TIMETRA-IPSEC-STATIC-SA-MIB

All MIBs › TIMETRA-IPSEC-STATIC-SA-MIB

Organization: Alcatel-Lucent

Last Updated: 2009-12-14

Category: Nokia SR OS / Alcatel-Lucent 7750 SR, Security and Filtering, VPN

Description: Manages Nokia/Alcatel-Lucent 7750 SR IPsec static security association parameters and keys.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TIMETRA-IPSEC-STATIC-SA-MIB?

This MIB module is part of Alcatel-Lucent's (now Nokia's) TIMETRA enterprise tree for the 7750 SR SROS platform, managing manually configured (static) IPsec Security Associations used for tunnel encryption and authentication. It exposes a table of configured static SAs including direction (inbound/outbound), protocol, authentication algorithm and key, SPI value, description, and row status, along with a table-level last-changed timestamp. It is used to monitor and manage the software/security configuration status of IPsec tunnels, confirming which SAs are active, correctly keyed, and consistently paired between peers, rather than any hardware sensor data. It is inherently dependent on IPsec/IKE standards for security-association semantics (SPI, authentication algorithms) even though the MIB itself is an Alcatel-Lucent-proprietary management representation. It is deployed on Alcatel-Lucent/Nokia 7750 SR routers providing site-to-site IPsec VPN connectivity in carrier and enterprise WAN networks, where TIMETRA-IPSEC-STATIC-SA-MIB SNMP monitoring confirms tunnel security-association state.

IPNetwork Monitor allows you to monitor SNMP objects defined in TIMETRA-IPSEC-STATIC-SA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Alcatel-Lucent/Nokia 7750 SR (SROS router)

Monitoring Examples

A security engineer would poll the tmnxIPsecStaticSATable, keyed by tmnxIPsecStaticSAName, to confirm a given SA's tmnxIPsecStaticSADirection and tmnxIPsecStaticSASpi match the values configured on the remote peer, since an SPI or direction mismatch prevents the tunnel from passing traffic. tmnxIPsecStaticSARowStatus would be checked to verify the SA is in the active state rather than notInService after a configuration change, and tmnxIPsecStaticSALastChanged together with tmnxIPsecStaticSATableLastChange helps an operator confirm exactly when a given SA was last modified during a troubleshooting session. tmnxIPsecStaticSAAuthAlgorithm and tmnxIPsecStaticSAAuthKey would be reviewed, with appropriate access controls, to confirm the authentication algorithm configured matches policy.

What Can Be Monitored

static IPsec SA direction/protocol
SPI values
authentication algorithm/key configuration
SA row status (active/inactive)
last-changed timestamps

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TimeStamp

From TIMETRA-GLOBAL-MIB

timetraSRMIBModules	OBJECT-IDENTITY
tmnxSRConfs	OBJECT-IDENTITY
tmnxSRObjs	OBJECT-IDENTITY

