2.1.3.3	Gauge32	read-only	The current number of ISAKMP SAs successfully negotiated in the entity that were initiated by the peer entity.
C32 isakmpTotalSAs	1.3.6.1.4.1.9999.1.2.1.3.4	Counter32	read-only	The total number of ISAKMP SAs successfully negotiated in the entity since boot time.
C32 isakmpTotalInitiatedSAs	1.3.6.1.4.1.9999.1.2.1.3.5	Counter32	read-only	The total number of ISAKMP SAs successfully negotiated in the entity since boot time that were initiated by the entity.
C32 isakmpTotalRespondedSAs	1.3.6.1.4.1.9999.1.2.1.3.6	Counter32	read-only	The total number of ISAKMP SAs successfully negotiated in the entity since boot time that were initiated by the peer entity.
C32 isakmpTotalAttempts	1.3.6.1.4.1.9999.1.2.1.3.7	Counter32	read-only	The total number of ISAKMP SAs negotiation attempts made since boot time. This includes successful negotiations.
C32 isakmpTotalAsInitAttempts	1.3.6.1.4.1.9999.1.2.1.3.8	Counter32	read-only	The total number of ISAKMP SAs negotiation attempts made where the entity was the initiator since boot time. This includes successful negotiations.
C32 isakmpTotalAsRespAttempts	1.3.6.1.4.1.9999.1.2.1.3.9	Counter32	read-only	The total number of ISAKMP SAs negotiation attempts made where the entity was the responder since boot time. This includes successful negotiations.
isakmpTrafStats	1.3.6.1.4.1.9999.1.2.1.4			This is the base object identifier for all objects which are global counters for ISAKMP security association traffic statistics.
C32 isakmpTotalInPackets	1.3.6.1.4.1.9999.1.2.1.4.1	Counter32	read-only	The total number of ISAKMP packets received by the entity since boot time, including re-transmissions and un-encrypted packets.
C32 isakmpTotalOutPackets	1.3.6.1.4.1.9999.1.2.1.4.2	Counter32	read-only	The total number of ISAKMP packets sent by the entity since boot time, including re-transmissions and un-encrypted packets.
C32 isakmpTotalInOctets	1.3.6.1.4.1.9999.1.2.1.4.3	Counter32	read-only	The total amount of ISAKMP traffic received by the entity since boot time, measured in bytes, including any re- transmitted packets received, and including encrypted and un-encrypted packets.
C32 isakmpTotalOutOctets	1.3.6.1.4.1.9999.1.2.1.4.4	Counter32	read-only	The total amount of ISAKMP traffic sent by the entity since boot time, measured in bytes, including any re-transmissions and including encrypted and un-encrypted packets.
isakmpErrors	1.3.6.1.4.1.9999.1.2.1.5			This is the base object identifier for all objects which are global error counters for ISAKMP.
C32 isakmpTotalInitFailures	1.3.6.1.4.1.9999.1.2.1.5.1	Counter32	read-only	The total number of attempts to initiate an ISAKMP phase 1 SA that failed since boot time, when there was a response from the peer entity. This value may be used to detect clogging or denial-of- service attacks.
C32 isakmpTotalInitNoResponses	1.3.6.1.4.1.9999.1.2.1.5.2	Counter32	read-only	The total number of attempts to initiate an ISAKMP phase 1 SA that failed since boot time, when there was no response from the peer entity. This should only be incremented if the peer does not repond to the first packet of attempted negotiations.
C32 isakmpTotalRespFailures	1.3.6.1.4.1.9999.1.2.1.5.3	Counter32	read-only	The total number of attempts to initiate an ISAKMP phase 1 SA that failed since boot time, when the initiation attempt came for the peer entity.
