IPSEC-SPD-MIB
File:
IPSEC-SPD-MIB.mib (97316 bytes)
Imported modules
Imported symbols
Defined Types
| SpdBooleanOperator |
|
| The SpdBooleanOperator operator is used to specify
whether sub-components in a decision-making process are
ANDed or ORed together to decide if the resulting
expression is true or false. |
| TEXTUAL-CONVENTION |
|
|
|
| |
INTEGER |
or(1), and(2) |
|
| SpdAdminStatus |
|
| The SpdAdminStatus is used to specify the administrative
status of an object. Objects that are disabled MUST NOT
be used by the packet processing engine. |
| TEXTUAL-CONVENTION |
|
|
|
| |
INTEGER |
enabled(1), disabled(2) |
|
| SpdIPPacketLogging |
|
| SpdIPPacketLogging specifies whether an audit message
SHOULD be logged if a packet is passed through a Security
Association (SA) and if some of that packet is included in
the log event. A value of '-1' indicates no logging. A
value of '0' or greater indicates that logging SHOULD be
done and indicates the number of bytes starting at the
beginning of the packet to place in the log. Values greater
than the size of the packet being processed indicate that
the entire packet SHOULD be sent.
Examples:
'-1' no logging
'0' log but do not include any of the packet in the log
'20' log and include the first 20 bytes of the packet
in the log. |
| TEXTUAL-CONVENTION |
|
|
|
| |
Integer32 |
-1..65535 |
|
| SpdTimePeriod |
|
| This property identifies an overall range of calendar dates
and time. In a boolean context, a value within this time
range, inclusive, is considered true.
This information is encoded as an octet string using
the UTF-8 transformation format described in STD 63,
RFC 3629.
It uses the format suggested in RFC 3060. An octet string
represents a start date and time and an end date and time.
For example:
yyyymmddThhmmss/yyyymmddThhmmss
Where: yyyy = year mm = month dd = day
hh = hour mm = minute ss = second
The first 'yyyymmddThhmmss' sub-string indicates the start
date and time. The second 'yyyymmddThhmmss' sub-string
indicates the end date and time. The character 'T' within
these sub-strings indicates the beginning of the time
portion of each sub-string. The solidus character '/'
separates the start from the end date and time. The end
date and time MUST be subsequent to the start date and
time.
There are also two allowed substitutes for a
'yyyymmddThhmmss' sub-string: one for the start date and
time, and one for the end date and time.
If the start date and time are replaced with the string
'THISANDPRIOR', this sub-string would indicate the current
date and time and the previous dates and time.
If the end date and time are replaced with the string
'THISANDFUTURE', this sub-string would indicate the current
date and time and the subsequent dates and time.
Any of the following SHOULD be considered a
'wrongValue' error:
- Setting a value with the end date and time earlier than
or equal to the start date and time.
- Setting the start date and time to 'THISANDFUTURE'.
- Setting the end date and time to 'THISANDPRIOR'. |
| TEXTUAL-CONVENTION |
|
|
|
| |
OCTET STRING |
Size(0..31) |
|
| SpdEndpointToGroupEntry |
|
| SEQUENCE |
|
|
|
| |
spdEndGroupDirection |
IfDirection |
|
| |
spdEndGroupInterface |
InterfaceIndex |
|
| |
spdEndGroupName |
SnmpAdminString |
|
| |
spdEndGroupLastChanged |
TimeStamp |
|
| |
spdEndGroupStorageType |
StorageType |
|
| |
spdEndGroupRowStatus |
RowStatus |
|
| SpdGroupContentsEntry |
|
| SEQUENCE |
|
|
|
| |
spdGroupContName |
SnmpAdminString |
|
| |
spdGroupContPriority |
Integer32 |
|
| |
spdGroupContFilter |
VariablePointer |
|
| |
spdGroupContComponentType |
INTEGER |
|
| |
spdGroupContComponentName |
SnmpAdminString |
|
| |
spdGroupContLastChanged |
TimeStamp |
|
| |
spdGroupContStorageType |
StorageType |
|
| |
spdGroupContRowStatus |
RowStatus |
|
| SpdRuleDefinitionEntry |
|
| SEQUENCE |
|
|
|
| |
spdRuleDefName |
SnmpAdminString |
|
| |
spdRuleDefDescription |
SnmpAdminString |
|
| |
spdRuleDefFilter |
VariablePointer |
|
| |
spdRuleDefFilterNegated |
TruthValue |
|
| |
spdRuleDefAction |
VariablePointer |
|
| |
spdRuleDefAdminStatus |
SpdAdminStatus |
|
| |
spdRuleDefLastChanged |
TimeStamp |
|
| |
spdRuleDefStorageType |
StorageType |
|
| |
spdRuleDefRowStatus |
RowStatus |
|
| SpdCompoundFilterEntry |
|
| SEQUENCE |
|
|
|
| |
spdCompFiltName |
SnmpAdminString |
|
| |
spdCompFiltDescription |
SnmpAdminString |
|
| |
spdCompFiltLogicType |
SpdBooleanOperator |
|
| |
spdCompFiltLastChanged |
TimeStamp |
|
| |
spdCompFiltStorageType |
StorageType |
|
| |
spdCompFiltRowStatus |
RowStatus |
|
| SpdSubfiltersEntry |
|
| SEQUENCE |
|
|
|
| |
spdSubFiltPriority |
Integer32 |
|
| |
spdSubFiltSubfilter |
VariablePointer |
|
| |
spdSubFiltSubfilterIsNegated |
TruthValue |
|
| |
spdSubFiltLastChanged |
TimeStamp |
|
| |
spdSubFiltStorageType |
StorageType |
|
| |
spdSubFiltRowStatus |
RowStatus |
|
| SpdIpOffsetFilterEntry |
|
| SEQUENCE |
|
|
|
| |
spdIpOffFiltName |
SnmpAdminString |
|
| |
spdIpOffFiltOffset |
Unsigned32 |
|
| |
spdIpOffFiltType |
INTEGER |
|
| |
spdIpOffFiltValue |
OCTET STRING |
|
| |
spdIpOffFiltLastChanged |
TimeStamp |
|
| |
spdIpOffFiltStorageType |
StorageType |
|
| |
spdIpOffFiltRowStatus |
RowStatus |
|
| SpdTimeFilterEntry |
|
| SEQUENCE |
|
|
|
| |
spdTimeFiltName |
SnmpAdminString |
|
| |
spdTimeFiltPeriod |
SpdTimePeriod |
|
| |
spdTimeFiltMonthOfYearMask |
BITS |
|
| |
spdTimeFiltDayOfMonthMask |
OCTET STRING |
|
| |
spdTimeFiltDayOfWeekMask |
BITS |
|
| |
spdTimeFiltTimeOfDayMask |
SpdTimePeriod |
|
| |
spdTimeFiltLastChanged |
TimeStamp |
|
| |
spdTimeFiltStorageType |
StorageType |
|
| |
spdTimeFiltRowStatus |
RowStatus |
