All MIBs › JNX-GDOI-MIB
Organization: Juniper Networks, Inc.
Last Updated: 2018-01-04
Category: Domain: Security, VPN and Security, Vendor: Juniper
Description: Defines managed objects for Group Domain of Interpretation (GDOI) on Juniper Networks devices, supporting group key management for IPsec VPN.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is JNX-GDOI-MIB?
JNX-GDOI-MIB is a Juniper Networks enterprise MIB defining managed objects for GDOI (Group Domain of Interpretation), the IETF protocol (RFC 6407) used for group key management in IPsec group VPNs such as GET VPN-style deployments. Per its module description, this initial version covers only Group Member (GM) side notifications and tables: the GDOI group table, GM table, GM key-encryption-key (KEK) table, and GM traffic-encryption-key selector/policy tables. Its monitoring focus is security/software configuration status rather than hardware: it exposes which GDOI groups a device belongs to, group member registration identifiers, and — via associated notifications — key-server registration and rekey events, letting an operator confirm group members are properly registered and receiving updated keys. It explicitly builds on the IETF GDOI protocol standard and depends on Juniper's IPsec/security MIB framework for interface context. It is deployed on Juniper routers/security gateways participating in group-based IPsec VPNs where multiple sites share a common key managed by a central key server. Engineers can download the JNX-GDOI-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in JNX-GDOI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Juniper Networks routers/security gateways
Monitoring Examples
An admin can poll jnxGdoiGroupTable/jnxGdoiGroupEntry indexed by jnxGdoiGroupIdType/jnxGdoiGroupIdValue to confirm a device is registered to the expected GDOI group by jnxGdoiGroupName, and check jnxGdoiGmTable entries (jnxGdoiGmIdType, jnxGdoiGmRegKeyServerIdType) to verify the group member has successfully registered with its key server. Subscribing to jnxGdoiMIBNotifications would alert the admin to a failed re-registration or key-server change, which could otherwise silently break group VPN connectivity for that member.
What Can Be Monitored
- GDOI group membership
- group member registration status
- key server identity
- GDOI notification/trap events
This MIB depends on
Related MIBs
Imported Objects
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From JUNIPER-SMI
| jnxMibs | OBJECT-IDENTITY |
From SNMPv2-SMI
| Counter32 | |
| Counter64 | |
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| DisplayString | |
| TEXTUAL-CONVENTION | |
| TimeInterval |
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| jnxGdoiMIB | 1.3.6.1.4.1.2636.3.759 | Initial version, implements only the GDOI GM notifications and following tables for GDOI protocol. - GDOI Group Table - GDOI Gm Table - GDOI Gm Kek Table - GDOI Gm Tek SelectorTable - GDOI Gm Tek PolicyTable | ||
| jnxGdoiMIBNotifications | 1.3.6.1.4.1.2636.3.759.0 | |||
| NTF jnxGdoiGmRegister | 1.3.6.1.4.1.2636.3.759.0.5 | A notification from a Group Member when it is starting to register with its GDOI Group's Key Server. Registration includes downloading keying & security association material. This is equivalent to a Group Member or Initiator sending the first message of a GROUPKEY-PULL exchange to its Group's Key Server. | ||
