All MIBs › RAPID-IPSEC-SA-MON-MIB-EXT
Organization: WatchGuard Technologies, Inc.
Last Updated: 2000-03-21
Category: Firewall / Security Appliance, IPsec / VPN, WatchGuard
Description: Extends IPsec security association monitoring with WatchGuard-specific SA statistics.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is RAPID-IPSEC-SA-MON-MIB-EXT?
RAPID-IPSEC-SA-MON-MIB-EXT is a WatchGuard Technologies (RapidStream) private MIB that implements the generic IPsec security-association monitoring objects from the IETF working draft draft-ietf-ipsec-monitor-mib, extended with RapidStream-specific detail. Its rsIpsecSaEspInTable, indexed by peer address and SPI, models inbound ESP security associations with negotiated parameters (rsIpsecSaEspInEncapsulation, rsIpsecSaEspInEncAlg, rsIpsecSaEspInEncKeyLength, rsIpsecSaEspInAuthAlg), lifetime limits (rsIpsecSaEspInLimitSeconds/Kbytes) versus accumulated usage (rsIpsecSaEspInAccSeconds/Kbytes, rsIpsecSaEspInUserOctets, rsIpsecSaEspInPackets), and a detailed error breakdown (rsIpsecSaEspInDecryptErrors, rsIpsecSaEspInAuthErrors, rsIpsecSaEspInReplayErrors, rsIpsecSaEspInPolicyErrors, rsIpsecSaEspInPadErrors, rsIpsecSaEspInOtherReceiveErrors), organized under rsSaTables/rsSaStatistics/rsSaErrors/rsSaTraps branches. This gives operators fine-grained visibility into whether IPsec tunnels are healthy or experiencing decryption, authentication, replay, or policy failures rather than just an up/down status. It depends on IPSEC-ISAKMP-IKE-DOI-TC for DOI transform/algorithm types and RAPID-MIB for its registration point, and is deployed on WatchGuard/RapidStream security gateways terminating IPsec VPN tunnels, and administrators can download the RAPID-IPSEC-SA-MON-MIB-EXT file to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in RAPID-IPSEC-SA-MON-MIB-EXT. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- WatchGuard / RapidStream IPsec security gateways
Monitoring Examples
An operator polls rsIpsecSaEspInAccKbytes against rsIpsecSaEspInLimitKbytes to anticipate SA rekeying, while watching rsIpsecSaEspInAuthErrors and rsIpsecSaEspInReplayErrors; a sustained rise in rsIpsecSaEspInDecryptErrors for a specific peer's SA would indicate a key mismatch or corrupted tunnel, likely requiring the IKE session to be renegotiated.
What Can Be Monitored
- inbound ESP SA negotiated parameters (encryption/auth algorithm)
- SA lifetime limits vs. accumulated usage
- decryption and authentication error counters
- replay and policy error counters
- SA creator/origin identification
This MIB depends on
Related MIBs
Imported Objects
| IpsecDoiAhTransform | |
| IpsecDoiAuthAlgorithm | |
| IpsecDoiEncapsulationMode | |
| IpsecDoiEspTransform | |
| IpsecDoiIdentType | |
| IpsecDoiIpcompTransform | |
| IpsecDoiSecProtocolId |
From RAPID-MIB
| rapidstream | OBJECT-IDENTITY |
From RFC1213-MIB
| ifIndex |
From SNMPv2-SMI
| Counter32 | |
| Gauge32 | |
| Integer32 | |
| IpAddress | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-IDENTITY | |
| OBJECT-TYPE | |
| enterprises |
From SNMPv2-TC
| TEXTUAL-CONVENTION | |
| TruthValue |
How to Use in IPNetwork Monitor
Example using rsIpsecEspTotalInboundSAs OID:
Select a WatchGuard/RapidStream IPsec security gateway (IPsec SA monitoring) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rsIpsecEspTotalInboundSAs into the Find box to locate it in the OID tree, then select it and click OK. The total number of inbound ESP SAs created in the entity since boot time. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| rsIpsecSaMonModule | 1.3.6.1.4.1.4355.3 | The MIB module describes generic IPSec objects defined in IETF working draft 'draft-ieft-ipsec-monitor-mib-01' and RapidStream's extension. | ||
| rsIpsecSaMonitorMIB | 1.3.6.1.4.1.4355.3.1 | This is the base object identifier for all IPSec branches. | ||
| rsSaTables | 1.3.6.1.4.1.4355.3.1.1 | This is the base object identifier for all SA tables. | ||
| rsIpsecSaEspInTable | 1.3.6.1.4.1.4355.3.1.1.1 | not-accessible | The (conceptual) table containing information on IPSec inbound ESP SAs. There should be one row for every inbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent. | |
| rsIpsecSaEspInEntry | 1.3.6.1.4.1.4355.3.1.1.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular IPSec inbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IP rsIpsecSaEspInAddress | 1.3.6.1.4.1.4355.3.1.1.1.1.1 | IpAddress | read-only | The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes. |
| I32 rsIpsecSaEspInSpi | 1.3.6.1.4.1.4355.3.1.1.1.1.2 | Integer32 | read-only | The security parameters index of the SA. |
| OCT rsIpsecSaEspInDestId | 1.3.6.1.4.1.4355.3.1.1.1.1.3 | OCTET STRING | read-only | The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchanged during SA creation negotiation. |
