ONEACCESS-IPSEC-MIB

All MIBs › ONEACCESS-IPSEC-MIB

Organization: OneAccess

Last Updated: 2011-10-27

Category: CPE/Router

Description: Manages IPsec VPN tunnel configuration, SA status, and traffic statistics on OneAccess CPE routers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ONEACCESS-IPSEC-MIB?

ONEACCESS-IPSEC-MIB is a vendor MIB from OneAccess (a CPE/router manufacturer) used to manage and monitor IPsec VPN functionality on OneAccess customer-premises routers. It exposes configuration data for IPsec tunnels and ISAKMP/IKE parameters, along with runtime Security Association (SA) status and per-tunnel traffic statistics, plus notification objects for IPsec and ISAKMP events. Its monitoring emphasis is on VPN tunnel health and security state: administrators track whether SAs are established or have failed/expired, watch traffic counters to confirm a tunnel is actively passing data, and rely on the notification objects (oacIPSecNotifications, oacIsakmpNotifications) to be alerted in real time to tunnel failures or renegotiation events. It builds on standard IPsec/IKE concepts defined by IETF (RFC 2401 family and related IPsec/IKE standards) even though the objects themselves are proprietary. It is typically deployed on OneAccess branch/edge routers providing site-to-site or remote-access VPN connectivity in enterprise WAN deployments. Engineers can download the ONEACCESS-IPSEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ONEACCESS-IPSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

OneAccess CPE routers
OneAccess branch/edge VPN routers

Monitoring Examples

An operator would subscribe to oacIPSecNotifications and oacIsakmpNotifications traps to be alerted immediately when an IPsec tunnel goes down or an ISAKMP/IKE negotiation fails, then correlate that with tunnel configuration and SA status objects to determine whether the failure was a key mismatch, timeout, or peer unreachability. Repeated ISAKMP notification traps for the same peer would indicate a persistent IKE negotiation problem needing configuration review.

What Can Be Monitored

IPsec tunnel configuration
Security Association (SA) status
per-tunnel traffic statistics
IPsec failure notifications
ISAKMP/IKE negotiation notifications

Imported Objects

From IF-MIB

ifIndex

OBJECT-TYPE

From ONEACCESS-GLOBAL-REG

oacExpIMIPSec	OBJECT-IDENTITY
oacExpIMIp	OBJECT-IDENTITY
oacMIBModules	OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TimeInterval

OIDs

OID symbolic	OID numeric	Description
oacNatMIBModule	1.3.6.1.4.1.13191.1.100.675	Contact updated
oacIPSecNotifications	1.3.6.1.4.1.13191.10.3.1.4.1
NTF oacIPSecSAcreated	1.3.6.1.4.1.13191.10.3.1.4.1.1	An IPSec SA created notification signifies that the device created an IPSec security association.
NTF oacIPSecSAremoved	1.3.6.1.4.1.13191.10.3.1.4.1.2	An IPSec SA removed notification signifies that the device removed an IPSec security association.
NTF oacIPSecCmapEnabled	1.3.6.1.4.1.13191.10.3.1.4.1.3	An IPSec crypto map enabled notification signifies that the device validated the crypto map attached to an interface and the crypto map becomes valid on this interface.
NTF oacIPSecCmapDisabled	1.3.6.1.4.1.13191.10.3.1.4.1.4	An IPSec crypto map disabled notification signifies that the device did not validate the crypto map attached to an interface and the crypto map becomes invalid on this interface.
NTF oacIPSecCpolEnabled	1.3.6.1.4.1.13191.10.3.1.4.1.5	An IPSec crypto map policy enabled notification signifies that the device validated the crypto map policy. configuration is considered as active and can be used by Isakmp daemon, or IPSec manual keying.
NTF oacIPSecCpolDisabled	1.3.6.1.4.1.13191.10.3.1.4.1.6	An IPSec crypto map policy disabled notification signifies that the device did not validate the crypto map policy. Configuration is considered as inactive and can not be used by Isakmp or manual IPSec manual keying.
NTF oacIPSecHwModuleDown	1.3.6.1.4.1.13191.10.3.1.4.1.7	An IPSec hardware module down notification signifies that the device can not use any hardware encryption module, because it is not activated, or it is not present on the device.
oacIsakmpNotifications	1.3.6.1.4.1.13191.10.3.1.4.2
NTF oacISAKMPBadProposal	1.3.6.1.4.1.13191.10.3.1.4.2.1	An ISAKMP bad proposal notification signifies that the device did not validate proposal for IPSec phase 1 with a remote peer.
NTF oacISAKMPNoResponse	1.3.6.1.4.1.13191.10.3.1.4.2.2	An ISAKMP No Response notification signifies that the device was exchanging ISAKMP information with a remote ISAKMP peer, and the peer did not give any answer to the device.
NTF oacISAKMPConnectionEstablished	1.3.6.1.4.1.13191.10.3.1.4.2.3	An ISAKMP Connection established notification signifies that the device established an ISAKMP connection with a remote ISAKMP device.
NTF oacISAKMPConnectionRemoved	1.3.6.1.4.1.13191.10.3.1.4.2.4	An ISAKMP Connection removed notification signifies that the device removed an ISAKMP connection with a remote ISAKMP device, because the lifetime of the connection reached the limit, or a reset has been carried out on the device, either by using clear crypto isakmp sa, or by shutting down the IPSec working interface.
NTF oacISAMPIPSecConnectionEstablished	1.3.6.1.4.1.13191.10.3.1.4.2.5	An ISAKMP IPSec Connection established notification signifies that the ISAKMP daemon of the device successfully created an IPSec tunnel between two ISAKMP peers.
NTF oacISAKMPIPSecConnectionRemoved	1.3.6.1.4.1.13191.10.3.1.4.2.6	An ISAKMP IPSec Connection removed notification signifies that the ISAKMP daemon of the device removed an IPSec connection, either because the lifetime of the IPSec session reached the limit, or because a reset has been carried out on the IPSec working interface of the device.
NTF oacISAKMPUnknownPeer	1.3.6.1.4.1.13191.10.3.1.4.2.7	An ISAKMP unknown peer notification signifies that the device received an unknown isakmp request and did not process it.
NTF oacISAKMPNotificationMsgReceived	1.3.6.1.4.1.13191.10.3.1.4.2.8	An ISAKMP notification message received notification signifies that the device received a notification from a known ISAKMP peer.
NTF oacISAKMPNotificationMsgSent	1.3.6.1.4.1.13191.10.3.1.4.2.9	An ISAKMP notification message sent notification signifies that the device sent a notification to a known ISAKMP peer. Generally, a sent notification is due to a problem on the ISAKMP connection between two ISAKMP peers. For example, if received packet is malformed, a notification message is sent.
NTF oacISAKMPDeadPeerDetected	1.3.6.1.4.1.13191.10.3.1.4.2.10	An ISAKMP Dead Peer detection signifies that the device detected a DPD when using ISAKMP keepalive.

RFC description

Manages IPSec security associations and ISAKMP notifications for OneAccess routers.

Start monitoring OneAccess CPE router (IPsec VPN tunnel/SA status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ONEACCESS-IPSEC-MIB

What Is ONEACCESS-IPSEC-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description