|
| SpdCompoundActionEntry |
|
| SEQUENCE |
|
|
|
| |
spdCompActName |
SnmpAdminString |
|
| |
spdCompActExecutionStrategy |
INTEGER |
|
| |
spdCompActLastChanged |
TimeStamp |
|
| |
spdCompActStorageType |
StorageType |
|
| |
spdCompActRowStatus |
RowStatus |
|
| SpdSubactionsEntry |
|
| SEQUENCE |
|
|
|
| |
spdSubActPriority |
Integer32 |
|
| |
spdSubActSubActionName |
VariablePointer |
|
| |
spdSubActLastChanged |
TimeStamp |
|
| |
spdSubActStorageType |
StorageType |
|
| |
spdSubActRowStatus |
RowStatus |
|
Defined Values
| spdMIB |
1.3.6.1.2.1.153 |
| This MIB module defines configuration objects for managing
IPsec Security Policies. In general, this MIB can be
implemented anywhere IPsec security services exist (e.g.,
bump-in-the-wire, host, gateway, firewall, router, etc.).
Copyright (C) The IETF Trust (2007). This version of
this MIB module is part of RFC 4807; see the RFC itself for
full legal notices. |
| MODULE-IDENTITY |
|
|
|
| spdIngressPolicyGroupName |
1.3.6.1.2.1.153.1.1.1 |
| This object indicates the global system policy group that
is to be applied on ingress packets (i.e., arriving at an
interface from a network) when a given endpoint does not
contain a policy definition in the spdEndpointToGroupTable.
Its value can be used as an index into the
spdGroupContentsTable to retrieve a list of policies. A
zero length string indicates that no system-wide policy exists
and the default policy of 'drop' SHOULD be executed for
ingress packets until one is imposed by either this object
or by the endpoint processing a given packet.
This object MUST be persistent |
| Status: current |
Access: read-write |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(0..32) |
|
| spdEgressPolicyGroupName |
1.3.6.1.2.1.153.1.1.2 |
| This object indicates the policy group containing the
global system policy that is to be applied on egress
packets (i.e., packets leaving an interface and entering a
network) when a given endpoint does not contain a policy
definition in the spdEndpointToGroupTable. Its value can
be used as an index into the spdGroupContentsTable to
retrieve a list of policies. A zero length string
indicates that no system-wide policy exists and the default
policy of 'drop' SHOULD be executed for egress packets
until one is imposed by either this object or by the
endpoint processing a given packet.
This object MUST be persistent |
| Status: current |
Access: read-write |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(0..32) |
|
| spdEndpointToGroupTable |
1.3.6.1.2.1.153.1.2 |
| This table maps policies (groupings) onto an endpoint
(interface). A policy group assigned to an endpoint is then
used to control access to the network traffic passing
through that endpoint.
If an endpoint has been configured with a policy group and
no rule within that policy group matches that packet, the
default action in this case SHALL be to drop the packet.
If no policy group has been assigned to an endpoint, then
the policy group specified by spdIngressPolicyGroupName MUST
be used on traffic inbound from the network through that
endpoint, and the policy group specified by
spdEgressPolicyGroupName MUST be used for traffic outbound
to the network through that endpoint. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdEndpointToGroupEntry |
|
| spdEndpointToGroupEntry |
1.3.6.1.2.1.153.1.2.1 |
| A mapping assigning a policy group to an endpoint. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdEndpointToGroupEntry |
|
|
| spdEndGroupDirection |
1.3.6.1.2.1.153.1.2.1.1 |
| This object indicates which direction of packets crossing
the interface are associated with which spdEndGroupName
object. Ingress packets, or packets into the device match
when this value is inbound(1). Egress packets or packets
out of the device match when this value is outbound(2). |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
IfDirection |
|
|
| spdEndGroupInterface |
1.3.6.1.2.1.153.1.2.1.2 |
| This value matches the IF-MIB's ifTable's ifIndex column
and indicates the interface associated with a given
endpoint. This object can be used to uniquely identify an
endpoint that a set of policy groups are applied to. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
InterfaceIndex |
|
|
| spdEndGroupName |
1.3.6.1.2.1.153.1.2.1.3 |
| The policy group name to apply at this endpoint. The
value of the spdEndGroupName object is then used as an
index into the spdGroupContentsTable to come up with a list
of rules that MUST be applied at this endpoint. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdEndGroupLastChanged |
1.3.6.1.2.1.153.1.2.1.4 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdEndGroupStorageType |
1.3.6.1.2.1.153.1.2.1.5 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a storage
type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdEndGroupRowStatus |
1.3.6.1.2.1.153.1.2.1.6 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
This object is considered 'notReady' and MUST NOT be set to
active until one or more active rows exist within the
spdGroupContentsTable for the group referenced by the
spdEndGroupName object. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdGroupContentsTable |
1.3.6.1.2.1.153.1.3 |
| This table contains a list of rules and/or subgroups
contained within a given policy group. For a given value
of spdGroupContName, the set of rows sharing that value
forms a 'group'. The rows in a group MUST be processed
according to the value of the spdGroupContPriority object
in each row. The processing MUST be executed starting with
the lowest value of spdGroupContPriority and in ascending
order thereafter.