| IPS rsIpsecSaEspInDestIdType | 1.3.6.1.4.1.4355.3.1.1.1.1.4 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaEspInDestId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| OCT rsIpsecSaEspInSourceId | 1.3.6.1.4.1.4355.3.1.1.1.1.5 | OCTET STRING | read-only | The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation. |
| IPS rsIpsecSaEspInSourceIdType | 1.3.6.1.4.1.4355.3.1.1.1.1.6 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaEspInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| I32 rsIpsecSaEspInProtocol | 1.3.6.1.4.1.4355.3.1.1.1.1.7 | Integer32 | read-only | The transport-layer protocol number that this SA carries, or 0 if it carries any protocol. |
| I32 rsIpsecSaEspInDestPort | 1.3.6.1.4.1.4355.3.1.1.1.1.8 | Integer32 | read-only | The destination port number of the protocol that this SA carries, or 0 if it carries any port number. |
| I32 rsIpsecSaEspInSourcePort | 1.3.6.1.4.1.4355.3.1.1.1.1.9 | Integer32 | read-only | The source port number of the protocol that this SA carries, or 0 if it carries any port number. |
| IPS rsIpsecSaEspInCreator | 1.3.6.1.4.1.4355.3.1.1.1.1.10 | IpsecSaCreatorIdent | read-only | The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method. |
| IPS rsIpsecSaEspInEncapsulation | 1.3.6.1.4.1.4355.3.1.1.1.1.11 | IpsecDoiEncapsulationMode | read-only | The type of encapsulation used by this SA. |
| IPS rsIpsecSaEspInEncAlg | 1.3.6.1.4.1.4355.3.1.1.1.1.12 | IpsecDoiEspTransform | read-only | A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used. |
| I32 rsIpsecSaEspInEncKeyLength | 1.3.6.1.4.1.4355.3.1.1.1.1.13 | Integer32 | read-only | The length of the encryption key in bits used for the algorithm specified in the 'rsIpsecSaEspInEncAlg' object, or 0 if the key length is implicit in the specified algorithm or there is no encryption specified. |
| IPS rsIpsecSaEspInAuthAlg | 1.3.6.1.4.1.4355.3.1.1.1.1.14 | IpsecDoiAuthAlgorithm | read-only | A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used. |
| I32 rsIpsecSaEspInLimitSeconds | 1.3.6.1.4.1.4355.3.1.1.1.1.15 | Integer32 | read-only | The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated. |
| I32 rsIpsecSaEspInLimitKbytes | 1.3.6.1.4.1.4355.3.1.1.1.1.16 | Integer32 | read-only | The maximum traffic in kilobytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated. |
| C32 rsIpsecSaEspInAccSeconds | 1.3.6.1.4.1.4355.3.1.1.1.1.17 | Counter32 | read-only | The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed. |
| C32 rsIpsecSaEspInAccKbytes | 1.3.6.1.4.1.4355.3.1.1.1.1.18 | Counter32 | read-only | The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic. |
| C32 rsIpsecSaEspInUserOctets | 1.3.6.1.4.1.4355.3.1.1.1.1.19 | Counter32 | read-only | The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit. |
| C32 rsIpsecSaEspInPackets | 1.3.6.1.4.1.4355.3.1.1.1.1.20 | Counter32 | read-only | The number of packets handled by the SA. |
| C32 rsIpsecSaEspInDecryptErrors | 1.3.6.1.4.1.4355.3.1.1.1.1.21 | Counter32 | read-only | The number of packets discarded by the SA due to decryption errors. |
| C32 rsIpsecSaEspInAuthErrors | 1.3.6.1.4.1.4355.3.1.1.1.1.22 | Counter32 | read-only | The number of packets discarded by the SA due to authentication errors. |
| C32 rsIpsecSaEspInReplayErrors | 1.3.6.1.4.1.4355.3.1.1.1.1.23 | Counter32 | read-only | The number of packets discarded by the SA due to replay errors. |
| C32 rsIpsecSaEspInPolicyErrors | 1.3.6.1.4.1.4355.3.1.1.1.1.24 | Counter32 | read-only | The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid. |
| C32 rsIpsecSaEspInPadErrors | 1.3.6.1.4.1.4355.3.1.1.1.1.25 | Counter32 | read-only | The number of packets discarded by the SA due to pad value errors. Implementations that do not check this must not support this object. |
| C32 rsIpsecSaEspInOtherReceiveErrors | 1.3.6.1.4.1.4355.3.1.1.1.1.26 | Counter32 | read-only | The number of packets discarded by the SA due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the decryption element. |
| rsIpsecSaAhInTable | 1.3.6.1.4.1.4355.3.1.1.2 | not-accessible | The (conceptual) table containing information on IPSec inbound AH SAs. There should be one row for every inbound AH security association that exists in the entity. The maximum number of rows is implementation dependent. | |
| rsIpsecSaAhInEntry | 1.3.6.1.4.1.4355.3.1.1.2.1 | not-accessible | An entry (conceptual row) containing the information on a particular IPSec inbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IP rsIpsecSaAhInAddress | 1.3.6.1.4.1.4355.3.1.1.2.1.1 | IpAddress | read-only | The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes. |
