NETWORK-ALCHEMY-IPSEC-MIB

All MIBs › NETWORK-ALCHEMY-IPSEC-MIB

Organization: Network Alchemy, Inc.

Last Updated: 2000-10-25

Category: IPSec/VPN

Description: Monitors IPsec tunnel states, SA counts, and VPN throughput on Network Alchemy security appliances.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETWORK-ALCHEMY-IPSEC-MIB?

NETWORK-ALCHEMY-IPSEC-MIB is a vendor-specific MIB from Network Alchemy, Inc. (a maker of IPsec/VPN crypto cluster appliances) that exposes aggregate, appliance-wide IPsec statistics rather than a per-tunnel table. It is organized into replayStats (replayStatsWraps, replayStatsReplays, replayStatsoutofrange), naIKEStats (naIKEStatsacounts for total ISAKMP SAs, naIKEStatsmainmodes/quickmodes/aggressivemodes, naIKEStatsbadhash/badsig for authentication failures), naAHStats and naESPStats (per-protocol sent/received datagram counts, crypto-processing distribution across server process/secondary processor/HiFn hardware accelerator, output/input errors, SA lookup failures, replay detections), and naKeyStats. These scalar counters are useful for monitoring the overall health and load of the IPsec crypto engine — authentication failure rates, hardware-offload utilization, and SA churn — even though they don't break results down by individual tunnel or peer. It depends on the vendor's NETAL-SMI module for its OID root and standard SNMPv2-SMI/TC imports, and is deployed on Network Alchemy IPsec/VPN cluster appliances; this NETWORK-ALCHEMY-IPSEC-MIB is used for SNMP monitoring of IPsec crypto engine health.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETWORK-ALCHEMY-IPSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Network Alchemy IPsec/VPN crypto cluster appliances

Monitoring Examples

An operator polls naESPStats objects to track esp output/input error counts and SA lookup failures alongside naIKEStatsacounts for the total ISAKMP SA count; a rising naESPStats error counter combined with a flat or falling ISAKMP SA total would indicate the crypto hardware is failing to process ESP traffic even as new tunnels attempt to negotiate.

What Can Be Monitored

anti-replay window statistics
IKE/ISAKMP SA counts and negotiation-mode counters
AH and ESP sent/received datagram counters
crypto processing distribution (server/secondary/hardware accelerator)
output/input errors and resource-allocation drops
SA lookup failure and replay-detection counts

Imported Objects

From NETAL-SMI

ipsec	OBJECT-IDENTITY
netalModules	OBJECT-IDENTITY

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

How to Use in IPNetwork Monitor

Example using replayStatsWraps OID:

Select a Network Alchemy IPsec/VPN crypto cluster appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type replayStatsWraps into the Find box to locate it in the OID tree, then select it and click OK. It reports the number of wrapped sequence numbers detected. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if the count changes from its expected baseline, since that would indicate the underlying set of items changed unexpectedly. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
replayStats	1.3.6.1.4.1.2972.2.2.1
I32 replayStatsWrapsEx	1.3.6.1.4.1.2972.2.2.1.1	Integer32	read-only	Number of wrapped sequence numbers detected
I32 replayStatsReplays	1.3.6.1.4.1.2972.2.2.1.2	Integer32	read-only	Number of legit replayed packets detected
I32 replayStatsoutofrange	1.3.6.1.4.1.2972.2.2.1.3	Integer32	read-only	Number of packets earlier than left edge detected
I32 replayStatstimewarps	1.3.6.1.4.1.2972.2.2.1.4	Integer32	read-only	Number of packets that warped the window's left edge
I32 replayStatsstale	1.3.6.1.4.1.2972.2.2.1.5	Integer32	read-only	Number of packets in replay update table
I32 replayStatsreset	1.3.6.1.4.1.2972.2.2.1.6	Integer32	read-only	Total resets performed
I32 replayStatsdeferred	1.3.6.1.4.1.2972.2.2.1.7	Integer32	read-only	Number of REPLAY-UPDATE messages on lookaside
naIKEStats	1.3.6.1.4.1.2972.2.2.2
I32 naIKEStatsbadhash	1.3.6.1.4.1.2972.2.2.2.1	Integer32	read-only	Total authentication failures (pre-shared)
I32 naIKEStatsbadsig	1.3.6.1.4.1.2972.2.2.2.2	Integer32	read-only	Total authentication failures (RSA/DSS)
I32 naIKEStatsinvalidcookies	1.3.6.1.4.1.2972.2.2.2.3	Integer32	read-only	Total packets dropped due to bad cookies
I32 naIKEStatsacounts	1.3.6.1.4.1.2972.2.2.2.4	Integer32	read-only	Total ISAKMP SA's
I32 naIKEStatsmainmodes	1.3.6.1.4.1.2972.2.2.2.5	Integer32	read-only	Total Main Modes
I32 naIKEStatsquickmodes	1.3.6.1.4.1.2972.2.2.2.6	Integer32	read-only	Total Quick Modes
I32 naIKEStatsaggressivemodes	1.3.6.1.4.1.2972.2.2.2.7	Integer32	read-only	Total Aggressive Modes
I32 naIKEStatsnewgroupmodes	1.3.6.1.4.1.2972.2.2.2.8	Integer32	read-only	Total Oakley New Group Modes
I32 naIKEStatsfailedsend	1.3.6.1.4.1.2972.2.2.2.9	Integer32	read-only	Total number of failed ISAKMP sendto's
I32 naIKEStatstotalnetwork	1.3.6.1.4.1.2972.2.2.2.10	Integer32	read-only	Total ISAKMP messages received
I32 naIKEStatstotalsend	1.3.6.1.4.1.2972.2.2.2.11	Integer32	read-only	Total ISAKMP messages sent
I32 naIKEStatstotalsaapi	1.3.6.1.4.1.2972.2.2.2.12	Integer32	read-only	Total PFKEY messages received
I32 naIKEStatstotalipc	1.3.6.1.4.1.2972.2.2.2.13	Integer32	read-only	Total PF_LOCAL messages received
I32 naIKEStatstotalmanual	1.3.6.1.4.1.2972.2.2.2.14	Integer32	read-only	Total number of manual key acquire's
I32 naIKEStatstotalauto	1.3.6.1.4.1.2972.2.2.2.15	Integer32	read-only	Total number of automatic key acquire's
I32 naIKEStatstransitions	1.3.6.1.4.1.2972.2.2.2.16	Integer32	read-only	Cluster state transitions
I32 naIKEStatssentsa	1.3.6.1.4.1.2972.2.2.2.17	Integer32	read-only	SA's distributed
I32 naIKEStatssentipsecsapair	1.3.6.1.4.1.2972.2.2.2.18	Integer32	read-only	IPSEC SA pair's distributed
I32 naIKEStatssentpacket	1.3.6.1.4.1.2972.2.2.2.19	Integer32	read-only	PACKET's sent
I32 naIKEStatsrecvsa	1.3.6.1.4.1.2972.2.2.2.20	Integer32	read-only	SA's processed
I32 naIKEStatsrecvipsecsapair	1.3.6.1.4.1.2972.2.2.2.21	Integer32	read-only	IPSEC SA pair's processed
I32 naIKEStatsrecvpacket	1.3.6.1.4.1.2972.2.2.2.22	Integer32	read-only	PACKET's received
I32 naIKEStatssentinitialstate	1.3.6.1.4.1.2972.2.2.2.23	Integer32	read-only	IPSEC IKE stat sent_initial_state
