IPSP M. Baer Internet-Draft Sparta, Inc. Expires: April 20, 2005 R. Charlet Self W. Hardaker Sparta, Inc. R. Story Revelstone Software C. Wang SmartPipes, Inc. October 20, 2004 IPsec Security Policy Database Configuration MIB draft-ietf-ipsp-spd-mib-01.txt Status of this Memo By submitting this Internet-Draft, I certify that any applicable patent or other IPR claims of which I am aware have been disclosed, and any of which I become aware will be disclosed, in accordance with RFC 3668. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on April 20, 2005. Copyright Notice Copyright (C) The Internet Society (2004). All Rights Reserved. Abstract This document defines a SMIv2 Management Information Base (MIB) module for configuring the security policy database of a device Baer, et al. Expires April 20, 2005 [Page 1] Internet-Draft IPsec SPD configuration MIB October 2004 implementing the IPSec protocol. The policy-based packet filtering and the corresponding execution of actions is of a more general nature than for IPsec configuration only, such as for configuration of a firewall. This MIB module is designed with future extensibility in mind. It is thus possible to externally add other packet filters and actions to the policy-based packet filtering system defined in this document. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. The Internet-Standard Management Framework . . . . . . . . . . 3 3. Relationship to the DMTF Policy Model . . . . . . . . . . . . 3 4. MIB Module Overview . . . . . . . . . . . . . . . . . . . . . 4 4.1 Usage Tutorial . . . . . . . . . . . . . . . . . . . . . . 4 4.1.1 Notational conventions . . . . . . . . . . . . . . . . 4 4.1.2 Implementing an example SPD policy . . . . . . . . . . 5 5. MIB definition . . . . . . . . . . . . . . . . . . . . . . . . 6 6. Security Considerations . . . . . . . . . . . . . . . . . . . 60 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . 60 6.2 Protecting against in-authentic access . . . . . . . . . . 61 6.3 Protecting against involuntary disclosure . . . . . . . . 61 6.4 Bootstrapping your configuration . . . . . . . . . . . . . 61 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 62 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 62 8.1 Normative References . . . . . . . . . . . . . . . . . . . . 62 8.2 Informative References . . . . . . . . . . . . . . . . . . . 63 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 63 Intellectual Property and Copyright Statements . . . . . . . . 65 Baer, et al. Expires April 20, 2005 [Page 2] Internet-Draft IPsec SPD configuration MIB October 2004 1. Introduction This document defines a MIB module for configuration of an IPsec security policy database (SPD). The policy-based packet filtering and the corresponding execution of actions is of a more general nature than for IPsec configuration only, such as for configuration of a firewall. It is possible to add other packet transforming actions to this MIB module if those actions needed to be performed conditionally on filtered traffic. Companion documents [RFCXXXX], [RFCYYYY] document actions which are specific to IPsec and IKE. No IPsec or IKE specific actions are defined within this document. 2. The Internet-Standard Management Framework For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 [RFC3410] Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. 3. Relationship to the DMTF Policy Model The Distributed Management Task Force (DMTF) has created an object oriented model of IPsec policy information known as the IPsec Policy Model White Paper [IPPMWP]. The contents of this document are also reflected in the "IPsec Configuration Policy Model" (IPCP) [RFC3585]. This MIB module is a task specific derivation of the IPCP for use with SNMPv3. The high-level areas where this MIB module diverges from the IPCP model are: o Policies, Groups, Conditions, and some levels of Action are generically named. That is we dropped prefixes like "SA", or "ipsec". This is because we feel that packet classification and matching of conditions to actions is more general than IPsec and could possibly be reused by other packet transforming actions which need to conditionally act on packets matching filters. Baer, et al. Expires April 20, 2005 [Page 3] Internet-Draft IPsec SPD configuration MIB October 2004 o Filters are implemented in a more generic and scalable manner, rather than enforcing the condition/filtering pairing and their restrictions upon the user. The MIB module offers a compound filter object to provide for greater flexibility when creating complex filters. 4. MIB Module Overview The MIB module is modularized into several different parts: rules, filters, and actions. The rules section connects endpoints and groups of rules together. This is partially made up of the ipspEndpointToGroupTable, ipspGroupContentsTable, and the ipspRuleDefinitionTable. Each row of the ipspRuleDefinitionTable connects a filter(s) with an action(s). It is structured to allow for reuse through the future creation of extension tables that provide additional filters and/or actions. In fact, the companion documents to this one do just that to define IPsec and IKE specific actions to be used within this SPD configuration MIB. The filter section of the MIB module is composed of all the different types of filters in the Policy Model. It is partially made up of the trueFilter, ipspCompoundFilterTable, ipspIpHeaderFilterTable, ipspIpOffsetFilterTable, ipspTimeFilterTable, and the ipspIpsoHeaderFilterTable. The action section of the MIB module contains different action types from the Policy Model. This document contains only the basic actions needed for firewall processing (accept, drop, log, ...) that an SPD implementation will need. The companion documents define the IPsec and IKE specific actions. 