TIMETRA-RPKI-MIB

All MIBs › TIMETRA-RPKI-MIB

Organization: Nokia

Last Updated: 2014-03-10

Description: TIMETRA-RPKI-MIB module

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TIMETRA-RPKI-MIB?

TIMETRA-RPKI-MIB is a Nokia (Alcatel-Lucent/Timetra-lineage) proprietary MIB for the SR OS platform, providing SNMP management of RPKI (Resource Public Key Infrastructure) origin-validation sessions used to validate BGP route origins against RPKI data. It exposes a session table describing RPKI cache-server sessions—address, port, connect-retry timer, hold time, refresh time, description, and row status—along with notification objects for session events. Monitoring this MIB is chiefly a software/protocol-health concern: confirming an RPKI validator session is established and healthy (correct timers, active row status) so that BGP routers can reliably validate route origins, which is a control-plane security function rather than hardware status. It is closely tied to the router's BGP implementation, since RPKI origin validation directly affects BGP route acceptance/rejection decisions. It is typically deployed on Nokia SR OS routers at the edge of ISP/carrier networks running RPKI-based BGP route origin validation. Network engineers evaluating or troubleshooting this functionality can download the TIMETRA-RPKI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TIMETRA-RPKI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Nokia SR OS router

Monitoring Examples

An operator would poll vRtrRpkiSessInstanceTable/vRtrRpkiSessInstanceEntry to check vRtrRpkiSessInstanceRowStatus and confirm each configured RPKI cache-server session (identified by vRtrRpkiSessInstanceAddressType/vRtrRpkiSessInstanceAddress) is active, and inspect vRtrRpkiSessInstanceHoldTime and vRtrRpkiSessInstanceRefreshTime to verify session timers match the RPKI cache server's expectations. vRtrRpkiSessInstanceConnectRetry and vRtrRpkiSessLocalAddressType/vRtrRpkiSessLocalAddress help diagnose why a session repeatedly fails to establish, which would leave BGP route validation degraded or unavailable.

What Can Be Monitored

RPKI session connection state
session hold/refresh timers
cache server address/port
connect-retry configuration
session row status

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType
InetAutonomousSystemNumber
InetPortNumber

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TimeStamp
TruthValue

From TIMETRA-BGP-MIB

BgpConnectRetryTime
BgpHoldTime

From TIMETRA-GLOBAL-MIB

timetraSRMIBModules	OBJECT-IDENTITY
tmnxSRConfs	OBJECT-IDENTITY
tmnxSRNotifyPrefix	OBJECT-IDENTITY
tmnxSRObjs	OBJECT-IDENTITY

From TIMETRA-TC-MIB

TLNamedItemOrEmpty
TNamedItem
TmnxAdminState
TmnxOperState
TmnxPortID
TmnxVRtrID

From TIMETRA-VRTR-MIB

vRtrID

OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using vRtrRpkiSessInstanceSessionState OID:

