All MIBs › TUNNEL-MIB
Organization: IETF IP Version 6 (IPv6) Working Group
Last Updated: 2005-05-16
Category: IP and Core Protocols
Description:
Defines managed objects for managing IP tunnels of any type (GRE, IP-in-IP, L2TP, PPTP, and others) over IPv4 and IPv6 networks.
Imported Objects
From IANAifType-MIB
| IANAtunnelType |
From IF-MIB
| InterfaceIndexOrZero | |
| ifIndex | OBJECT-TYPE |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From IPV6-FLOW-LABEL-MIB
| IPv6FlowLabelOrAny |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Integer32 | |
| IpAddress | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| transmission |
From SNMPv2-TC
| RowStatus | |
| StorageType |
What Is TUNNEL-MIB?
TUNNEL-MIB is a vendor-neutral IETF standards MIB (RFC 4087) that defines managed objects for configuring and monitoring IP tunnel interfaces independent of the specific encapsulation scheme, covering technologies like GRE, IP-in-IP, L2TP, and PPTP over both IPv4 and IPv6. It exposes a tunnel interface table describing each tunnel's local and remote endpoint addresses, encapsulation method, hop limit, security mode, type-of-service, and IPv6 flow label, effectively giving a configuration and topology view of every active tunnel on a device via the TUNNEL-MIB OID list defined in RFC 4087. For hardware/software status monitoring, this MIB's role is primarily to confirm tunnel interfaces are correctly configured and operationally consistent (e.g., matching local/remote addressing and encapsulation), and combined with IF-MIB counters it can reveal a tunnel that is administratively up but not passing traffic. It has an explicit dependency on IF-MIB, since each tunnel is represented as an ifEntry and this MIB's tunnelIfTable is indexed by ifIndex to supply tunnel-specific attributes. It is typically deployed on routers and VPN/tunnel-terminating devices that support multiple tunneling protocols and need a unified, encapsulation-agnostic management view.
IPNetwork Monitor allows you to monitor SNMP objects defined in TUNNEL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
What Can Be Monitored
- tunnel local and remote endpoint addresses
- tunnel encapsulation method
- tunnel hop limit and TOS/flow label settings
- tunnel interface operational status (via IF-MIB)
- IPv4/IPv6 tunnel address type
Supported Devices
- vendor-neutral, standards-based MIB, not tied to a specific manufacturer
- router or VPN gateway supporting IP tunneling (GRE, IP-in-IP, L2TP, PPTP)
Monitoring Examples
An administrator would poll tunnelIfTable/tunnelIfEntry, checking tunnelIfLocalAddress and tunnelIfRemoteAddress against expected endpoint pairs, and tunnelIfEncapsMethod to confirm the correct protocol (e.g., GRE vs IP-in-IP) is in use for a given tunnel interface. Monitoring tunnelIfHopLimit and tunnelIfTOS/tunnelIfFlowLabel alongside IF-MIB's ifOperStatus for the same ifIndex would reveal a tunnel whose encapsulation settings mismatch the peer, a common cause of a tunnel showing up but silently dropping packets. Using tunnelIfAddressType with tunnelIfLocalInetAddress/tunnelIfRemoteInetAddress lets the same table represent IPv6 tunnels alongside IPv4 ones.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| tunnelMIB | 1.3.6.1.2.1.10.131 | The MIB module for management of IP Tunnels, independent of the specific encapsulation scheme in use. Copyright (C) The Internet Society (2005). This version of this MIB module is part of RFC 4087; see the RFC itself for full legal notices. | ||
| tunnelMIBObjects | 1.3.6.1.2.1.10.131.1 | |||
| tunnel | 1.3.6.1.2.1.10.131.1.1 | |||
| tunnelIfTable | 1.3.6.1.2.1.10.131.1.1.1 | not-accessible | The (conceptual) table containing information on configured tunnels. | |
| tunnelIfEntry | 1.3.6.1.2.1.10.131.1.1.1.1 | not-accessible | An entry (conceptual row) containing the information on a particular configured tunnel. | |
| IP tunnelIfLocalAddress | 1.3.6.1.2.1.10.131.1.1.1.1.1 | IpAddress | read-only | The address of the local endpoint of the tunnel (i.e., the source address used in the outer IP header), or 0.0.0.0 if unknown or if the tunnel is over IPv6. Since this object does not support IPv6, it is deprecated in favor of tunnelIfLocalInetAddress. |
| IP tunnelIfRemoteAddress | 1.3.6.1.2.1.10.131.1.1.1.1.2 | IpAddress | read-only | The address of the remote endpoint of the tunnel (i.e., the destination address used in the outer IP header), or 0.0.0.0 if unknown, or an IPv6 address, or the tunnel is not a point-to-point link (e.g., if it is a 6to4 tunnel). Since this object does not support IPv6, it is deprecated in favor of tunnelIfRemoteInetAddress. |
