SECURITY-MANAGEMENT-MIB

All MIBs › SECURITY-MANAGEMENT-MIB

Organization: Avaya

Last Updated: 2010-03-23

Category: Security and Access Control

Description: Manages Avaya network device security policy configuration, access control, and audit logging.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is SECURITY-MANAGEMENT-MIB?

SECURITY-MANAGEMENT-MIB is an Avaya-specific MIB that centralizes device security-mode status, management-protocol service state, and a large set of security-related notifications across Avaya media gateway/switching platforms (e.g., G450/G700 series). Key objects include secMode (secured vs. non-secured operating mode), secTcpSynCkiOpState/CfgState (SYN-cookie DoS defense operational and configured state), the secMngProtoTable enumerating which management protocols (SSH, Telnet, HTTP/HTTPS, SNMPv1/v3, ICMP, TFTP, DHCP, DNS resolver, etc.) are supported and currently on/off, fipsEnhancedSecurityFlg (FIPS-140-2-aligned operation), and an extensive notification set covering DoS attacks (avMSSDenialOfService with attack type, source/destination address, port, and MAC), unauthorized access/account lockout events, IPv6 address-duplication events, password-expiry alerts, and configuration encryption-key mismatch/change events. Because it combines protocol-enablement state with real-time security event traps, this MIB is valuable for confirming that insecure management protocols (like unencrypted Telnet) are disabled, that SYN-cookie protection is active, and for catching brute-force login attempts or DoS traffic via its notification group before they escalate. It depends on companion Avaya MIBs (AVAYAGEN-MIB, G700-MG-MIB, AVAYA-ENTITY-MIB, LOAD-MIB) for shared trap varbinds and enterprise anchoring, and is deployed on Avaya media gateways and switches; security teams can download the SECURITY-MANAGEMENT-MIB file to load it into their MIB browser when hardening or auditing these platforms' management-plane security posture.

IPNetwork Monitor allows you to monitor SNMP objects defined in SECURITY-MANAGEMENT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Avaya media gateways/switches (e.g. G450/G700 series)

Monitoring Examples

An operator checks secMngProtoTable to confirm telnet(4) status is off(2) while ssh(3) is on(1), and monitors for avUnAuthAccessEvent/avAccountLockoutEvent traps; repeated lockout notifications from the same source address would indicate an active brute-force login attempt against the device.

What Can Be Monitored

secured vs. non-secured mode status
management protocol enablement state (SSH/Telnet/HTTP/SNMP/etc.)
SYN-cookie DoS defense state
unauthorized access / account lockout notifications
DoS attack notification varbinds
license feature activation status

Imported Objects

From AVAYA-ENTITY-MIB

avEntPhySeverity

OBJECT-TYPE

From AVAYAGEN-MIB

lsg	OBJECT-IDENTITY

From G700-MG-MIB

cmgTrapLocation	OBJECT-TYPE
cmgTrapModule	OBJECT-TYPE
cmgTrapOnBoard	OBJECT-TYPE
cmgTrapOnIccMissing	OBJECT-TYPE
cmgTrapSubsystem	OBJECT-TYPE

From IF-MIB

ifIndex	OBJECT-TYPE
ifName	OBJECT-TYPE
ifPhysAddress	OBJECT-TYPE
ifType	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From LOAD-MIB

genAppFileId	OBJECT-TYPE
genAppFileName	OBJECT-TYPE
genAppFileVersionNumber	OBJECT-TYPE
genOpLastFailureDisplay	OBJECT-TYPE