Select a Nokia SR OS router (RPKI origin-validation session status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type vRtrRpkiSessInstanceSessionState into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The value of vRtrRpkiSessInstanceSessionState indicates the current state of a particular session. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value is anything other than 'established', since that indicates the condition this object reports has changed to one worth investigating. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
timetraRpkiOriginValidMIBModule	1.3.6.1.4.1.6527.1.1.3.96			This document is the SNMP MIB module for the Nokia SROS implementation of origin validation for rpki session. Copyright 2003-2016 Nokia. All rights reserved. Reproduction of this document is authorized on the condition that the foregoing copyright notice is included. This SNMP MIB module (Specification) embodies Nokia's proprietary intellectual property. Nokia retains all title and ownership in the Specification, including any revisions. Nokia grants all interested parties a non-exclusive license to use and distribute an unmodified copy of this Specification in connection with management of Nokia products, and without fee, provided this copyright notice and license appear on all copies. This Specification is supplied 'as is', and Nokia makes no warranty, either express or implied, as to the use, operation, condition, or performance of the Specification.
tmnxRpkiConformance	1.3.6.1.4.1.6527.3.1.1.96
tmnxRpkiCompliances	1.3.6.1.4.1.6527.3.1.1.96.1
tmnxOriginValidV12v0Compliance	1.3.6.1.4.1.6527.3.1.1.96.1.1			The compliance statement for management of origin validation instances on Nokia SROS series systems release R12.0.
tmnxRpkiGroups	1.3.6.1.4.1.6527.3.1.1.96.2
tmnxRpkiOriginValidGroup	1.3.6.1.4.1.6527.3.1.1.96.2.1			The group of additional objects supporting the management of RPKI session in version 12.0 of Nokia SROS series systems.
tmnxRpkiNotifyObjsGroup	1.3.6.1.4.1.6527.3.1.1.96.2.2			The group of objects supporting extended MPLS notifications on Nokia SROS series systems.
tmnxRpkiNotificationGroup	1.3.6.1.4.1.6527.3.1.1.96.2.3			The group of notifications supporting the RPKI feature on Nokia SROS series systems 12.0 Release.
tmnxRpkiObjs	1.3.6.1.4.1.6527.3.1.2.96
vRtrRpkiSessInstanceTable	1.3.6.1.4.1.6527.3.1.2.96.1		not-accessible	vRtrRpkiSessInstanceTable consists of information about each running instance of Rpki-Session.
vRtrRpkiSessInstanceEntry	1.3.6.1.4.1.6527.3.1.2.96.1.1		not-accessible	An entry (conceptual row) in the vRtrRpkiSessInstanceTable. Each entry represents an instance of Rpki-Session running on the virtual router.
IPt vRtrRpkiSessInstanceAddressType	1.3.6.1.4.1.6527.3.1.2.96.1.1.1	InetAddressType	not-accessible	The value of vRtrRpkiSessInstanceAddressType indicates the IP address type of the RPKI session configuration. vRtrRpkiSessInstanceAddressType supports InetAddressType values 'ipv4 (1)','ipv6 (2)' and 'ipv6z(4)'.
IP vRtrRpkiSessInstanceAddress	1.3.6.1.4.1.6527.3.1.2.96.1.1.2	InetAddress	not-accessible	The value of vRtrRpkiSessInstanceAddress indicates the IPv4,IPv6 or a link local address of a local cache server.
ROW vRtrRpkiSessInstanceRowStatus	1.3.6.1.4.1.6527.3.1.2.96.1.1.3	RowStatus	read-create	The value of vRtrRpkiSessInstanceRowStatus specifies the row status for this RPKI instance for the virtual router. It is used to create and delete row entries in this table.
BGP vRtrRpkiSessInstanceConnectRetry	1.3.6.1.4.1.6527.3.1.2.96.1.1.4	BgpConnectRetryTime	read-create	The value of vRtrRpkiSessInstanceConnectRetry specifies the value (in seconds) for the RPKI Connect Retry timer.
STR vRtrRpkiSessInstanceDescription	1.3.6.1.4.1.6527.3.1.2.96.1.1.5	DisplayString	read-create	The value of vRtrRpkiSessInstanceDescription specifies the textual description of this RPKI instance.