| NTF jnxGdoiGmRegistrationComplete | 1.3.6.1.4.1.2636.3.759.0.6 | A notification from a Group Member when it has successfully registered with a Key Server in its GDOI Group. This is equivalent to a Group Member receiving the last message of a GROUPKEY-PULL exchange from the Key Server containing KEKs, TEKs, and their associated policies. | ||
| NTF jnxGdoiGmReRegister | 1.3.6.1.4.1.2636.3.759.0.7 | A notification from a Group Member when it is starting to re-register with a Key Server in its GDOI Group. A Group Member needs to re-register to the key server if its keying & security association material has expired and it has not received a rekey from the key server to refresh the material. This is equivalent to a Group Member sending the first message of a GROUPKEY-PULL exchange to the Key Server of a Group it is already registered with. | ||
| NTF jnxGdoiGmRekeyReceived | 1.3.6.1.4.1.2636.3.759.0.8 | A notification from a Group Member when it has successfully received and processed a rekey from a Key Server in its GDOI Group. Periodically the key server sends a rekey to refresh the keying & security association material. This is equivalent to a Group Member receiving a GROUPKEY-PUSH message from the Key Server of the Group it is already registered with. | ||
| NTF jnxGdoiGmRekeyFailure | 1.3.6.1.4.1.2636.3.759.0.11 | An error notification from a Group Member when it is unable to successfully process and install a rekey (GROUPKEY-PUSH message) sent by the Key Server in its Group that it is registered with. | ||
| jnxGdoiMIBObjects | 1.3.6.1.4.1.2636.3.759.1 | |||
| jnxGdoiGroupTable | 1.3.6.1.4.1.2636.3.759.1.1 | not-accessible | A table of information regarding GDOI Groups in use on the network device being queried. This table is modified to include only fields related to Group Member | |
| jnxGdoiGroupEntry | 1.3.6.1.4.1.2636.3.759.1.1.1 | not-accessible | An entry containing GDOI Group information, uniquely identified by the GDOI Group ID. | |
| JNX jnxGdoiGroupIdType | 1.3.6.1.4.1.2636.3.759.1.1.1.1 | JnxGdoiIdentificationType | not-accessible | The Identification Type Value used to parse a GDOI Group ID. The GDOI RFC 3547 defines the types that can be used as a GDOI Group ID, and RFC 4306 defines all valid types that can be used as an identifier. This Group ID type is sent as the 'ID Type' field of the Identification Payload for a GDOI GROUPKEY-PULL exchange. |
| U32 jnxGdoiGroupIdLength | 1.3.6.1.4.1.2636.3.759.1.1.1.2 | Unsigned32 | read-only | The length (i.e. number of octets) of a Group ID. If no length is given (i.e. it has a value of 0), the default length of its jnxGdoiGroupIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'Payload Length' (subtracting the generic header length) of the Identification Payload for a GDOI GROUPKEY-PULL exchange. |
| JNX jnxGdoiGroupIdValue | 1.3.6.1.4.1.2636.3.759.1.1.1.3 | JnxGdoiIdentificationValue | not-accessible | The value of a Group ID with its type indicated by the jnxGdoiGroupIdType. Use the jnxGdoiGroupIdType to parse the Group ID correctly. This Group ID value is sent as the 'Identification Data' field of the Identification Payload for a GDOI GROUPKEY-PULL exchange. |
| STR jnxGdoiGroupName | 1.3.6.1.4.1.2636.3.759.1.1.1.4 | DisplayString | read-only | The string-readable name configured for or given to a GDOI Group. |
| jnxGdoiPeers | 1.3.6.1.4.1.2636.3.759.1.2 | |||
| jnxGdoiGmTable | 1.3.6.1.4.1.2636.3.759.1.2.2 | not-accessible | A table of information regarding GDOI Group Members (GMs) locally configured on the network device being queried. Note that Local Group Members may or may not be registered to a Key Server in its GDOI Group on the same network device being queried. | |