From RFC1213-MIB

DisplayString

From SNMPv2-CONF

NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
PhysAddress
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
avayaSecurity	1.3.6.1.4.1.6889.2.1.14
secMngModule	1.3.6.1.4.1.6889.2.1.14.1			Defines MIB objects related to device secured management.
ONO secMode	1.3.6.1.4.1.6889.2.1.14.1.1	OnOffType	read-only	When the security mode flag = on - it indicates that device operates in secured mode, =off - in non-secured mode. Otherwize when the value retuned =Not relevant - secured mode is not supported in this device.
secTcpSynCookies	1.3.6.1.4.1.6889.2.1.14.1.2
ONO secTcpSynCkiOpState	1.3.6.1.4.1.6889.2.1.14.1.2.1	OnOffType	read-only	Monitors the operational state of the TCP SYN cookies defense mechanism. The operational state of the SYN cookies can change only after a reset, if the configuration state was changed and the running configuration was saved to the startup configuration before the reset. Use secTcpSynCkiCfgState to monitor and change the SYN cookies configuration state. When the SYN cookies feature is turned on, it helps protect the local host from SYN attacks (a type of DoS attack).
ONO secTcpSynCkiCfgState	1.3.6.1.4.1.6889.2.1.14.1.2.2	OnOffType	read-write	Controls and monitors the configuration state of the TCP SYN cookies defense mechanism. The operational state of the SYN cookies can change only after reset, if the configuration state was changed and the running configuration was saved to the startup configuration before the reset. Use secTcpSynCkiOpState to monitor the SYN cookies operational state. When the SYN cookies feature is turned on, it helps protect the local host from SYN attacks (a type of DoS attack).
secMngProtoTable	1.3.6.1.4.1.6889.2.1.14.1.3		not-accessible	List of security management protocols supported in the device.
secMngProtoEntry	1.3.6.1.4.1.6889.2.1.14.1.3.1		not-accessible	Description.
INT secMngProtoId	1.3.6.1.4.1.6889.2.1.14.1.3.1.1	INTEGER	read-only	Index to the secMngProtoTable. The index can take one of the following values that correspond to supported management protocols scpConfigFiles(1), scpImageFiles(2), ssh(3), telnet(4), snmpv3(5), http(6), https(7), telnetClient(8), icmpRedirection(9), - icmp redirection service state icmp(10), - icmp services status recoveryPassword(11), - recovery password state sshClient(12), snmpv1(13), icmpEcho(14) - icmp service has been launched in EchoOnly mode tftp(16), dhcp(17), dnsResolver(18, scpClient(19), tftpClient(20), servicesTelnet(21), - reports telnet status on Services interface in G450 Missing entry indicates that corresponding protocol is not supported.
SER secMngProtoStatus	1.3.6.1.4.1.6889.2.1.14.1.3.1.2	ServiceStateType	read-only	Portocol status. When the status is =on - it indicates that correpsonding protocol is up and running, =off - protocol is down. Otherwize when the value retuned =Not relevant - the protocol is not supported.
secMngConformance	1.3.6.1.4.1.6889.2.1.14.1.4
secMngGroups	1.3.6.1.4.1.6889.2.1.14.1.4.1
secMngBasicGroup	1.3.6.1.4.1.6889.2.1.14.1.4.1.1			Description.
secMngCompliance	1.3.6.1.4.1.6889.2.1.14.1.4.2
lsgLicManagement	1.3.6.1.4.1.6889.2.1.14.1.5			Group of MIBs objects used for configuration/presentation of the License information generated by Avaya Remote Feature Activation (RFA) system.
