XEDIA-SECURITY-MIB

All MIBs › XEDIA-SECURITY-MIB

Organization: Xedia Corp.

Last Updated: 1997-06-26

Description: Xedia object-level access-control MIB enabling per-object and per-instance security checks with hierarchical parent-depth enforcement on Xedia routers

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is XEDIA-SECURITY-MIB?

XEDIA-SECURITY-MIB is a private enterprise MIB from Xedia Corporation (a maker of WAN access routers later absorbed into Lucent) that governs the object-level access-control mechanism built into Xedia router firmware. It exposes configuration data describing which SNMP objects and table rows are protected, what function ID governs each protected item, and how many levels of parent-object security checks must be traversed before access is granted. Rather than reporting environmental or performance metrics, this MIB is used to monitor the software configuration and enforcement state of the device's security subsystem, letting administrators confirm that read/write permission settings on sensitive objects and instances are correctly applied and have not drifted from policy. It has no stated formal dependency beyond the standard SNMPv2 SMI conventions, though it is designed to sit alongside the full Xedia enterprise object tree it protects. It is typically deployed on legacy Xedia/Lucent access routers where administrators need fine-grained, per-object SNMP write protection in multi-admin environments. Engineers can download the XEDIA-SECURITY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in XEDIA-SECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Xedia access routers
Lucent-branded WAN routers (post-acquisition)

Monitoring Examples

An administrator would walk the xsecurityObjConfTable, whose xsecurityObjConfEntry rows are indexed by xsecurityObjID/xsecurityObjInstance, to check the current xsecurityObjReadAdmin and xsecurityObjWriteAdmin settings for a sensitive object. If xsecurityObjWriteAdmin unexpectedly shows a permissive value, that reveals a misconfigured or compromised access-control policy. The xsecurityParentDepth value tells the poller how many levels of parent-object checks (via xsecurityFunctionID) must also pass before a write is honored, useful for auditing the effective protection depth of nested objects.

What Can Be Monitored

per-object read/write admin permissions
protected object and instance identifiers
security function ID assignments
parent security check depth
object-level access-control configuration table