4.1 Usage Tutorial In order to make use of the tables contained in this document, a general understanding of firewall processing must be first understood. The processing of the security policy database involves applying a set of firewall rules to an interface on a device. The given set of rules to apply to any given interface is defined within the ipspEndpointToGroupTable table. This table maps a given interface to a group of rules. The interface itself with in this table is specified using its assigned address. There is also one group of rules per direction (inbound and outbound). 4.1.1 Notational conventions Notes about the following example operations: Baer, et al. Expires April 20, 2005 [Page 4] Internet-Draft IPsec SPD configuration MIB October 2004 1. All of the example operations in the following section make use of default values for all columns not listed. The operations and close are the minimal SNMP Varbinds that must be sent. 2. The example operations are formatted such that a row (i.e. the table's Entry object) is operated on by using the indexes to that row and the column values for the that row. It is left as an exercise for the reader to turn these into real SNMP operations using real OIDs and real varbinds in a SET PDU. Example: rowEntry(index1 = value1, index2 = value2) = (column1 = column_value1, column2 = column_value2) 4.1.2 Implementing an example SPD policy For our example, let us define and apply the following policy for all incoming traffic on a network interface: o Drop all packets from the host 10.6.6.6. o Accept all other packets. To do this, let us call the set of rules (as a group) "incoming" and apply them to the incoming traffic for the interface associated with the IPv4 address "10.0.0.1". For these rules, let us apply a policy that accepts all traffic except for packets that arrive from a host with an IPv4 address of "10.6.6.6". To achieve this policy, we would follow these steps: First, we need to create the rules to institute this policy. To accomplish this, first we have to create the filter for the host. We could do this using the following row insertion into the spdIpHeaderFilterTable table: SpdIpHeaderFilterEntry(spdIpHeadFiltName = "10.6.6.6") = (spdIpHeadFiltType = 0x80, -- sourceAddress spdIpHeadFiltIPVersion = 1, -- IPv4 spdIpHeadFiltSrcAddressBegin = 0x0a060606, spdIpHeadFiltSrcAddressEnd = 0x0a060606, spdIpHeadFiltRowStatus = 5) -- createAndGo Next, we need to bind this filter to an action of "drop" in a new rule. We can do this as follows: Baer, et al. Expires April 20, 2005 [Page 5] Internet-Draft IPsec SPD configuration MIB October 2004 spdRuleDefinitionEntry(spdRuleDefName = "drop from 10.6.6.6") = (spdRuleDefFilter = spdIpHeadFiltType.8.49.48.46.54.46.54.46.54, spdRuleDefAction = spdDropAction.0, spdRuleDefRowStatus = 5) -- createAndGo We also need a rule to accept all other packets: spdRuleDefinitionEntry(spdRuleDefName = "accept all") = (spdRuleDefFilter = spdTrueFilter.0, spdRuleDefAction = spdAcceptAction.0, spdRuleDefRowStatus = 5) -- createAndGo Now, we need to put these two rules into a group. We will put the "accept all" rule at the very end (i.e. assign it the highest priority number), so it is matched last. Then, at an earlier priority (1000), we will insert the "drop from 10.6.6.6" rule. We will do this by putting the rules into the group "incoming". SpdGroupContentsEntry(spdGroupContName = "incoming", spdGroupContPriority = 65535) = (spdGroupContComponentName = "accept all", spdGroupContRowStatus = 5) -- createAndGo SpdGroupContentsEntry(spdGroupContName = "incoming", spdGroupContPriority = 1000) = (spdGroupContComponentName = "drop from 10.6.6.6", spdGroupContRowStatus = 5) -- createAndGo Finally, we apply this group of rules to our interface: SpdEndpointToGroupEntry(spdEndGroupDirection = 1, -- incoming spdEndGroupIdentType = 4, -- IPv4 spdEndGroupAddress = 0x0a000001) = (spdEndGroupName = "incoming", spdEndGroupRowStatus = 5) -- createAndGo This completes the necessary steps to implement the policy. Once all of these rules have been applied, our policy should take effect. 5. MIB definition IPSEC-SPD-MIB DEFINITIONS ::= BEGIN IMPORTS Baer, et al. Expires April 20, 2005 [Page 6] Internet-Draft IPsec SPD configuration MIB October 2004 MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Integer32, mib-2 FROM SNMPv2-SMI TEXTUAL-CONVENTION, RowStatus, TruthValue, TimeStamp, StorageType, VariablePointer, DateAndTime FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF SnmpAdminString FROM SNMP-FRAMEWORK-MIB InetAddressType, InetAddress, InetPortNumber FROM INET-ADDRESS-MIB ; -- -- module identity -- spdMIB MODULE-IDENTITY LAST-UPDATED "200212100000Z" -- 12 December 2002 ORGANIZATION "IETF IP Security Policy Working Group" CONTACT-INFO "Michael Baer Sparta, Inc. Phone: +1 530 902 3131 Email: baerm@tislabs.com Ricky Charlet Email: rcharlet@alumni.calpoly.edu Wes Hardaker Sparta, Inc. P.O. Box 382 Davis, CA 95617 Phone: +1 530 792 1913 Email: hardaker@tislabs.com Robert Story Revelstone Software PO Box 1812 Tucker, GA 30085 Phone: +1 770 617 3722 Email: ipsp-mib@revelstone.com Cliff Wang SmartPipes Inc. Suite 300, 565 Metro Place South Baer, et al. Expires April 20, 2005 [Page 7] Internet-Draft IPsec SPD configuration MIB October 2004 Dublin, OH 43017 Phone: +1 614 923 6241 E-Mail: cliffwang2000@yahoo.com" DESCRIPTION "This MIB module defines configuration objects for managing IPsec Security Policy. Copyright (C) The Internet Society (2003). This version of this MIB module is part of RFC XXXX, see