BGP vRtrRpkiSessInstanceHoldTime	1.3.6.1.4.1.6527.3.1.2.96.1.1.6	BgpHoldTime	read-create	The value of vRtrRpkiSessInstanceHoldTime specifies the length of time in seconds that the session is to be considered UP without any indication that the cache server is alive and reachable. The default value of vRtrRpkiSessInstanceHoldTime is 600 seconds and must be set to a value at least 2 times the value of vRtrRpkiSessInstanceRefreshTime. When object vRtrRpkiSessInstanceHoldTime is set, object vRtrRpkiSessInstanceRefreshTime needs to be set as well. Reception of any PDU from the cache server resets the hold timer. When the hold-time expires the session is considered to be DOWN and the stale timer is started.
IPt vRtrRpkiSessLocalAddressType	1.3.6.1.4.1.6527.3.1.2.96.1.1.7	InetAddressType	read-create	The value of vRtrRpkiSessLocalAddressType specifies the type of vRtrRpkiSessLocalAddress.
IP vRtrRpkiSessLocalAddress	1.3.6.1.4.1.6527.3.1.2.96.1.1.8	InetAddress	read-create	The value of vRtrRpkiSessLocalAddress specifies the address of the local end of the Rpki session. In order for Rpki to function at least one peer must be configured. This address is used to validate incoming connections to the peer and to establish connections to the remote peer. The default value of vRtrRpkiSessLocalAddress is the system IP address.
U32 vRtrRpkiSessInstancePort	1.3.6.1.4.1.6527.3.1.2.96.1.1.9	Unsigned32	read-create	The value of vRtrRpkiSessInstancePort specifies the destination port number to be used to connect the cache server. The default port number is 323.
U32 vRtrRpkiSessInstanceRefreshTime	1.3.6.1.4.1.6527.3.1.2.96.1.1.10	Unsigned32	read-create	The value of vRtrRpkiSessInstanceRefreshTime triggers the sending of periodic Serial Query PDUs for purposes of liveness detection. The default value of vRtrRpkiSessInstanceRefreshTime is 300 seconds. and is reset whenever a Reset Query or Serial Query PDU is sent to the cache server. When the timer expires a new Serial Query PDU is sent with the last known serial number. When object vRtrRpkiSessInstanceRefreshTime is set, object vRtrRpkiSessInstanceHoldTime needs to be set as well.
TMN vRtrRpkiSessInstanceAdminState	1.3.6.1.4.1.6527.3.1.2.96.1.1.11	TmnxAdminState	read-create	The value of vRtrRpkiSessInstanceAdminState specifies the administrative state of Rpki session in this virtual router instance.
U32 vRtrRpkiSessInstanceStaleRoutTim	1.3.6.1.4.1.6527.3.1.2.96.1.1.12	Unsigned32	read-create	The value of vRtrRpkiSessInstanceStaleRoutTim specifies the maximum length of time that prefix origin records learned from the cache server remain valid after the session with the cache server goes down. The default value of vRtrRpkiSessInstanceStaleRoutTim is 3600 seconds (1 hour). When the timer expires all remaining stale entries associated with the session are deleted.
INT vRtrRpkiSessInstanceSessionStateEx	1.3.6.1.4.1.6527.3.1.2.96.1.1.13	INTEGER	read-only	The value of vRtrRpkiSessInstanceSessionState indicates the current state of a particular session.
U32 vRtrRpkiSessInstanceSessionFlaps	1.3.6.1.4.1.6527.3.1.2.96.1.1.14	Unsigned32	read-only	The value of vRtrRpkiSessInstanceSessionFlaps indicates the number of times the session has transitioned from 'established' state to 'idle' state.
TIM vRtrRpkiSessInstanceUptime	1.3.6.1.4.1.6527.3.1.2.96.1.1.15	TimeStamp	read-only	The value of vRtrRpkiSessInstanceUptime indicates the time since this session is active.
U32 vRtrRpkiSessInstanceActIpv4Rec	1.3.6.1.4.1.6527.3.1.2.96.1.1.16	Unsigned32	read-only	The value of vRtrRpkiSessInstanceActIpv4Rec indicates the number of active, non-withdrawn IPv4 records.
U32 vRtrRpkiSessInstanceActIpv6Rec	1.3.6.1.4.1.6527.3.1.2.96.1.1.17	Unsigned32	read-only	The value of vRtrRpkiSessInstanceActIpv6Rec indicates the number of active, non-withdrawn IPv6 records.
U32 vRtrRpkiSessInstanceSerialId	1.3.6.1.4.1.6527.3.1.2.96.1.1.18	Unsigned32	read-only	The value of vRtrRpkiSessInstanceSerialId indicates the serial id associated with this session.
U32 vRtrRpkiSessInstanceSessionId	1.3.6.1.4.1.6527.3.1.2.96.1.1.19	Unsigned32	read-only	The value of vRtrRpkiSessInstanceSessionId indicates the session id of this session.