lsgLicMngTable	1.3.6.1.4.1.6889.2.1.14.1.5.1		not-accessible	RFA based License management table. All elements are displaying the feature activation status. License activation controlled by the license file. The table is indexed by the license feature keyword assuming that the same keyword describing a feature cannot appear more than once per a license file.
lsgLicMngEntry	1.3.6.1.4.1.6889.2.1.14.1.5.1.1		not-accessible	Entry in lsgLicMngTable.
OCT lsgLicMngFeatureKeyword	1.3.6.1.4.1.6889.2.1.14.1.5.1.1.1	OCTET STRING	read-create	This table entry contains a features keyword. The feature keywords are text-based for example FEAT_VPN string. This field is used as a table index
INT lsgLicMngFeatureType	1.3.6.1.4.1.6889.2.1.14.1.5.1.1.2	INTEGER	read-only	License activation mechanism support two feature types * Boolean on-off feature * Features that describe quantities for example number of concurrent VPN peers
ONO lsgLicMngAdminStatus	1.3.6.1.4.1.6889.2.1.14.1.5.1.1.3	OnOffType	read-only	An administration status shows the feature activation status - when set to On the feature is activated by the RFA licensing system.
ONO lsgLicMngOperStatus	1.3.6.1.4.1.6889.2.1.14.1.5.1.1.4	OnOffType	read-only	The operation status shows the actual status of the corresponding feature - feature can be not operational enabled if for example device must be reset for feature to be activated or feature is not supported by a device.
U32 lsgLicMngCountedValue	1.3.6.1.4.1.6889.2.1.14.1.5.1.1.5	Unsigned32	read-only	For counted features, this entry shows the associated quantity
INT lsgLicMngLastError	1.3.6.1.4.1.6889.2.1.14.1.5.1.1.6	INTEGER	read-only	Shows feature error state
lsgLicMngConformance	1.3.6.1.4.1.6889.2.1.14.1.5.20			Description.
lsgLicMngGroups	1.3.6.1.4.1.6889.2.1.14.1.5.20.1			Description.
lsgLicMngBasicGroup	1.3.6.1.4.1.6889.2.1.14.1.5.20.1.1			Description.
fips140	1.3.6.1.4.1.6889.2.1.14.1.6			Description.
ONO fipsEnhancedSecurityFlg	1.3.6.1.4.1.6889.2.1.14.1.6.1	OnOffType	read-only	enhanceSecurity flag reports operation of a product in enhance security mode. When running under enhanced security a product performs certain secure-related activities safely, closely matching FIPS-140-2 standard. However the flag doesn't necessary indicate that all device operations comply to FIPS approved mode as some of security activities might be controlled via different mechanisms for example manual configuration. Security policy/Crypto Office guidance documents shall be used as reference as for if this flag can be used as an evidence for operation in FIPS approved mode. The flag is read only and set via product CLI.
avMssNotifications	1.3.6.1.4.1.6889.2.1.14.1.7			Subtree hosting MSS notification traps
avMssNotificationPrefix	1.3.6.1.4.1.6889.2.1.14.1.7.0			Description.
NTF avMSSDenialOfService	1.3.6.1.4.1.6889.2.1.14.1.7.0.1			The MSS notification sent on DoS attack
INT avMSSNotificationRate	1.3.6.1.4.1.6889.2.1.14.1.7.2	INTEGER	read-write	Defines the rate of MSS notification report. MSS reports will be generated as per rate if the event group counter passes the threshold correspondingly. The rate units are given in seconds with minimum - 10 seconds maximum - 8 hours (60 * 60 * 8)
avMSSVarbinds	1.3.6.1.4.1.6889.2.1.14.1.7.4			Subtree of access-for-notify arguments to MSS notification varbinds list.
INT avMSSVarbindsDoSType	1.3.6.1.4.1.6889.2.1.14.1.7.4.1	INTEGER	accessible-for-notify	Enumeration of DoS attacks