C32 isakmpInvalidCookieCount	1.3.6.1.4.1.9999.1.2.1.5.4	Counter32	read-only	The total number of ISAKMP packets with invalid cookies received by the entity since boot time.
isakmpGroups	1.3.6.1.4.1.9999.1.2.1.6			This is the base object identifier for all objects which describe the groups in this MIB.
isakmpSaGroup	1.3.6.1.4.1.9999.1.2.1.6.1			A collection of objects that describe the state of the security associations of the ISAKMP protocol.
isakmpGlobalsGroup	1.3.6.1.4.1.9999.1.2.1.6.2			A collections of objects that describe the global state of the ISAKMP protocol.
isakmpTrapControlGroup	1.3.6.1.4.1.9999.1.2.1.6.3			Trap control for the ISAKMP protocol.
isakmpTrapDataGroup	1.3.6.1.4.1.9999.1.2.1.6.4			Trap data for the ISAKMP protocol.
isakmpTrapGroup	1.3.6.1.4.1.9999.1.2.1.6.5			The traps for the ISAKMP protocol.
isakmpConformance	1.3.6.1.4.1.9999.1.2.1.7			This is the base object identifier for all objects which describe the conformance for this MIB.
isakmpDoiIndependentMonitorCompliance	1.3.6.1.4.1.9999.1.2.1.7.1			The compliance statement for the SNMPv3 entities which implement the ISAKMP DOI-Indpendent Monitoring MIB.
isakmpTrapControl	1.3.6.1.4.1.9999.1.2.1.8			This is the base object identifier for all trap controls for this MIB.
T/F invalidCookieTrapEnable	1.3.6.1.4.1.9999.1.2.1.8.1	TruthValue	read-write	Indicates whether invalidCookieTrap traps should be generated.
isakmpTraps	1.3.6.1.4.1.9999.1.2.1.9			This is the base object identifier for all traps for this MIB.
isakmpTrapObjects	1.3.6.1.4.1.9999.1.2.1.10			This is the base object identifier for all objects used by traps for this MIB.
IPt localIpAddressType	1.3.6.1.4.1.9999.1.2.1.10.1	InetAddressType	accessible-for-notify	The type of the local IP address used in an ISAKMP message, to be associated with a trap.
IP localIpAddress	1.3.6.1.4.1.9999.1.2.1.10.2	InetAddress	accessible-for-notify	The local IP address used in an ISAKMP message, to be associated with a trap.
INT localUdpPort	1.3.6.1.4.1.9999.1.2.1.10.3	INTEGER	accessible-for-notify	The local port UDP number used in an ISAKMP message, to be associated with a trap.
IPt remoteIpAddressType	1.3.6.1.4.1.9999.1.2.1.10.4	InetAddressType	accessible-for-notify	The type of the remote IP used in an ISAKMP message, to be associated with a trap.
ISA remoteIpAddress	1.3.6.1.4.1.9999.1.2.1.10.5	IsakmpCookie	accessible-for-notify	The remote IPaddress used in an ISAKMP message, to be associated with a trap.
INT remoteUdpPort	1.3.6.1.4.1.9999.1.2.1.10.6	INTEGER	accessible-for-notify	The remote UDP port number used in an ISAKMP message, to be associated with a trap.
ISA initiatorCookie	1.3.6.1.4.1.9999.1.2.1.10.7	IsakmpCookie	accessible-for-notify	The initiator cookie used in an ISAKMP message, to be associated with a trap.
ISA responderCookie	1.3.6.1.4.1.9999.1.2.1.10.8	IsakmpCookie	accessible-for-notify	The responder cookie used in an ISAKMP message, to be associated with a trap.

RFC description

IPsec ISAKMP DOI indicator monitoring MIB for security protocol management and IKE operations.

Start monitoring Vendor-neutral IETF standard (IPsec/VPN gateway, IKE-capable device) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ISAKMP-DOI-IND-MON-MIB

What Is ISAKMP-DOI-IND-MON-MIB?

Supported Devices

Monitoring Examples

This MIB depends on

Related MIBs

How to Use in IPNetwork Monitor

RFC description