| I32 rsIpsecSaAhInSpi | 1.3.6.1.4.1.4355.3.1.1.2.1.2 | Integer32 | read-only | The security parameters index of the SA. |
| OCT rsIpsecSaAhInDestId | 1.3.6.1.4.1.4355.3.1.1.2.1.3 | OCTET STRING | read-only | The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation. |
| IPS rsIpsecSaAhInDestIdType | 1.3.6.1.4.1.4355.3.1.1.2.1.4 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaAhInDestId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| OCT rsIpsecSaAhInSourceId | 1.3.6.1.4.1.4355.3.1.1.2.1.5 | OCTET STRING | read-only | The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during SA creation negotiation. |
| IPS rsIpsecSaAhInSourceIdType | 1.3.6.1.4.1.4355.3.1.1.2.1.6 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaAhInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| I32 rsIpsecSaAhInProtocol | 1.3.6.1.4.1.4355.3.1.1.2.1.7 | Integer32 | read-only | The transport-layer protocol number that this SA carries, or 0 if it carries any protocol. |
| I32 rsIpsecSaAhInDestPort | 1.3.6.1.4.1.4355.3.1.1.2.1.8 | Integer32 | read-only | The destination port number of the protocol that this SA carries, or 0 if it carries any port number. |
| I32 rsIpsecSaAhInSourcePort | 1.3.6.1.4.1.4355.3.1.1.2.1.9 | Integer32 | read-only | The source port number of the protocol that this SA carries, or 0 if it carries any port number. |
| IPS rsIpsecSaAhInCreator | 1.3.6.1.4.1.4355.3.1.1.2.1.10 | IpsecSaCreatorIdent | read-only | The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method. |
| IPS rsIpsecSaAhInEncapsulation | 1.3.6.1.4.1.4355.3.1.1.2.1.11 | IpsecDoiEncapsulationMode | read-only | The type of encapsulation used by this SA. |
| IPS rsIpsecSaAhInAuthAlg | 1.3.6.1.4.1.4355.3.1.1.2.1.12 | IpsecDoiAhTransform | read-only | A unique value representing the hash algorithm applied to traffic carried by this SA if it uses ESP or 0 if there is no authentication applied by ESP. |
| I32 rsIpsecSaAhInLimitSeconds | 1.3.6.1.4.1.4355.3.1.1.2.1.13 | Integer32 | read-only | The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated. |
| I32 rsIpsecSaAhInLimitKbytes | 1.3.6.1.4.1.4355.3.1.1.2.1.14 | Integer32 | read-only | The maximum traffic in Kbytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated. |
| C32 rsIpsecSaAhInAccSeconds | 1.3.6.1.4.1.4355.3.1.1.2.1.15 | Counter32 | read-only | The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed. |
| C32 rsIpsecSaAhInAccKbytes | 1.3.6.1.4.1.4355.3.1.1.2.1.16 | Counter32 | read-only | The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic. |
| C32 rsIpsecSaAhInUserOctets | 1.3.6.1.4.1.4355.3.1.1.2.1.17 | Counter32 | read-only | The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit. |
| C32 rsIpsecSaAhInPackets | 1.3.6.1.4.1.4355.3.1.1.2.1.18 | Counter32 | read-only | The number of packets handled by the SA. |
| C32 rsIpsecSaAhInAuthErrors | 1.3.6.1.4.1.4355.3.1.1.2.1.19 | Counter32 | read-only | The number of packets discarded by the SA due to authentication errors. |
| C32 rsIpsecSaAhInReplayErrors | 1.3.6.1.4.1.4355.3.1.1.2.1.20 | Counter32 | read-only | The number of packets discarded by the SA due to replay errors. |
| C32 rsIpsecSaAhInPolicyErrors | 1.3.6.1.4.1.4355.3.1.1.2.1.21 | Counter32 | read-only | The number of packets discarded by the SA due to policy errors. This includes packets where the next protocol is invalid. |
| C32 rsIpsecSaAhInOtherReceiveErrors | 1.3.6.1.4.1.4355.3.1.1.2.1.22 | Counter32 | read-only | The number of packets discarded by the SA due to errors other than decryption, authentication or replay errors. This may include packets dropped due to a lack of receive buffers, and may include packets dropped due to congestion at the authentication element. |
| rsIpsecSaIpcompInTable | 1.3.6.1.4.1.4355.3.1.1.3 | not-accessible | The (conceptual) table containing information on IPSec inbound IPCOMP SAs. There should be one row for every inbound IPCOMP (security) association that exists in the entity. The maximum number of rows is implementation dependent. | |
| rsIpsecSaIpcompInEntry | 1.3.6.1.4.1.4355.3.1.1.3.1 | not-accessible | An entry (conceptual row) containing the information on a particular IPSec inbound IPCOMP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IP rsIpsecSaIpcompInAddress | 1.3.6.1.4.1.4355.3.1.1.3.1.1 | IpAddress | read-only | The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes. |
| IPS rsIpsecSaIpcompInCpi | 1.3.6.1.4.1.4355.3.1.1.3.1.2 | IpsecDoiIpcompTransform | read-only | The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform. |
| OCT rsIpsecSaIpcompInDestId | 1.3.6.1.4.1.4355.3.1.1.3.1.3 | OCTET STRING | read-only | The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during SA creation negotiation. |