I32 naIKEStatssentflush	1.3.6.1.4.1.2972.2.2.2.24	Integer32	read-only	IPSEC IKE statsent_flush
I32 naIKEStatssentcryptostate	1.3.6.1.4.1.2972.2.2.2.25	Integer32	read-only	IPSEC IKE stat sent_crypto_state
I32 naIKEStatssentacquire	1.3.6.1.4.1.2972.2.2.2.26	Integer32	read-only	IPSEC IKE stat sent_acquire
I32 naIKEStatssentipseclifetime	1.3.6.1.4.1.2972.2.2.2.27	Integer32	read-only	IPSEC IKE stat sent_ipsec_lifetime
I32 naIKEStatssentikelifetime	1.3.6.1.4.1.2972.2.2.2.28	Integer32	read-only	IPSEC IKE statsent_ike_lifetime
I32 naIKEStatssentdelete	1.3.6.1.4.1.2972.2.2.2.29	Integer32	read-only	IPSEC IKE sent_delete
I32 naIKEStatssentselector	1.3.6.1.4.1.2972.2.2.2.30	Integer32	read-only	IPSEC IKE sent_selector
I32 naIKEStatsrecvjoin	1.3.6.1.4.1.2972.2.2.2.31	Integer32	read-only	IPSEC IKE recv_join
I32 naIKEStatsrecvrejoin	1.3.6.1.4.1.2972.2.2.2.32	Integer32	read-only	IPSEC IKE recv_rejoin
I32 naIKEStatsrecvflush	1.3.6.1.4.1.2972.2.2.2.33	Integer32	read-only	IPSEC IKE recv_flush
I32 naIKEStatsrecvcryptostate	1.3.6.1.4.1.2972.2.2.2.34	Integer32	read-only	IPSEC IKE recv_crypto_state
I32 naIKEStatsrecvacquire	1.3.6.1.4.1.2972.2.2.2.35	Integer32	read-only	IPSEC IKE recv_acquire
I32 naIKEStatsrecvipseclifetime	1.3.6.1.4.1.2972.2.2.2.36	Integer32	read-only	IPSEC IKE recv_ipsec_lifetime
I32 naIKEStatsrecvikelifetime	1.3.6.1.4.1.2972.2.2.2.37	Integer32	read-only	IPSEC IKE recv_ike_lifetime
I32 naIKEStatsrecvdelete	1.3.6.1.4.1.2972.2.2.2.38	Integer32	read-only	IPSEC IKE recv_delete
I32 naIKEStatsrecvselector	1.3.6.1.4.1.2972.2.2.2.39	Integer32	read-only	IPSEC IKE recv_selector
I32 naIKEStatssentinhibit	1.3.6.1.4.1.2972.2.2.2.40	Integer32	read-only	IPSEC IKE sent_inhibit
I32 naIKEStatsrecvinhibit	1.3.6.1.4.1.2972.2.2.2.41	Integer32	read-only	IPSEC IKE recv_inhibit
naAHStats	1.3.6.1.4.1.2972.2.2.3
I32 naAHStatssent	1.3.6.1.4.1.2972.2.2.3.1	Integer32	read-only	Total datagrams sent
I32 naAHStatstunnelsent	1.3.6.1.4.1.2972.2.2.3.2	Integer32	read-only	Total tunnelled datagrams sent
I32 naAHStatstransportsent	1.3.6.1.4.1.2972.2.2.3.3	Integer32	read-only	Total transport datagrams sent
I32 naAHStatsqueuesent	1.3.6.1.4.1.2972.2.2.3.4	Integer32	read-only	Output packets processed by crypto server process
I32 naAHStatscpusent	1.3.6.1.4.1.2972.2.2.3.5	Integer32	read-only	Output packets processed by secondary processor
I32 naAHStatsidlesent	1.3.6.1.4.1.2972.2.2.3.6	Integer32	read-only	Output packets processed by idle loop
I32 naAHStatshifnsent	1.3.6.1.4.1.2972.2.2.3.7	Integer32	read-only	Output packets processed by a HiFn 77x1 processor
I32 naAHStatsouterrors	1.3.6.1.4.1.2972.2.2.3.8	Integer32	read-only	Output errors
I32 naAHStatsoutdrops	1.3.6.1.4.1.2972.2.2.3.9	Integer32	read-only	Packets dropped due to resource allocation failures
I32 naAHStatsreceived	1.3.6.1.4.1.2972.2.2.3.10	Integer32	read-only	Total datagrams received
I32 naAHStatstunnelrcvd	1.3.6.1.4.1.2972.2.2.3.11	Integer32	read-only	Total tunnelled datagrams received
I32 naAHStatstransportrcvd	1.3.6.1.4.1.2972.2.2.3.12	Integer32	read-only	Total transport datagrams received
I32 naAHStatsqueuercvd	1.3.6.1.4.1.2972.2.2.3.13	Integer32	read-only	Input packets processed by crypto server process
I32 naAHStatscpurcvd	1.3.6.1.4.1.2972.2.2.3.14	Integer32	read-only	Input packets processed by secondary processor
I32 naAHStatsidlercvd	1.3.6.1.4.1.2972.2.2.3.15	Integer32	read-only	Input packets processed by idle loop
I32 naAHStatshifnrcvd	1.3.6.1.4.1.2972.2.2.3.16	Integer32	read-only	Input packets processed by a HiFn 77x1 processor
