TELDAT-MON-PROTOCOL-IPSEC-MIB

All MIBs › TELDAT-MON-PROTOCOL-IPSEC-MIB

Organization: Teldat, S.A.

Last Updated: 2011-07-08

Category: IP Security and VPN, Teldat Router Management

Description: Monitors Teldat router IPsec protocol tunnel status, SA negotiation state, and encrypted traffic byte counters.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TELDAT-MON-PROTOCOL-IPSEC-MIB?

TELDAT-MON-PROTOCOL-IPSEC-MIB is a vendor-specific MIB from Teldat for monitoring IPsec (Internet Protocol Security) on Teldat routers, covering VPN tunnel and Security Association (SA) status alongside encryption performance statistics, organized into Advanced, SA, and Statistics groups. It exposes objects for cipher queue sizing and watermarks, current and maximum simultaneous SAs, negotiation duration limits, and per-tunnel SA state via an IKE SA table. Its monitoring purpose is software/security feature health and performance: administrators track whether IPsec tunnels are actively negotiated and healthy, whether the cipher processing queue is backing up (indicating the crypto engine is a bottleneck), and how close the device is to its maximum supported tunnel or SA count, all of which affect VPN availability and throughput. It depends conceptually on standard IPsec/IKE protocol constructs (Security Associations, IKE negotiation) as implemented by Teldat's router software. It is typically deployed on Teldat routers terminating site-to-site or remote-access IPsec VPN tunnels in enterprise WAN deployments. Engineers can download the TELDAT-MON-PROTOCOL-IPSEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TELDAT-MON-PROTOCOL-IPSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Teldat enterprise/carrier routers

Monitoring Examples

An administrator would poll currentNumberIPSecSa against maxSASimultaneous and maxTunnelSupported to see how close the router is to its VPN capacity limits, and would check cypherQueueSize and cypherQueueWaterMark alongside currentQueueLevel to detect whether the crypto/cipher engine is becoming a bottleneck under load. Polling teldatIPSecIkeSaTable / teldatIPSecIkeSaEntry reveals the state of individual IKE Security Associations, and a tunnel stuck negotiating longer than maxNegotiationDuration signals a failing VPN peer or misconfiguration.

What Can Be Monitored

active and maximum IPsec SA count
cipher/crypto queue size and watermark
IKE SA state per tunnel
SA negotiation duration
maximum supported tunnels