If an action is executed as the result of the processing of
a row in a group, the processing of further rows in that
group MUST stop. Iterating to the next policy group row by
finding the next largest spdGroupContPriority object SHALL
only be done if no actions were run while processing the
current row for a given packet. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdGroupContentsEntry |
|
| spdGroupContentsEntry |
1.3.6.1.2.1.153.1.3.1 |
| Defines a given sub-component within a policy group. A
sub-component is either a rule or another group as
indicated by spdGroupContComponentType and referenced by
spdGroupContComponentName. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdGroupContentsEntry |
|
|
| spdGroupContName |
1.3.6.1.2.1.153.1.3.1.1 |
| The administrative name of the group associated with this
row. A 'group' is formed by all the rows in this table that
have the same value of this object. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdGroupContPriority |
1.3.6.1.2.1.153.1.3.1.2 |
| The priority (sequence number) of the sub-component in
a group that this row represents. This value indicates
the order that each row of this table MUST be processed
from low to high. For example, a row with a priority of 0
is processed before a row with a priority of 1, a 1 before
a 2, etc. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
0..65535 |
|
| spdGroupContFilter |
1.3.6.1.2.1.153.1.3.1.3 |
| spdGroupContFilter points to a filter that is evaluated
to determine whether the spdGroupContComponentName within
this row is exercised. Managers can use this object to
classify groups of rules, or subgroups, together in order to
achieve a greater degree of control and optimization over
the execution order of the items within the group. If the
filter evaluates to false, the rule or subgroup will be
skipped and the next rule or subgroup will be evaluated
instead. This value can be used to indicate a scalar or
row in a table. When indicating a row in a table, this
value MUST point to the first column instance in that row.
An example usage of this object would be to limit a
group of rules to executing only when the IP packet
being processed is designated to be processed by IKE.
This effectively creates a group of IKE-specific rules.
The following tables and scalars can be pointed to by this
column. All but diffServMultiFieldClfrTable are defined in
this MIB:
diffServMultiFieldClfrTable
spdIpOffsetFilterTable
spdTimeFilterTable
spdCompoundFilterTable
spdTrueFilter
spdIpsoHeaderFilterTable
Implementations MAY choose to provide support for other
filter tables or scalars.
If this column is set to a VariablePointer value, which
references a non-existent row in an otherwise supported
table, the inconsistentName exception MUST be returned. If
the table or scalar pointed to by the VariablePointer is
not supported at all, then an inconsistentValue exception
MUST be returned.
If, during packet processing, a row in this table is applied
to a packet and the value of this column in that row
references a non-existent or non-supported object, the
packet MUST be dropped. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
VariablePointer |
|
|
| spdGroupContComponentType |
1.3.6.1.2.1.153.1.3.1.4 |
| Indicates whether the spdGroupContComponentName object
is the name of another group defined within the
spdGroupContentsTable or is the name of a rule defined
within the spdRuleDefinitionTable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
INTEGER |
group(1), rule(2) |
|
| spdGroupContComponentName |
1.3.6.1.2.1.153.1.3.1.5 |
| The name of the policy rule or subgroup contained within
this row, as indicated by the spdGroupContComponentType
object. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdGroupContLastChanged |
1.3.6.1.2.1.153.1.3.1.6 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem,
this object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdGroupContStorageType |
1.3.6.1.2.1.153.1.3.1.7 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a storage
type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdGroupContRowStatus |
1.3.6.1.2.1.153.1.3.1.8 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
This object MUST NOT be set to active until the row to
which the spdGroupContComponentName points to exists and is
active.
If active, this object MUST remain active unless one of the
following two conditions are met:
I. No active row in spdEndpointToGroupTable exists that
references this row's group (i.e., indicate this row's
spdGroupContName).
II. Or at least one other active row in this table has a
matching spdGroupContName.
If neither condition is met, an attempt to set this row to
something other than active MUST result in an
inconsistentValue error. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdRuleDefinitionTable |
1.3.6.1.2.1.153.1.4 |
| This table defines a rule by associating a filter
or a set of filters to an action to be executed. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdRuleDefinitionEntry |
|
| spdRuleDefinitionEntry |
1.3.6.1.2.1.153.1.4.1 |
| A row defining a particular rule definition. A rule
definition binds a filter pointer to an action pointer. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdRuleDefinitionEntry |
|
|
| spdRuleDefName |
1.3.6.1.2.1.153.1.4.1.1 |
| spdRuleDefName is the administratively assigned name of
the rule referred to by the spdGroupContComponentName
object. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdRuleDefDescription |
1.3.6.1.2.1.153.1.4.1.2 |
| A user defined string. This field MAY be used for
administrative tracking purposes. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
|
|
| spdRuleDefFilter |
1.3.6.1.2.1.153.1.4.1.3 |
| spdRuleDefFilter points to a filter that is used to
evaluate whether the action associated with this row is
executed or not. The action will only execute if the
filter referenced by this object evaluates to TRUE after
first applying any negation required by the
spdRuleDefFilterNegated object.
The following tables and scalars can be pointed to by this
column. All but diffServMultiFieldClfrTable are defined in
this MIB. Implementations MAY choose to provide support
for other filter tables or scalars as well:
diffServMultiFieldClfrTable
spdIpOffsetFilterTable
spdTimeFilterTable
spdCompoundFilterTable
spdTrueFilter
If this column is set to a VariablePointer value, which
references a non-existent row in an otherwise supported
table, the inconsistentName exception MUST be returned. If
the table or scalar pointed to by the VariablePointer is
not supported at all, then an inconsistentValue exception
MUST be returned.