| IPS rsIpsecSaIpcompInDestIdType | 1.3.6.1.4.1.4355.3.1.1.3.1.4 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaIpcompInDestId', or 0 if unknown or if the SA uses transport mode, or 0 if this SA is used with multiple SAs in protection suites. |
| OCT rsIpsecSaIpcompInSourceId | 1.3.6.1.4.1.4355.3.1.1.3.1.5 | OCTET STRING | read-only | The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during SA creation negotiation. |
| IPS rsIpsecSaIpcompInSourceIdType | 1.3.6.1.4.1.4355.3.1.1.3.1.6 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaIpcompInSourceId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. |
| I32 rsIpsecSaIpcompInProtocol | 1.3.6.1.4.1.4355.3.1.1.3.1.7 | Integer32 | read-only | The transport-layer protocol number that this SA carries, or 0 if it carries any protocol. |
| I32 rsIpsecSaIpcompInDestPort | 1.3.6.1.4.1.4355.3.1.1.3.1.8 | Integer32 | read-only | The destination port number of the protocol that this SA carries, or 0 if it carries any port number. |
| I32 rsIpsecSaIpcompInSourcePort | 1.3.6.1.4.1.4355.3.1.1.3.1.9 | Integer32 | read-only | The source port number of the protocol that this SA carries, or 0 if it carries any port number. |
| IPS rsIpsecSaIpcompInCreator | 1.3.6.1.4.1.4355.3.1.1.3.1.10 | IpsecSaCreatorIdent | read-only | The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method. |
| IPS rsIpsecSaIpcompInEncapsulation | 1.3.6.1.4.1.4355.3.1.1.3.1.11 | IpsecDoiEncapsulationMode | read-only | The type of encapsulation used by this SA. |
| IPS rsIpsecSaIpcompInDecompAlg | 1.3.6.1.4.1.4355.3.1.1.3.1.12 | IpsecDoiIpcompTransform | read-only | A unique value representing the decompression algorithm applied to traffic. |
| C32 rsIpsecSaIpcompInSeconds | 1.3.6.1.4.1.4355.3.1.1.3.1.13 | Counter32 | read-only | The number of seconds that the SA has existed. |
| C32 rsIpsecSaIpcompInUserOctets | 1.3.6.1.4.1.4355.3.1.1.3.1.14 | Counter32 | read-only | The amount of user level traffic measured in bytes handled by the SA. |
| C32 rsIpsecSaIpcompInPackets | 1.3.6.1.4.1.4355.3.1.1.3.1.15 | Counter32 | read-only | The number of packets handled by the SA. |
| C32 rsIpsecSaIpcompInDecompErrors | 1.3.6.1.4.1.4355.3.1.1.3.1.16 | Counter32 | read-only | The number of packets discarded by the SA due to decompression errors. |
| C32 rsIpsecSaIpcompInOtherReceiveErrors | 1.3.6.1.4.1.4355.3.1.1.3.1.17 | Counter32 | read-only | The number of packets discarded by the SA due to errors other than decompression errors. This may include packets dropped due to a lack of receive buffers, and packets dropped due to congestion at the decompression element. |
| rsIpsecSaEspOutTable | 1.3.6.1.4.1.4355.3.1.1.4 | not-accessible | The (conceptual) table containing information on IPSec Outbound ESP SAs. There should be one row for every outbound ESP security association that exists in the entity. The maximum number of rows is implementation dependent. | |
| rsIpsecSaEspOutEntry | 1.3.6.1.4.1.4355.3.1.1.4.1 | not-accessible | An entry (conceptual row) containing the information on a particular IPSec Outbound ESP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IP rsIpsecSaEspOutAddress | 1.3.6.1.4.1.4355.3.1.1.4.1.1 | IpAddress | read-only | The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes. |
| I32 rsIpsecSaEspOutSpi | 1.3.6.1.4.1.4355.3.1.1.4.1.2 | Integer32 | read-only | The security parameters index of the SA. |
| OCT rsIpsecSaEspOutSourceId | 1.3.6.1.4.1.4355.3.1.1.4.1.3 | OCTET STRING | read-only | The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| IPS rsIpsecSaEspOutSourceIdType | 1.3.6.1.4.1.4355.3.1.1.4.1.4 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaEspOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| OCT rsIpsecSaEspOutDestId | 1.3.6.1.4.1.4355.3.1.1.4.1.5 | OCTET STRING | read-only | The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| IPS rsIpsecSaEspOutDestIdType | 1.3.6.1.4.1.4355.3.1.1.4.1.6 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaEspOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| I32 rsIpsecSaEspOutProtocol | 1.3.6.1.4.1.4355.3.1.1.4.1.7 | Integer32 | read-only | The transport-layer protocol number that this SA carries, or 0 if it carries any protocol. |
| I32 rsIpsecSaEspOutSourcePort | 1.3.6.1.4.1.4355.3.1.1.4.1.8 | Integer32 | read-only | The source port number of the protocol that this SA carries, or 0 if it carries any port number. |
| I32 rsIpsecSaEspOutDestPort | 1.3.6.1.4.1.4355.3.1.1.4.1.9 | Integer32 | read-only | The destination port number of the protocol that this SA carries, or 0 if it carries any port number. |
| IPS rsIpsecSaEspOutCreator | 1.3.6.1.4.1.4355.3.1.1.4.1.10 | IpsecSaCreatorIdent | read-only | The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method. |
