-- extracted from draft-ietf-l3vpn-mpls-vpn-mib-04.txt -- at Thu Jul 8 06:21:49 2004 MPLS-L3VPN-DRAFT-03-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Integer32, Counter32, Unsigned32, Gauge32 FROM SNMPv2-SMI -- [RFC2578] MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF -- [RFC2580] TEXTUAL-CONVENTION, TruthValue, RowStatus, TimeStamp, StorageType FROM SNMPv2-TC -- [RFC2579] InterfaceIndex, InterfaceIndexOrZero FROM IF-MIB -- [RFC2863] VPNId FROM VPN-TC-MIB SnmpAdminString FROM SNMP-FRAMEWORK-MIB -- [RFC3411] IANAipRouteProtocol FROM IANA-RTPROTO-MIB InetAddress, InetAddressType, InetAddressPrefixLength, InetAutonomousSystemNumber FROM INET-ADDRESS-MIB -- [RFC3291] mplsStdMIB FROM MPLS-TC-STD-MIB -- [RFC3811] MplsIndexType FROM MPLS-LSR-STD-MIB -- [RFC3813] ; mplsL3VpnMIB MODULE-IDENTITY LAST-UPDATED "200406018200Z" -- 18 June 2004 12:00:00 GMT ORGANIZATION "IETF Layer-3 Virtual Private Networks Working Group." CONTACT-INFO " Thomas D. Nadeau tnadeau@cisco.com Harmen van der Linde hvdl@att.com Luyuan Fang luyuanfang@att.com Stephen Brannon Fabio M. Chiussi fabio@bell-labs.com Joseph Dube Martin Tatham martin.tatham@bt.com Comments and discussion to l3vpn@ietf.org" DESCRIPTION "This MIB contains managed object definitions for the Layer-3 Multiprotocol Label Switching Virtual Private Networks. Copyright (C) The Internet Society (2004). This version of this MIB module is part of RFCXXX; see the RFC itself for full legal notices." -- Revision history. REVISION "200406018200Z" -- 18 June 2004 12:00:00 GMT DESCRIPTION "Initial version. Published as RFC xxxx." -- RFC-editor pls fill in xxx ::= { mplsStdMIB 1 } -- assigned by IANA, see section 18.1 for details -- Textual Conventions. MplsL3VpnName ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "An identifier that is assigned to each MPLS/BGP VPN and is used to uniquely identify it. This is assigned by the system operator or NMS and SHOULD be unique throughout the MPLS domain. If this is the case, then this identifier can then be used at any LSR within a specific MPLS domain to identify this MPLS/BGP VPN. It may also be possible to preserve the uniqueness of this identifier across MPLS domain boundaries, in which case this identifier can then be used to uniquely identify MPLS/BGP VPNs on a more global basis. This object MAY be set to the VPN ID as defined in RFC 2685." REFERENCE "RFC 2685 Fox B., et al, 'Virtual Private Networks Identifier', September 1999." SYNTAX OCTET STRING(SIZE (0..31)) MplsL3VpnRouteDistinguisher ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "Syntax for a route distinguisher and route target." SYNTAX OCTET STRING(SIZE (0..256)) -- Top level components of this MIB. mplsL3VpnNotifications OBJECT IDENTIFIER ::= { mplsL3VpnMIB 0 } mplsL3VpnObjects OBJECT IDENTIFIER ::= { mplsL3VpnMIB 1 } mplsL3VpnScalars OBJECT IDENTIFIER ::= { mplsL3VpnObjects 1 } mplsL3VpnConf OBJECT IDENTIFIER ::= { mplsL3VpnObjects 2 } mplsL3VpnPerf OBJECT IDENTIFIER ::= { mplsL3VpnObjects 3 } mplsL3VpnRoute OBJECT IDENTIFIER ::= { mplsL3VpnObjects 4 } mplsL3VpnConformance OBJECT IDENTIFIER ::= { mplsL3VpnMIB 3 } -- -- Scalar Objects -- mplsL3VpnConfiguredVrfs OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of VRFs which are configured on this node." ::= { mplsL3VpnScalars 1 } mplsL3VpnActiveVrfs OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of VRFs which are active on this node. That is, those VRFs whose corresponding mplsL3VpnVrfOperStatus object value is equal to operational (1)." ::= { mplsL3VpnScalars 2 } mplsL3VpnConnectedInterfaces OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "Total number of interfaces connected to a VRF." ::= { mplsL3VpnScalars 3 } mplsL3VpnNotificationEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "If this object is true, then it enables the generation of all notifications defined in this MIB." REFERENCE "See also RFC3413 for explanation that notifications are under the ultimate control of the MIB modules in this document." DEFVAL { false } ::= { mplsL3VpnScalars 4 } mplsL3VpnVrfConfMaxPossRts OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "Denotes maximum number of routes which the device will allow all VRFs jointly to hold. If this value is set to 0, this indicates that the device is unable to determine the absolute maximum. In this case, the configured maximum MAY not actually be allowed by the device." ::= { mplsL3VpnScalars 5 } mplsL3VpnVrfConfRteMxThrshTime OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "Denotes the interval in seconds, at which the route max threshold notification may be re-issued after the maximum value has been exceeded (or has been reached if mplsL3VpnVrfConfMaxRoutes and mplsL3VpnVrfConfHighRteThresh are equal) and the initial notification has been issued. This value is intended to prevent continuous generation of notifications by an agent in the event that routes are continually added to a VRF after it has reached its maximum value. If this value is set to 0, the agent should only issue a single notification at the time that the maxium threshold has been reached, and should not issue any more notifications until the value of routes has fallen below the configured threshold value. This is the recommended default behavior." DEFVAL { 0 } ::= { mplsL3VpnScalars 6 } -- VPN Interface Configuration Table mplsL3VpnIfConfTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsL3VpnIfConfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per-interface MPLS capability and associated information." ::= { mplsL3VpnConf 1 } mplsL3VpnIfConfEntry OBJECT-TYPE SYNTAX MplsL3VpnIfConfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in this table is created by an LSR for every interface capable of supporting MPLS L3VPN. Each entry in this table is meant to correspond to an entry in