| jnxGdoiGmEntry | 1.3.6.1.4.1.2636.3.759.1.2.2.1 | not-accessible | An entry containing Local GDOI Group Member information, uniquely identified by Group & GM IDs. Because the Group Member is Local to the network device being queried, TEKs installed for this Group Member can be queried as well. | |
| JNX jnxGdoiGmIdType | 1.3.6.1.4.1.2636.3.759.1.2.2.1.1 | JnxGdoiIdentificationType | not-accessible | The Identification Type Value used to parse the identity information for a Initiator or Group Member. RFC 4306 defines all valid types that can be used as an identifier. These identification types are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges. |
| U32 jnxGdoiGmIdLength | 1.3.6.1.4.1.2636.3.759.1.2.2.1.2 | Unsigned32 | read-only | The length (i.e. number of octets) of a Group Member ID. If no length is given (i.e. it has a value of 0), the default length of its jnxGdoiGmIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges. |
| JNX jnxGdoiGmIdValue | 1.3.6.1.4.1.2636.3.759.1.2.2.1.3 | JnxGdoiIdentificationValue | not-accessible | The value of the identity information for a Group Member with its type indicated by the jnxGdoiGmIdType. Use the jnxGdoiGmIdType to parse the Group Member ID correctly. This Group Member ID value is sent as the 'SRC Identification Data' and 'DST Identification Data' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges. |
| JNX jnxGdoiGmRegKeyServerIdType | 1.3.6.1.4.1.2636.3.759.1.2.2.1.4 | JnxGdoiIdentificationType | read-only | The Identification Type Value used to parse the identity information of this Group Member's registered Key Server. RFC 4306 defines all valid types that can be used as an identifier. These identification types are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges. |
| U32 jnxGdoiGmRegKeyServerIdLength | 1.3.6.1.4.1.2636.3.759.1.2.2.1.5 | Unsigned32 | read-only | The length (i.e. number of octets) of the registered Key Server's ID. If no length is given (i.e. it has a value of 0), the default length of its jnxGdoiGmRegKeyServerIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges. |
| JNX jnxGdoiGmRegKeyServerIdValue | 1.3.6.1.4.1.2636.3.759.1.2.2.1.6 | JnxGdoiIdentificationValue | read-only | The value of the identity information for this Group Member's registered Key Server with its type indicated by the jnxGdoiGmRegKeyServerIdType. Use the jnxGdoiGmRegKeyServerIdType to parse the registered Key Server's ID correctly. This Key Server ID value is sent as the 'SRC Identification Data' and 'DST Identification Data' of the KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges. |
| JNX jnxGdoiGmActiveKEK | 1.3.6.1.4.1.2636.3.759.1.2.2.1.7 | JnxGdoiKekSPI | read-only | The SPI of the Key Encryption Key (KEK) that is currently being used by the Group Member to authenticate & decrypt a rekey from a GROUPKEY-PUSH message. |
| C32 jnxGdoiGmRekeysReceived | 1.3.6.1.4.1.2636.3.759.1.2.2.1.8 | Counter32 | read-only | The sequence number of the last rekey successfully received from this Group Member's registered Key Server. |
| C32 jnxGdoiGmActiveTEKNum | 1.3.6.1.4.1.2636.3.759.1.2.2.1.9 | Counter32 | read-only | The number of active traffic encryption keys (TEKS) currently being used by the Group Member to encrypt/decrypt/authenticate dataplane traffic. |
| jnxGdoiSecAssociations | 1.3.6.1.4.1.2636.3.759.1.3 | |||