If, during packet processing, this column has a value that
references a non-existent or non-supported object, the
packet MUST be dropped. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
VariablePointer |
|
|
| spdRuleDefFilterNegated |
1.3.6.1.2.1.153.1.4.1.4 |
| spdRuleDefFilterNegated specifies whether or not the results of
the filter referenced by the spdRuleDefFilter object is
negated. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
TruthValue |
|
|
| spdRuleDefAction |
1.3.6.1.2.1.153.1.4.1.5 |
| This column points to the action to be taken. It MAY,
but is not limited to, point to a row in one of the
following tables:
spdCompoundActionTable
ipsaSaPreconfiguredActionTable
ipiaIkeActionTable
ipiaIpsecActionTable
It MAY also point to one of the scalar objects beneath
spdStaticActions.
If this object is set to a pointer to a row in an
unsupported (or unknown) table, an inconsistentValue
error MUST be returned.
If this object is set to point to a non-existent row in an
otherwise supported table, an inconsistentName error MUST
be returned.
If, during packet processing, this column has a value that
references a non-existent or non-supported object, the
packet MUST be dropped. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
VariablePointer |
|
|
| spdRuleDefAdminStatus |
1.3.6.1.2.1.153.1.4.1.6 |
| Indicates whether the current rule definition is considered
active. If the value is enabled, the rule MUST be evaluated
when processing packets. If the value is disabled, the
packet processing MUST continue as if this rule's filter
had effectively failed. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SpdAdminStatus |
|
|
| spdRuleDefLastChanged |
1.3.6.1.2.1.153.1.4.1.7 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdRuleDefStorageType |
1.3.6.1.2.1.153.1.4.1.8 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a
storage type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdRuleDefRowStatus |
1.3.6.1.2.1.153.1.4.1.9 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
This object MUST NOT be set to active until the containing
conditions, filters, and actions have been defined. Once
active, it MUST remain active until no active
policyGroupContents entries are referencing it. A failed
attempt to do so MUST return an inconsistentValue error. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdCompoundFilterTable |
1.3.6.1.2.1.153.1.5 |
| A table defining compound filters and their associated
parameters. A row in this table can be pointed to by a
spdRuleDefFilter object. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdCompoundFilterEntry |
|
| spdCompoundFilterEntry |
1.3.6.1.2.1.153.1.5.1 |
| An entry in the spdCompoundFilterTable. Each entry in this
table represents a compound filter. A filter defined by
this table is considered to have a TRUE return value if and
only if:
spdCompFiltLogicType is AND and all of the sub-filters
associated with it, as defined in the spdSubfiltersTable,
are all true themselves (after applying any required
negation, as defined by the ficFilterIsNegated object).
spdCompFiltLogicType is OR and at least one of the
sub-filters associated with it, as defined in the
spdSubfiltersTable, is true itself (after applying any
required negation, as defined by the ficFilterIsNegated
object. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdCompoundFilterEntry |
|
|
| spdCompFiltName |
1.3.6.1.2.1.153.1.5.1.1 |
| A user definable string. This value is used as an index
into this table. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdCompFiltDescription |
1.3.6.1.2.1.153.1.5.1.2 |
| A user definable string. This field MAY be used for
your administrative tracking purposes. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
|
|
| spdCompFiltLogicType |
1.3.6.1.2.1.153.1.5.1.3 |
| Indicates whether the sub-component filters of this
compound filter are functionally ANDed or ORed together. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SpdBooleanOperator |
|
|
| spdCompFiltLastChanged |
1.3.6.1.2.1.153.1.5.1.4 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdCompFiltStorageType |
1.3.6.1.2.1.153.1.5.1.5 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a
storage type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdCompFiltRowStatus |
1.3.6.1.2.1.153.1.5.1.6 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
Once active, it MUST NOT have its value changed if any
active rows in the spdRuleDefinitionTable are currently
pointing at this row. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdSubfiltersTable |
1.3.6.1.2.1.153.1.6 |
| This table defines a list of filters contained within a
given compound filter defined in the
spdCompoundFilterTable. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdSubfiltersEntry |
|
| spdSubfiltersEntry |
1.3.6.1.2.1.153.1.6.1 |
| An entry in the spdSubfiltersTable. There is an entry in
this table for each sub-filter of all compound filters
present in the spdCompoundFilterTable. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdSubfiltersEntry |
|
|
| spdSubFiltPriority |
1.3.6.1.2.1.153.1.6.1.1 |
| The priority of a given filter within a compound filter.
The order of execution is from lowest to highest priority
value (i.e., priority 0 before priority 1, 1 before 2,
etc.). Implementations MAY choose to follow this ordering,
as set by the manager that created the rows. This can allow
a manager to intelligently construct filter lists such that
faster filters are evaluated first. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
0..65535 |
|
| spdSubFiltSubfilter |
1.3.6.1.2.1.153.1.6.1.2 |
| The OID of the contained filter. The value of this
object is a VariablePointer that references the filter to
be included in this compound filter.
The following tables and scalars can be pointed to by this
column. All but diffServMultiFieldClfrTable are defined in
this MIB. Implementations MAY choose to provide support
for other filter tables or scalars as well:
diffServMultiFieldClfrTable
spdIpsoHeaderFilterTable
spdIpOffsetFilterTable
spdTimeFilterTable
spdCompoundFilterTable
spdTrueFilter
If this column is set to a VariablePointer value that
references a non-existent row in an otherwise supported
table, the inconsistentName exception MUST be returned. If
the table or scalar pointed to by the VariablePointer is
not supported at all, then an inconsistentValue exception
MUST be returned.
If, during packet processing, this column has a value that
references a non-existent or non-supported object, the
packet MUST be dropped. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
VariablePointer |
|
|
| spdSubFiltLastChanged |
1.3.6.1.2.1.153.1.6.1.4 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdSubFiltStorageType |
1.3.6.1.2.1.153.1.6.1.5 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a
storage type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdSubFiltRowStatus |
1.3.6.1.2.1.153.1.6.1.6 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
This object cannot be made active until a filter
referenced by the spdSubFiltSubfilter object is both
defined and active. An attempt to do so MUST result in
an inconsistentValue error.
If active, this object MUST remain active unless one of the
following two conditions are met:
I. No active row in the SpdCompoundFilterTable exists
that has a matching spdCompFiltName.