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus

From XEDIA-REG

xediaMibs

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
xediaSecurityMIB	1.3.6.1.4.1.838.3.8			This module defines objects for management of the 'Security' mechanism in Xedia devices. Security Model: In all cases, a top level, 'object-wide' security check is performed, followed by the 'instantiated object' (particular instance or row) check, if specified, followed by the security function (when appropriate), followed by the required 'parent' security checks, in the same order.
xsecurityObjects	1.3.6.1.4.1.838.3.8.1
xsecurityGeneral	1.3.6.1.4.1.838.3.8.1.1
INT xsecurityAdmin	1.3.6.1.4.1.838.3.8.1.1.1	INTEGER	read-write	The administrative status of the 'Security mechanism' in the router. The value 'enabled(1)' indicates that the appropriate security checks will be performed on all configured objects. The value 'disabled(2)' indicates that no security checks will be performed on any objects.
INT xsecurityParentDepth	1.3.6.1.4.1.838.3.8.1.1.2	INTEGER	read-write	The number of 'parent' nodes inwhich the security checks are performed for any given object. The security checks start at the endpoint (the actual object requested) and traverse upwards, checking the immediate parent node, then that parent's parent, etc., until the maximun number of parents is reached, or there are no more parents.
STR xsecurityFunctionID	1.3.6.1.4.1.838.3.8.1.1.3	DisplayString	read-write	The textual string ID used to determine a specific set of special customer security functions, when appropriate. Only OS builds containing customized security functions will take advantage of this object.
xsecurityObjectTables	1.3.6.1.4.1.838.3.8.1.2
xsecurityObjConfTable	1.3.6.1.4.1.838.3.8.1.2.1		not-accessible	A list of security object configuration entries. The number of entries is representative of the number of objects defined in the supported mib.
xsecurityObjConfEntry	1.3.6.1.4.1.838.3.8.1.2.1.1		not-accessible	An entry containing additional management information applicable to a particular Rip2 interface.
OID xsecurityObjID	1.3.6.1.4.1.838.3.8.1.2.1.1.1	OBJECT IDENTIFIER	not-accessible	The Object Identifier of a known object, or a particular instance of the object. Objects can be end nodes, which contain readable data, or they can be inner nodes which are only used to identify the end points. The object ID can be secified by using the complete OID of an object, with the exact OID digits making up the instance portion of the object when needed. In all cases, an 'end of ID' marker of decimal '999' will be used to separate the base objectID from the instance portion of the whole OID. When '.0' instance information is specified, the 'object-wide' security levels of the object are modified. But, when specific instance information is specified, the security levels of a particular instance are modifed. Then,only requests with exactly matching instance information are validated against the specified levels. The '.0' also indicates where the 'base' oid ends and the instance information (if any) begins. This way, it is possible to identify high level nodes with specific instances matching lower level nodes. ie: ifEntry.1 --> ifEntry.999.1 filters out all instances of '1'. The '999' is necessary since ifEntry.1 looks exactly the same as ifIndex. 1.3.6.1.2.1.2.2.1 ifEntry 1.3.6.1.2.1.2.2.1.1 ifIndex
STR xsecurityObjName	1.3.6.1.4.1.838.3.8.1.2.1.1.2	DisplayString	read-only	The mib name of the specificed object.
STR xsecurityObjInstance	1.3.6.1.4.1.838.3.8.1.2.1.1.3	DisplayString	read-only	The instance portion of the specified object. The OID digits are represented in a readable string format.
INT xsecurityObjReadAdmin	1.3.6.1.4.1.838.3.8.1.2.1.1.4	INTEGER	read-create	The 'Read' administrative status of the 'Security mechanism' for an individual object. The value 'enabled(1)' indicates that the appropriate security checks will be performed on all access to the spcified object. The value 'disabled(2)' indicates that no security checks will be performed for the specified object, although, all expected 'parent' security checks will still be performed.
INT xsecurityObjWriteAdmin	1.3.6.1.4.1.838.3.8.1.2.1.1.5	INTEGER	read-create	The 'Write' administrative status of the 'Security mechanism' for an individual object. The value 'enabled(1)' indicates that the appropriate security checks will be performed on all access to the spcified object. The value 'disabled(2)' indicates that no security checks will be performed for the specified object, although, all expected 'parent' security checks will still be performed.
INT xsecurityObjReadFunctAdmin	1.3.6.1.4.1.838.3.8.1.2.1.1.6	INTEGER	read-create	The 'Read' administrative status of the 'Security Function mechanism' for an individual object. The value 'enabled(1)' indicates that the appropriate security functions will be called on all access to the spcified object. The value 'disabled(2)' indicates that no security functions will be called for the specified object.
INT xsecurityObjWriteFunctAdmin	1.3.6.1.4.1.838.3.8.1.2.1.1.7	INTEGER	read-create	The 'Write' administrative status of the 'Security Function mechanism' for an individual object. The value 'enabled(1)' indicates that the appropriate security functions will be called on all access to the spcified object. The value 'disabled(2)' indicates that no security functions will be called for the specified object.
BIT xsecurityObjReadLevels	1.3.6.1.4.1.838.3.8.1.2.1.1.8	Bits	read-create	The bit mask associated with a particular object for 'reading' and 'viewing'. The levels of security indicate which community entries have read access to the variable. The level matches the index, or entry number of the community table.
BIT xsecurityObjWriteLevels	1.3.6.1.4.1.838.3.8.1.2.1.1.9	Bits	read-create	The bit mask associated with a particular object for 'writinging' and 'setting'. The levels of security indicate which community entries have read access to the variable. The level matches the index, or entry number of the community table.
ROW xsecurityObjRowStatus	1.3.6.1.4.1.838.3.8.1.2.1.1.10	RowStatus	read-create	This object is used to add and remove entries from the table. It is important to note that the '.0' entry, which represents the 'object level' can not be added or deleted, they simply always exists. However the 'instanciated' table rows can be added or deleted as necessary.
xsecurityConformance	1.3.6.1.4.1.838.3.8.2
xsecurityCompliances	1.3.6.1.4.1.838.3.8.2.1
xsecurityCompliance	1.3.6.1.4.1.838.3.8.2.1.1			The compliance statement for all agents that support this MIB. A compliant agent implements all objects defined in this MIB.
xsecurityGroups	1.3.6.1.4.1.838.3.8.2.2
xsecurityAllGroup	1.3.6.1.4.1.838.3.8.2.2.1			The set of all accessible objects in this MIB.

RFC description

Security mechanism management for router access control and authentication policies.

Start monitoring Xedia access routers, Lucent-branded WAN routers (object-level SNMP security-policy config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download XEDIA-SECURITY-MIB

What Is XEDIA-SECURITY-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description