| jnxGdoiGmKekTable | 1.3.6.1.4.1.2636.3.759.1.3.2 | not-accessible | A table of information regarding GDOI Key Encryption Key (KEK) Security Associations (SAs) currently installed for GDOI entities acting as Group Members on the network device being queried. There is one entry in this table for each KEK SA that has been installed and not yet deleted. Each KEK SA is uniquely identified by a SPI at any given time. | |
| jnxGdoiGmKekEntry | 1.3.6.1.4.1.2636.3.759.1.3.2.1 | not-accessible | An entry containing the attributes associated with a GDOI KEK SA, uniquely identified by the Group ID, Group Member (GM) ID, & SPI value assigned by the GM's registered Key Server to the KEK. There will be at least one KEK SA entry for each GM & two KEK SA entries for a given GM only during a KEK rekey when a new KEK is received & installed. The KEK SPI is unique for every KEK for a given Group Member. | |
| U32 jnxGdoiGmKekIndex | 1.3.6.1.4.1.2636.3.759.1.3.2.1.1 | Unsigned32 | not-accessible | The index of the GM KEK in table.The value of the index is a number which begins at one and is incremented with each KEK that is used by the GM for that GDOI group. |
| JNX jnxGdoiGmKekSPI | 1.3.6.1.4.1.2636.3.759.1.3.2.1.2 | JnxGdoiKekSPI | read-only | The value of the Security Parameter Index (SPI) of a KEK SA. The SPI must be the ISAKMP Header cookie pair where the first 8 octets become the 'Initiator Cookie' field of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8 octets become the 'Responder Cookie' in the same HDR. As described above, these cookies are assigned by the GCKS. |
| JNX jnxGdoiGmKekSrcIdType | 1.3.6.1.4.1.2636.3.759.1.3.2.1.3 | JnxGdoiIdentificationType | read-only | The Identification Type Value used to parse the identity information for the source of a KEK SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'SRC ID Type' of the KEK payload. |
| U32 jnxGdoiGmKekSrcIdLength | 1.3.6.1.4.1.2636.3.759.1.3.2.1.4 | Unsigned32 | read-only | The length (i.e. number of octets) of the source ID of a KEK SA. If no length is given (i.e. it has a value of 0), the default length of its jnxGdoiGmKekSrcIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' field sent in the KEK payload. |
| JNX jnxGdoiGmKekSrcIdValue | 1.3.6.1.4.1.2636.3.759.1.3.2.1.5 | JnxGdoiIdentificationValue | read-only | The value of the identity information for the source of a KEK SA with its type indicated by the jnxGdoiGmKekSrcIdType. Use the jnxGdoiGmKekSrcIdType to parse the KEK Source ID correctly. This ID value is sent as the 'SRC Identification Data' of a KEK payload. |
| JNX jnxGdoiGmKekSrcIdPort | 1.3.6.1.4.1.2636.3.759.1.3.2.1.6 | JnxGdoiUnsigned16 | read-only | The value specifying a port associated with the source ID of a KEK SA. A value of zero means that the port should be ignored. This port value is sent as the `SRC ID Port` field of a KEK payload. |
| JNX jnxGdoiGmKekDstIdType | 1.3.6.1.4.1.2636.3.759.1.3.2.1.7 | JnxGdoiIdentificationType | read-only | The Identification Type Value used to parse the identity information for the dest. (multicast rekey address) of a KEK SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'DST ID Type' of the KEK payload. |
| U32 jnxGdoiGmKekDstIdLength | 1.3.6.1.4.1.2636.3.759.1.3.2.1.8 | Unsigned32 | read-only | The length (i.e. number of octets) of the destination ID of a KEK SA. If no length is given (i.e. it has a value of 0), the default length of its jnxGdoiGmKekDstIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'DST ID Data Len' field sent in the KEK payload. |
