PANA-EP-MIB

All MIBs › PANA-EP-MIB

Organization: IETF PANA Working Group

Last Updated: 2006-05-28

Description: MIB for PANA (Protocol for Carrying Authentication for Network Access) enforcement-point objects, extending the IPsec SPD MIB for authenticating network access clients

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is PANA-EP-MIB?

PANA-EP-MIB is an IETF-standards-track MIB (drafted as part of an RFC) defining objects for a PANA (Protocol for Carrying Authentication for Network Access) Enforcement Point, the network element that enforces access-control decisions made via PANA authentication. It supplements the IPsec Security Policy Database (SPD) MIB with PANA-specific objects, so the data it exposes centers on authentication/enforcement policy state rather than traditional interface or performance counters. Its practical monitoring value lies in software/service status -- confirming an enforcement point is correctly applying access-control policy for authenticated PANA clients -- rather than hardware health. It has an explicit, stated dependency on the IPsec SPD MIB, since it defines only the incremental objects PANA needs on top of that base module. It would be deployed on network-access-enforcement devices (access routers or gateways) participating in a PANA-based network access authentication architecture, a relatively niche IETF protocol. Engineers implementing or auditing this functionality typically reference the PANA-EP-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in PANA-EP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
network access enforcement point / gateway supporting PANA authentication

Monitoring Examples

No sample object names are provided for this module, so a specific polling scenario cannot be grounded in real object/table names. Conceptually, monitoring would involve checking the enforcement point's PANA-related policy entries added on top of the IPsec SPD MIB's existing policy tables, and confirming enforcement state matches the client's authenticated status. This module should be treated as a narrow protocol-extension MIB rather than one with a rich set of runtime counters.

What Can Be Monitored

PANA client authentication/enforcement state
IPsec SPD policy entries extended for PANA

Imported Objects

From IF-MIB

InterfaceIndex

From IPSEC-SPD-MIB

spdActionExecuted	OBJECT-TYPE
spdIPDestinationAddress	OBJECT-TYPE
spdIPDestinationType	OBJECT-TYPE
spdIPEndpointAddType	OBJECT-TYPE
spdIPEndpointAddress	OBJECT-TYPE
spdIPSourceAddress	OBJECT-TYPE
spdIPSourceType	OBJECT-TYPE
spdMIB	MODULE-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
mib-2

From SNMPv2-TC

PhysAddress
RowStatus
StorageType
TEXTUAL-CONVENTION
TimeInterval
TimeStamp

OIDs

OID symbolic	OID numeric	Type	Access	Description
panaMIB	1.3.6.1.2.1.185			The MIB module for defining additional PANA-specific objects to the IPsec SPD MIB. Copyright (C) The Internet Society (2003). This version of this MIB module is part of RFC XXXX, see the RFC itself for full legal notices.
panaConfigObjects	1.3.6.1.2.1.185.1
panaL2FilterTable	1.3.6.1.2.1.185.1.1		not-accessible	Link-layer filter definitions.
panaL2FilterEntry	1.3.6.1.2.1.185.1.1.1		not-accessible	An entry in the Link-layer filter table.
NUM panaL2FiltEpIfIndex	1.3.6.1.2.1.185.1.1.1.1	InterfaceIndex	read-create	The index identifying the EP interface where the filter policy must be enforced on.
PHY panaL2FiltAddr	1.3.6.1.2.1.185.1.1.1.2	PhysAddress	read-create	The authorized device Link-layer address (DI). For example, for a 802.x interface, this object normally contains a MAC address. For interfaces which do not have such an address (e.g., a serial line), this object should contain an octet string of zero length.
PAN panaL2FiltPmk	1.3.6.1.2.1.185.1.1.1.3	PanaKey	read-create	This is PMK (Pairwise Master Key) used for bootstraping link-layer ciphers.
PAN panaL2FiltPmkName	1.3.6.1.2.1.185.1.1.1.4	PanaKeyName	read-create	This is the name of the panaL2Pmk.
NUM panaL2FiltPmkLifetime	1.3.6.1.2.1.185.1.1.1.5	TimeInterval	read-create	This is the lifetime of panaL2Pmk.
TIM panaL2FiltLastChanged	1.3.6.1.2.1.185.1.1.1.6	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means.
STO panaL2FiltStorageType	1.3.6.1.2.1.185.1.1.1.7	StorageType	read-create	The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent.
ROW panaL2FiltRowStatus	1.3.6.1.2.1.185.1.1.1.8	RowStatus	read-create	This object indicates the conceptual status of this row.
panaNotificationObjects	1.3.6.1.2.1.185.2
panaNotifications	1.3.6.1.2.1.185.2.0
NTF panaNewPacNotification	1.3.6.1.2.1.185.2.0.1			Notification that EP detected traffic coming from an unauthorized source. When source and destination IP addresses of the traffic is unknown, spdIPSourceType and spdIPDestinationType must be zero. When source L2 address of the traffic is unknown, panaL2SourceAddress must be zero.Notification that EP detected traffic coming from an unauthorized source.
panaNotificationVariables	1.3.6.1.2.1.185.2.1
NUM panaEpIfIndex	1.3.6.1.2.1.185.2.1.1	InterfaceIndex	accessible-for-notify	Contains the interface index on which the packet triggered the notification in question.
PHY panaL2SourceAddress	1.3.6.1.2.1.185.2.1.2	PhysAddress	accessible-for-notify	Contains the source Link layer address of the packet which triggered the notification in question. For example, for a 802.x frame, this object normally contains a MAC address. For interfaces which do not have such an address (e.g., a serial line), this object should contain an octet string of zero length.
panaConformanceObjects	1.3.6.1.2.1.185.3
panaGroups	1.3.6.1.2.1.185.3.1
panaL2FilterGroup	1.3.6.1.2.1.185.3.1.1			The Link-layer Filter Group.
panaNewPacNotificationObjectsGroup	1.3.6.1.2.1.185.3.1.2			PaC Presence Notification Objects Group.
panaNewPacNotificationGroup	1.3.6.1.2.1.185.3.1.3			PaC Presence Notification Group.
panaCompliances	1.3.6.1.2.1.185.3.2
panaFilterCompliance	1.3.6.1.2.1.185.3.2.1			The compliance statement for SNMP entities that support PANA DI-based filtering.
panaNewPacNotificationCompliance	1.3.6.1.2.1.185.3.2.2			The compliance statement for SNMP entities that support new PaC presence Notification.

RFC description

Defines PANA-specific IPsec Security Policy Database objects for endpoint protection and L2/L3 filter management.

Start monitoring vendor-neutral, standards-based MIB (PANA network-access enforcement point) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PANA-EP-MIB

What Is PANA-EP-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description