STR avMSSVarbindsDescription	1.3.6.1.4.1.6889.2.1.14.1.7.4.2	DisplayString	accessible-for-notify	Textual description of the DoS event
IP avMSSVarbindsSrcAddr	1.3.6.1.4.1.6889.2.1.14.1.7.4.3	IpAddress	accessible-for-notify	Source IP address in IP header. Set to 0.0.0.0 if address is unknown
IP avMSSVarbindsDstAddr	1.3.6.1.4.1.6889.2.1.14.1.7.4.4	IpAddress	accessible-for-notify	Destination IP address in IP header. Set to 0.0.0.0 if address is unknown
INT avMSSVarbindsDstPort	1.3.6.1.4.1.6889.2.1.14.1.7.4.5	INTEGER	accessible-for-notify	Destination port number in IP header. 0 if port is not applicable or unknown
INT avMSSVarbindsIpProtocol	1.3.6.1.4.1.6889.2.1.14.1.7.4.6	INTEGER	accessible-for-notify	The protocol field in IP header
C64 avMSSVarbindsCount	1.3.6.1.4.1.6889.2.1.14.1.7.4.7	Counter64	accessible-for-notify	Counted number of events that occur in a given period for a corresponding class of security violations (DoS, not authorized access, etc).
PHY avMSSVarbindsSrcMACAddr	1.3.6.1.4.1.6889.2.1.14.1.7.4.8	PhysAddress	accessible-for-notify	Source Physical address (MAC) of a packet identified as a packet carrying DoS payload. Set to 00:00:00:00:00:00 when phyicial address is not supported or unknown to the system
avMSSgroup	1.3.6.1.4.1.6889.2.1.14.1.8			Description.
mssNotificationGroup	1.3.6.1.4.1.6889.2.1.14.1.9			Description.
secMngNotifications	1.3.6.1.4.1.6889.2.1.14.1.10			Description.
secMngNotificationsPrefix	1.3.6.1.4.1.6889.2.1.14.1.10.0			Description.
NTF avConfigurationEncKeyMismatchFault	1.3.6.1.4.1.6889.2.1.14.1.10.0.1			Encryption keys mismatch error. Configuration download operation is aborted
NTF avConfigurationMasterKeyChange	1.3.6.1.4.1.6889.2.1.14.1.10.0.2			Configuration Master key was changed
NTF avPasswordToExpireAlert	1.3.6.1.4.1.6889.2.1.14.1.10.0.3			User password is about to expire in n days
NTF avUnAuthAccessEvent	1.3.6.1.4.1.6889.2.1.14.1.10.0.200			Notification on unauthorized login attempts. o For CLI and SNMP login failures: Both SNMP SSH and WEB management interfaces shall identify situation and alert. The reported information should include wrong user name, host name and IP address of remote host. Passwords is not reported because of the possibility to reveal password. o For pre-shared-key (PSK) authentication failure in IKE: * lntUnauthUserName - - In IKE AM: the ID sent by the remote peer in the ID payload. - In IKE MM: the ID associated with the remote peer IP in the running configuration. * avUnauthInetAddressType and avUnauthInetAddress - represents the source IP of the packet sent by the remote peer. * avUnauthProtocol - lntIKEAccess(500)
NTF avAccountLockoutEvent	1.3.6.1.4.1.6889.2.1.14.1.10.0.201			After configurable number of failed attempts to authenticate a user, device penalized by locking them out for a pre-specified amount of time.
NTF avIPv6AddressDuplicationEvent	1.3.6.1.4.1.6889.2.1.14.1.10.0.202			The trap is generated whenever there is a detection of IPv6 address (link-local or global IPv6 address) duplication as part of DAD.
secMngVarbinds	1.3.6.1.4.1.6889.2.1.14.1.10.1			Notify only varbinds used for notifications in secMngNotifications group
U32 secMngNumOfDays2Expire	1.3.6.1.4.1.6889.2.1.14.1.10.1.1	Unsigned32	accessible-for-notify	Description.
OCT avUnauthUserName	1.3.6.1.4.1.6889.2.1.14.1.10.1.3	OCTET STRING	accessible-for-notify	The name of the user who's attempt to access device was identified as unauthorized.