II. Or, at least one other active row in this table has a
matching spdCompFiltName.
If neither condition is met, an attempt to set this row to
something other than active MUST result in an
inconsistentValue error. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdTrueFilter |
1.3.6.1.2.1.153.1.7.1 |
| This scalar indicates a (automatic) true result for
a filter. That is, this is a filter that is always
true; it is useful for adding as a default filter for a
default action or a set of actions. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
1 |
|
| spdIpOffsetFilterTable |
1.3.6.1.2.1.153.1.8 |
| This table contains a list of filter definitions to be
used within the spdRuleDefinitionTable or the
spdSubfiltersTable.
This type of filter is used to compare an administrator
specified octet string to the octets at a particular
location in a packet. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdIpOffsetFilterEntry |
|
| spdIpOffsetFilterEntry |
1.3.6.1.2.1.153.1.8.1 |
| A definition of a particular filter. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdIpOffsetFilterEntry |
|
|
| spdIpOffFiltName |
1.3.6.1.2.1.153.1.8.1.1 |
| The administrative name for this filter. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdIpOffFiltOffset |
1.3.6.1.2.1.153.1.8.1.2 |
| This is the byte offset from the front of the entire IP
packet where the value or arithmetic comparison is done. A
value of '0' indicates the first byte of the packet header.
If this value is greater than the length of the packet, the
filter represented by this row should be considered to
fail. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
Unsigned32 |
0..65535 |
|
| spdIpOffFiltType |
1.3.6.1.2.1.153.1.8.1.3 |
| This defines the various tests that are used when
evaluating a given filter.
The various tests definable in this table are as follows:
equal:
- Tests if the OCTET STRING, 'spdIpOffFiltValue', matches
a value in the packet starting at the given offset in
the packet and comparing the entire OCTET STRING of
'spdIpOffFiltValue'. Any values compared this way are
assumed to be unsigned integer values in network byte
order of the same length as 'spdIpOffFiltValue'.
notEqual:
- Tests if the OCTET STRING, 'spdIpOffFiltValue', does
not match a value in the packet starting at the given
offset in the packet and comparing to the entire OCTET
STRING of 'spdIpOffFiltValue'. Any values compared
this way are assumed to be unsigned integer values in
network byte order of the same length as
'spdIpOffFiltValue'.
arithmeticLess:
- Tests if the OCTET STRING, 'spdIpOffFiltValue', is
arithmetically less than ('<') the value starting at
the given offset within the packet. The value in the
packet is assumed to be an unsigned integer in network
byte order of the same length as 'spdIpOffFiltValue'.
arithmeticGreaterOrEqual:
- Tests if the OCTET STRING, 'spdIpOffFiltValue', is
arithmetically greater than or equal to ('>=') the
value starting at the given offset within the packet.
The value in the packet is assumed to be an unsigned
integer in network byte order of the same length as
'spdIpOffFiltValue'.
arithmeticGreater:
- Tests if the OCTET STRING, 'spdIpOffFiltValue', is
arithmetically greater than ('>') the value starting at
the given offset within the packet. The value in the
packet is assumed to be an unsigned integer in network
byte order of the same length as 'spdIpOffFiltValue'.
arithmeticLessOrEqual:
- Tests if the OCTET STRING, 'spdIpOffFiltValue', is
arithmetically less than or equal to ('<=') the value
starting at the given offset within the packet. The
value in the packet is assumed to be an unsigned
integer in network byte order of the same length as
'spdIpOffFiltValue'. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
INTEGER |
equal(1), notEqual(2), arithmeticLess(3), arithmeticGreaterOrEqual(4), arithmeticGreater(5), arithmeticLessOrEqual(6) |
|
| spdIpOffFiltValue |
1.3.6.1.2.1.153.1.8.1.4 |
| spdIpOffFiltValue is used for match comparisons of a
packet at spdIpOffFiltOffset. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
OCTET STRING |
Size(1..1024) |
|
| spdIpOffFiltLastChanged |
1.3.6.1.2.1.153.1.8.1.5 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdIpOffFiltStorageType |
1.3.6.1.2.1.153.1.8.1.6 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a
storage type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdIpOffFiltRowStatus |
1.3.6.1.2.1.153.1.8.1.7 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
If active, this object MUST remain active if it is
referenced by an active row in another table. An attempt
to set it to anything other than active while it is
referenced by an active row in another table MUST result in
an inconsistentValue error. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdTimeFilterTable |
1.3.6.1.2.1.153.1.9 |
| Defines a table of filters that can be used to
effectively enable or disable policies based on a valid
time range. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdTimeFilterEntry |
|
| spdTimeFilterEntry |
1.3.6.1.2.1.153.1.9.1 |
| A row describing a given time frame for which a policy
is filtered on to activate or deactivate the rule.
If all the column objects in a row are true for the current
time, the row evaluates as 'true'. More explicitly, the
time matching column objects in a row MUST be logically
ANDed together to form the boolean true/false for the row. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdTimeFilterEntry |
|
|
| spdTimeFiltName |
1.3.6.1.2.1.153.1.9.1.1 |
| An administratively assigned name for this filter. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdTimeFiltPeriod |
1.3.6.1.2.1.153.1.9.1.2 |
| The valid time period for this filter. This column is
considered 'true' if the current time is within the range of
this object. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SpdTimePeriod |
|
|
| spdTimeFiltMonthOfYearMask |
0.1.2.3.4.5.6.7.8.9.10.11.1.3.6.1.2.1.153.1.9.1.3 |
| A bit mask that indicates acceptable months of the year.
This column evaluates to 'true' if the current month's bit
is set. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
BITS |
january(0), february(1), march(2), april(3), may(4), june(5), july(6), august(7), september(8), october(9), november(10), december(11) |
|
| spdTimeFiltDayOfMonthMask |
1.3.6.1.2.1.153.1.9.1.4 |
| Defines which days of the month the current time is
valid for. It is a sequence of 64 BITS, where each BIT
represents a corresponding day of the month in forward or
reverse order. Starting from the left-most bit, the first
31 bits identify the day of the month, counting from the
beginning of the month. The following 31 bits (bits 32-62)
indicate the day of the month, counting from the end of the
month. For months with fewer than 31 days, the bits that
correspond to the non-existent days of that month are
ignored (e.g., for non-leap year Februarys, bits 29-31 and
60-62 are ignored).