| IPS rsIpsecSaEspOutEncapsulation | 1.3.6.1.4.1.4355.3.1.1.4.1.11 | IpsecDoiEncapsulationMode | read-only | The type of encapsulation used by this SA. |
| IPS rsIpsecSaEspOutEncAlg | 1.3.6.1.4.1.4355.3.1.1.4.1.12 | IpsecDoiEspTransform | read-only | A unique value representing the encryption algorithm applied to traffic or 0 if there is no encryption used. |
| I32 rsIpsecSaEspOutEncKeyLength | 1.3.6.1.4.1.4355.3.1.1.4.1.13 | Integer32 | read-only | The length of the encryption key in bits used for the algorithm specified in the 'rsIpsecSaEspOutEncAlg' object, or 0 if the key length is implicit in the specified algorithm or there is no encryption specified. |
| IPS rsIpsecSaEspOutAuthAlg | 1.3.6.1.4.1.4355.3.1.1.4.1.14 | IpsecDoiAuthAlgorithm | read-only | A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used. |
| I32 rsIpsecSaEspOutLimitSeconds | 1.3.6.1.4.1.4355.3.1.1.4.1.15 | Integer32 | read-only | The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated. |
| I32 rsIpsecSaEspOutLimitKbytes | 1.3.6.1.4.1.4355.3.1.1.4.1.16 | Integer32 | read-only | The maximum traffic in kbytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated. |
| C32 rsIpsecSaEspOutAccSeconds | 1.3.6.1.4.1.4355.3.1.1.4.1.17 | Counter32 | read-only | The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed. |
| C32 rsIpsecSaEspOutAccKbytes | 1.3.6.1.4.1.4355.3.1.1.4.1.18 | Counter32 | read-only | The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic. |
| C32 rsIpsecSaEspOutUserOctets | 1.3.6.1.4.1.4355.3.1.1.4.1.19 | Counter32 | read-only | The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit. |
| C32 rsIpsecSaEspOutPackets | 1.3.6.1.4.1.4355.3.1.1.4.1.20 | Counter32 | read-only | The number of packets handled by the SA. |
| C32 rsIpsecSaEspOutSendErrors | 1.3.6.1.4.1.4355.3.1.1.4.1.21 | Counter32 | read-only | The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers. |
| rsIpsecSaAhOutTable | 1.3.6.1.4.1.4355.3.1.1.5 | not-accessible | The (conceptual) table containing information on IPSec Outbound AH SAs. There should be one row for every outbound AH security association that exists in the entity. The maximum number of rows is implementation dependent. | |
| rsIpsecSaAhOutEntry | 1.3.6.1.4.1.4355.3.1.1.5.1 | not-accessible | An entry (conceptual row) containing the information on a particular IPSec Outbound AH SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IP rsIpsecSaAhOutAddress | 1.3.6.1.4.1.4355.3.1.1.5.1.1 | IpAddress | read-only | The destination address of the SA. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes. |
| I32 rsIpsecSaAhOutSpi | 1.3.6.1.4.1.4355.3.1.1.5.1.2 | Integer32 | read-only | The security parameters index of the SA. |
| OCT rsIpsecSaAhOutSourceId | 1.3.6.1.4.1.4355.3.1.1.5.1.3 | OCTET STRING | read-only | The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| IPS rsIpsecSaAhOutSourceIdType | 1.3.6.1.4.1.4355.3.1.1.5.1.4 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaAhOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| OCT rsIpsecSaAhOutDestId | 1.3.6.1.4.1.4355.3.1.1.5.1.5 | OCTET STRING | read-only | The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation. This value is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| IPS rsIpsecSaAhOutDestIdType | 1.3.6.1.4.1.4355.3.1.1.5.1.6 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaAhOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation. |
| I32 rsIpsecSaAhOutProtocol | 1.3.6.1.4.1.4355.3.1.1.5.1.7 | Integer32 | read-only | The transport-layer protocol number that this SA carries, or 0 if it carries any protocol. |
| I32 rsIpsecSaAhOutSourcePort | 1.3.6.1.4.1.4355.3.1.1.5.1.8 | Integer32 | read-only | The source port number of the protocol that this SA carries, or 0 if it carries any port number. |
| I32 rsIpsecSaAhOutDestPort | 1.3.6.1.4.1.4355.3.1.1.5.1.9 | Integer32 | read-only | The destination port number of the protocol that this SA carries, or 0 if it carries any port number. |
| IPS rsIpsecSaAhOutCreator | 1.3.6.1.4.1.4355.3.1.1.5.1.10 | IpsecSaCreatorIdent | read-only | The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method. |
| IPS rsIpsecSaAhOutEncapsulation | 1.3.6.1.4.1.4355.3.1.1.5.1.11 | IpsecDoiEncapsulationMode | read-only | The type of encapsulation used by this SA. |
| IPS rsIpsecSaAhOutAuthAlg | 1.3.6.1.4.1.4355.3.1.1.5.1.12 | IpsecDoiAhTransform | read-only | A unique value representing the hash algorithm applied to traffic or 0 if there is no authentication used. |
| I32 rsIpsecSaAhOutLimitSeconds | 1.3.6.1.4.1.4355.3.1.1.5.1.13 | Integer32 | read-only | The maximum lifetime in seconds of the SA, or 0 if there is no time constraint on its expiration. The display value is limited to 4294967295 seconds (more than 136 years); values greater than that value will be truncated. |