Imported Objects

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

From TELDAT-SW-STRUCTURE-MIB

telProdNpMonProtocols

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
telProdNpMonProtIpsec	1.3.6.1.4.1.2007.4.1.2.3.15			This module defines a MIB for monitoring Internet Protocol Security (IPSec). IPSec is a security platform on network level, which lets securing IP communications by authenticating and encrypting each IP data flow. The MIB is made up of three major groups: Advanced, SA and Statistics. Advanced group shows the counter values of use of SA and cypher queue. In SA group is visualized the state of every Security Association (SA). Statistics group contains statistics of IPSec performance.
teldatIPSecAdvancedGroup	1.3.6.1.4.1.2007.4.1.2.3.15.1
U32 iPSecClear	1.3.6.1.4.1.2007.4.1.2.3.15.1.1	Unsigned32	read-write	Reset the counter values of cypher queue and SA use. This variable just can take the values 1 (reset counters) or 0 (no effects) on SET operation.
U32 iPSecActive	1.3.6.1.4.1.2007.4.1.2.3.15.1.2	Unsigned32	read-write	Close every Security Association and disable IPSec. This variable just can take the values 1 (enabling IPSec) or 0 (disabling IPSec). GET operation returns the protocol state: 1 (enabled) and 0 (disabled).
U32 cypherQueueSize	1.3.6.1.4.1.2007.4.1.2.3.15.1.3	Unsigned32	read-only	Size of cypher queue.
U32 cypherQueueWaterMark	1.3.6.1.4.1.2007.4.1.2.3.15.1.4	Unsigned32	read-only	Maximum number of messages which have been in the cypher queue.
U32 currentQueueLevel	1.3.6.1.4.1.2007.4.1.2.3.15.1.5	Unsigned32	read-only	Current number of messages in the cypher queue.
U32 maxSASimultaneous	1.3.6.1.4.1.2007.4.1.2.3.15.1.6	Unsigned32	read-only	Maximum number of IPSec SA which have been simultaneously active.
U32 currentNumberIPSecSa	1.3.6.1.4.1.2007.4.1.2.3.15.1.7	Unsigned32	read-only	Current number of active IPSec SA.
U32 maxNegotiationDuration	1.3.6.1.4.1.2007.4.1.2.3.15.1.8	Unsigned32	read-only	Maximum time that has lasted an IKE negotiation phase, in miliseconds.
U32 maxTunnelSupported	1.3.6.1.4.1.2007.4.1.2.3.15.1.9	Unsigned32	read-only	Maximum number of supported tunnels.
U32 accessListHashSize	1.3.6.1.4.1.2007.4.1.2.3.15.1.10	Unsigned32	read-only	Size of access list hash.
teldatIPSecSaGroup	1.3.6.1.4.1.2007.4.1.2.3.15.2
teldatIPSecIkeSaTable	1.3.6.1.4.1.2007.4.1.2.3.15.2.1		not-accessible	This table shows information of active ISAKMP SA.
teldatIPSecIkeSaEntry	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1		not-accessible	Each entry identifies an active ISAKMP SA.
U32 ikeSaIndex	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.1	Unsigned32	read-only	Table index.
U32 ikeSaClear	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.2	Unsigned32	read-write	Close this active ISAKMP SA. This variable just can take the value 1 on SET operation.
U32 saConnection	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.3	Unsigned32	read-only	Number of SA connection. This variable internally identifies an active SA in the router.
STR initiatorCookie	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.4	DisplayString	read-only	Cookie of the negotiation initiator.
STR responderCookie	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.5	DisplayString	read-only	Cookie of the negotiation responder.
STR negotiationInitiator	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.6	DisplayString	read-only	IP address or hostname of the negotiation initiator.
STR negotiationResponder	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.7	DisplayString	read-only	IP address or hostname of the negotiation responder.
IP ikeSaSrc	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.8	IpAddress	read-only	Local endpoint IP address of the tunnel.
IP ikeSaDes	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.9	IpAddress	read-only	Remote endpoint IP address of the tunnel.
STR ikeSaState	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.10	DisplayString	read-only	State of negotiation SA. This variable just can take three values: ESTABLISH, DYING and ALIVE.
U32 saOakleyGroup	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.11	Unsigned32	read-only	Type of Oakley group.
STR ikeSaLifeTime	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.12	DisplayString	read-only	Life time of this ISAKMP SA.
STR ikeSaRemLifeTime	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.13	DisplayString	read-only	Remaining life time of this ISAKMP SA.
STR ikeSaPurgeTime	1.3.6.1.4.1.2007.4.1.2.3.15.2.1.1.14	DisplayString	read-only	Time (seconds) for clearing this ISAKMP SA if destinity does not response during negotiation. This variable shows '-' if purge time is not configured.
teldatIPSecInSaTable	1.3.6.1.4.1.2007.4.1.2.3.15.2.2		not-accessible	Table of manual or dinamic active input SA. In this table each SA represents a input IPSec data flow.
teldatIPSecInSaEntry	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1		not-accessible	Each entry identifies an input IPSec SA.
U32 inSaIndex	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.1	Unsigned32	read-only	Table index.
U32 inSaClear	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.2	Unsigned32	read-write	Close this SA if it is dinamic. This variable just can take the values 1 (clear SA) or 0 (not clear) on SET operation. For manual SA it does not effect.