| JNX jnxGdoiGmKekDstIdValue | 1.3.6.1.4.1.2636.3.759.1.3.2.1.9 | JnxGdoiIdentificationValue | read-only | The value of the identity information for the destination of a KEK SA (multicast rekey address) with its type indicated by jnxGdoiGmKekDstIdType. Use the jnxGdoiGmKekDstIdType to parse the KEK Dest. ID correctly. This ID value is sent as the 'DST Identification Data' of a KEK payload. |
| JNX jnxGdoiGmKekDstIdPort | 1.3.6.1.4.1.2636.3.759.1.3.2.1.10 | JnxGdoiUnsigned16 | read-only | The value specifying a port associated with the dest. ID of a KEK SA. A value of zero means that the port should be ignored. This port value is sent as the `DST ID Port` field of a KEK payload. |
| JNX jnxGdoiGmKekIpProtocol | 1.3.6.1.4.1.2636.3.759.1.3.2.1.11 | JnxGdoiIpProtocolId | read-only | The value of the IP protocol ID (e.g. UDP/TCP) being used for the rekey datagram. |
| JNX jnxGdoiGmKekMgmtAlg | 1.3.6.1.4.1.2636.3.759.1.3.2.1.12 | JnxGdoiKeyManagementAlgorithm | read-only | The value of the KEK_MANAGEMENT_ALGORITHM which specifies the group KEK management algorithm used to provide forward or backward access control (i.e. used to exclude group members). KEK Management Type Value ------------------- ----- RESERVED 0 LKH 1 RESERVED 2-127 Private Use 128-255 |
| JNX jnxGdoiGmKekEncryptAlg | 1.3.6.1.4.1.2636.3.759.1.3.2.1.13 | JnxGdoiEncryptionAlgorithm | read-only | The value of the KEK_ALGORITHM which specifies the encryption algorithm used with the KEK SA. A GDOI implementaiton must support KEK_ALG_3DES. Following are the KEK encryption algoritm values defined in the GDOI RFC 3547, however the JnxGdoiEncryptionAlgorithm TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 KEK_ALG_DES 1 KEK_ALG_3DES 2 KEK_ALG_AES 3 RESERVED 4-127 Private Use 128-255 |
| U32 jnxGdoiGmKekEncryptKeyLength | 1.3.6.1.4.1.2636.3.759.1.3.2.1.14 | Unsigned32 | read-only | The value of the KEK_KEY_LENGTH which specifies the KEK Algorithm key length (in bits). |
| JNX jnxGdoiGmKekSigHashAlg | 1.3.6.1.4.1.2636.3.759.1.3.2.1.15 | JnxGdoiPseudoRandomFunction | read-only | The value of the SIG_HASH_ALGORITHM which specifies the SIG payload hash algorithm. This is not required (i.e. could have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a value of zero or SIG_HASH_SHA1). Following are the Signature Hash Algorithm values defined in the GDOI RFC 3547, however the JnxGdoiPseudoRandomFunction TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 SIG_HASH_MD5 1 SIG_HASH_SHA1 2 RESERVED 3-127 Private Use 128-255 |
| JNX jnxGdoiGmKekSigAlg | 1.3.6.1.4.1.2636.3.759.1.3.2.1.16 | JnxGdoiSignatureMethod | read-only | The value of the SIG_ALGORITHM which specifies the SIG payload signature algorithm. A GDOI implementation must support SIG_ALG_RSA. Following are the Signature Algorithm values defined in the GDOI RFC 3547, however the JnxGdoiSignatureMethod TC defines all possible values. Algorithm Type Value -------------- ----- RESERVED 0 SIG_ALG_RSA 1 SIG_ALG_DSS 2 SIG_ALG_ECDSS 3 RESERVED 4-127 Private Use 128-255 |
| U32 jnxGdoiGmKekSigKeyLength | 1.3.6.1.4.1.2636.3.759.1.3.2.1.17 | Unsigned32 | read-only | The value of the SIG_KEY_LENGTH which specifies the length of the SIG payload key. |
| OID jnxGdoiGmKekOakleyGroup | 1.3.6.1.4.1.2636.3.759.1.3.2.1.18 | JnxGdoiDiffieHellmanGroup | read-only | The value of the KE_OAKLEY_GROUP which specifies the OAKLEY or Diffie-Hellman Group used to compute the PFS secret in the optional KE payload of the GDOI GROUPKEY-PULL exchange. |