| I32 rsIpsecSaAhOutLimitKbytes | 1.3.6.1.4.1.4355.3.1.1.5.1.14 | Integer32 | read-only | The maximum traffic in Kbytes that the SA is allowed to support, or 0 if there is no traffic constraint on its expiration. The display value is limited to 4294967295 kilobytes; values greater than that value will be truncated. |
| C32 rsIpsecSaAhOutAccSeconds | 1.3.6.1.4.1.4355.3.1.1.5.1.15 | Counter32 | read-only | The number of seconds accumulated against the SA's expiration by time. This is also the number of seconds that the SA has existed. |
| C32 rsIpsecSaAhOutAccKbytes | 1.3.6.1.4.1.4355.3.1.1.5.1.16 | Counter32 | read-only | The amount of traffic accumulated that counts against the SA's expiration by traffic limitation, measured in Kbytes. This value may be 0 if the SA does not expire based on traffic. |
| C32 rsIpsecSaAhOutUserOctets | 1.3.6.1.4.1.4355.3.1.1.5.1.17 | Counter32 | read-only | The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit. |
| C32 rsIpsecSaAhOutPackets | 1.3.6.1.4.1.4355.3.1.1.5.1.18 | Counter32 | read-only | The number of packets handled by the SA. |
| C32 rsIpsecSaAhOutSendErrors | 1.3.6.1.4.1.4355.3.1.1.5.1.19 | Counter32 | read-only | The number of packets discarded by the SA due to any error. This may include errors due to a lack of transmit buffers. |
| rsIpsecSaIpcompOutTable | 1.3.6.1.4.1.4355.3.1.1.6 | not-accessible | The (conceptual) table containing information on IPSec Outbound IPCOMP SAs. There should be one row for every outbound IPCOMP (security) association that exists in the entity. The maximum number of rows is implementation dependent. | |
| rsIpsecSaIpcompOutEntry | 1.3.6.1.4.1.4355.3.1.1.6.1 | not-accessible | An entry (conceptual row) containing the information on a particular IPSec Outbound IPCOMP SA. A row in this table cannot be created or deleted by SNMP operations on columns of the table. | |
| IP rsIpsecSaIpcompOutAddress | 1.3.6.1.4.1.4355.3.1.1.6.1.1 | IpAddress | read-only | The destination address of the SA. If the IPCOMP SA is shared across multiple SAs in protection suites, this value may be 0. For implementations that do not support IPv6, this address should appear as one of the IPv4-mapped IPv6 addresses as defined in Section 2.5.4 of [IPV6AA]. Specifically, the prefix '0000:0000:0000:0000:0000:FFFF:' is used for IPv4 only nodes, while the prefix '0000:0000:0000:0000:0000:0000:' is used for bi-lingual nodes. |
| IPS rsIpsecSaIpcompOutCpi | 1.3.6.1.4.1.4355.3.1.1.6.1.2 | IpsecDoiIpcompTransform | read-only | The CPI of the SA. Since the lower values of CPIs are reserved to be the same as the algorithm, the syntax for this object is the same as the transform. |
| OCT rsIpsecSaIpcompOutSourceId | 1.3.6.1.4.1.4355.3.1.1.6.1.3 | OCTET STRING | read-only | The source identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| IPS rsIpsecSaIpcompOutSourceIdType | 1.3.6.1.4.1.4355.3.1.1.6.1.4 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaIpcompOutSourceId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. |
| OCT rsIpsecSaIpcompOutDestId | 1.3.6.1.4.1.4355.3.1.1.6.1.5 | OCTET STRING | read-only | The destination identifier of the SA, or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. This value, if non-zero, is taken directly from the optional ID payloads that are exchange during phase 2 negotiations. |
| IPS rsIpsecSaIpcompOutDestIdType | 1.3.6.1.4.1.4355.3.1.1.6.1.6 | IpsecDoiIdentType | read-only | The type of identifier presented by 'rsIpsecSaIpcompOutDestId', or 0 if unknown or if the SA uses transport mode encapsulation, or 0 if this SA is used with multiple SAs in protection suites. |
| I32 rsIpsecSaIpcompOutProtocol | 1.3.6.1.4.1.4355.3.1.1.6.1.7 | Integer32 | read-only | The transport-layer protocol number that this SA carries, or 0 if it carries any protocol. |
| I32 rsIpsecSaIpcompOutSourcePort | 1.3.6.1.4.1.4355.3.1.1.6.1.8 | Integer32 | read-only | The source port number of the protocol that this SA carries, or 0 if it carries any port number. |
| I32 rsIpsecSaIpcompOutDestPort | 1.3.6.1.4.1.4355.3.1.1.6.1.9 | Integer32 | read-only | The destination port number of the protocol that this SA carries, or 0 if it carries any port number. |
| IPS rsIpsecSaIpcompOutCreator | 1.3.6.1.4.1.4355.3.1.1.6.1.10 | IpsecSaCreatorIdent | read-only | The creator of this SA. This MIB makes no assumptions about how the SAs are created. They may be created statically, or by a key exchange protocol such as IKE, or by some other method. |
| IPS rsIpsecSaIpcompOutEncapsulation | 1.3.6.1.4.1.4355.3.1.1.6.1.11 | IpsecDoiEncapsulationMode | read-only | The type of encapsulation used by this SA. |