U32 inSaConnection	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.3	Unsigned32	read-only	Number of SA connection. This variable internally identifies an active SA in the router.
STR inSaSpi	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.4	DisplayString	read-only	Identification number of the security configuration of the SA.
STR inSaKeyType	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.5	DisplayString	read-only	Type of keys used by the IPSec tunnel. This variable only can take two values: 'manual-keying' if the keys have been setted by user, and 'IKE' if the keys have been dinamically managed using IKE protocol.
STR inSaStatus	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.6	DisplayString	read-only	State of the SA. It just can take two values: UP: the SA is active. DOWN: the SA is not active.
STR inSaEncryption	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.7	DisplayString	read-only	SA encryption protocol.
STR inSaAuthentication	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.8	DisplayString	read-only	SA authentication protocol.
IP inSaSrc	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.9	IpAddress	read-only	Local endpoint IP address of the tunnel.
IP inSaDes	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.10	IpAddress	read-only	Remote endpoint IP address of the tunnel.
STR inSaLifeTime	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.11	DisplayString	read-only	Life time of the input SA.
STR inSaRemLifeTime	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.12	DisplayString	read-only	Remaining life time of the input SA.
U32 inSaEncodePkts	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.13	Unsigned32	read-only	Number of packets sent by this tunnel.
U32 inSaEncodePktsErr	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.14	Unsigned32	read-only	Number of errors in sent packets.
U32 inSaDecodePkts	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.15	Unsigned32	read-only	Number of packets received by this tunnel.
U32 inSaDecodePktsErr	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.16	Unsigned32	read-only	Number of errors in received packets.
STR inSaDpd	1.3.6.1.4.1.2007.4.1.2.3.15.2.2.1.17	DisplayString	read-only	This variable indicates if the Dead Peer Detection is enabled. It just can take two possible values: ON (enabled) and OFF (disabled).
teldatIPSecOutSaTable	1.3.6.1.4.1.2007.4.1.2.3.15.2.3		not-accessible	Table of manual or dinamic active output SA. In this table each SA represents a output IPSec data flow.
teldatIPSecOutSaEntry	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1		not-accessible	Each entry identifies an output IPSec SA.
U32 outSaIndex	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.1	Unsigned32	read-only	Table index.
U32 outSaClear	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.2	Unsigned32	read-write	Close this SA if it is dinamic. This variable just can take the values 1 (clear SA) or 0 (not clear) on SET operation. For manual SA it does not effect.
U32 outSaConnection	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.3	Unsigned32	read-only	Number of SA connection. This variable internally identifies an active SA in the router.
STR outSaSpi	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.4	DisplayString	read-only	Identification number of the security configuration of the SA.
STR outSaKeyType	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.5	DisplayString	read-only	Type of keys used by the IPSec tunnel. This variable only can take two values: 'manual-keying' if the keys have been setted by the user, and 'IKE' if the keys have been setted by IKE protocol.
STR outSaStatus	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.6	DisplayString	read-only	State of the SA. It just can take two values: UP: the SA is active. DOWN: the SA is not active.
STR outSaEncryption	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.7	DisplayString	read-only	SA encryption protocol.
STR outSaAuthentication	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.8	DisplayString	read-only	SA authentication protocol.
IP outSaSrc	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.9	IpAddress	read-only	Local endpoint IP address of the tunnel.
IP outSaDes	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.10	IpAddress	read-only	Remote endpoint IP address of the tunnel.
STR outSaLifeTime	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.11	DisplayString	read-only	Life time of the output SA.
STR outSaRemLifeTime	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.12	DisplayString	read-only	Remaining life time of the output SA.
U32 outSaEncodePkts	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.13	Unsigned32	read-only	Number of packets sent by this tunnel.
U32 outSaEncodePktsErr	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.14	Unsigned32	read-only	Number of errors in sent packets.
U32 outSaDecodePkts	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.15	Unsigned32	read-only	Number of packets received by this tunnel.
U32 outSaDecodePktsErr	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.16	Unsigned32	read-only	Number of errors in received packets.