This column evaluates to 'true' if the current day of the
month's bit is set.
For example, a value of 0X'80 00 00 01 00 00 00 00'
indicates that this column evaluates to true on the first
and last days of the month.
The last two bits in the string MUST be zero. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
OCTET STRING |
Size(8) |
|
| spdTimeFiltDayOfWeekMask |
1.2.3.4.5.6.0.1.3.6.1.2.1.153.1.9.1.5 |
| A bit mask that defines which days of the week that the current
time is valid for. This column evaluates to 'true' if the
current day of the week's bit is set. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
BITS |
sunday(0), monday(1), tuesday(2), wednesday(3), thursday(4), friday(5), saturday(6) |
|
| spdTimeFiltTimeOfDayMask |
1.3.6.1.2.1.153.1.9.1.6 |
| Indicates the start and end time of the day for which this
filter evaluates to true. The date portions of the
spdTimePeriod TC are ignored for purposes of evaluating this
mask, and only the time-specific portions are used.
This column evaluates to 'true' if the current time of day
is within the range of the start and end times of the day
indicated by this object. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
SpdTimePeriod |
|
|
| spdTimeFiltLastChanged |
1.3.6.1.2.1.153.1.9.1.7 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdTimeFiltStorageType |
1.3.6.1.2.1.153.1.9.1.8 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a storage
type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdTimeFiltRowStatus |
1.3.6.1.2.1.153.1.9.1.9 |
| This object indicates the conceptual status of this
row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
If active, this object MUST remain active if it is
referenced by an active row in another table. An attempt
to set it to anything other than active while it is
referenced by an active row in another table MUST result in
an inconsistentValue error. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdIpsoHeadFiltType |
1.3.6.1.2.1.153.1.10.1.2 |
| This object indicates which of the IPSO header field a
packet is filtered on for this row. If this object is set
to classification(0), the spdIpsoHeadFiltClassification
object indicates how the packet is filtered. If this object
is set to protectionAuthority(1), the
spdIpsoHeadFiltProtectionAuth object indicates how the
packet is filtered. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
BITS |
classificationLevel(0), protectionAuthority(1) |
|
| spdIpsoHeadFiltClassification |
1.3.6.1.2.1.153.1.10.1.3 |
| This object indicates the IPSO classification header field
value that the packet MUST have for this row to evaluate to
'true'.
The values of these enumerations are defined by RFC 1108. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
INTEGER |
topSecret(61), secret(90), confidential(150), unclassified(171) |
|
| spdIpsoHeadFiltProtectionAuth |
1.3.6.1.2.1.153.1.10.1.4 |
| This object indicates the IPSO protection authority header
field value that the packet MUST have for this row to
evaluate to 'true'.
The values of these enumerations are defined by RFC 1108.
Hence the reason the SMIv2 convention of not using 0 in
enumerated lists is violated here. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
INTEGER |
genser(0), siopesi(1), sci(2), nsa(3), doe(4) |
|
| spdIpsoHeadFiltLastChanged |
1.3.6.1.2.1.153.1.10.1.5 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdIpsoHeadFiltStorageType |
1.3.6.1.2.1.153.1.10.1.6 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a storage
type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdIpsoHeadFiltRowStatus |
1.3.6.1.2.1.153.1.10.1.7 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
However, this object MUST NOT be set to active if the
requirements of the spdIpsoHeadFiltType object are not met.
Specifically, if the spdIpsoHeadFiltType bit for
classification(0) is set, the spdIpsoHeadFiltClassification
column MUST have a valid value for the row status to be set
to active. If the spdIpsoHeadFiltType bit for
protectionAuthority(1) is set, the
spdIpsoHeadFiltProtectionAuth column MUST have a valid
value for the row status to be set to active.
If active, this object MUST remain active if it is
referenced by an active row in another table. An attempt
to set it to anything other than active while it is
referenced by an active row in another table MUST result in
an inconsistentValue error. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdCompoundActionTable |
1.3.6.1.2.1.153.1.11 |
| Table used to allow multiple actions to be associated
with a rule. It uses the spdSubactionsTable to do this.
The rows from spdSubactionsTable that are partially indexed
by spdCompActName form the set of compound actions to be
performed. The spdCompActExecutionStrategy column in this
table indicates how those actions are processed. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdCompoundActionEntry |
|
| spdCompoundActionEntry |
1.3.6.1.2.1.153.1.11.1 |
| A row in the spdCompoundActionTable. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdCompoundActionEntry |
|
|
| spdCompActName |
1.3.6.1.2.1.153.1.11.1.1 |
| This is an administratively assigned name of this
compound action. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SnmpAdminString |
Size(1..32) |
|
| spdCompActExecutionStrategy |
1.3.6.1.2.1.153.1.11.1.2 |
| This object indicates how the sub-actions are executed
based on the success of the actions as they finish
executing.
doAll - run each sub-action regardless of the
exit status of the previous action.