the RFC itself for full legal notices." -- Revision History REVISION "200401070000Z" -- 7 January 2004 DESCRIPTION "Initial version, published as RFC xxxx." -- RFC-editor assigns xxxx -- XXX: To be assigned by IANA ::= { mib-2 xxx } -- -- groups of related objects -- spdConfigObjects OBJECT IDENTIFIER ::= { spdMIB 1 } spdNotificationObjects OBJECT IDENTIFIER ::= { spdMIB 2 } spdConformanceObjects OBJECT IDENTIFIER ::= { spdMIB 3 } spdActions OBJECT IDENTIFIER ::= { spdMIB 4 } -- Note: the following subassignments have been used in other MIBs: -- IPSEC-IPSECACTION-MIB: -- ipsaMIB MODULE-IDENTITY ::= { spdActions 1 } -- IPSEC-IKEACTION-MIB: -- ipiaMIB MODULE-IDENTITY ::= { spdActions 2 } -- -- Textual Conventions -- SpdBooleanOperator ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The SpdBooleanOperator operator is used to specify whether sub-components in a decision making process are Baer, et al. Expires April 20, 2005 [Page 8] Internet-Draft IPsec SPD configuration MIB October 2004 ANDed or ORed together to decide if the resulting expression is true or false." SYNTAX INTEGER { or(1), and(2) } SpdAdminStatus ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The SpdAdminStatus is used to specify the administrative status of an object. Objects which are disabled must not be used by the packet processing engine." SYNTAX INTEGER { enabled(1), disabled(2) } SpdIPPacketLogging ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "SpdIPPacketLogging specifies whether or not an audit message should be logged when a packet is passed through an SA. A value of '-1' indicates no logging. A value of '0' or greater indicates that logging should be done and how many bytes of the beginning of the packet to place in the log. Values greater than the size of the packet being processed indicate that the entire packet should be sent. Examples: '-1' no logging '0' log but do not include any of the packet in the log '20' log and include the first 20 bytes of the packet in the log." SYNTAX Integer32 (-1..65535) -- -- Policy group definitions -- spdLocalConfigObjects OBJECT IDENTIFIER ::= { spdConfigObjects 1 } spdIncomingPolicyGroupName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..32)) MAX-ACCESS read-write STATUS current DESCRIPTION "This object indicates the policy group containing the global system policy that is to be applied on incoming packets (I.E., arriving at a interface) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates no system wide Baer, et al. Expires April 20, 2005 [Page 9] Internet-Draft IPsec SPD configuration MIB October 2004 policy exits and the default policy of 'accept' should be executed for incoming packets until one is imposed by either this object or by the endpoint processing a given packet." ::= { spdLocalConfigObjects 1 } spdOutgoingPolicyGroupName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..32)) MAX-ACCESS read-write STATUS current DESCRIPTION "This object indicates the policy group containing the global system policy that is to be applied on outgoing packets (I.E., leaving an interface) when a given endpoint does not contain a policy definition in the spdEndpointToGroupTable. Its value can be used as an index into the spdGroupContentsTable to retrieve a list of policies. A zero length string indicates no system wide policy exits and the default policy of 'accept' should be executed for outgoing packets until one is imposed by either this object or by the endpoint processing a given packet." ::= { spdLocalConfigObjects 2 } spdEndpointToGroupTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdEndpointToGroupEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table is used to map policy (groupings) onto an endpoint where traffic is to pass by. Any policy group assigned to an endpoint is then used to control access to the traffic passing by it. If an endpoint has been configured with a policy group and no contained rule matches the incoming packet, the default action in this case shall be to drop the packet. If no policy group has been assigned to an endpoint, then the policy group specified by spdSystemPolicyGroupName should be used for the endpoint." ::= { spdConfigObjects 2 } spdEndpointToGroupEntry OBJECT-TYPE SYNTAX SpdEndpointToGroupEntry MAX-ACCESS not-accessible Baer, et al. Expires April 20, 2005 [Page 10] Internet-Draft IPsec SPD configuration MIB October 2004 STATUS current DESCRIPTION "A mapping assigning a policy group to an endpoint." INDEX { spdEndGroupIdentType, spdEndGroupAddress } ::= { spdEndpointToGroupTable 1 } SpdEndpointToGroupEntry ::= SEQUENCE { spdEndGroupDirection INTEGER, spdEndGroupIdentType InetAddressType, spdEndGroupAddress InetAddress, spdEndGroupName SnmpAdminString, spdEndGroupLastChanged TimeStamp, spdEndGroupStorageType StorageType, spdEndGroupRowStatus RowStatus } spdEndGroupDirection OBJECT-TYPE SYNTAX INTEGER { incoming(1), outgoing(2) } MAX-ACCESS not-accessible STATUS current DESCRIPTION "The direction of the packet crossing the interface. As packets arrive or leave an interface, the appropriate policy is applied according to the direction it is traveling: into or out of the device." ::= { spdEndpointToGroupEntry 1 } spdEndGroupIdentType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The Internet Protocol version of the address associated with a given endpoint. All addresses are represented as an array of octets in network byte order. When combined with the spdEndGroupAddress these objects can be used to uniquely identify an endpoint that a set of policy groups should be applied to. Devices supporting IPv4 MUST support the ipv4 value, and devices supporting IPv6 MUST support the ipv6 value. Values of