STR outSaDpd	1.3.6.1.4.1.2007.4.1.2.3.15.2.3.1.17	DisplayString	read-only	This variable indicates if the Dead Peer Detection is enabled. It just can take two possible values: ON (enabled) and OFF (disabled).
teldatIPSecStatisticsGroup	1.3.6.1.4.1.2007.4.1.2.3.15.3
U32 statisticsClear	1.3.6.1.4.1.2007.4.1.2.3.15.3.1	Unsigned32	read-write	Reset the statistics of IPSec use. This variable just can take the value 1 on SET operation. If reset was successfully, GET operation returns 0 (OK) and otherwise returns 2 (Error).
teldatIPSecESPAHGroup	1.3.6.1.4.1.2007.4.1.2.3.15.3.2
U32 inFramesOk	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.1	Unsigned32	read-only	Correctly decapsulated and received frames on IPSec data tunnels.
U32 inFramesError	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.2	Unsigned32	read-only	Number of received erroneous frames on IPSec data tunnels. That is the sum of three parameters: - Out order received frames. - Discarded frames by unknown payload protocol. - Discarded frames by ESP authentication error.
U32 inFramesErrOutOfOrder	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.3	Unsigned32	read-only	Number of out order received frames on IPSec data tunnels.
U32 inFramesErrUnkPayloadProt	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.4	Unsigned32	read-only	Number of discarded frames by unknown payload protocol on IPSec data tunnels.
U32 inFramesInternalErrors	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.5	Unsigned32	read-only	Number of discarded frames by ESP authentication error on IPSec data tunnels.
U32 inFramesPerSec	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.6	Unsigned32	read-only	Received traffic (frames/second) on IPSec data tunnels.
U32 inFramesPerSecMax	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.7	Unsigned32	read-only	Maximum received traffic (frames/second) on IPSec data tunnels.
U32 inKbitsPerSec	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.8	Unsigned32	read-only	Decoded traffic (kbytes/second) on IPSec data tunnels.
U32 inKbitsPerSecMax	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.9	Unsigned32	read-only	Maximum decoded traffic (kbytes/second) on IPSec data tunnels.
U32 outFramesOk	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.10	Unsigned32	read-only	Correctly encapsulated and transmitted frames on IPSec data tunnels.
U32 outFramesUnkAuthAlg	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.11	Unsigned32	read-only	Number of frames with unknown authentication algorithm on IPSec data tunnels.
U32 outFramesPerSec	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.12	Unsigned32	read-only	Transmitted traffic (frames/second) on IPSec data tunnels.
U32 outFramesPerSecMax	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.13	Unsigned32	read-only	Maximum transmitted traffic (frames/second) on IPSec data tunnels.
U32 outKbitsPerSec	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.14	Unsigned32	read-only	Encoded traffic (kbytes/second) on IPSec data tunnels.
U32 outKbitsPerSecMax	1.3.6.1.4.1.2007.4.1.2.3.15.3.2.15	Unsigned32	read-only	Maximum encoded traffic (kbytes/second) on IPSec data tunnels.
teldatIPSecForwardingGroup	1.3.6.1.4.1.2007.4.1.2.3.15.3.3
U32 inSaNotFound	1.3.6.1.4.1.2007.4.1.2.3.15.3.3.1	Unsigned32	read-only	Number of input SA not found.
U32 outSaTemplateNotFound	1.3.6.1.4.1.2007.4.1.2.3.15.3.3.2	Unsigned32	read-only	Number of output SA templates not found.
U32 outSaNotFound	1.3.6.1.4.1.2007.4.1.2.3.15.3.3.3	Unsigned32	read-only	Number of output SA not found.
teldatIPSecIKEGroup	1.3.6.1.4.1.2007.4.1.2.3.15.3.4
U32 ikeNegotiationsPhaseI	1.3.6.1.4.1.2007.4.1.2.3.15.3.4.1	Unsigned32	read-only	Number of phase I negotiations.
U32 ikeNegotiationsPhaseII	1.3.6.1.4.1.2007.4.1.2.3.15.3.4.2	Unsigned32	read-only	Number of phase II negotiations.
U32 ikeCheckHashErrorPhaseI	1.3.6.1.4.1.2007.4.1.2.3.15.3.4.3	Unsigned32	read-only	Number of check hash errors on phase I.
U32 ikeCheckHashErrorPhaseII	1.3.6.1.4.1.2007.4.1.2.3.15.3.4.4	Unsigned32	read-only	Number of check hash errors on phase II.
U32 dropsCollisionsIKEMessage	1.3.6.1.4.1.2007.4.1.2.3.15.3.4.5	Unsigned32	read-only	Number of packets dropped by collision of IKE messages.
U32 dropsWaittingIKEMessage	1.3.6.1.4.1.2007.4.1.2.3.15.3.4.6	Unsigned32	read-only	Number of packets dropped waiting for IKE processing.
U32 cypherQueueEmpty	1.3.6.1.4.1.2007.4.1.2.3.15.3.5	Unsigned32	read-only	Attempts of getting a free message from the empty queue of free generic cypher messages.
U32 jobQueueEmpty	1.3.6.1.4.1.2007.4.1.2.3.15.3.6	Unsigned32	read-only	Attempts of getting a job from the empty queue of pending jobs.
U32 openConnectNotNotified	1.3.6.1.4.1.2007.4.1.2.3.15.3.7	Unsigned32	read-only	Number of open connections not notified during last connevent-period.

RFC description

Monitors IPSec security associations, performance statistics, and encryption usage for Teldat routing equipment.

Start monitoring Teldat enterprise/carrier router (IPsec SA/cipher-queue/tunnel status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TELDAT-MON-PROTOCOL-IPSEC-MIB

What Is TELDAT-MON-PROTOCOL-IPSEC-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description