| IPS rsIpsecSaIpcompOutCompAlg | 1.3.6.1.4.1.4355.3.1.1.6.1.12 | IpsecDoiIpcompTransform | read-only | A unique value representing the compression algorithm applied to traffic. |
| C32 rsIpsecSaIpcompOutSeconds | 1.3.6.1.4.1.4355.3.1.1.6.1.13 | Counter32 | read-only | The number of seconds that the SA has existed. |
| C32 rsIpsecSaIpcompOutUserOctets | 1.3.6.1.4.1.4355.3.1.1.6.1.14 | Counter32 | read-only | The amount of user level traffic measured in bytes handled by the SA. This is not necessarily the same as the amount of traffic applied against the traffic expiration limit. |
| C32 rsIpsecSaIpcompOutPackets | 1.3.6.1.4.1.4355.3.1.1.6.1.15 | Counter32 | read-only | The number of packets handled by the SA. |
| rsSaStatistics | 1.3.6.1.4.1.4355.3.1.2 | This is the base object identifier for all objects which are global counters for IPSec security associations. | ||
| G32 rsIpsecEspCurrentInboundSAs | 1.3.6.1.4.1.4355.3.1.2.1 | Gauge32 | read-only | The current number of inbound ESP SAs in the entity. |
| C32 rsIpsecEspTotalInboundSAsEx | 1.3.6.1.4.1.4355.3.1.2.2 | Counter32 | read-only | The total number of inbound ESP SAs created in the entity since boot time. |
| G32 rsIpsecEspCurrentOutboundSAs | 1.3.6.1.4.1.4355.3.1.2.3 | Gauge32 | read-only | The current number of outbound ESP SAs in the entity. |
| C32 rsIpsecEspTotalOutboundSAs | 1.3.6.1.4.1.4355.3.1.2.4 | Counter32 | read-only | The total number of outbound ESP SAs created in the entity since boot time. |
| G32 rsIpsecAhCurrentInboundSAs | 1.3.6.1.4.1.4355.3.1.2.5 | Gauge32 | read-only | The current number of inbound AH SAs in the entity. |
| C32 rsIpsecAhTotalInboundSAs | 1.3.6.1.4.1.4355.3.1.2.6 | Counter32 | read-only | The total number of inbound AH SAs created in the entity since boot time. |
| G32 rsIpsecAhCurrentOutboundSAs | 1.3.6.1.4.1.4355.3.1.2.7 | Gauge32 | read-only | The current number of outbound AH SAs in the entity. |
| C32 rsIpsecAhTotalOutboundSAs | 1.3.6.1.4.1.4355.3.1.2.8 | Counter32 | read-only | The total number of outbound AH SAs created in the entity since boot time. |
| G32 rsIpsecIpcompCurrentInboundSAs | 1.3.6.1.4.1.4355.3.1.2.9 | Gauge32 | read-only | The current number of inbound IPCOMP SAs in the entity. |
| C32 rsIpsecIpcompTotalInboundSAs | 1.3.6.1.4.1.4355.3.1.2.10 | Counter32 | read-only | The total number of inbound IPCOMP SAs created in the entity since boot time. |
| G32 rsIpsecIpcompCurrentOutboundSAs | 1.3.6.1.4.1.4355.3.1.2.11 | Gauge32 | read-only | The current number of outbound IPCOMP SAs in the entity. |
| C32 rsIpsecIpcompTotalOutboundSAs | 1.3.6.1.4.1.4355.3.1.2.12 | Counter32 | read-only | The total number of outbound IPCOMP SAs created in the entity since boot time. |
| rsSaErrors | 1.3.6.1.4.1.4355.3.1.3 | This is the base object identifier for all objects which are global error counters for IPSec security associations. | ||
| C32 rsIpsecDecryptionErrors | 1.3.6.1.4.1.4355.3.1.3.1 | Counter32 | read-only | The total number of packets received by the entity in SAs since boot time with decryption errors. |
| C32 rsIpsecAuthenticationErrors | 1.3.6.1.4.1.4355.3.1.3.2 | Counter32 | read-only | The total number of packets received by the entity in SAs since boot time with authentication errors. This includes all packets in which the hash value is determined to be invalid, for both ESP and AH SAs. |
| C32 rsIpsecReplayErrors | 1.3.6.1.4.1.4355.3.1.3.3 | Counter32 | read-only | The total number of packets received by the entity in SAs since boot time with replay errors. |
| C32 rsIpsecPolicyErrors | 1.3.6.1.4.1.4355.3.1.3.4 | Counter32 | read-only | The total number of packets received by the entity in SAs since boot time and discarded due to policy errors. This includes packets that had selectors that were invalid for the SA that carried them. |
| C32 rsIpsecOtherReceiveErrors | 1.3.6.1.4.1.4355.3.1.3.5 | Counter32 | read-only | The total number of packets received by the entity in SAs since boot time and discarded due to errors not due to decryption, authentication, replay or policy. |
| C32 rsIpsecSendErrors | 1.3.6.1.4.1.4355.3.1.3.6 | Counter32 | read-only | The total number of packets to be sent by the entity in SAs since boot time and discarded due to errors. |
| C32 rsIpsecUnknownSpiErrors | 1.3.6.1.4.1.4355.3.1.3.7 | Counter32 | read-only | The total number of packets received by the entity since boot time with SPIs or CPIs that were not valid. |
| rsSaTraps | 1.3.6.1.4.1.4355.3.1.4 | This is the base object identifier for all objects which are traps for IPSec security associations. | ||