From TIMETRA-TC-MIB

TNamedItem
TNamedItemOrEmpty

OIDs

OID symbolic	OID numeric	Type	Access	Description
timetraIPsecStaticSAMIBModule	1.3.6.1.4.1.6527.1.1.3.73			This document is the SNMP MIB module to manage and provision the Alcatel-Lucent SROS device with IPsec Static SA tunneling, encryption and other related features. Copyright 2008-2011 Alcatel-Lucent. All rights reserved. Reproduction of this document is authorized on the condition that the foregoing copyright notice is included. This SNMP MIB module (Specification) embodies Alcatel-Lucent's proprietary intellectual property. Alcatel-Lucent retains all title and ownership in the Specification, including any revisions. Alcatel-Lucent grants all interested parties a non-exclusive license to use and distribute an unmodified copy of this Specification in connection with management of Alcatel-Lucent products, and without fee, provided this copyright notice and license appear on all copies. This Specification is supplied 'as is', and Alcatel-Lucent makes no warranty, either express or implied, as to the use, operation, condition, or performance of the Specification.
tmnxIPsecStaticSAConformance	1.3.6.1.4.1.6527.3.1.1.73
tmnxIPsecStaticSACompliances	1.3.6.1.4.1.6527.3.1.1.73.1
tmnxIPsecStaticSAV8v0Compliance	1.3.6.1.4.1.6527.3.1.1.73.1.1			The compliance statement for management of IPsec static SA features on Alcatel 7x50 SR series systems.
tmnxIPsecStaticSAGroups	1.3.6.1.4.1.6527.3.1.1.73.2
tmnxIPsecStaticSAGroup	1.3.6.1.4.1.6527.3.1.1.73.2.1			The group of objects for IPsec static SA on Alcatel 7xx0 SR series systems.
tmnxIPsecStaticSAObjects	1.3.6.1.4.1.6527.3.1.2.73
TIM tmnxIPsecStaticSATableLastChange	1.3.6.1.4.1.6527.3.1.2.73.1	TimeStamp	read-only	The value of tmnxIPsecStaticSATableLastChange indicates the sysUpTime at the time of the last modification to tmnxIPsecStaticSATable by adding, deleting an entry or change to a writable object in the table. If no changes were made to the table since the last re-initialization of the local network management subsystem, then this object contains a zero value.
tmnxIPsecStaticSATable	1.3.6.1.4.1.6527.3.1.2.73.2		not-accessible	Table to store the IPsec static SA entries.
tmnxIPsecStaticSAEntry	1.3.6.1.4.1.6527.3.1.2.73.2.1		not-accessible	Information about a single IPsec static SA entry.
TNA tmnxIPsecStaticSAName	1.3.6.1.4.1.6527.3.1.2.73.2.1.1	TNamedItem	not-accessible	The value of tmnxIPsecStaticSAName specifies the name of this static SA and is part of the index for the table tmnxIPsecStaticSATable, and thus a required object.
ROW tmnxIPsecStaticSARowStatus	1.3.6.1.4.1.6527.3.1.2.73.2.1.2	RowStatus	read-create	The tmnxIPsecStaticSARowStatus object is used to create and delete rows in the tmnxIPsecStaticSATable. When creating an entry in tmnxIPsecStaticSATable, the value of tmnxIPsecStaticSARowStatus must be 'createAndGo'.
TIM tmnxIPsecStaticSALastChanged	1.3.6.1.4.1.6527.3.1.2.73.2.1.3	TimeStamp	read-only	The value of tmnxIPsecStaticSALastChanged indicates the sysUpTime at the time of the last modification of this entry. If no changes were made to the entry since the last re-initialization of the local network management subsystem, then this object contains a zero value.
TMN tmnxIPsecStaticSADirection	1.3.6.1.4.1.6527.3.1.2.73.2.1.4	TmnxIPsecDirection2	read-create	The value of tmnxIPsecStaticSADirection specifies the direction to which this static SA entry can be applied. This is an optional object when creating an entry in tmnxIPsecStaticSATable.
TMN tmnxIPsecStaticSAProtocol	1.3.6.1.4.1.6527.3.1.2.73.2.1.5	TmnxIPsecProtocol	read-create	The value of tmnxIPsecStaticSAProtocol specifies the protocol used by this static SA. This is an optional object when creating an entry in tmnxIPsecStaticSATable.
TMN tmnxIPsecStaticSAAuthAlgorithm	1.3.6.1.4.1.6527.3.1.2.73.2.1.6	TmnxAuthAlgorithm	read-create	The value of tmnxIPsecStaticSAAuthAlgorithm indicates the authentication algorithm used with this static SA. The 'md5' algorithm requires a 16 byte key, and the 'sha1' algorithm requires a 20 byte key. This is an optional object when creating an entry in tmnxIPsecStaticSATable.
OCT tmnxIPsecStaticSAAuthKey	1.3.6.1.4.1.6527.3.1.2.73.2.1.7	OCTET STRING	read-create	The value of tmnxIPsecStaticSAAuthKey specifies the key used for the authentication algorithm defined by tmnxIPsecStaticSAAuthAlgorithm. The length of the key must match the length required by the authentication algorithm. If a key of another length is set, the request will fail with an 'inconsistentValue' error. The default value for tmnxIPsecStaticSAAuthKey is an empty string, in this case the static SA cannot be used. When read, tmnxIPsecStaticSAAuthKey always returns an octet string of length zero. This is an optional object when creating an entry in tmnxIPsecStaticSATable.
U32 tmnxIPsecStaticSASpi	1.3.6.1.4.1.6527.3.1.2.73.2.1.8	Unsigned32	read-create	The value of tmnxIPsecStaticSASpi specifies the SPI (Security Parameter Index) used to lookup the instruction to verify and decrypt the incoming IPsec packets when the value of tmnxIPsecStaticSADirection is 'inbound'. The value of tmnxIPsecStaticSASpi specifies the SPI that will be used in the encoding of the outgoing packets when the value of tmnxIPsecStaticSADirection is 'outbound'. The remote node can use this SPI to lookup the instruction to verify and decrypt the packet. If 'no' SPI is selected, then this static SA cannot be used. This is an optional object when creating an entry in tmnxIPsecStaticSATable.
TNA tmnxIPsecStaticSADescription	1.3.6.1.4.1.6527.3.1.2.73.2.1.9	TNamedItemOrEmpty	read-create	The value of tmnxIPsecStaticSADescription describes this static SA. This is an optional object when creating an entry in tmnxIPsecStaticSATable.

RFC description

IPsec static security association management for Alcatel-Lucent SROS devices with encryption and tunneling features.

Start monitoring Alcatel-Lucent/Nokia SR routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TIMETRA-IPSEC-STATIC-SA-MIB

What Is TIMETRA-IPSEC-STATIC-SA-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description