TIM vRtrRpkiSessInstanceLastChange	1.3.6.1.4.1.6527.3.1.2.96.1.1.20	TimeStamp	read-only	The value of vRtrRpkiSessInstanceLastChange indicates the sysUpTime when this row was last modified.
vRtrOriginValStaticTable	1.3.6.1.4.1.6527.3.1.2.96.2		not-accessible	vRtrOriginValStaticTable consists of information about static-entry under origin-validation. A static-entry can express validity or invalidity information about an entry.
vRtrOriginValStaticEntry	1.3.6.1.4.1.6527.3.1.2.96.2.1		not-accessible	An entry (conceptual row) in the vRtrOriginValStaticTable.Each entry represents a static-entry about the AS numbers that are authorized to originate routes for different prefixes.
IPt vRtrOrigValStaticIpPrefixType	1.3.6.1.4.1.6527.3.1.2.96.2.1.1	InetAddressType	not-accessible	The value of vRtrOrigValStaticIpPrefixType specifies the address type of vRtrOrigValStaticIpPrefix address.
IP vRtrOrigValStaticIpPrefix	1.3.6.1.4.1.6527.3.1.2.96.2.1.2	InetAddress	not-accessible	The value of vRtrOrigValStaticIpPrefix specifies the IP address prefix to match for the origin validation.
ADR vRtrOrigValStaticMinPrefixLen	1.3.6.1.4.1.6527.3.1.2.96.2.1.3	InetAddressPrefixLength	not-accessible	The value of vRtrOrigValStaticMinPrefixLen specifies the min value of the prefix length for vRtrOrigValStaticIpPrefix, to match for the aggregation.
ADR vRtrOrigValStaticMaxPrefixLen	1.3.6.1.4.1.6527.3.1.2.96.2.1.4	InetAddressPrefixLength	not-accessible	The value of vRtrOrigValStaticMaxPrefixLen specifies the max value of the prefix length for vRtrOrigValStaticIpPrefix, to match for the aggregation.
INE vRtrOrigValStaticAS4Byte	1.3.6.1.4.1.6527.3.1.2.96.2.1.5	InetAutonomousSystemNumber	not-accessible	The value of vRtrOrigValStaticAS4Byte specifies the autonomous system number to be advertised to this peer.
ROW vRtrOrigValStaticRowStatus	1.3.6.1.4.1.6527.3.1.2.96.2.1.6	RowStatus	read-create	The value of vRtrOrigValStaticRowStatus specifies the row status for this static entry instance for the virtual router. It is used to create and delete row entries in this table.
T/F vRtrOrigValStaticASValidity	1.3.6.1.4.1.6527.3.1.2.96.2.1.7	TruthValue	read-create	The value of vRtrOrigValStaticASValidity specifies whether the route entry corresponding to the autonomous number is valid (true) or invalid (false).
vRtrOriginValRouteTable	1.3.6.1.4.1.6527.3.1.2.96.3		not-accessible	vRtrOriginValRouteTable consists of information about the route database which includes both static and dynamic route information under origin-validation rpki.
vRtrOriginValRouteEntry	1.3.6.1.4.1.6527.3.1.2.96.3.1		not-accessible	An entry (conceptual row) in the vRtrOriginValRouteTable. Each entry represents the AS numbers that are authorized to originate routes for different prefixes. Entries cannot be created or deleted via a SNMP SET operation.
IPt vRtrOrigValRouteIpPrefixType	1.3.6.1.4.1.6527.3.1.2.96.3.1.1	InetAddressType	not-accessible	The value of vRtrOrigValRouteIpPrefixType specify the address type of vRtrOrigValRouteIpPrefix address.
IP vRtrOrigValRouteIpPrefix	1.3.6.1.4.1.6527.3.1.2.96.3.1.2	InetAddress	not-accessible	The value of vRtrOrigValRouteIpPrefix specify the IP address prefix to match for the origin validation.
ADR vRtrOrigValRouteMinPrefixLen	1.3.6.1.4.1.6527.3.1.2.96.3.1.3	InetAddressPrefixLength	not-accessible	The value of vRtrOrigValRouteMinPrefixLen specify the min value of the prefix length for vRtrOrigValRouteIpPrefix, to match for the aggregation.
ADR vRtrOrigValRouteMaxPrefixLen	1.3.6.1.4.1.6527.3.1.2.96.3.1.4	InetAddressPrefixLength	not-accessible	The value of vRtrOrigValRouteMaxPrefixLen specify the max value of the prefix length for vRtrOrigValRouteIpPrefix, to match for the aggregation.
INE vRtrOrigValRouteAS4Byte	1.3.6.1.4.1.6527.3.1.2.96.3.1.5	InetAutonomousSystemNumber	not-accessible	The value of vRtrOrigValRouteAS4Byte specify the autonomous system number to be advertised to this peer.