| U32 jnxGdoiGmKekOriginalLifetime | 1.3.6.1.4.1.2636.3.759.1.3.2.1.19 | Unsigned32 | read-only | The value of the KEK_KEY_LIFETIME which specifies the maximum time for which a KEK is valid. The GCKS may refresh the KEK at any time before the end of the valid period. The value is a four (4) octet (32-bit) number defining a valid time period in seconds. |
| U32 jnxGdoiGmKekRemainingLifetime | 1.3.6.1.4.1.2636.3.759.1.3.2.1.20 | Unsigned32 | read-only | The value of the remaining time for which a KEK is valid. The value is a four (4) octet (32-bit) number which begins at the value of jnxGdoiGmKekOriginalLifetime and counts down to 0 in seconds. If the lifetime has already expired, this value should remain at zero (0) until the GCKS refreshes the KEK. |
| JNX jnxGdoiGmKekStatus | 1.3.6.1.4.1.2636.3.759.1.3.2.1.21 | JnxGdoiKekStatus | read-only | The status of the KEK SA. When this status value is queried, one of the following is returned: inUse(1), new(2), old(3). |
| jnxGdoiGmTekSelectorTable | 1.3.6.1.4.1.2636.3.759.1.3.5 | not-accessible | A table of information regarding GDOI Traffic Encryption Key (TEK) Security Associations (SAs/Policies) pushed by a Key Server & installed for GDOI entities acting as Group Members (GMs) on the network device being queried. There is one entry in this table for each unique TEK traffic selector (Source/Destination tuple) that has been downloaded from the Key Server and installed on the Group Member. | |
| jnxGdoiGmTekSelectorEntry | 1.3.6.1.4.1.2636.3.759.1.3.5.1 | not-accessible | An entry containing the attributes associated with a GDOI TEK Policy/SA, uniquely identified by the Group ID, Group Member ID, Source/Destination IDs & Ports, and TEK SPI. There will be one or more TEK entries for each TEK Policy/SA received and installed by the given Group Member from its registered Key Server, each with a unique 5-tuple. This table does not contain the SPI which is part of the TEK policy table. | |
| U32 jnxGdoiGmTekSelectorIndex | 1.3.6.1.4.1.2636.3.759.1.3.5.1.1 | Unsigned32 | not-accessible | The index of the Source/Destination pair secured by the GM TEK.The value of the index is a number which begins at one and is incremented with each Source/Destination pair that is secured by the GM TEK policy for that GDOI group. |
| JNX jnxGdoiGmTekSrcIdType | 1.3.6.1.4.1.2636.3.759.1.3.5.1.2 | JnxGdoiIdentificationType | read-only | The Identification Type Value used to parse the identity information for the source of a TEK Policy/SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'SRC ID Type' of the TEK payload. |
| U32 jnxGdoiGmTekSrcIdLength | 1.3.6.1.4.1.2636.3.759.1.3.5.1.3 | Unsigned32 | read-only | The length (i.e. number of octets) of the source ID of a TEK Policy/SA. If no length is given (i.e. it has a value of 0), the default length of its jnxGdoiGmTekSrcIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'SRC ID Data Len' field sent in the TEK payload. |
| JNX jnxGdoiGmTekSrcIdValue | 1.3.6.1.4.1.2636.3.759.1.3.5.1.4 | JnxGdoiIdentificationValue | read-only | The value of the identity information for the source of a TEK Policy/SA with its type indicated by the jnxGdoiGmTekSrcIdType. Use the jnxGdoiGmTekSrcIdType to parse the TEK Source ID correctly. This ID value is sent as the 'SRC Identification Data' of a TEK payload. |