| IAN tunnelIfEncapsMethod | 1.3.6.1.2.1.10.131.1.1.1.1.3 | IANAtunnelType | read-only | The encapsulation method used by the tunnel. |
| I32 tunnelIfHopLimit | 1.3.6.1.2.1.10.131.1.1.1.1.4 | Integer32 | read-write | The IPv4 TTL or IPv6 Hop Limit to use in the outer IP header. A value of 0 indicates that the value is copied from the payload's header. |
| INT tunnelIfSecurity | 1.3.6.1.2.1.10.131.1.1.1.1.5 | INTEGER | read-only | The method used by the tunnel to secure the outer IP header. The value ipsec indicates that IPsec is used between the tunnel endpoints for authentication or encryption or both. More specific security-related information may be available in a MIB module for the security protocol in use. |
| I32 tunnelIfTOS | 1.3.6.1.2.1.10.131.1.1.1.1.6 | Integer32 | read-write | The method used to set the high 6 bits (the differentiated services codepoint) of the IPv4 TOS or IPv6 Traffic Class in the outer IP header. A value of -1 indicates that the bits are copied from the payload's header. A value of -2 indicates that a traffic conditioner is invoked and more information may be available in a traffic conditioner MIB module. A value between 0 and 63 inclusive indicates that the bit field is set to the indicated value. Note: instead of the name tunnelIfTOS, a better name would have been tunnelIfDSCPMethod, but the existing name appeared in RFC 2667 and existing objects cannot be renamed. |
| IPV tunnelIfFlowLabel | 1.3.6.1.2.1.10.131.1.1.1.1.7 | IPv6FlowLabelOrAny | read-write | The method used to set the IPv6 Flow Label value. This object need not be present in rows where tunnelIfAddressType indicates the tunnel is not over IPv6. A value of -1 indicates that a traffic conditioner is invoked and more information may be available in a traffic conditioner MIB. Any other value indicates that the Flow Label field is set to the indicated value. |
| IPt tunnelIfAddressType | 1.3.6.1.2.1.10.131.1.1.1.1.8 | InetAddressType | read-write | The type of address in the corresponding tunnelIfLocalInetAddress and tunnelIfRemoteInetAddress objects. |
| IP tunnelIfLocalInetAddress | 1.3.6.1.2.1.10.131.1.1.1.1.9 | InetAddress | read-write | The address of the local endpoint of the tunnel (i.e., the source address used in the outer IP header). If the address is unknown, the value is 0.0.0.0 for IPv4 or :: for IPv6. The type of this object is given by tunnelIfAddressType. |
| IP tunnelIfRemoteInetAddress | 1.3.6.1.2.1.10.131.1.1.1.1.10 | InetAddress | read-write | The address of the remote endpoint of the tunnel (i.e., the destination address used in the outer IP header). If the address is unknown or the tunnel is not a point-to-point link (e.g., if it is a 6to4 tunnel), the value is 0.0.0.0 for tunnels over IPv4 or :: for tunnels over IPv6. The type of this object is given by tunnelIfAddressType. |
| I32 tunnelIfEncapsLimit | 1.3.6.1.2.1.10.131.1.1.1.1.11 | Integer32 | read-write | The maximum number of additional encapsulations permitted for packets undergoing encapsulation at this node. A value of -1 indicates that no limit is present (except as a result of the packet size). |
| tunnelConfigTable | 1.3.6.1.2.1.10.131.1.1.2 | not-accessible | The (conceptual) table containing information on configured tunnels. This table can be used to map a set of tunnel endpoints to the associated ifIndex value. It can also be used for row creation. Note that every row in the tunnelIfTable with a fixed IPv4 destination address should have a corresponding row in the tunnelConfigTable, regardless of whether it was created via SNMP. Since this table does not support IPv6, it is deprecated in favor of tunnelInetConfigTable. | |
| tunnelConfigEntry | 1.3.6.1.2.1.10.131.1.1.2.1 | not-accessible | An entry (conceptual row) containing the information on a particular configured tunnel. Since this entry does not support IPv6, it is deprecated in favor of tunnelInetConfigEntry. | |
| IP tunnelConfigLocalAddress | 1.3.6.1.2.1.10.131.1.1.2.1.1 | IpAddress | not-accessible | The address of the local endpoint of the tunnel, or 0.0.0.0 if the device is free to choose any of its addresses at tunnel establishment time. Since this object does not support IPv6, it is deprecated in favor of tunnelInetConfigLocalAddress. |
| IP tunnelConfigRemoteAddress | 1.3.6.1.2.1.10.131.1.1.2.1.2 | IpAddress | not-accessible | The address of the remote endpoint of the tunnel. Since this object does not support IPv6, it is deprecated in favor of tunnelInetConfigRemoteAddress. |
| IAN tunnelConfigEncapsMethod | 1.3.6.1.2.1.10.131.1.1.2.1.3 | IANAtunnelType | not-accessible | The encapsulation method used by the tunnel. Since this object does not support IPv6, it is deprecated in favor of tunnelInetConfigEncapsMethod. |