INT vRtrOrigValRouteType	1.3.6.1.4.1.6527.3.1.2.96.3.1.6	INTEGER	not-accessible	The vRtrOrigValRouteType is an enumerated value that specifies whether type of the route entry is static or dynamic.
TMN vRtrOrigValRouteRpkiVrId	1.3.6.1.4.1.6527.3.1.2.96.3.1.7	TmnxVRtrID	not-accessible	The value of vRtrOrigValRouteRpkiVrId specify if the type of the Rpki Session is base or management.
IPt vRtrOrigValRouteRpkiAddrType	1.3.6.1.4.1.6527.3.1.2.96.3.1.8	InetAddressType	not-accessible	The value of vRtrOrigValRouteRpkiAddrType specify the type of vRtrRpkiSessLocalAddress.
IP vRtrOrigValRouteRpkiAddress	1.3.6.1.4.1.6527.3.1.2.96.3.1.9	InetAddress	not-accessible	The value of vRtrOrigValRouteRpkiAddress specify the address of the local end of the Rpki session. In order for Rpki to function at least one peer must be configured. This address is used to validate incoming connections to the peer and to establish connections to the remote peer. When the value of vRtrOrigValRouteType is static the value of vRtrOrigValRouteRpkiAddress is null.
T/F vRtrOrigValASRouteValidity	1.3.6.1.4.1.6527.3.1.2.96.3.1.10	TruthValue	read-only	The value of vRtrOrigValASRouteValidity indicates whether the route entry corresponding to the autonomous number is valid (true) or invalid (false) if the route is static. Default value for this object is valid(true).
tmnxRpkiNotificationObjs	1.3.6.1.4.1.6527.3.1.2.96.4
IPt tmnxRpkiPeerAddrType	1.3.6.1.4.1.6527.3.1.2.96.4.1	InetAddressType	accessible-for-notify	The value of tmnxRpkiPeerAddrType indicates the type of address for the BGP peer represented by tmnxRpkiPeerAddr.
IP tmnxRpkiPeerAddr	1.3.6.1.4.1.6527.3.1.2.96.4.2	InetAddress	accessible-for-notify	The value of tmnxRpkiPeerAddr indicates the address for the Rpki peer.
INT tmnxRpkiErrorType	1.3.6.1.4.1.6527.3.1.2.96.4.3	INTEGER	accessible-for-notify	The value of tmnxRpkiErrorType indicates the type of the error message seen on the Rpki session.
INT tmnxRpkiTrapStatus	1.3.6.1.4.1.6527.3.1.2.96.4.4	INTEGER	accessible-for-notify	The value of tmnxRpkiTrapStatus indicates the state of the trap.
tmnxRpkiNotifyPrefix	1.3.6.1.4.1.6527.3.1.3.96
tmnxRpkiNotifications	1.3.6.1.4.1.6527.3.1.3.96.0
NTF tmnxRpkiNotifySession	1.3.6.1.4.1.6527.3.1.3.96.0.1			[CAUSE] A tmnxRpkiNotifySession notification is generated when a rpki session either comes up or goes down. Possible reasons for this to happen is listed below: (a) a session goes down due to hold-timer expiry. (b) a session goes down due to failure of the TCP connection. (c) a session goes down due to session ID mismatch. (d) a session goes down due to sent or received Error Report PDU containing fatal error code (e) a session comes up (established state) [EFFECT] This may remove the routes learned from a particular rpki server if session goes down. Or start learning routes from a rpki session which was newly established. [RECOVERY] There is no recovery required for this notification.
NTF tmnxRpkiStaleTimerExpiry	1.3.6.1.4.1.6527.3.1.3.96.0.2			[CAUSE] This notification is generated when a stale timer expires. The stale timer expires due to the following reasons: 1) The peer goes down, and never comes up within the stale timer interval 2) Peer goes down and comes backup and refreshes the databases. The stale timer is expired to remove unrefreshed entries in the database. 3) The peer goes down and comes back again and again goes down before refreshing any entries. Here again the stale timer is expired due to unstable connection. [EFFECT] This may remove the routes learned from a particular rpki server if session goes down. Or start learning routes from a rpki session which was newly established. [RECOVERY] There is no recovery required for this notification.

RFC description

Manages Resource Public Key Infrastructure (RPKI) configuration and monitoring for BGP route origin validation on Nokia TIMETRA platforms.

Start monitoring Nokia SR OS router (RPKI origin-validation session status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TIMETRA-RPKI-MIB