unknown, ipv4z, ipv6z and dns are not legal values for this object." ::= { spdEndpointToGroupEntry 2 } spdEndGroupAddress OBJECT-TYPE SYNTAX InetAddress (SIZE (4|16)) MAX-ACCESS not-accessible Baer, et al. Expires April 20, 2005 [Page 11] Internet-Draft IPsec SPD configuration MIB October 2004 STATUS current DESCRIPTION "The address of a given endpoint, the format of which is specified by the spdEndGroupIdentType object." ::= { spdEndpointToGroupEntry 3 } spdEndGroupName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS read-create STATUS current DESCRIPTION "The policy group name to apply to this endpoint. The value of the spdEndGroupName object should then be used as an index into the spdGroupContentsTable to come up with a list of rules that MUST be applied to this endpoint." ::= { spdEndpointToGroupEntry 4 } spdEndGroupLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdEndpointToGroupEntry 5 } spdEndGroupStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdEndpointToGroupEntry 6 } spdEndGroupRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. The value of this object has no effect on whether other Baer, et al. Expires April 20, 2005 [Page 12] Internet-Draft IPsec SPD configuration MIB October 2004 objects in this conceptual row can be modified. This object may not be set to active until one or more active rows exist within the spdGroupContentsTable for the group referenced by the spdEndGroupName object." ::= { spdEndpointToGroupEntry 7 } -- -- policy group definition table -- spdGroupContentsTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdGroupContentsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table contains a list of rules and/or subgroups contained within a given policy group. The entries are sorted by the spdGroupContPriority object and MUST be executed in order according to this value, starting with the lowest value. Once a group item has been processed, the processor MUST stop processing this packet if an action was executed as a result of the processing of a given group. Iterating into the next policy group item by finding the next largest spdGroupContPriority object shall only be done if no actions were run when processing the last item for a given packet." ::= { spdConfigObjects 3 } spdGroupContentsEntry OBJECT-TYPE SYNTAX SpdGroupContentsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Defines a given sub-component within a policy group." INDEX { spdGroupContName, spdGroupContPriority } ::= { spdGroupContentsTable 1 } SpdGroupContentsEntry ::= SEQUENCE { spdGroupContName SnmpAdminString, spdGroupContPriority Integer32, spdGroupContFilter VariablePointer, spdGroupContComponentType INTEGER, spdGroupContComponentName SnmpAdminString, spdGroupContLastChanged TimeStamp, spdGroupContStorageType StorageType, spdGroupContRowStatus RowStatus } Baer, et al. Expires April 20, 2005 [Page 13] Internet-Draft IPsec SPD configuration MIB October 2004 spdGroupContName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The administrative name of this group." ::= { spdGroupContentsEntry 1 } spdGroupContPriority OBJECT-TYPE SYNTAX Integer32 (0..65535) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The priority (sequence number) of the sub-component in this group." ::= { spdGroupContentsEntry 2 } spdGroupContFilter OBJECT-TYPE SYNTAX VariablePointer MAX-ACCESS read-create STATUS current DESCRIPTION "spdGroupContFilter points to a filter which is evaluated to determine whether the sub-component within this group should be exercised. Managers can use this object to classify groups of rules or subgroups together in order to achieve a greater degree of control and optimization over the execution order of the items within the group. If the filter evaluates to false, the rule or subgroup will be skipped and the next rule or subgroup will be evaluated instead. An example usage of this object would be to limit a group of rules to executing only when the IP packet being process is designated to be processed by IKE. This effecitevly creates a group of IKE specific rules. This MIB defines the following tables and scalars which may be pointed to by this column. Implementations may choose to provide support for other filter tables or scalars as well: spdIpHeaderFilterTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter Baer, et al. Expires April 20, 2005 [Page 14] Internet-Draft IPsec SPD configuration MIB October 2004 If this column is set to a VariablePointer value which references a non-existent row in an otherwise supported table, the inconsistentName exception should be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception should be returned." DEFVAL { spdTrueFilterInstance } ::= { spdGroupContentsEntry 3 } spdGroupContComponentType OBJECT-TYPE SYNTAX INTEGER { reserved(0), group(1), rule(2) } MAX-ACCESS read-create STATUS current DESCRIPTION "Indicates whether the spdGroupContComponentName object is the name of another group defined within the spdGroupContentsTable or is the name of a rule defined within the spdRuleDefinitionTable." DEFVAL { rule } ::= { spdGroupContentsEntry 4 } spdGroupContComponentName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS read-create STATUS current DESCRIPTION "The name of the policy rule or subgroup contained within this group, as indicated by the spdGroupContComponentType object." ::= { spdGroupContentsEntry 5 } spdGroupContLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdGroupContentsEntry 6 } spdGroupContStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a Baer, et al. Expires April 20, 2005 [Page 15] Internet-Draft IPsec SPD configuration MIB October 2004 storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdGroupContentsEntry 7 } spdGroupContRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object may not be set to active until the row to which the spdGroupContComponentName points to exists." ::= { spdGroupContentsEntry 8 } -- -- policy definition table -- spdRuleDefinitionTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdRuleDefinitionEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table defines a policy rule by associating a filter or a set of filters to an action to be executed." ::= { spdConfigObjects 4 } spdRuleDefinitionEntry OBJECT-TYPE SYNTAX SpdRuleDefinitionEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A row defining a particular policy definition. A rule definition binds a filter pointer to an action pointer." INDEX { spdRuleDefName } ::= { spdRuleDefinitionTable 1 } SpdRuleDefinitionEntry ::= SEQUENCE { spdRuleDefName SnmpAdminString, spdRuleDefDescription SnmpAdminString, spdRuleDefFilter VariablePointer, spdRuleDefFilterNegated TruthValue, spdRuleDefAction VariablePointer, Baer, et al. Expires April 20, 2005 [Page 16] Internet-Draft IPsec SPD configuration MIB October 2004 spdRuleDefAdminStatus SpdAdminStatus, spdRuleDefLastChanged TimeStamp, spdRuleDefStorageType StorageType, spdRuleDefRowStatus RowStatus } spdRuleDefName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "spdRuleDefName is the administratively assigned name of the rule referred to by the spdGroupContComponentName object." ::= { spdRuleDefinitionEntry 1 } spdRuleDefDescription OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-create STATUS current DESCRIPTION "A user definable string. This field may be used for your administrative tracking purposes." DEFVAL { "" } ::= { spdRuleDefinitionEntry 2 } spdRuleDefFilter OBJECT-TYPE SYNTAX VariablePointer MAX-ACCESS read-create STATUS current DESCRIPTION "spdRuleDefFilter points to a filter which is used to evaluate whether the action associated with this row should be fired or not. The action will only fire if the filter referenced by this object evaluates to TRUE after first applying any negation required by the spdRuleDefFilterNegated object. This MIB defines the following tables and scalars which may be pointed to by this column. Implementations may choose to provide support for other filter tables or scalars as well: spdIpHeaderFilterTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter Baer, et al. Expires April 20, 2005 [Page 17] Internet-Draft IPsec SPD configuration MIB October 2004 If this column is set to a VariablePointer value which references a non-existent row in an otherwise supported table, the inconsistentName exception should be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception should be returned." ::= { spdRuleDefinitionEntry 3 } spdRuleDefFilterNegated OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION "spdRuleDefFilterNegated specifies whether the filter referenced by the spdRuleDefFilter object should be negated or not." DEFVAL { false } ::= { spdRuleDefinitionEntry 4 } spdRuleDefAction OBJECT-TYPE SYNTAX VariablePointer MAX-ACCESS read-create STATUS current DESCRIPTION "This column points to the action to be taken. It may, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable spdSaPreconfiguredActionTable spdIkeActionTable spdIpsecActionTable It may also point to one of the scalar objects beneath spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error should be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error should be returned." ::= { spdRuleDefinitionEntry 5 } spdRuleDefAdminStatus OBJECT-TYPE SYNTAX SpdAdminStatus MAX-ACCESS read-create Baer, et al. Expires April 20, 2005 [Page 18] Internet-Draft IPsec SPD configuration MIB October 2004 STATUS current DESCRIPTION "Indicates whether the current rule definition should be considered active. If enabled, it should be evaluated when processing packets. If disabled, packets should continue to be processed by the rest of the rules defined in the spdGroupContentsTable as if this rule's filters had effectively failed." DEFVAL { enabled } ::= { spdRuleDefinitionEntry 6 } spdRuleDefLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdRuleDefinitionEntry 7 } spdRuleDefStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdRuleDefinitionEntry 8 } spdRuleDefRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object may not be set to active until the containing contitions, filters and actions have been defined. Once active, it must remain active until no policyGroupContents entries are referencing it." ::= { spdRuleDefinitionEntry 9 } Baer, et al. Expires April 20, 2005 [Page 19] Internet-Draft IPsec SPD configuration MIB October 2004 -- -- Policy compound filter definition table -- spdCompoundFilterTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdCompoundFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table defining a compound set of filters and their associated parameters. A row in this table can either be pointed to by a spdRuleDefFilter object or by a ficSubFilter object." ::= { spdConfigObjects 5 } spdCompoundFilterEntry OBJECT-TYPE SYNTAX SpdCompoundFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the spdCompoundFilterTable. A filter defined by this table is considered to have a TRUE return value if and only if: spdCompFiltLogicType is AND and all of the sub-filters associated with it, as defined in the spdSubfiltersTable, are all true themselves (after applying any requried negation as defined by the ficFilterIsNegated object). spdCompFiltLogicType is OR and at least one of the sub-filters associated with it, as defined in the spdSubfiltersTable, is true itself (after applying any requried negation as