I32 naAHStatsinerrors	1.3.6.1.4.1.2972.2.2.3.17	Integer32	read-only	Input errors
I32 naAHStatsindrops	1.3.6.1.4.1.2972.2.2.3.18	Integer32	read-only	Packets dropped due to resource allocation failures
I32 naAHStatssafailures	1.3.6.1.4.1.2972.2.2.3.19	Integer32	read-only	Total SA lookup failures
I32 naAHStatsreplay	1.3.6.1.4.1.2972.2.2.3.20	Integer32	read-only	Total replayed packets detected
I32 naAHStatsfragments	1.3.6.1.4.1.2972.2.2.3.21	Integer32	read-only	Total fragmented datagrams received (and discarded)
I32 naAHStatshifnrefused	1.3.6.1.4.1.2972.2.2.3.22	Integer32	read-only	Total packets not sent to HiFn
I32 naAHStatscpurefused	1.3.6.1.4.1.2972.2.2.3.23	Integer32	read-only	Total packets refused by secondary CPU queue
naESPStats	1.3.6.1.4.1.2972.2.2.4
I32 naESPStatssent	1.3.6.1.4.1.2972.2.2.4.1	Integer32	read-only	Total datagrams sent
I32 naESPStatstunnelsent	1.3.6.1.4.1.2972.2.2.4.2	Integer32	read-only	Total tunnelled datagrams sent
I32 naESPStatstransportsent	1.3.6.1.4.1.2972.2.2.4.3	Integer32	read-only	Total transport datagrams sent
I32 naESPStatsqueuesent	1.3.6.1.4.1.2972.2.2.4.4	Integer32	read-only	Output packets processed by crypto server process
I32 naESPStatscpusent	1.3.6.1.4.1.2972.2.2.4.5	Integer32	read-only	Output packets processed by secondary processor
I32 naESPStatsidlesent	1.3.6.1.4.1.2972.2.2.4.6	Integer32	read-only	Output packets processed by idle loop
I32 naESPStatshifnsent	1.3.6.1.4.1.2972.2.2.4.7	Integer32	read-only	Output packets processed by a HiFn 77x1 processor
I32 naESPStatsouterrors	1.3.6.1.4.1.2972.2.2.4.8	Integer32	read-only	Output errors
I32 naESPStatsoutdrops	1.3.6.1.4.1.2972.2.2.4.9	Integer32	read-only	Packets dropped due to resource allocation failures
I32 naESPStatsreceived	1.3.6.1.4.1.2972.2.2.4.10	Integer32	read-only	Total datagrams received
I32 naESPStatstunnelrcvd	1.3.6.1.4.1.2972.2.2.4.11	Integer32	read-only	Total tunnelled datagrams received
I32 naESPStatstransportrcvd	1.3.6.1.4.1.2972.2.2.4.12	Integer32	read-only	Total transport datagrams received
I32 naESPStatsqueuercvd	1.3.6.1.4.1.2972.2.2.4.13	Integer32	read-only	Input packets processed by crypto server process
I32 naESPStatscpurcvd	1.3.6.1.4.1.2972.2.2.4.14	Integer32	read-only	Input packets processed by secondary processor
I32 naESPStatsidlercvd	1.3.6.1.4.1.2972.2.2.4.15	Integer32	read-only	Input packets processed by idle loop
I32 naESPStatshifnrcvd	1.3.6.1.4.1.2972.2.2.4.16	Integer32	read-only	Input packets processed by a HiFn 77x1 processor
I32 naESPStatsinerrors	1.3.6.1.4.1.2972.2.2.4.17	Integer32	read-only	Input errors
I32 naESPStatsindrops	1.3.6.1.4.1.2972.2.2.4.18	Integer32	read-only	Packets dropped due to resource allocation failures
I32 naESPStatssafailures	1.3.6.1.4.1.2972.2.2.4.19	Integer32	read-only	Total SA lookup failures
I32 naESPStatsreplay	1.3.6.1.4.1.2972.2.2.4.20	Integer32	read-only	Total replayed packets detected
I32 naESPStatsfragments	1.3.6.1.4.1.2972.2.2.4.21	Integer32	read-only	Total fragmented datagrams received (and discarded)
I32 naESPStatspadverifyfailures	1.3.6.1.4.1.2972.2.2.4.22	Integer32	read-only	Total packet padding verification failures
I32 naESPStatssignaturefailures	1.3.6.1.4.1.2972.2.2.4.23	Integer32	read-only	Total input packets rejected due to bad signature
I32 naESPStatsweakkey	1.3.6.1.4.1.2972.2.2.4.24	Integer32	read-only	Total weak cryptographic keys detected
I32 naESPStatskeyparity	1.3.6.1.4.1.2972.2.2.4.25	Integer32	read-only	Total DES key parity errors detected
I32 naESPStatshifnrefused	1.3.6.1.4.1.2972.2.2.4.26	Integer32	read-only	Total packets not sent to Hi/fn