| NTF rsEspAuthFailureTrap | 1.3.6.1.4.1.4355.3.1.4.0.1 | IPSec packets with invalid hashes were found in an inbound ESP SA. The total number of authentication errors accumulated is sent for the specific row of the 'rsIpsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF rsAhAuthFailureTrap | 1.3.6.1.4.1.4355.3.1.4.0.2 | IPSec packets with invalid hashes were found in an inbound AH SA. The total number of authentication errors accumulated is sent for the specific row of the 'rsIpsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF rsEspReplayFailureTrap | 1.3.6.1.4.1.4355.3.1.4.0.3 | IPSec packets with invalid sequence numbers were found in an inbound ESP SA. The total number of replay errors accumulated is sent for the specific row of the 'rsIpsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF rsAhReplayFailureTrap | 1.3.6.1.4.1.4355.3.1.4.0.4 | IPSec packets with invalid sequence numbers were found in the specified AH SA. The total number of replay errors accumulated is sent for the specific row of the 'rsIpsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF rsEspPolicyFailureTrap | 1.3.6.1.4.1.4355.3.1.4.0.5 | IPSec packets carrying packets with invalid selectors for the specified ESP SA were found. The total number of policy errors accumulated is sent for the specific row of the 'rsIpsecSaEspInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF rsAhPolicyFailureTrap | 1.3.6.1.4.1.4355.3.1.4.0.6 | IPSec packets carrying packets with invalid selectors for the specified AH SA were found. The total number of policy errors accumulated is sent for the specific row of the 'rsIpsecSaAhInTable' table for the SA; this provides the identity of the SA in which the error occurred. Implementations SHOULD send one trap per SA (within a reasonable time period), rather than sending one trap per packet. | ||
| NTF rsInvalidSpiTrap | 1.3.6.1.4.1.4355.3.1.4.0.7 | A packet with an unknown SPI was detected from the specified peer with the specified SPI using the specified protocol. The destination address of the received packet is specified by 'ipsecLocalAddress'. The value 'ifIndex' may be 0 if this optional linkage is unsupported. If the object 'ipsecSecurityProtocol' has the value for IPCOMP, then the 'ipsecSPI' object is the CPI of the packet. Implementations SHOULD send one trap per peer (within a reasonable time period), rather than sending one trap per packet. | ||
| rsSaTrapObjects | 1.3.6.1.4.1.4355.3.1.5 | This is the base object identifier for objects which are used as part of traps. | ||
| IPS rsIpsecSecurityProtocol | 1.3.6.1.4.1.4355.3.1.5.1 | IpsecDoiSecProtocolId | read-only | A security protocol associated with the trap. |
| I32 rsIpsecSPI | 1.3.6.1.4.1.4355.3.1.5.2 | Integer32 | read-only | An SPI associated with a trap. Where the security protocol associated with the trap is IPCOMP, this value has a maximum of 65535. |
| IP rsIpsecLocalAddress | 1.3.6.1.4.1.4355.3.1.5.3 | IpAddress | read-only | A local IP address associated with the trap. |
| IP rsIpsecPeerAddress | 1.3.6.1.4.1.4355.3.1.5.4 | IpAddress | read-only | A peer IP address associated with the trap. |
| rsSaTrapControl | 1.3.6.1.4.1.4355.3.1.6 | This is the base object identifier for all objects which are trap controls for IPSec security associations. | ||
| T/F rsEspAuthFailureTrapEnable | 1.3.6.1.4.1.4355.3.1.6.1 | TruthValue | read-write | Indicates whether espAuthFailureTrap traps should be generated. |
| T/F rsAhAuthFailureTrapEnable | 1.3.6.1.4.1.4355.3.1.6.2 | TruthValue | read-write | Indicates whether ahAuthFailureTrap traps should be generated. |
| T/F rsEspReplayFailureTrapEnable | 1.3.6.1.4.1.4355.3.1.6.3 | TruthValue | read-write | Indicates whether espReplayFailureTrap traps should be generated. |
| T/F rsAhReplayFailureTrapEnable | 1.3.6.1.4.1.4355.3.1.6.4 | TruthValue | read-write | Indicates whether ahReplayFailureTrap traps should be generated. |
| T/F rsEspPolicyFailureTrapEnable | 1.3.6.1.4.1.4355.3.1.6.5 | TruthValue | read-write | Indicates whether espPolicyFailureTrap traps should be generated. |
| T/F rsAhPolicyFailureTrapEnable | 1.3.6.1.4.1.4355.3.1.6.6 | TruthValue | read-write | Indicates whether ahPolicyFailureTrap traps should be generated. |
| T/F rsInvalidSpiTrapEnable | 1.3.6.1.4.1.4355.3.1.6.7 | TruthValue | read-write | Indicates whether invalidSpiTrap traps should be generated. |
| rsSaGroups | 1.3.6.1.4.1.4355.3.1.7 | This is the base object identifier for all objects which describe the groups in this MIB. | ||
| rsSaConformance | 1.3.6.1.4.1.4355.3.1.8 | This is the base object identifier for all objects which describe the conformance for this MIB. |
RFC description
WatchGuard IPSec Security Association monitoring MIB tracking SA creation, encryption transforms, and protocol statistics.
Start monitoring WatchGuard / RapidStream IPsec security gateways (IPsec SA monitoring) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.