This parent action is always
considered to have acted successfully.
doUntilSuccess - run each sub-action until one succeeds,
at which point stop processing the
sub-actions within this parent
compound action. If one of the
sub-actions did execute successfully,
this parent action is also considered
to have executed successfully.
doUntilFailure - run each sub-action until one fails,
at which point stop processing the
sub-actions within this compound
action. If any sub-action fails, the
result of this parent action is
considered to have failed. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
INTEGER |
doAll(1), doUntilSuccess(2), doUntilFailure(3) |
|
| spdCompActLastChanged |
1.3.6.1.2.1.153.1.11.1.3 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdCompActStorageType |
1.3.6.1.2.1.153.1.11.1.4 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a storage
type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdCompActRowStatus |
1.3.6.1.2.1.153.1.11.1.5 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
Once a row in the spdCompoundActionTable has been made
active, this object MUST NOT be set to destroy without
first destroying all the contained rows listed in the
spdSubactionsTable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdSubactionsTable |
1.3.6.1.2.1.153.1.12 |
| This table contains a list of the sub-actions within a
given compound action. Compound actions executing these
actions MUST execute them in series based on the
spdSubActPriority value, with the lowest value executing
first. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SEQUENCE OF |
|
|
| |
|
SpdSubactionsEntry |
|
| spdSubactionsEntry |
1.3.6.1.2.1.153.1.12.1 |
| A row containing a reference to a given compound-action
sub-action. |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
SpdSubactionsEntry |
|
|
| spdSubActPriority |
1.3.6.1.2.1.153.1.12.1.1 |
| The priority of a given sub-action within a compound
action. The order in which sub-actions MUST be executed
are based on the value from this column, with the lowest
numeric value executing first (i.e., priority 0 before
priority 1, 1 before 2, etc.). |
| Status: current |
Access: not-accessible |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
0..65535 |
|
| spdSubActSubActionName |
1.3.6.1.2.1.153.1.12.1.2 |
| This column points to the action to be taken. It MAY,
but is not limited to, point to a row in one of the
following tables:
spdCompoundActionTable - Allowing recursion
ipsaSaPreconfiguredActionTable
ipiaIkeActionTable
ipiaIpsecActionTable
It MAY also point to one of the scalar objects beneath
spdStaticActions.
If this object is set to a pointer to a row in an
unsupported (or unknown) table, an inconsistentValue
error MUST be returned.
If this object is set to point to a non-existent row in
an otherwise supported table, an inconsistentName error
MUST be returned.
If, during packet processing, this column has a value that
references a non-existent or non-supported object, the
packet MUST be dropped. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
VariablePointer |
|
|
| spdSubActLastChanged |
1.3.6.1.2.1.153.1.12.1.3 |
| The value of sysUpTime when this row was last modified
or created either through SNMP SETs or by some other
external means.
If this row has not been modified since the last
re-initialization of the network management subsystem, this
object SHOULD have a zero value. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
TimeStamp |
|
|
| spdSubActStorageType |
1.3.6.1.2.1.153.1.12.1.4 |
| The storage type for this row. Rows in this table that
were created through an external process MAY have a storage
type of readOnly or permanent.
For a storage type of permanent, none of the columns have
to be writable. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
StorageType |
|
|
| spdSubActRowStatus |
1.3.6.1.2.1.153.1.12.1.5 |
| This object indicates the conceptual status of this row.
The value of this object has no effect on whether other
objects in this conceptual row can be modified.
If active, this object MUST remain active unless one of the
following two conditions are met. An attempt to set it to
anything other than active while the following conditions
are not met MUST result in an inconsistentValue error. The
two conditions are:
I. No active row in the spdCompoundActionTable exists
which has a matching spdCompActName.
II. Or, at least one other active row in this table has a
matching spdCompActName. |
| Status: current |
Access: read-create |
| OBJECT-TYPE |
|
|
|
| |
RowStatus |
|
|
| spdDropAction |
1.3.6.1.2.1.153.1.13.1 |
| This scalar indicates that a packet MUST be dropped
and SHOULD NOT have action/packet logging. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
1 |
|
| spdDropActionLog |
1.3.6.1.2.1.153.1.13.2 |
| This scalar indicates that a packet MUST be dropped
and SHOULD have action/packet logging. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
1 |
|
| spdAcceptAction |
1.3.6.1.2.1.153.1.13.3 |
| This Scalar indicates that a packet MUST be accepted
(pass-through) and SHOULD NOT have action/packet logging. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
1 |
|
| spdAcceptActionLog |
1.3.6.1.2.1.153.1.13.4 |
| This scalar indicates that a packet MUST be accepted
(pass-through) and SHOULD have action/packet logging. |
| Status: current |
Access: read-only |
| OBJECT-TYPE |
|
|
|
| |
Integer32 |
1 |
|
| spdActionExecuted |
1.3.6.1.2.1.153.2.1.1 |
| Points to the action instance that was executed that
resulted in the notification being sent. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
VariablePointer |
|
|
| spdIPEndpointAddType |
1.3.6.1.2.1.153.2.1.2 |
| Contains the address type for the interface that the
notification triggering packet is passing through. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
InetAddressType |
|
|
| spdIPEndpointAddress |
1.3.6.1.2.1.153.2.1.3 |
| Contains the interface address for the interface that the
notification triggering packet is passing through.
The format of this object is specified by the
spdIPEndpointAddType object. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
InetAddress |
|
|
| spdIPSourceType |
1.3.6.1.2.1.153.2.1.4 |
| Contains the source address type of the packet that
triggered the notification. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
InetAddressType |
|
|
| spdIPSourceAddress |
1.3.6.1.2.1.153.2.1.5 |
| Contains the source address of the packet that
triggered the notification.
The format of this object is specified by the
spdIPSourceType object. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
InetAddress |
|
|
| spdIPDestinationType |
1.3.6.1.2.1.153.2.1.6 |
| Contains the destination address type of the packet
that triggered the notification. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
InetAddressType |
|
|
| spdIPDestinationAddress |
1.3.6.1.2.1.153.2.1.7 |
| Contains the destination address of the packet that
triggered the notification.
The format of this object is specified by the
spdIPDestinationType object. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
InetAddress |
|
|
| spdPacketDirection |
1.3.6.1.2.1.153.2.1.8 |
| Indicates if the packet that triggered the action in
questions was ingress (inbound) or egress (outbound). |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
IfDirection |
|
|
| spdPacketPart |
1.3.6.1.2.1.153.2.1.9 |
| spdPacketPart is the front part of the full IP packet that
triggered this notification. The initial size limit is
determined by the smaller of the size, indicated by:
I. The value of the object with the TC syntax
'SpdIPPacketLogging' that indicated the packet SHOULD be
logged and
II. The size of the triggering packet.
The final limit is determined by the SNMP packet size when
sending the notification. The maximum size that can be
included will be the smaller of the initial size, given the
above, and the length that will fit in a single SNMP
notification packet after the rest of the notification's
objects and any other necessary packet data (headers encoding,
etc.) have been included in the packet. |
| Status: current |
Access: accessible-for-notify |
| OBJECT-TYPE |
|
|
|
| |
OCTET STRING |
Size(0..65535) |
|
| spdActionNotification |
1.3.6.1.2.1.153.2.0.1 |
| Notification that an action was executed by a rule.