| JNX jnxGdoiGmTekSrcIdPort | 1.3.6.1.4.1.2636.3.759.1.3.5.1.5 | JnxGdoiUnsigned16 | read-only | The value specifying a port associated with the source ID of a TEK Policy/SA. A value of zero means that the port should be ignored. This port value is sent as the `SRC ID Port` field of a TEK payload. |
| JNX jnxGdoiGmTekDstIdType | 1.3.6.1.4.1.2636.3.759.1.3.5.1.6 | JnxGdoiIdentificationType | read-only | The Identification Type Value used to parse the identity information for the dest. of a TEK Policy/SA. RFC 4306 defines all valid types that can be used as an identifier. This identification type is sent as the 'DST ID Type' of the TEK payload. |
| U32 jnxGdoiGmTekDstIdLength | 1.3.6.1.4.1.2636.3.759.1.3.5.1.7 | Unsigned32 | read-only | The length (i.e. number of octets) of the destination ID of a TEK Policy/SA. If no length is given (i.e. it has a value of 0), the default length of its jnxGdoiGmTekDstIdType should be used as long as it is not reprsented by an ASCII string. If the value has a type that is represented by an ASCII string, a length MUST be included. If the length given is not 0, it should match the 'DST ID Data Len' field sent in the TEK payload. |
| JNX jnxGdoiGmTekDstIdValue | 1.3.6.1.4.1.2636.3.759.1.3.5.1.8 | JnxGdoiIdentificationValue | read-only | The value of the identity information for the destination of a TEK Policy/SA with its type indicated by the jnxGdoiGmTekDstIdType. Use the jnxGdoiGmTekDstIdType to parse the TEK Dest. ID correctly. This ID value is sent as the 'DST Identification Data' of a TEK payload. |
| JNX jnxGdoiGmTekDstIdPort | 1.3.6.1.4.1.2636.3.759.1.3.5.1.9 | JnxGdoiUnsigned16 | read-only | The value specifying a port associated with the dest. ID of a TEK Policy/SA. A value of zero means that the port should be ignored. This port value is sent as the `DST ID Port` field of a TEK payload. |
| JNX jnxGdoiGmTekSecurityProtocol | 1.3.6.1.4.1.2636.3.759.1.3.5.1.10 | JnxGdoiSecurityProtocol | read-only | The value of the Protocol-ID field of a SA TEK (SAT) payload which specifies the Security Protocol for a TEK. Following are the Security Protocol values defined in the GDOI RFC 3547, however the JnxGdoiSecurityProtocol TC defines all possible values. Protocol ID Value ---------------------- ----- RESERVED 0 GDOI_PROTO_IPSEC_ESP 1 RESERVED 2-127 Private Use 128-255 |
| JNX jnxGdoiGmTekPolicyMismatchAction | 1.3.6.1.4.1.2636.3.759.1.3.5.1.11 | JnxGdoiPolicyMismatchAction | read-only | Default action for packets that does not match TEK Policy/SA received from group key server |
| jnxGdoiGmTekPolicyTable | 1.3.6.1.4.1.2636.3.759.1.3.6 | not-accessible | A table of information regarding GDOI Traffic Encryption Key (TEK) Security Associations (SAs/Policies) received by a Key Server & installed for GDOI entities acting as Group Members (GMs) on the network device being queried. There is one entry in this table for each TEK SA that has been installed on the Group Member. | |
| jnxGdoiGmTekPolicyEntry | 1.3.6.1.4.1.2636.3.759.1.3.6.1 | not-accessible | An entry containing the attributes associated with a GDOI TEK Policy/SA, uniquely identified by the Group ID, Group Member ID, TEK Selector (Source/Destination IDs & Ports), and TEK Policy index (TEK SPI and direction). There will be one or more TEK entries for each TEK Policy/SA received and installed by the given Group Member from its registered Key Server, each with a unique tuple. This table contains the SPI information corresponding to a TEK Selector index. | |
| U32 jnxGdoiGmTekPolicyIndex | 1.3.6.1.4.1.2636.3.759.1.3.6.1.1 | Unsigned32 | not-accessible | The index of the SPI used to secure the GM TEK.The value of the index is a number which begins at one and is incremented with each row of the GM TEK SPI table. |