INT avUnauthProtocol	1.3.6.1.4.1.6889.2.1.14.1.10.1.5	INTEGER	accessible-for-notify	The management protocol employed for the unauthorized access - avSSHAccess(22) -- SSH protocol avTELNETAccess(23), --Telnet protocol avHTTPAccess(80), -- HTTP protocol avSNMPAccess(161), -- SNMP protocol avHTTPSAccess(443), -- HTTPS protocol over TLS sockets avIKEAccess(500), -- IKE protocol - PSK authentication failure avRASAccess(6889), -- RAS access over dial-up connection avConsoleAccess(6890), -- Access from the Console port avPPPAccess(6891) -- Access to PPP over modem
IPt avUnauthInetAddressType	1.3.6.1.4.1.6889.2.1.14.1.10.1.9	InetAddressType	accessible-for-notify	The Inet Address Type of access violating station
IP avUnauthInetAddress	1.3.6.1.4.1.6889.2.1.14.1.10.1.10	InetAddress	accessible-for-notify	The Inet Address of access violating station
IPt avDuplicatedInetAddressType	1.3.6.1.4.1.6889.2.1.14.1.10.1.11	InetAddressType	accessible-for-notify	The duplicated Inet Address Type.
IP avDuplicatedInetAddress	1.3.6.1.4.1.6889.2.1.14.1.10.1.12	InetAddress	accessible-for-notify	The duplicated Inet Address.
PHY avDuplicatedMACAddress	1.3.6.1.4.1.6889.2.1.14.1.10.1.13	PhysAddress	accessible-for-notify	The MAC address of the station that claims to be configured with the duplicated IPv6 address.
avMngNotificationCompliance	1.3.6.1.4.1.6889.2.1.14.1.10.2			Description.
secMngNotificationGroup	1.3.6.1.4.1.6889.2.1.14.1.11			Description.
avASGAuthenticationFiles	1.3.6.1.4.1.6889.2.1.14.1.12			Info on authentication file(s) installed in a product
avASGAuthFileHeader	1.3.6.1.4.1.6889.2.1.14.1.12.3			The information on Authentication File stored in ASG AF file header
STR avASGAuthFileAFID	1.3.6.1.4.1.6889.2.1.14.1.12.3.1	DisplayString	read-only	The productID value ascociated with the Authentication File (format 7xxxxxxxxx)
STR avASGAuthFileGenDate	1.3.6.1.4.1.6889.2.1.14.1.12.3.2	DisplayString	read-only	Date of Authentication file generation (format YYYY/MM/DD)
STR avASGAuthFileGenTime	1.3.6.1.4.1.6889.2.1.14.1.12.3.3	DisplayString	read-only	A 8-character string in US short locale time (format= HH:MM:SS)
STR avASGAuthFileRelease	1.3.6.1.4.1.6889.2.1.14.1.12.3.4	DisplayString	read-only	Major software release the AF file was generated for
avASGNotifications	1.3.6.1.4.1.6889.2.1.14.1.12.3.5			Description.
avASGNotificationsPrefix	1.3.6.1.4.1.6889.2.1.14.1.12.3.5.0			Description.
NTF avASGAFDownloadSuccess	1.3.6.1.4.1.6889.2.1.14.1.12.3.5.0.1			AF download successfully accomplished
NTF avASGAFDownloadFailure	1.3.6.1.4.1.6889.2.1.14.1.12.3.5.0.2			AF download Failed
avASGAuthFileGroup	1.3.6.1.4.1.6889.2.1.14.1.12.1000			Description.
avASGAuthFileNotificationGroup	1.3.6.1.4.1.6889.2.1.14.1.12.1001			ASG authentictation File Notification Group
DAT avSecLocalDateAndTime	1.3.6.1.4.1.6889.2.1.14.1.13	DateAndTime	read-write	Setting the Local current RTC date and time, when not registered with CM

RFC description

SNMP security-related MIB covering user-based security models and security configuration for SNMPv3, including standards from RFC 3414 and related RFCs for encryption and access control.

Start monitoring Avaya media gateways/switches, e.g. G450/G700 series (secured-mode/management-protocol/DoS-defense status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SECURITY-MANAGEMENT-MIB

What Is SECURITY-MANAGEMENT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description