I32 naESPStatscpurefused	1.3.6.1.4.1.2972.2.2.4.27	Integer32	read-only	Total packets refused by secondary CPU queue
naKeyStats	1.3.6.1.4.1.2972.2.2.5
I32 naKeyStatssyntax	1.3.6.1.4.1.2972.2.2.5.1	Integer32	read-only	Total malformed messages
I32 naKeyStatsoutbound	1.3.6.1.4.1.2972.2.2.5.2	Integer32	read-only	Total SAs in general hash table
I32 naKeyStatsinbound	1.3.6.1.4.1.2972.2.2.5.3	Integer32	read-only	Total SAs in inbound SPI table
I32 naKeyStatspending	1.3.6.1.4.1.2972.2.2.5.4	Integer32	read-only	Total pending SAs in pending list
I32 naKeyStatsselectors	1.3.6.1.4.1.2972.2.2.5.5	Integer32	read-only	Total number of selectors in SPD
I32 naKeyStatsoutlast	1.3.6.1.4.1.2972.2.2.5.6	Integer32	read-only	Total outbound packets that matched last SA used
I32 naKeyStatsouthash	1.3.6.1.4.1.2972.2.2.5.7	Integer32	read-only	Total outbound packets found in outbound hash table
I32 naKeyStatsoutnew	1.3.6.1.4.1.2972.2.2.5.8	Integer32	read-only	Total outbound packets resulting in new KM requests
I32 naKeyStatsinlast	1.3.6.1.4.1.2972.2.2.5.9	Integer32	read-only	Total inbound packets that matched last SA used
I32 naKeyStatsinhash	1.3.6.1.4.1.2972.2.2.5.10	Integer32	read-only	Total inbound packets found in inbound hash table
I32 naKeyStatsrefresh	1.3.6.1.4.1.2972.2.2.5.11	Integer32	read-only	Total key refresh messages delivered
I32 naKeyStatsreaped	1.3.6.1.4.1.2972.2.2.5.12	Integer32	read-only	Total SAs reaped
I32 naKeyStatsreapedlarval	1.3.6.1.4.1.2972.2.2.5.13	Integer32	read-only	Total pending entries deleted
I32 naKeyStatsbypass	1.3.6.1.4.1.2972.2.2.5.14	Integer32	read-only	Total bypass selectors matched (output)
I32 naKeyStatsdrop	1.3.6.1.4.1.2972.2.2.5.15	Integer32	read-only	Total drop selectors matched (output)
I32 naKeyStatsprotect	1.3.6.1.4.1.2972.2.2.5.16	Integer32	read-only	Total protect selectors matched (output)
I32 naKeyStatsinbypass	1.3.6.1.4.1.2972.2.2.5.17	Integer32	read-only	Total bypass selectors matched (input)
I32 naKeyStatsindrop	1.3.6.1.4.1.2972.2.2.5.18	Integer32	read-only	Total drop selectors matched (input)
I32 naKeyStatsinprotect	1.3.6.1.4.1.2972.2.2.5.19	Integer32	read-only	Total protect selectors matched (input)
I32 naKeyStatsstallq	1.3.6.1.4.1.2972.2.2.5.20	Integer32	read-only	Total packets on stall queue
I32 naKeyStatsnomatch	1.3.6.1.4.1.2972.2.2.5.21	Integer32	read-only	Total packets not matching any selector (output)
I32 naKeyStatsinnomatch	1.3.6.1.4.1.2972.2.2.5.22	Integer32	read-only	Total packets not matching any selector (input)
I32 naKeyStatsinmismatch	1.3.6.1.4.1.2972.2.2.5.23	Integer32	read-only	Total packets dropped due to security policy mismatch (input)
I32 naKeyStatsadvmtusent	1.3.6.1.4.1.2972.2.2.5.24	Integer32	read-only	Total advisory MTU ICMP messages sent
I32 naKeyStatsadvmturcvd	1.3.6.1.4.1.2972.2.2.5.25	Integer32	read-only	Total advisory MTU ICMP messages received
I32 naKeyStatsphantom	1.3.6.1.4.1.2972.2.2.5.26	Integer32	read-only	Total phantom SPIs causing reverse negotiations
I32 naKeyStatsdynamicselectors	1.3.6.1.4.1.2972.2.2.5.27	Integer32	read-only	Total dynamic selectors
I32 naKeyStatstoolarge	1.3.6.1.4.1.2972.2.2.5.28	Integer32	read-only	Total packets discarded because they would become too large (output)
networkAlchemyIPSECMIB	1.3.6.1.4.1.2972.5.3			IPSEC MIB module.

RFC description

Monitors IPsec performance statistics including IKE, AH, ESP, and replay attack detection in Network Alchemy systems.

Start monitoring Network Alchemy IPsec/VPN crypto cluster appliance with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETWORK-ALCHEMY-IPSEC-MIB