| JNX jnxGdoiGmTekSPI | 1.3.6.1.4.1.2636.3.759.1.3.6.1.2 | JnxGdoiTekSPI | read-only | The value of the Security Parameter Index (SPI) of a TEK Policy/SA. The SPI must be the SPI for ESP. |
| JNX jnxGdoiGmTekEncapsulationMode | 1.3.6.1.4.1.2636.3.759.1.3.6.1.3 | JnxGdoiEncapsulationMode | read-only | The value of the Encapsulation Mode of a TEK (IPsec SA). Following are the Encapsulation Mode values defined in RFC 2407, however the JnxGdoiEncapsulationMode TC defines all possible values. Encapsulation Mode Value ------------------ ----- RESERVED 0 Tunnel 1 Transport 2 |
| JNX jnxGdoiGmTekEncryptionAlgorithm | 1.3.6.1.4.1.2636.3.759.1.3.6.1.4 | JnxGdoiEncryptionAlgorithm | read-only | The value of the Transform ID field of a PROTO_IPSEC_ESP payload which specifies the ESP transform to be used. If no encryption is used, this value will be zero (0). Following are the ESP Transform values defined in RFC 2407, however the JnxGdoiEncryptionAlgorithm TC defines all possible values. IPsec ESP Transform ID Value ------------------------ ----- RESERVED 0 ESP_DES_IV64 1 ESP_DES 2 ESP_3DES 3 ESP_RC5 4 ESP_IDEA 5 ESP_CAST 6 ESP_BLOWFISH 7 ESP_3IDEA 8 ESP_DES_IV32 9 ESP_RC4 10 ESP_NULL 11 |
| U32 jnxGdoiGmTekEncryptionKeyLength | 1.3.6.1.4.1.2636.3.759.1.3.6.1.5 | Unsigned32 | read-only | The length of the key used for encryption in a TEK (in bits). |
| NUM jnxGdoiGmTekIntegrityAlgorithm | 1.3.6.1.4.1.2636.3.759.1.3.6.1.6 | JnxGdoiIntegrityAlgorithm | read-only | The value of the Authentication Algorithm for a TEK IPsec ESP SA. If no authentication is used, this value will be zero (0). Following are the Authentication Algorithm values defined in RFC 2407, however the JnxGdoiEncryptionAlgorithm TC defines all possible values. Algorithm Type Value -------------- ----- HMAC-MD5 1 HMAC-SHA 2 DES-MAC 3 KPDK 4 |
| U32 jnxGdoiGmTekIntegrityKeyLength | 1.3.6.1.4.1.2636.3.759.1.3.6.1.7 | Unsigned32 | read-only | The length of the key used for integrity/authentication in a TEK (in bits). |
| U32 jnxGdoiGmTekWindowSize | 1.3.6.1.4.1.2636.3.759.1.3.6.1.8 | Unsigned32 | read-only | The size of the Time Based Anti-Replay (TBAR) window used by this TEK Policy/SA. |
| U32 jnxGdoiGmTekOriginalLifetime | 1.3.6.1.4.1.2636.3.759.1.3.6.1.9 | Unsigned32 | read-only | The value of the SA Life Type defined in RFC 2407 which specifies the maximum time for which a TEK IPsec SA is valid. The GCKS may refresh the TEK at any time before the end of the valid period. The value is a four (4) octet (32-bit) number defining a valid time period in seconds. |
| U32 jnxGdoiGmTekRemainingLifetime | 1.3.6.1.4.1.2636.3.759.1.3.6.1.10 | Unsigned32 | read-only | The value of the remaining time for which a TEK is valid. The value is a four (4) octet (32-bit) number which begins at the value of jnxGdoiGmTekOriginalLifetime and counts down to 0 in seconds. |
| JNX jnxGdoiGmTekStatus | 1.3.6.1.4.1.2636.3.759.1.3.6.1.11 | JnxGdoiTekStatus | read-only | The status of the TEK Policy/SA. When this status value is queried, one of the following is returned: inbound(1), outbound(2), biDirectional(3). |
RFC description
Juniper Networks Group Domain of Interpretation MIB for managing multicast key distribution and group security policies.
Start monitoring Juniper Networks router/security gateway (GDOI group VPN key management) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.