the Interfaces Table." INDEX { mplsL3VpnVrfName, mplsL3VpnIfConfIndex } ::= { mplsL3VpnIfConfTable 1 } MplsL3VpnIfConfEntry ::= SEQUENCE { mplsL3VpnIfConfIndex InterfaceIndex, mplsL3VpnIfVpnClassification INTEGER, mplsL3VpnIfVpnRouteDistProtocol BITS, mplsL3VpnIfConfStorageType StorageType, mplsL3VpnIfConfRowStatus RowStatus } mplsL3VpnIfConfIndex OBJECT-TYPE SYNTAX InterfaceIndex MAX-ACCESS not-accessible STATUS current DESCRIPTION "This is a unique index for an entry in the mplsL3VpnIfConfTable. A non-zero index for an entry indicates the ifIndex for the corresponding interface entry in the MPLS-VPN-layer in the ifTable. Note that this table does not necessarily correspond one-to-one with all entries in the Interface MIB having an ifType of MPLS-layer; rather, only those which are enabled for MPLS L3VPN functionality." REFERENCE "RFC 2233 - The Interfaces Group MIB using SMIv2, McCloghrie, K., and F. Kastenholtz, Nov. 1997" ::= { mplsL3VpnIfConfEntry 1 } mplsL3VpnIfVpnClassification OBJECT-TYPE SYNTAX INTEGER { carrierOfCarrier (1), enterprise (2), interProvider (3) } MAX-ACCESS read-create STATUS current DESCRIPTION "Denotes whether this link participates in a carrier-of-carrier's, enterprise, or inter-provider scenario." DEFVAL { 2 } ::= { mplsL3VpnIfConfEntry 2 } mplsL3VpnIfVpnRouteDistProtocol OBJECT-TYPE SYNTAX BITS { none (0), bgp (1), ospf (2), rip(3), isis(4), static(5), other (6) } MAX-ACCESS read-create STATUS current DESCRIPTION "Denotes the route distribution protocol across the PE-CE link. Note that more than one routing protocol may be enabled at the same time, thus this object is specified as a bitmask. For example, static(5) and ospf(2) are a typical configuration." DEFVAL { 0 } ::= { mplsL3VpnIfConfEntry 3 } mplsL3VpnIfConfStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this entry." REFERENCE "See RFC2579." DEFVAL { volatile } ::= { mplsL3VpnIfConfEntry 4 } mplsL3VpnIfConfRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This variable is used to create, modify, and/or delete a row in this table. Rows in this table signify that the specified interface is associated with this VRF. If the row creation operation succeeds, the interface will have been associated with the specified VRF, otherwise the agent MUST not allow the association. If the agent only allows read-only operations on this table, it MUST create entries in this table as they are created on the device. When a row in this table is in active(1) state, no objects in that row can be modified by the agent except mplsL3VpnIfConfStorageType and mplsL3VpnIfConfRowStatus." ::= { mplsL3VpnIfConfEntry 5 } -- VRF Configuration Table mplsL3VpnVrfTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsL3VpnVrfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per-interface MPLS L3VPN VRF Table capability and associated information. Entries in this table define VRF routing instances associated with MPLS/VPN interfaces. Note that multiple interfaces can belong to the same VRF instance. The collection of all VRF instances comprises an actual VPN." ::= { mplsL3VpnConf 2 } mplsL3VpnVrfEntry OBJECT-TYPE SYNTAX MplsL3VpnVrfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in this table is created by an LSR for every VRF capable of supporting MPLS L3VPN. The indexing provides an ordering of VRFs per-VPN interface." INDEX { mplsL3VpnVrfName } ::= { mplsL3VpnVrfTable 1 } MplsL3VpnVrfEntry ::= SEQUENCE { mplsL3VpnVrfName MplsL3VpnName, mplsL3VpnVrfVpnId VPNId, mplsL3VpnVrfDescription SnmpAdminString, mplsL3VpnVrfRD MplsL3VpnRouteDistinguisher, mplsL3VpnVrfCreationTime TimeStamp, mplsL3VpnVrfOperStatus INTEGER, mplsL3VpnVrfActiveInterfaces Unsigned32, mplsL3VpnVrfAssociatedInterfaces Unsigned32, mplsL3VpnVrfConfMidRteThresh Unsigned32, mplsL3VpnVrfConfHighRteThresh Unsigned32, mplsL3VpnVrfConfMaxRoutes Unsigned32, mplsL3VpnVrfConfLastChanged TimeStamp, mplsL3VpnVrfConfRowStatus RowStatus, mplsL3VpnVrfConfStorageType StorageType } mplsL3VpnVrfName OBJECT-TYPE SYNTAX MplsL3VpnName MAX-ACCESS not-accessible STATUS current DESCRIPTION "The human-readable name of this VPN. This MAY be equivalent to the RFC2685 VPN-ID, but may also vary. If it is set to the VPN ID, it MUST be equivalent to the value of mplsL3VpnVrfVpnId. It is strongly recommended that all sites supporting VRFs that are part of the same VPN use the same naming convention for VRFs as well as the same VPN ID." REFERENCE "RFC 2685 Fox B., et al, `Virtual Private Networks Identifier`, September 1999." ::= { mplsL3VpnVrfEntry 1 } mplsL3VpnVrfVpnId OBJECT-TYPE SYNTAX VPNId MAX-ACCESS read-create STATUS current DESCRIPTION "The VPN ID as specified in RFC 2685. If a VPN ID has not been specified for this VRF, then this variable SHOULD be set to an empty string." ::= { mplsL3VpnVrfEntry 2 } mplsL3VpnVrfDescription OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-create STATUS current DESCRIPTION "The human-readable description of this VRF." DEFVAL { "" } ::= { mplsL3VpnVrfEntry 3 } mplsL3VpnVrfRD OBJECT-TYPE SYNTAX MplsL3VpnRouteDistinguisher MAX-ACCESS read-create STATUS current DESCRIPTION "The route distinguisher for this VRF." DEFVAL { "" } ::= { mplsL3VpnVrfEntry 4 } mplsL3VpnVrfCreationTime OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The time at which this VRF entry was created." ::= { mplsL3VpnVrfEntry 5 } mplsL3VpnVrfOperStatus OBJECT-TYPE SYNTAX INTEGER { up (1), down (2) } MAX-ACCESS read-only STATUS current DESCRIPTION "Denotes whether a VRF is operational or not. A VRF is up(1) when at least one interface associated with the VRF, which ifOperStatus is up(1). A VRF is down(2) when: a. There does not exist at least one interface whose ifOperStatus is up(1). b. There are no interfaces associated with the VRF." ::= { mplsL3VpnVrfEntry 6 } mplsL3VpnVrfActiveInterfaces OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "Total number of interfaces connected to this VRF with ifOperStatus = up(1). This counter should be incremented when: a. When the ifOperStatus of one of the connected interfaces changes from down(2) to up(1). b. When an interface with ifOperStatus = up(1) is connected to this VRF. This counter should be decremented when: a. When the ifOperStatus of one of the connected interfaces changes from up(1) to down(2). b. When one of the connected interfaces with ifOperStatus = up(1) gets disconnected from this VRF." ::= { mplsL3VpnVrfEntry 7 } mplsL3VpnVrfAssociatedInterfaces OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "Total number of interfaces connected to this VRF (independent of ifOperStatus type)." ::= { mplsL3VpnVrfEntry 8 } mplsL3VpnVrfConfMidRteThresh OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-create STATUS current DESCRIPTION "Denotes mid-level water marker for the number of routes which this VRF may hold." DEFVAL { 0 } ::= { mplsL3VpnVrfEntry 9 } mplsL3VpnVrfConfHighRteThresh OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-create STATUS current DESCRIPTION "Denotes high-level water marker for the number of routes which this VRF may hold." DEFVAL { 0 } ::= { mplsL3VpnVrfEntry 10 } mplsL3VpnVrfConfMaxRoutes OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-create STATUS current DESCRIPTION "Denotes maximum number of routes which this VRF is configured to hold. This value MUST be less than or equal to mplsL3VpnVrfConfMaxPossRts unless it is set to 0." DEFVAL { 0 } ::= { mplsL3VpnVrfEntry 11 } mplsL3VpnVrfConfLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime at the time of the last change of this table entry, which includes changes of VRF parameters defined in this table or addition or deletion of interfaces associated with this VRF." ::= { mplsL3VpnVrfEntry 12 } mplsL3VpnVrfConfRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This variable is used to create, modify, and/or delete a row in this table." ::= { mplsL3VpnVrfEntry 13 } mplsL3VpnVrfConfStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this entry." REFERENCE "See RFC2579." DEFVAL { volatile } ::= { mplsL3VpnVrfEntry 14 } -- MplsL3VpnVrfRTTable mplsL3VpnVrfRTTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsL3VpnVrfRTEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per-VRF route target association. Each entry identifies a connectivity policy supported as part of a VPN." ::= { mplsL3VpnConf 3 } mplsL3VpnVrfRTEntry OBJECT-TYPE SYNTAX MplsL3VpnVrfRTEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION " An entry in this table is created by an LSR for each route target configured for a VRF supporting a MPLS L3VPN instance. The indexing provides an ordering per-VRF instance." INDEX { mplsL3VpnVrfName, mplsL3VpnVrfRTIndex, mplsL3VpnVrfRTType } ::= { mplsL3VpnVrfRTTable 1 } MplsL3VpnVrfRTEntry ::= SEQUENCE { mplsL3VpnVrfRTIndex Unsigned32, mplsL3VpnVrfRTType INTEGER, mplsL3VpnVrfRT MplsL3VpnRouteDistinguisher, mplsL3VpnVrfRTDescr SnmpAdminString, mplsL3VpnVrfRTRowStatus RowStatus } mplsL3VpnVrfRTIndex OBJECT-TYPE SYNTAX Unsigned32 (1..4294967295) MAX-ACCESS not-accessible STATUS current DESCRIPTION "Auxiliary index for route-targets configured for a particular VRF." ::= { mplsL3VpnVrfRTEntry 2 } mplsL3VpnVrfRTType OBJECT-TYPE SYNTAX INTEGER { import(1), export(2), both(3) } MAX-ACCESS not-accessible STATUS current DESCRIPTION "The route target export distribution type." ::= { mplsL3VpnVrfRTEntry 3 } mplsL3VpnVrfRT OBJECT-TYPE SYNTAX MplsL3VpnRouteDistinguisher MAX-ACCESS read-create STATUS current DESCRIPTION "The route target distribution policy." DEFVAL { "" } ::= { mplsL3VpnVrfRTEntry 4 } mplsL3VpnVrfRTDescr OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-create STATUS current DESCRIPTION "Description of the route target." DEFVAL { "" } ::= { mplsL3VpnVrfRTEntry 5 } mplsL3VpnVrfRTRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This variable is used to create, modify, and/or delete a row in this table. When a row in this table is in active(1) state, no objects in that row can be modified by the agent except mplsL3VpnVrfRTRowStatus." ::= { mplsL3VpnVrfRTEntry 6 } -- VRF Security Table mplsL3VpnVrfSecTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsL3VpnVrfSecEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per MPLS L3VPN VRF Table security features." ::= { mplsL3VpnConf 6 } mplsL3VpnVrfSecEntry OBJECT-TYPE SYNTAX MplsL3VpnVrfSecEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in this table is created by an LSR for every VRF capable of supporting MPLS L3VPN. Each entry in this table is used to indicate security-related information for each VRF entry." AUGMENTS { mplsL3VpnVrfEntry } ::= { mplsL3VpnVrfSecTable 1 } MplsL3VpnVrfSecEntry ::= SEQUENCE { mplsL3VpnVrfSecIllegalLblVltns Counter32, mplsL3VpnVrfSecIllLblRcvThrsh Unsigned32 } mplsL3VpnVrfSecIllegalLblVltns OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "Indicates the number of illegally received labels on this VPN/VRF." ::= { mplsL3VpnVrfSecEntry 1 } mplsL3VpnVrfSecIllLblRcvThrsh OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-create STATUS current DESCRIPTION "The number of illegally received labels above which this notification is issued." ::= { mplsL3VpnVrfSecEntry 2 } -- VRF Performance Table mplsL3VpnVrfPerfTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsL3VpnVrfPerfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per MPLS L3VPN VRF Table performance information." ::= { mplsL3VpnPerf 1 } mplsL3VpnVrfPerfEntry OBJECT-TYPE SYNTAX MplsL3VpnVrfPerfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in this table is created by an LSR for every VRF capable of supporting MPLS L3VPN." AUGMENTS { mplsL3VpnVrfEntry } ::= { mplsL3VpnVrfPerfTable 1 } MplsL3VpnVrfPerfEntry ::= SEQUENCE { mplsL3VpnVrfPerfRoutesAdded Counter32, mplsL3VpnVrfPerfRoutesDeleted Counter32, mplsL3VpnVrfPerfCurrNumRoutes Unsigned32, mplsL3VpnVrfPerfRoutesDropped Counter32 } mplsL3VpnVrfPerfRoutesAdded OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "Indicates the number of routes added to this VPN/VRF since this device has last been reset or the VRF was created, whichever came last." ::= { mplsL3VpnVrfPerfEntry 1 } mplsL3VpnVrfPerfRoutesDeleted OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "Indicates the number of routes removed from this VPN/VRF." ::= { mplsL3VpnVrfPerfEntry 2 } mplsL3VpnVrfPerfCurrNumRoutes OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "Indicates the number of routes currently used by this VRF." ::= { mplsL3VpnVrfPerfEntry 3 } mplsL3VpnVrfPerfRoutesDropped OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "This counter should be incremented when the number of routes contained by the specified VRF exceeds or attempts to exceed the maximum allowed value as indicated by mplsL3VpnVrfMaxRouteThreshold." ::= { mplsL3VpnVrfPerfEntry 4 } -- VRF Routing Table mplsL3VpnVrfRteTable OBJECT-TYPE SYNTAX SEQUENCE OF MplsL3VpnVrfRteEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table specifies per-interface MPLS L3VPN VRF Table routing information. Entries in this table define VRF routing entries associated with the specified MPLS/VPN interfaces. Note that this table contains both BGP and IGP routes, as both may appear in the same VRF." REFERENCE "1. RFC 1213 Section 6.6, The IP Group. 2. RFC 2096 " ::= { mplsL3VpnRoute 1 } mplsL3VpnVrfRteEntry OBJECT-TYPE SYNTAX MplsL3VpnVrfRteEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in this table is created by an LSR for every route present configured (either dynamically or statically) within the context of a specific VRF capable of supporting MPLS/BGP VPN. The indexing provides an ordering of VRFs per-VPN interface. Implementors need to be aware that if the value of the mplsL3VpnVrfName (an OID) has more that 111 sub-identifiers, then OIDs of column instances in this table will have more than 128 sub-identifiers and cannot be accessed using SNMPv1, SNMPv2c, or SNMPv3." INDEX { mplsL3VpnVrfName, mplsL3VpnVrfRteInetCidrDestType, mplsL3VpnVrfRteInetCidrDest, mplsL3VpnVrfRteInetCidrPfxLen, mplsL3VpnVrfRteInetCidrPolicy, mplsL3VpnVrfRteInetCidrNHopType, mplsL3VpnVrfRteInetCidrNextHop } ::= { mplsL3VpnVrfRteTable 1 } MplsL3VpnVrfRteEntry ::= SEQUENCE { mplsL3VpnVrfRteInetCidrDestType InetAddressType, mplsL3VpnVrfRteInetCidrDest InetAddress, mplsL3VpnVrfRteInetCidrPfxLen InetAddressPrefixLength, mplsL3VpnVrfRteInetCidrPolicy OBJECT IDENTIFIER, mplsL3VpnVrfRteInetCidrNHopType InetAddressType, mplsL3VpnVrfRteInetCidrNextHop InetAddress, mplsL3VpnVrfRteInetCidrIfIndex InterfaceIndexOrZero, mplsL3VpnVrfRteInetCidrType INTEGER, mplsL3VpnVrfRteInetCidrProto IANAipRouteProtocol, mplsL3VpnVrfRteInetCidrAge Gauge32, mplsL3VpnVrfRteInetCidrNextHopAS InetAutonomousSystemNumber, mplsL3VpnVrfRteInetCidrMetric1 Integer32, mplsL3VpnVrfRteInetCidrMetric2 Integer32, mplsL3VpnVrfRteInetCidrMetric3 Integer32, mplsL3VpnVrfRteInetCidrMetric4 Integer32, mplsL3VpnVrfRteInetCidrMetric5 Integer32, mplsL3VpnVrfRteXCPointer MplsIndexType, mplsL3VpnVrfRteInetCidrStatus RowStatus } mplsL3VpnVrfRteInetCidrDestType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The type of the mplsL3VpnVrfRteInetCidrDest address, as defined in the InetAddress MIB. Only those address types that may appear in an actual routing table are allowed as values of this object." REFERENCE "RFC 3291" ::= { mplsL3VpnVrfRteEntry 1 } mplsL3VpnVrfRteInetCidrDest OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The destination IP address of this route. The type of this address is determined by the value of the mplsL3VpnVrfRteInetCidrDestType object. The values for the index objects mplsL3VpnVrfRteInetCidrDest and mplsL3VpnVrfRteInetCidrPfxLen must be consistent. When the value of mplsL3VpnVrfRteInetCidrDest is x, then the bitwise logical-AND of x with the value of the mask formed from the corresponding index object mplsL3VpnVrfRteInetCidrPfxLen MUST be equal to x. If not, then the index pair is not consistent and an inconsistentName error must be returned on SET or CREATE requests." ::= { mplsL3VpnVrfRteEntry 2 } mplsL3VpnVrfRteInetCidrPfxLen OBJECT-TYPE SYNTAX InetAddressPrefixLength (0..128) MAX-ACCESS not-accessible STATUS current DESCRIPTION "Indicates the number of leading one bits which form the mask to be logical-ANDed with the destination address before being compared to the value in the mplsL3VpnVrfRteInetCidrDest field. The values for the index objects mplsL3VpnVrfRteInetCidrDest and mplsL3VpnVrfRteInetCidrPfxLen must be consistent. When the value of mplsL3VpnVrfRteInetCidrDest is x, then the bitwise logical-AND of x with the value of the mask formed from the corresponding index object mplsL3VpnVrfRteInetCidrPfxLen MUST be equal to x. If not, then the index pair is not consistent and an inconsistentName error must be returned on SET or CREATE requests." ::= { mplsL3VpnVrfRteEntry 3 } mplsL3VpnVrfRteInetCidrPolicy OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object is an opaque object without any defined semantics. Its purpose is to serve as an additional index which may delineate between multiple entries to the same destination. The value { 0 0 } shall be used as the default value for this object." ::= { mplsL3VpnVrfRteEntry 4 } mplsL3VpnVrfRteInetCidrNHopType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The type of the mplsL3VpnVrfRteInetCidrNextHop address, as defined in the InetAddress MIB. Value should be set to unknown(0) for non-remote routes. Only those address types that may appear in an actual routing table are allowed as values of this object." REFERENCE "RFC 3291" ::= { mplsL3VpnVrfRteEntry 5 } mplsL3VpnVrfRteInetCidrNextHop OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "On remote routes, the address of the next system en route. For non-remote routes, a zero length string. The type of this address is determined by the value of the mplsL3VpnVrfRteInetCidrNHopType object." ::= { mplsL3VpnVrfRteEntry 6 } mplsL3VpnVrfRteInetCidrIfIndex OBJECT-TYPE SYNTAX InterfaceIndexOrZero MAX-ACCESS read-create STATUS current DESCRIPTION "The ifIndex value which identifies the local interface through which the next hop of this route should be reached. A value of 0 is valid and represents the scenario where no interface is specified." DEFVAL { 0 } ::= { mplsL3VpnVrfRteEntry 7 } mplsL3VpnVrfRteInetCidrType OBJECT-TYPE SYNTAX INTEGER { other (1), -- not specified by this MIB reject (2), -- route which discards traffic and -- returns ICMP notification local (3), -- local interface remote (4), -- remote destination blackhole(5) -- route which discards traffic -- silently } MAX-ACCESS read-create STATUS current DESCRIPTION "The type of route. Note that local(3) refers to a route for which the next hop is the final destination; remote(4)refers to a route for which the next hop is not the final destination. Routes which do not result in traffic forwarding or rejection should not be displayed even if the implementation keeps them stored internally. reject(2) refers to a route which, if matched, discards the message as unreachable and returns a notification (e.g. ICMP error) to the message sender. This is used in some protocols as a means of correctly aggregating routes. blackhole(5) refers to a route which, if matched, discards the message silently." DEFVAL { 1 } ::= { mplsL3VpnVrfRteEntry 8 } mplsL3VpnVrfRteInetCidrProto OBJECT-TYPE SYNTAX IANAipRouteProtocol MAX-ACCESS read-only STATUS current DESCRIPTION "The routing mechanism via which this route was learned. Inclusion of values for gateway routing protocols is not intended to imply that hosts should support those protocols." ::= { mplsL3VpnVrfRteEntry 9 } mplsL3VpnVrfRteInetCidrAge OBJECT-TYPE SYNTAX Gauge32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds since this route was last updated or otherwise determined to be correct. Note that no semantics of 'too old' can be implied except through knowledge of the routing protocol by which the route was learned." ::= { mplsL3VpnVrfRteEntry 10 } mplsL3VpnVrfRteInetCidrNextHopAS OBJECT-TYPE SYNTAX InetAutonomousSystemNumber MAX-ACCESS read-create STATUS current DESCRIPTION "The Autonomous System Number of the Next Hop. The semantics of this object are determined by the routing- protocol specified in the route's mplsL3VpnVrfRteInetCidrProto value. When this object is unknown or not relevant its value should be set to zero." DEFVAL { 0 } ::= { mplsL3VpnVrfRteEntry 11 } mplsL3VpnVrfRteInetCidrMetric1 OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-create STATUS current DESCRIPTION "The primary routing metric for this route. The semantics of this metric are determined by the routing- protocol specified in the route's mplsL3VpnVrfRteInetCidrProto value. If this metric is not used, its value should be set to -1." DEFVAL { -1 } ::= { mplsL3VpnVrfRteEntry 12 } mplsL3VpnVrfRteInetCidrMetric2 OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-create STATUS current DESCRIPTION "An alternate routing metric for this route. The semantics of this metric are determined by the routing- protocol specified in the route's mplsL3VpnVrfRteInetCidrProto value. If this metric is not used, its value should be set to -1." DEFVAL { -1 } ::= { mplsL3VpnVrfRteEntry 13 } mplsL3VpnVrfRteInetCidrMetric3 OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-create STATUS current DESCRIPTION "An alternate routing metric for this route. The semantics of this metric are determined by the routing- protocol specified in the route's mplsL3VpnVrfRteInetCidrProto value. If this metric is not used, its value should be set to -1." DEFVAL { -1 } ::= { mplsL3VpnVrfRteEntry 14 } mplsL3VpnVrfRteInetCidrMetric4 OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-create STATUS current DESCRIPTION "An alternate routing metric for this route. The semantics of this metric are determined by the routing- protocol specified in the route's mplsL3VpnVrfRteInetCidrProto value. If this metric is not used, its value should be set to -1." DEFVAL { -1 } ::= { mplsL3VpnVrfRteEntry 15 } mplsL3VpnVrfRteInetCidrMetric5 OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-create STATUS current DESCRIPTION "An alternate routing metric for this route. The semantics of this metric are determined by the routing- protocol specified in the route's mplsL3VpnVrfRteInetCidrProto value. If this metric is not used, its value should be set to -1." DEFVAL { -1 } ::= { mplsL3VpnVrfRteEntry 16 } mplsL3VpnVrfRteXCPointer OBJECT-TYPE SYNTAX MplsIndexType MAX-ACCESS read-create STATUS current DESCRIPTION "Index into mplsXCTable which identifies which cross- connect entry is associated with this VRF route entry by containing the mplsXCIndex of that cross-connect entry. The string containing the single octet 0x00 indicates that a label stack is not associated with this route entry. This can be the case because the label bindings have not yet been established, or because some change in the agent has removed them. When the label stack associated with this VRF route is created by the agent, it MUST establish the associated cross-connect entry in the mplsXCTable and then set that index to the value of this object. Changes to the cross-connect object in the mplsXCTable MUST automatically be be reflected the value of this object. If this object represents a static routing entry, then the manager must ensure that this entry is also maintained consistently