Only actions with logging enabled will result in this
notification getting sent. The object includes the
spdActionExecuted object, which will indicate which action
was executed within the scope of the rule. Additionally,
the spdIPSourceType, spdIPSourceAddress,
spdIPDestinationType, and spdIPDestinationAddress objects
are included to indicate the packet source and destination
of the packet that triggered the action. Finally, the
spdIPEndpointAddType, spdIPEndpointAddress, and
spdPacketDirection objects indicate which interface the
executed action was associated with, and if the packet was
ingress or egress through the endpoint.
A spdActionNotification SHOULD be limited to a maximum of
one notification sent per minute for any action
notifications that do not have any other configuration
controlling their send rate.
Note that compound actions with multiple executed
sub-actions may result in multiple notifications being sent
from a single rule execution. |
| Status: current |
Access: accessible-for-notify |
| NOTIFICATION-TYPE |
|
|
|
| spdPacketNotification |
1.3.6.1.2.1.153.2.0.2 |
| Notification that a packet passed through a Security
Association (SA). Only SAs created by actions with packet
logging enabled will result in this notification getting
sent. The objects sent MUST include the spdActionExecuted,
which will indicate which action was executed within the
scope of the rule. Additionally, the spdIPSourceType,
spdIPSourceAddress, spdIPDestinationType, and
spdIPDestinationAddress objects MUST be included to
indicate the packet source and destination of the packet
that triggered the action. The spdIPEndpointAddType,
spdIPEndpointAddress, and spdPacketDirection objects are
included to indicate which endpoint the packet was
associated with. Finally, spdPacketPart is included to
enable sending a variable sized part of the front of the
packet with the size dependent on the value of the object of
TC syntax 'SpdIPPacketLogging', which indicated that logging
should be done.
A spdPacketNotification SHOULD be limited to a maximum of
one notification sent per minute for any action
notifications that do not have any other configuration
controlling their send rate.
An action notification SHOULD be limited to a maximum of
one notification sent per minute for any action
notifications that do not have any other configuration
controlling their send rate. |
| Status: current |
Access: accessible-for-notify |
| NOTIFICATION-TYPE |
|
|
|
| spdGroups |
1.3.6.1.2.1.153.3.2 |
| OBJECT IDENTIFIER |
|
|
|
| spdRuleFilterFullCompliance |
1.3.6.1.2.1.153.3.1.1 |
| The compliance statement for SNMP entities that include
an IPsec MIB implementation with Endpoint, Rules, and
filters support.
When this MIB is implemented with support for read-create,
then such an implementation can claim full compliance. Such
devices can then be both monitored and configured with this
MIB. |
| Status: current |
Access: not-accessible |
| MODULE-COMPLIANCE |
|
|
|
| spdLoggingCompliance |
1.3.6.1.2.1.153.3.1.2 |
| The compliance statement for SNMP entities that support
sending notifications when actions are invoked. |
| Status: current |
Access: not-accessible |
| MODULE-COMPLIANCE |
|
|
|
| spdRuleFilterReadOnlyCompliance |
1.3.6.1.2.1.153.3.1.3 |
| The compliance statement for SNMP entities that include
an IPsec MIB implementation with Endpoint, Rules, and
filters support.
If this MIB is implemented without support for read-create
(i.e., in read-only), it is not in full compliance, but it
can claim read-only compliance. Such a device can then be
monitored, but cannot be configured with this MIB. |
| Status: current |
Access: read-only |
| MODULE-COMPLIANCE |
|
|
|
| spdEndpointGroup |
1.3.6.1.2.1.153.3.2.1 |
| This group is made up of objects from the IPsec Policy
Endpoint Table. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdGroupContentsGroup |
1.3.6.1.2.1.153.3.2.2 |
| This group is made up of objects from the IPsec Policy
Group Contents Table. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdIpsecSystemPolicyNameGroup |
1.3.6.1.2.1.153.3.2.3 |
| This group is made up of objects represent the System
Policy Group Names. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdRuleDefinitionGroup |
1.3.6.1.2.1.153.3.2.4 |
| This group is made up of objects from the IPsec Policy Rule
Definition Table. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdCompoundFilterGroup |
1.3.6.1.2.1.153.3.2.5 |
| This group is made up of objects from the IPsec Policy
Compound Filter Table and Sub-Filter Table Group. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdStaticFilterGroup |
1.3.6.1.2.1.153.3.2.6 |
| The static filter group. Currently this is just a true
filter. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdIPOffsetFilterGroup |
1.3.6.1.2.1.153.3.2.7 |
| This group is made up of objects from the IPsec Policy IP
Offset Filter Table. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdTimeFilterGroup |
1.3.6.1.2.1.153.3.2.8 |
| This group is made up of objects from the IPsec Policy Time
Filter Table. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdStaticActionGroup |
1.3.6.1.2.1.153.3.2.10 |
| This group is made up of objects from the IPsec Policy
Static Actions. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdCompoundActionGroup |
1.3.6.1.2.1.153.3.2.11 |
| The IPsec Policy Compound Action Table and Actions In
Compound Action Table Group. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdActionLoggingObjectGroup |
1.3.6.1.2.1.153.3.2.12 |
| This group is made up of all the Notification objects for
this MIB. |
| Status: current |
Access: read-only |
| OBJECT-GROUP |
|
|
|
| spdActionNotificationGroup |
1.3.6.1.2.1.153.3.2.13 |
| This group is made up of all the Notifications for this MIB. |
| Status: current |
Access: read-only |
| NOTIFICATION-GROUP |
|
|
|