All MIBs › TIMETRA-IPSEC-MIB › tIPsecRUTnlPfsDHGroup
tIPsecRUTnlPfsDHGroup
Module: TIMETRA-IPSEC-MIB
OID (symbolic): TIMETRA-IPSEC-MIB::tIPsecRUTnlPfsDHGroup
OID (numeric): 1.3.6.1.4.1.6527.3.1.2.48.20.1.9
Node type: OBJECT-TYPE
Type: TmnxIkePolicyDHGroupOrZero
Access: read-only
Description: The value of tIPsecRUTnlPfsDHGroup indicates the new Diffie-hellman key exchange each time the SA(Security Association) key is renegotiated. After the SA expires, the key is forgotten and another key is generated (if the SA remains up). This means that an attacker who cracks part of the exchange can only read the part that used the key before the key changed. There is no advantage of cracking the other parts if the attacker has already cracked one.
What is tIPsecRUTnlPfsDHGroup?
Indicates the Diffie-Hellman group used for the fresh key exchange performed each time this remote-user tunnel's SA is renegotiated under Perfect Forward Secrecy, so compromising one rekey period's key doesn't expose traffic protected under a different period's key. Confirms whether, and at what strength, PFS is actually active for this specific client tunnel.
Examples
Walk all instances (SNMPv2c):
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.6527.3.1.2.48.20.1.9 snmpwalk -v2c -c public <target> TIMETRA-IPSEC-MIB::tIPsecRUTnlPfsDHGroup
Get a specific instance (index 1):
snmpget -v2c -c public <target> 1.3.6.1.4.1.6527.3.1.2.48.20.1.9.1 snmpget -v2c -c public <target> TIMETRA-IPSEC-MIB::tIPsecRUTnlPfsDHGroup.1
SNMPv3 example:
snmpget -v3 -l authPriv -u snmpv3-user -a SHA -A "AuthPassword1" -x AES -X "PrivPassword1" <target> tIPsecRUTnlPfsDHGroup.1
Start monitoring Alcatel-Lucent/Nokia SROS service routers (IPsec transform/IKE policy config status) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the TIMETRA-IPSEC-MIB::tIPsecRUTnlPfsDHGroup OID value, configure state conditions and alerts, and monitor any Alcatel-Lucent/Nokia SROS service routers (IPsec transform/IKE policy config status) from a single console.
OID Breakdown
Upper-level ancestors (10 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.6527 | timetra | ALCATEL-IND1-TIMETRA-GLOBAL-MIB |
| 1.3.6.1.4.1.6527.3 | timetraProducts | ALCATEL-IND1-TIMETRA-GLOBAL-MIB |
| 1.3.6.1.4.1.6527.3.1 | tmnxSRMIB | ALCATEL-IND1-TIMETRA-GLOBAL-MIB |
| 1.3.6.1.4.1.6527.3.1.2 | tmnxSRObjs | ALCATEL-IND1-TIMETRA-GLOBAL-MIB |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.6527.3.1.2.48 | tmnxIPsecObjects | TIMETRA-IPSEC-MIB |
| 1.3.6.1.4.1.6527.3.1.2.48.20 | tIPsecRUTnlTable | TIMETRA-IPSEC-MIB |
| 1.3.6.1.4.1.6527.3.1.2.48.20.1 | tIPsecRUTnlEntry | TIMETRA-IPSEC-MIB |
| 1.3.6.1.4.1.6527.3.1.2.48.20.1.9 | tIPsecRUTnlPfsDHGroup | TIMETRA-IPSEC-MIB |