| I32 tunnelConfigID | 1.3.6.1.2.1.10.131.1.1.2.1.4 | Integer32 | not-accessible | An identifier used to distinguish between multiple tunnels of the same encapsulation method, with the same endpoints. If the encapsulation protocol only allows one tunnel per set of endpoint addresses (such as for GRE or IP-in-IP), the value of this object is 1. For encapsulation methods (such as L2F) which allow multiple parallel tunnels, the manager is responsible for choosing any ID which does not conflict with an existing row, such as choosing a random number. Since this object does not support IPv6, it is deprecated in favor of tunnelInetConfigID. |
| NUM tunnelConfigIfIndex | 1.3.6.1.2.1.10.131.1.1.2.1.5 | InterfaceIndexOrZero | read-only | If the value of tunnelConfigStatus for this row is active, then this object contains the value of ifIndex corresponding to the tunnel interface. A value of 0 is not legal in the active state, and means that the interface index has not yet been assigned. Since this object does not support IPv6, it is deprecated in favor of tunnelInetConfigIfIndex. |
| ROW tunnelConfigStatus | 1.3.6.1.2.1.10.131.1.1.2.1.6 | RowStatus | read-create | The status of this row, by which new entries may be created, or old entries deleted from this table. The agent need not support setting this object to createAndWait or notInService since there are no other writable objects in this table, and writable objects in rows of corresponding tables such as the tunnelIfTable may be modified while this row is active. To create a row in this table for an encapsulation method which does not support multiple parallel tunnels with the same endpoints, the management station should simply use a tunnelConfigID of 1, and set tunnelConfigStatus to createAndGo. For encapsulation methods such as L2F which allow multiple parallel tunnels, the management station may select a pseudo-random number to use as the tunnelConfigID and set tunnelConfigStatus to createAndGo. In the event that this ID is already in use and an inconsistentValue is returned in response to the set operation, the management station should simply select a new pseudo-random number and retry the operation. Creating a row in this table will cause an interface index to be assigned by the agent in an implementation-dependent manner, and corresponding rows will be instantiated in the ifTable and the tunnelIfTable. The status of this row will become active as soon as the agent assigns the interface index, regardless of whether the interface is operationally up. Deleting a row in this table will likewise delete the corresponding row in the ifTable and in the tunnelIfTable. Since this object does not support IPv6, it is deprecated in favor of tunnelInetConfigStatus. |
| tunnelInetConfigTable | 1.3.6.1.2.1.10.131.1.1.3 | not-accessible | The (conceptual) table containing information on configured tunnels. This table can be used to map a set of tunnel endpoints to the associated ifIndex value. It can also be used for row creation. Note that every row in the tunnelIfTable with a fixed destination address should have a corresponding row in the tunnelInetConfigTable, regardless of whether it was created via SNMP. | |
| tunnelInetConfigEntry | 1.3.6.1.2.1.10.131.1.1.3.1 | not-accessible | An entry (conceptual row) containing the information on a particular configured tunnel. Note that there is a 128 subid maximum for object OIDs. Implementers need to be aware that if the total number of octets in tunnelInetConfigLocalAddress and tunnelInetConfigRemoteAddress exceeds 110 then OIDs of column instances in this table will have more than 128 sub-identifiers and cannot be accessed using SNMPv1, SNMPv2c, or SNMPv3. In practice this is not expected to be a problem since IPv4 and IPv6 addresses will not cause the limit to be reached, but if other types are supported by an agent, care must be taken to ensure that the sum of the lengths do not cause the limit to be exceeded. | |
| IPt tunnelInetConfigAddressType | 1.3.6.1.2.1.10.131.1.1.3.1.1 | InetAddressType | not-accessible | The address type over which the tunnel encapsulates packets. |
| IP tunnelInetConfigLocalAddress | 1.3.6.1.2.1.10.131.1.1.3.1.2 | InetAddress | not-accessible | The address of the local endpoint of the tunnel, or 0.0.0.0 (for IPv4) or :: (for IPv6) if the device is free to choose any of its addresses at tunnel establishment time. |
| IP tunnelInetConfigRemoteAddress | 1.3.6.1.2.1.10.131.1.1.3.1.3 | InetAddress | not-accessible | The address of the remote endpoint of the tunnel. |
| IAN tunnelInetConfigEncapsMethod | 1.3.6.1.2.1.10.131.1.1.3.1.4 | IANAtunnelType | not-accessible | The encapsulation method used by the tunnel. |