in the corresponding mplsXCTable as well." REFERENCE "RFC 3813 - Multiprotocol Label Switching (MPLS) Label Switching Router (LSR) Management Information base (MIB), C. Srinivasan, A. Vishwanathan, and T. Nadeau, June 2004" DEFVAL { "" } ::= { mplsL3VpnVrfRteEntry 17 } mplsL3VpnVrfRteInetCidrStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The row status variable, used according to row installation and removal conventions. A row entry cannot be modified when the status is marked as active(1)." ::= { mplsL3VpnVrfRteEntry 18 } -- MPLS L3VPN Notifications mplsVrfIfUp NOTIFICATION-TYPE OBJECTS { mplsL3VpnIfConfRowStatus, mplsL3VpnVrfOperStatus } STATUS current DESCRIPTION "This notification is generated when: a. The ifOperStatus of an interface associated with a VRF changes to the up(1) state. b. When an interface with ifOperStatus = up(1) is associated with a VRF." ::= { mplsL3VpnNotifications 1 } mplsVrfIfDown NOTIFICATION-TYPE OBJECTS { mplsL3VpnIfConfRowStatus, mplsL3VpnVrfOperStatus } STATUS current DESCRIPTION "This notification is generated when: a. The ifOperStatus of an interface associated with a VRF changes to the down(1) state. b. When an interface with ifOperStatus = up(1) state is disassociated with a VRF." ::= { mplsL3VpnNotifications 2 } mplsNumVrfRouteMidThreshExceeded NOTIFICATION-TYPE OBJECTS { mplsL3VpnVrfPerfCurrNumRoutes, mplsL3VpnVrfConfMidRteThresh } STATUS current DESCRIPTION "This notification is generated when the number of routes contained by the specified VRF exceeds the value indicated by mplsL3VpnVrfMidRouteThreshold. A single notification MUST be generated when this threshold is exceeded, and no other notifications of this type should be issued until the value of mplsL3VpnVrfPerfCurrNumRoutes has fallen below that of mplsL3VpnVrfConfMidRteThresh." ::= { mplsL3VpnNotifications 3 } mplsNumVrfRouteMaxThreshExceeded NOTIFICATION-TYPE OBJECTS { mplsL3VpnVrfPerfCurrNumRoutes, mplsL3VpnVrfConfHighRteThresh } STATUS current DESCRIPTION "This notification is generated when the number of routes contained by the specified VRF exceeds or attempts to exceed the maximum allowed value as indicated by mplsL3VpnVrfMaxRouteThreshold. In cases where mplsL3VpnVrfConfHighRteThresh is set to the same value as mplsL3VpnVrfConfMaxRoutes, mplsL3VpnVrfConfHighRteThresh need not be exceeded; rather, just reached for this notification to be issued. Note that mplsL3VpnVrfConfRteMxThrshTime denotes the interval at which the this notification will be re-issued after the maximum value has been exceeded (or reached if mplsL3VpnVrfConfMaxRoutes and mplsL3VpnVrfConfHighRteThresh are equal) and the initial notification has been issued. This value is intended to prevent continuous generation of notifications by an agent in the event that routes are continually added to a VRF after it has reached its maximum value. The default value is 0 minutes. If this value is set to 0, the agent should only issue a single notification at the time that the maximum threshold has been reached, and should not issue any more notifications until the value of routes has fallen below the configured threshold value." ::= { mplsL3VpnNotifications 4 } mplsNumVrfSecIllglLblThrshExcd NOTIFICATION-TYPE OBJECTS { mplsL3VpnVrfSecIllegalLblVltns } STATUS current DESCRIPTION "This notification is generated when the number of illegal label violations on a VRF as indicated by mplsL3VpnVrfSecIllegalLblVltns has exceeded mplsL3VpnVrfSecIllLblRcvThrsh. The threshold is not included in the varbind here because the value of mplsL3VpnVrfSecIllegalLblVltns should be one greater than the threshold at the time this notification is issued." ::= { mplsL3VpnNotifications 5 } mplsNumVrfRouteMaxThreshCleared NOTIFICATION-TYPE OBJECTS { mplsL3VpnVrfPerfCurrNumRoutes, mplsL3VpnVrfConfHighRteThresh } STATUS current DESCRIPTION "This notification is generated only after the number of routes contained by the specified VRF exceeds or attempts to exceed the maximum allowed value as indicated by mplsVrfMaxRouteThreshold, and then falls below this value. The emission of this notification informs the operator that the error condition has been cleared without the operator having to query the device. Note that mplsL3VpnVrfConfRteMxThrshTime denotes the interval at which the the mplsNumVrfRouteMaxThreshExceeded notification will be re-issued after the maximum value has been exceeded (or reached if mplsL3VpnVrfConfMaxRoutes and mplsL3VpnVrfConfHighRteThresh are equal) and the initial notification has been issued. Therefore, the generation of this notification should also be emitted with this same frequency (assuming that the error condition is cleared). Specifically, if the error condition is reached and cleared several times during the period of time specified in mplsL3VpnVrfConfRteMxThrshTime, only a single notification will be issued to indicate the first instance of the error condition as well as the first time the error condition is cleared. This behavior is intended to prevent continuous generation of notifications by an agent in the event that routes are continually added and removed to/from a VRF after it has reached its maximum value. The default value is 0. If this value is set to 0, the agent should issue a notification whenever the maximum threshold has been cleared." ::= { mplsL3VpnNotifications 6 } -- Conformance Statement mplsL3VpnGroups OBJECT IDENTIFIER ::= { mplsL3VpnConformance 1 } mplsL3VpnCompliances OBJECT IDENTIFIER ::= { mplsL3VpnConformance 2 } -- Module Compliance mplsL3VpnModuleFullCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "Compliance statement for agents that provide full support for the L3 MPLS VPN MIB" MODULE -- this module MANDATORY-GROUPS { mplsL3VpnScalarGroup, mplsL3VpnVrfGroup, mplsL3VpnIfGroup, mplsL3VpnPerfGroup, mplsL3VpnVrfRteGroup, mplsL3VpnVrfRTGroup, mplsL3VpnSecGroup, mplsL3VpnNotificationGroup } GROUP mplsL3VpnPerfRouteGroup DESCRIPTION "This group is only mandatory for LSRs that wish to support tracking the number of routes attempted to be added to VRFs." OBJECT mplsL3VpnIfConfRowStatus SYNTAX RowStatus { active(1), notInService(2) } WRITE-SYNTAX RowStatus { active(1), notInService(2), createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notReady is not required." OBJECT mplsL3VpnVrfConfRowStatus SYNTAX RowStatus { active(1), notInService(2) } WRITE-SYNTAX RowStatus { active(1), notInService(2), createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notReady is not required." OBJECT mplsL3VpnVrfRTRowStatus SYNTAX RowStatus { active(1), notInService(2) } WRITE-SYNTAX RowStatus { active(1), notInService(2), createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notReady is not required." ::= { mplsL3VpnCompliances 1 } -- -- ReadOnly Compliance -- mplsL3VpnModuleReadOnlyComplianc MODULE-COMPLIANCE STATUS current DESCRIPTION "Compliance requirement for implementations that only provide read-only support for L3-MPLS-VPN-STD-MIB. Such devices can then be monitored but cannot be configured using this MIB module. " MODULE -- this module MANDATORY-GROUPS { mplsL3VpnScalarGroup, mplsL3VpnVrfGroup, mplsL3VpnIfGroup, mplsL3VpnPerfGroup, mplsL3VpnVrfRteGroup, mplsL3VpnVrfRTGroup, mplsL3VpnSecGroup, mplsL3VpnNotificationGroup } GROUP mplsL3VpnPerfRouteGroup DESCRIPTION "This group is only mandatory for LSRs that wish to support tracking the number of routes attempted to be added to VRFs." OBJECT mplsL3VpnIfConfRowStatus SYNTAX RowStatus { active(1), notInService(2) } WRITE-SYNTAX RowStatus { active(1), notInService(2), createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notReady is not required." OBJECT mplsL3VpnVrfConfRowStatus SYNTAX RowStatus { active(1), notInService(2) } WRITE-SYNTAX RowStatus { active(1), notInService(2), createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notReady is not required." OBJECT mplsL3VpnVrfRTRowStatus SYNTAX RowStatus { active(1), notInService(2) } WRITE-SYNTAX RowStatus { active(1), notInService(2), createAndGo(4), destroy(6) } DESCRIPTION "Support for createAndWait and notReady is not required." OBJECT mplsL3VpnIfVpnClassification MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnIfVpnRouteDistProtocol MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnIfConfStorageType MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfVpnId MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfDescription MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRD MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfConfMidRteThresh MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfConfHighRteThresh MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfConfMaxRoutes MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfConfLastChanged MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfConfStorageType MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRT MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRTDescr MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfSecIllLblRcvThrsh MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrIfIndex MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrType MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrNextHopAS MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrMetric1 MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrMetric2 MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrMetric3 MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrMetric4 MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrMetric5 MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteXCPointer MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT mplsL3VpnVrfRteInetCidrStatus MIN-ACCESS read-only DESCRIPTION "Write access is not required." ::= { mplsL3VpnCompliances 2 } -- Units of conformance. mplsL3VpnScalarGroup OBJECT-GROUP OBJECTS { mplsL3VpnConfiguredVrfs, mplsL3VpnActiveVrfs, mplsL3VpnConnectedInterfaces, mplsL3VpnNotificationEnable, mplsL3VpnVrfConfMaxPossRts, mplsL3VpnVrfConfRteMxThrshTime } STATUS current DESCRIPTION "Collection of scalar objects required for MPLS VPN management." ::= { mplsL3VpnGroups 1 } mplsL3VpnVrfGroup OBJECT-GROUP OBJECTS { mplsL3VpnVrfVpnId, mplsL3VpnVrfDescription, mplsL3VpnVrfRD, mplsL3VpnVrfCreationTime, mplsL3VpnVrfOperStatus, mplsL3VpnVrfActiveInterfaces, mplsL3VpnVrfAssociatedInterfaces, mplsL3VpnVrfConfMidRteThresh, mplsL3VpnVrfConfHighRteThresh, mplsL3VpnVrfConfMaxRoutes, mplsL3VpnVrfConfLastChanged, mplsL3VpnVrfConfRowStatus, mplsL3VpnVrfConfStorageType } STATUS current DESCRIPTION "Collection of objects needed for MPLS VPN VRF management." ::= { mplsL3VpnGroups 2 } mplsL3VpnIfGroup OBJECT-GROUP OBJECTS { mplsL3VpnIfVpnClassification, mplsL3VpnIfVpnRouteDistProtocol, mplsL3VpnIfConfStorageType, mplsL3VpnIfConfRowStatus } STATUS current DESCRIPTION "Collection of objects needed for MPLS VPN interface management." ::= { mplsL3VpnGroups 3 } mplsL3VpnPerfGroup OBJECT-GROUP OBJECTS { mplsL3VpnVrfPerfRoutesAdded, mplsL3VpnVrfPerfRoutesDeleted, mplsL3VpnVrfPerfCurrNumRoutes } STATUS current DESCRIPTION "Collection of objects needed for MPLS VPN performance information." ::= { mplsL3VpnGroups 4 } mplsL3VpnPerfRouteGroup OBJECT-GROUP OBJECTS { mplsL3VpnVrfPerfRoutesDropped } STATUS current DESCRIPTION "Collection of objects needed to track MPLS VPN routing table dropped routes." ::= { mplsL3VpnGroups 5 } mplsL3VpnSecGroup OBJECT-GROUP OBJECTS { mplsL3VpnVrfSecIllegalLblVltns, mplsL3VpnVrfSecIllLblRcvThrsh } STATUS current DESCRIPTION "Collection of objects needed for MPLS VPN security-related information." ::= { mplsL3VpnGroups 7 } mplsL3VpnVrfRteGroup OBJECT-GROUP OBJECTS { mplsL3VpnVrfRteInetCidrIfIndex, mplsL3VpnVrfRteInetCidrType, mplsL3VpnVrfRteInetCidrProto, mplsL3VpnVrfRteInetCidrAge, mplsL3VpnVrfRteInetCidrNextHopAS, mplsL3VpnVrfRteInetCidrMetric1, mplsL3VpnVrfRteInetCidrMetric2, mplsL3VpnVrfRteInetCidrMetric3, mplsL3VpnVrfRteInetCidrMetric4, mplsL3VpnVrfRteInetCidrMetric5, mplsL3VpnVrfRteXCPointer, mplsL3VpnVrfRteInetCidrStatus } STATUS current DESCRIPTION "Objects required for VRF route table management." ::= { mplsL3VpnGroups 8 } mplsL3VpnVrfRTGroup OBJECT-GROUP OBJECTS { mplsL3VpnVrfRTDescr, mplsL3VpnVrfRT, mplsL3VpnVrfRTRowStatus } STATUS current DESCRIPTION "Objects required for VRF route target management." ::= { mplsL3VpnGroups 9 } mplsL3VpnNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { mplsVrfIfUp, mplsVrfIfDown, mplsNumVrfRouteMidThreshExceeded, mplsNumVrfRouteMaxThreshExceeded, mplsNumVrfSecIllglLblThrshExcd, mplsNumVrfRouteMaxThreshCleared } STATUS current DESCRIPTION "Objects required for MPLS VPN notifications." ::= { mplsL3VpnGroups 10 } -- End of MPLS-VPN-MIB END -- -- Copyright (C) The Internet Society (2004). All Rights Reserved. -- -- This document and translations of it may be copied and furnished -- to others, and derivative works that comment on or otherwise -- explain it or assist in its implementation may be prepared, -- copied, published and distributed, in whole or in part, without -- restriction of any kind, provided that the above copyright notice -- and this paragraph are included on all such copies and derivative -- works. However, this document itself may not be modified in any -- way, such as by removing the copyright notice or references to the -- Internet Society or other Internet organizations, except as needed -- for the purpose of developing Internet standards in which case -- the procedures for copyrights defined in the Internet Standards -- process must be followed, or as required to translate it into -- languages other than English. -- -- The limited permissions granted above are perpetual and will not -- be revoked by the Internet Society or its successors or assigns. -- This document and the information contained herein is provided on -- an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET -- ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR -- IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF -- THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED -- WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. -- -- -- 16.0 Security Considerations -- -- It is clear that these MIB modules are potentially useful for -- monitoring of MPLS LSRs supporting L3 MPLS VPN. This -- MIB module can also be used for configuration of certain objects, -- and anything that can be configured can be incorrectly configured, -- with potentially disastrous results. -- -- There are a number of management objects defined in this MIB module -- with a MAX-ACCESS clause of read-write and/or read-create. Such -- objects may be considered sensitive or vulnerable in some network -- environments. The support for SET operations in a non-secure -- environment without proper protection can have a negative effect on -- network operations. These are the tables and objects and their -- sensitivity/vulnerability: -- o the mplsL3VpnVrfRouteTable, mplsL3VpnIfConfTable and -- mplsL3VpnVrfTable tables collectively -- contain objects which may be used to provision MPLS VRF -- interfaces and configuration. Unauthorized access to objects -- in these tables, could result in disruption of traffic on the -- network. This is especially true if these VRFs have been -- previously provisioned and are in use. The use of stronger -- mechanisms such as SNMPv3 security should be considered where -- possible. Specifically, -- SNMPv3 VACM and USM MUST be used with any v3 agent which -- implements this MIB module. Administrators should consider -- whether read access to these objects should be allowed, -- since read access may be undesirable under certain -- circumstances. -- -- Some of the readable objects in this MIB module (i.e., objects with a -- MAX-ACCESS other than not-accessible) may be considered sensitive or -- vulnerable in some network environments. It is thus important to -- control even GET and/or NOTIFY access to these objects and possibly -- to even encrypt the values of these objects when sending them over -- the network via SNMP. These are the tables and objects and their -- sensitivity/vulnerability: -- -- o the mplsL3VpnVrfTable, mplsL3VpnIfConfTable tables -- collectively show the VRF interfaces and -- associated VRF configurations as well as their linkages to other -- MPLS-related configuration and/or performanc statistics. -- Administrators not wishing to reveal this information should -- consider these objects sensitive/vulnerable and take -- precautions so they are not revealed. -- -- SNMP versions prior to SNMPv3 did not include adequate security. -- Even if the network itself is secure (for example by using IPSec), -- even then, there is no control as to who on the secure network is -- allowed to access and GET/SET (read/change/create/delete) the objects -- in this MIB module. -- -- It is RECOMMENDED that implementers consider the security features as -- provided by the SNMPv3 framework (see [RFC3410], section 8), -- including full support for the SNMPv3 cryptographic mechanisms (for -- authentication and privacy). -- -- Further, deployment of SNMP versions prior to SNMPv3 is NOT -- RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to -- enable cryptographic security. It is then a customer/operator -- responsibility to ensure that the SNMP entity giving access to an -- instance of this MIB module, is properly configured to give access -- to the objects only to those principals (users) that have legitimate -- rights to indeed GET or SET (change/create/delete) them.