| I32 tunnelInetConfigID | 1.3.6.1.2.1.10.131.1.1.3.1.5 | Integer32 | not-accessible | An identifier used to distinguish between multiple tunnels of the same encapsulation method, with the same endpoints. If the encapsulation protocol only allows one tunnel per set of endpoint addresses (such as for GRE or IP-in-IP), the value of this object is 1. For encapsulation methods (such as L2F) which allow multiple parallel tunnels, the manager is responsible for choosing any ID which does not conflict with an existing row, such as choosing a random number. |
| NUM tunnelInetConfigIfIndex | 1.3.6.1.2.1.10.131.1.1.3.1.6 | InterfaceIndexOrZero | read-only | If the value of tunnelInetConfigStatus for this row is active, then this object contains the value of ifIndex corresponding to the tunnel interface. A value of 0 is not legal in the active state, and means that the interface index has not yet been assigned. |
| ROW tunnelInetConfigStatus | 1.3.6.1.2.1.10.131.1.1.3.1.7 | RowStatus | read-create | The status of this row, by which new entries may be created, or old entries deleted from this table. The agent need not support setting this object to createAndWait or notInService since there are no other writable objects in this table, and writable objects in rows of corresponding tables such as the tunnelIfTable may be modified while this row is active. To create a row in this table for an encapsulation method which does not support multiple parallel tunnels with the same endpoints, the management station should simply use a tunnelInetConfigID of 1, and set tunnelInetConfigStatus to createAndGo. For encapsulation methods such as L2F which allow multiple parallel tunnels, the management station may select a pseudo-random number to use as the tunnelInetConfigID and set tunnelInetConfigStatus to createAndGo. In the event that this ID is already in use and an inconsistentValue is returned in response to the set operation, the management station should simply select a new pseudo-random number and retry the operation. Creating a row in this table will cause an interface index to be assigned by the agent in an implementation-dependent manner, and corresponding rows will be instantiated in the ifTable and the tunnelIfTable. The status of this row will become active as soon as the agent assigns the interface index, regardless of whether the interface is operationally up. Deleting a row in this table will likewise delete the corresponding row in the ifTable and in the tunnelIfTable. |
| STO tunnelInetConfigStorageType | 1.3.6.1.2.1.10.131.1.1.3.1.8 | StorageType | read-create | The storage type of this row. If the row is permanent(4), no objects in the row need be writable. |
| tunnelMIBConformance | 1.3.6.1.2.1.10.131.2 | |||
| tunnelMIBCompliances | 1.3.6.1.2.1.10.131.2.1 | |||
| tunnelMIBCompliance | 1.3.6.1.2.1.10.131.2.1.1 | The (deprecated) IPv4-only compliance statement for the IP Tunnel MIB. This is deprecated in favor of tunnelMIBInetFullCompliance and tunnelMIBInetReadOnlyCompliance. | ||
| tunnelMIBInetFullCompliance | 1.3.6.1.2.1.10.131.2.1.2 | The full compliance statement for the IP Tunnel MIB. | ||
| tunnelMIBInetReadOnlyCompliance | 1.3.6.1.2.1.10.131.2.1.3 | The read-only compliance statement for the IP Tunnel MIB. | ||
| tunnelMIBGroups | 1.3.6.1.2.1.10.131.2.2 | |||
| tunnelMIBBasicGroup | 1.3.6.1.2.1.10.131.2.2.1 | A collection of objects to support basic management of IPv4 Tunnels. Since this group cannot support IPv6, it is deprecated in favor of tunnelMIBInetGroup. | ||
| tunnelMIBInetGroup | 1.3.6.1.2.1.10.131.2.2.2 | A collection of objects to support basic management of IPv4 and IPv6 Tunnels. |
FAQ
How can TUNNEL-MIB help confirm a GRE tunnel is configured consistently on both ends?
Its tunnel interface table reports each tunnel's local and remote endpoint addresses along with the encapsulation method, hop limit, and TOS/flow label settings, so comparing these values against the far-end configuration quickly reveals endpoint or encapsulation mismatches.
Why would a tunnel show as up in TUNNEL-MIB but still not be passing traffic?
TUNNEL-MIB mainly confirms configuration and topology consistency; since each tunnel is represented as an ifEntry indexed by ifIndex, you need to cross-reference IF-MIB counters on that same index to see whether the tunnel is administratively up but not actually forwarding packets.
RFC description
IETF MIB for management of IP tunnels independent of encapsulation scheme (RFC 4087).
Start monitoring vendor-neutral, standards-based MIB, router or VPN gateway supporting IP tunneling (GRE/IP-in-IP/L2TP/PPTP admin/oper status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.