defined by the ficFilterIsNegated object)." INDEX { spdCompFiltName } ::= { spdCompoundFilterTable 1 } SpdCompoundFilterEntry ::= SEQUENCE { spdCompFiltName SnmpAdminString, spdCompFiltDescription SnmpAdminString, spdCompFiltLogicType SpdBooleanOperator, spdCompFiltLastChanged TimeStamp, spdCompFiltStorageType StorageType, spdCompFiltRowStatus RowStatus } spdCompFiltName OBJECT-TYPE Baer, et al. Expires April 20, 2005 [Page 20] Internet-Draft IPsec SPD configuration MIB October 2004 SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "A user definable string. You may use this field for your administrative tracking purposes." ::= { spdCompoundFilterEntry 1 } spdCompFiltDescription OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-create STATUS current DESCRIPTION "A user definable string. You may use this field for your administrative tracking purposes." DEFVAL { ''H } ::= { spdCompoundFilterEntry 2 } spdCompFiltLogicType OBJECT-TYPE SYNTAX SpdBooleanOperator MAX-ACCESS read-create STATUS current DESCRIPTION "Indicates whether the filters contained within this filter are functionally ANDed or ORed together." DEFVAL { and } ::= { spdCompoundFilterEntry 3 } spdCompFiltLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdCompoundFilterEntry 4 } spdCompFiltStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } Baer, et al. Expires April 20, 2005 [Page 21] Internet-Draft IPsec SPD configuration MIB October 2004 ::= { spdCompoundFilterEntry 5 } spdCompFiltRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once active, it may not have its value changed if any active rows in the spdRuleDefinitionTable are currently pointing at this row." ::= { spdCompoundFilterEntry 6 } -- -- Policy filters in a cf table -- spdSubfiltersTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdSubfiltersEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table defines a list of filters contained within a given compound filter set defined in the spdCompoundFilterTable." ::= { spdConfigObjects 6 } spdSubfiltersEntry OBJECT-TYPE SYNTAX SpdSubfiltersEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry into the list of filters for a given compound filter." INDEX { spdCompFiltName, spdSubFiltPriority } ::= { spdSubfiltersTable 1 } SpdSubfiltersEntry ::= SEQUENCE { spdSubFiltPriority Integer32, spdSubFiltSubfilter VariablePointer, spdSubFiltSubfilterIsNegated TruthValue, spdSubFiltLastChanged TimeStamp, spdSubFiltStorageType StorageType, spdSubFiltRowStatus RowStatus Baer, et al. Expires April 20, 2005 [Page 22] Internet-Draft IPsec SPD configuration MIB October 2004 } spdSubFiltPriority OBJECT-TYPE SYNTAX Integer32 (0..65535) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The priority of a given filter within a condition. Implementations MAY choose to follow the ordering indicated by the manager that created the rows in order to allow the manager to intelligently construct filter lists such that faster filters are evaluated first." ::= { spdSubfiltersEntry 1 } spdSubFiltSubfilter OBJECT-TYPE SYNTAX VariablePointer MAX-ACCESS read-create STATUS current DESCRIPTION "The location of the contained filter. The value of this column should be a VariablePointer which references the properties for the filter to be included in this compound filter. This MIB defines the following tables and scalars which may be pointed to by this column. Implementations may choose to provide support for other filter tables or scalars as well: spdIpHeaderFilterTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter If this column is set to a VariablePointer value which references a non-existent row in an otherwise supported table, the inconsistentName exception should be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception should be returned." ::= { spdSubfiltersEntry 2 } spdSubFiltSubfilterIsNegated OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION Baer, et al. Expires April 20, 2005 [Page 23] Internet-Draft IPsec SPD configuration MIB October 2004 "Indicates whether the result of applying this subfilter should be negated or not." DEFVAL { false } ::= { spdSubfiltersEntry 3 } spdSubFiltLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdSubfiltersEntry 4 } spdSubFiltStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdSubfiltersEntry 5 } spdSubFiltRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. This object can not be made active until the filter referenced by the ficSubFilter object is both defined and is active. An attempt to do so will result in an inconsistentValue error." ::= { spdSubfiltersEntry 6 } -- -- Static Filters -- spdStaticFilters OBJECT IDENTIFIER ::= { spdConfigObjects 7 } Baer, et al. Expires April 20, 2005 [Page 24] Internet-Draft IPsec SPD configuration MIB October 2004 spdTrueFilter OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "This scalar indicates a (automatic) true result for a filter. I.e. this is a filter that is always true, useful for adding as a default filter for a default action or a set of actions." ::= { spdStaticFilters 1 } spdTrueFilterInstance OBJECT IDENTIFIER ::= { spdTrueFilter 0 } -- -- Policy IPHeader filter definition table -- spdIpHeaderFilterTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdIpHeaderFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table contains a list of filter definitions to be used within the spdRuleDefinitionTable or the spdSubfilterTable table." ::= { spdConfigObjects 8 } spdIpHeaderFilterEntry OBJECT-TYPE SYNTAX SpdIpHeaderFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A definition of a particular filter." INDEX { spdIpHeadFiltName } ::= { spdIpHeaderFilterTable 1 } SpdIpHeaderFilterEntry ::= SEQUENCE { spdIpHeadFiltName SnmpAdminString, spdIpHeadFiltType BITS, spdIpHeadFiltIPVersion InetAddressType, spdIpHeadFiltSrcAddressBegin InetAddress, spdIpHeadFiltSrcAddressEnd InetAddress, spdIpHeadFiltDstAddressBegin InetAddress, spdIpHeadFiltDstAddressEnd InetAddress, spdIpHeadFiltSrcLowPort InetPortNumber, spdIpHeadFiltSrcHighPort InetPortNumber, spdIpHeadFiltDstLowPort InetPortNumber, spdIpHeadFiltDstHighPort InetPortNumber, Baer, et al. Expires April 20, 2005 [Page 25] Internet-Draft IPsec SPD configuration MIB October 2004 spdIpHeadFiltProtocol Integer32, spdIpHeadFiltIPv6FlowLabel Integer32, spdIpHeadFiltLastChanged TimeStamp, spdIpHeadFiltStorageType StorageType, spdIpHeadFiltRowStatus RowStatus } spdIpHeadFiltName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The administrative name for this filter." ::= { spdIpHeaderFilterEntry 1 } spdIpHeadFiltType OBJECT-TYPE SYNTAX BITS { sourceAddress(0), destinationAddress(1), sourcePort(2), destinationPort(3), protocol(4), ipv6FlowLabel(5) } MAX-ACCESS read-create STATUS current DESCRIPTION "This defines the various tests that are used when evaluating a given filter. The results of each test are ANDed together to produce the result of the entire filter. When processing this filter, it is recommended for efficiency reasons that the filter halt processing the instant any of the specified tests fail. Once a row is 'active', this object's value may not be changed unless all the appropriate columns needed by the new value to be imposed on this object have been appropriately configured. The various tests definable in this table are as follows: sourceAddress: - Tests if the source address in the packet lies between the spdIpHeadFiltSrcAddressBegin and spdIpHeadFiltSrcAddressEnd objects. Note that setting these two objects to the same address will limit the search to the exact match of a single address. The format and length of the address objects are defined by the spdIpHeadFiltIPVersion column. Baer, et al. Expires April 20, 2005 [Page 26] Internet-Draft IPsec SPD configuration MIB October 2004 A row in this table containing a spdIpHeadFiltType object with the sourceAddress object bit but without the spdIpHeadFiltIPVersion, spdIpHeadFiltSrcAddressBegin and spdIpHeadFiltSrcAddressEnd objects set will cause the spdIpHeadFiltRowStatus object to return the notReady state. destinationAddress: - Tests if the destination address in the packet lies between the spdIpHeadFiltDstAddressBegin and spdIpHeadFiltDstAddressEnd objects. Note that setting these two objects to the same address will limit the search to the exact match of a single address. The format and length of the address objects are defined by the spdIpHeadFiltIPVersion column. A row in this table containing a spdIpHeadFiltType object with the destinationAddress object bit but without the spdIpHeadFiltIPVersion, spdIpHeadFiltDstAddressBegin and spdIpHeadFiltDstAddressEnd objects set will cause the spdIpHeadFiltRowStatus object to return the notReady state. sourcePort: - Tests if the source port of IP packets using a protocol that uses port numbers (at this time, UDP or TCP) lies between the spdIpHeadFiltSrcLowPort and spdIpHeadFiltSrcHighPort objects. Note that setting these two objects to the same address will limit the search to the exact match of a single port. A row in this table containing a spdIpHeadFiltType object with the sourcePort object bit but without the spdIpHeadFiltSrcLowPort, and spdIpHeadFiltSrcHighPort objects set will cause the spdIpHeadFiltRowStatus object to return the notReady state. destinationPort: - Tests if the source port of IP packets using a protocol that uses port numbers (at this time, UDP or TCP) lies between the spdIpHeadFiltDstLowPort and spdIpHeadFiltDstHighPort objects. Note that setting these two objects to the same address will limit the Baer, et al. Expires April 20, 2005 [Page 27] Internet-Draft IPsec SPD configuration MIB October 2004 search to the exact match of a single port. A row in this table containing a spdIpHeadFiltType object with the sourcePort object bit but without the spdIpHeadFiltDstLowPort, and spdIpHeadFiltDstHighPort objects set will cause the spdIpHeadFiltRowStatus object to return the notReady state. protocol: - Tests to see if the packet being processed is for the given protocol type. A row in this table containing a spdIpHeadFiltType object with the protocol object bit but without the spdIpHeadFiltProtocol object set will cause the spdIpHeadFiltRowStatus object to return the notReady state. ipv6FlowLabel: - Tests to see if the packet being processed contains an ipv6 Flow Label which matches the value in the ipfIPv6FlowLabel object. Setting this bit mandates that for the packet to match the filter, it must be an IPv6 packet. A row in this table containing a spdIpHeadFiltType object with the ipv6FlowLabel object bit but without the ipfIPv6FlowLabel object set will cause the spdIpHeadFiltRowStatus object to return the notReady state." ::= { spdIpHeaderFilterEntry 2 } spdIpHeadFiltIPVersion OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-create STATUS current DESCRIPTION "The Internet Protocol version the addresses are to match against. The value of this property determines the size and format of the spdIpHeadFiltSrcAddressBegin, spdIpHeadFiltSrcAddressEnd, spdIpHeadFiltDstAddressBegin, and spdIpHeadFiltDstAddressEnd objects. Values of unknown, ipv4z, ipv6z and dns are not legal values for this object." DEFVAL { ipv6 } Baer, et al. Expires April 20, 2005 [Page 28] Internet-Draft IPsec SPD configuration MIB October 2004 ::= { spdIpHeaderFilterEntry 3 } spdIpHeadFiltSrcAddressBegin OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION "The starting address of a source address range that the packet must match against for this filter to be considered TRUE. This object is only used if sourceAddress is set in spdIpHeadFiltType." ::= { spdIpHeaderFilterEntry 4 } spdIpHeadFiltSrcAddressEnd OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION "The ending address of a source address range to check a packet against, where the starting is specified by the spdIpHeadFiltSrcAddressBegin object. Set this column to the same value as the spdIpHeadFiltSrcAddressBegin column to get an exact single address match. This object is only used if sourceAddress is set in spdIpHeadFiltType." ::= { spdIpHeaderFilterEntry 5 } spdIpHeadFiltDstAddressBegin OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION "The starting address of a destination address range that the packet must match against for this filter to be considered TRUE. This object is only used if destinationAddress is set in spdIpHeadFiltType." ::= { spdIpHeaderFilterEntry 6 } spdIpHeadFiltDstAddressEnd OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION Baer, et al. Expires April 20, 2005 [Page 29] Internet-Draft IPsec SPD configuration MIB October 2004 "The ending address of a destination address range to check a packet against, where the first is specified by the spdIpHeadFiltDstAddressBegin object. Set this column to the same value as the spdIpHeadFiltDstAddressBegin column to get an exact single address match. This object is only used if destinationAddress is set in spdIpHeadFiltType." ::= { spdIpHeaderFilterEntry 7 } spdIpHeadFiltSrcLowPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-create STATUS current DESCRIPTION "The low port of the port range a packet's source must match against. To match, the port number must be greater than or equal to this value. This object is only used if sourcePort is set in spdIpHeadFiltType. The value of 0 for this object is illegal." ::= { spdIpHeaderFilterEntry 8 } spdIpHeadFiltSrcHighPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-create STATUS current DESCRIPTION "The high port of the port range a packet's source must match against. To match, the port number must be less than or equal to this value. This object is only used if sourcePort is set in spdIpHeadFiltType. The value of 0 for this object is illegal." ::= { spdIpHeaderFilterEntry 9 } spdIpHeadFiltDstLowPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-create STATUS current DESCRIPTION "The low port of the port range a packet's destination must match against. To match, the port number must be Baer, et al. Expires April 20, 2005 [Page 30] Internet-Draft IPsec SPD configuration MIB October 2004 greater than or equal to this value. This object is only used if destinationPort is set in spdIpHeadFiltType. The value of 0 for this object is illegal." ::= { spdIpHeaderFilterEntry 10 } spdIpHeadFiltDstHighPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-create STATUS current DESCRIPTION "The high port of the port range a packet's destination must match against. To match, the port number must be less than or equal to this value. This object is only used if destinationPort is set in spdIpHeadFiltType. The value of 0 for this object is illegal." ::= { spdIpHeaderFilterEntry 11 } spdIpHeadFiltProtocol OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-create STATUS current DESCRIPTION "The protocol number the incoming packet must match against for this filter to be evaluated as true. This object is only used if protocol is set in spdIpHeadFiltType." ::= { spdIpHeaderFilterEntry 12 } spdIpHeadFiltIPv6FlowLabel OBJECT-TYPE SYNTAX Integer32 (0..1048575) MAX-ACCESS read-create STATUS current DESCRIPTION "The IPv6 Flow Label that the packet must match against. This object is only used if ipv6FlowLabel is set in spdIpHeadFiltType." ::= { spdIpHeaderFilterEntry 13 } spdIpHeadFiltLastChanged OBJECT-TYPE SYNTAX TimeStamp Baer, et al. Expires April 20, 2005 [Page 31] Internet-Draft IPsec SPD configuration MIB October 2004 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdIpHeaderFilterEntry 14 } spdIpHeadFiltStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdIpHeaderFilterEntry 15 } spdIpHeadFiltRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. This object may not be set to active if the requirements of the spdIpHeadFiltType object are not met. In other words, if the associated value columns needed by a particular test have not been set, then attempting to change this row to an active state will result in an inconsistentValue error. See the spdIpHeadFiltType object description for further details." ::= { spdIpHeaderFilterEntry 16 } -- -- Policy IP Offset filter definition table -- spdIpOffsetFilterTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdIpOffsetFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table contains a list of filter definitions to be used within the spdRuleDefinitionTable or the spdSubfilterTable." Baer, et al. Expires April 20, 2005 [Page 32] Internet-Draft IPsec SPD configuration MIB October 2004 ::= { spdConfigObjects 9 } spdIpOffsetFilterEntry OBJECT-TYPE SYNTAX SpdIpOffsetFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A definition of a particular filter." INDEX { spdIpOffFiltName } ::= { spdIpOffsetFilterTable 1 } SpdIpOffsetFilterEntry ::= SEQUENCE { spdIpOffFiltName SnmpAdminString, spdIpOffFiltOffset Integer32, spdIpOffFiltType INTEGER, spdIpOffFiltValue OCTET STRING, spdIpOffFiltLastChanged TimeStamp, spdIpOffFiltStorageType StorageType, spdIpOffFiltRowStatus RowStatus } spdIpOffFiltName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The administrative name for this filter." ::= { spdIpOffsetFilterEntry 1 } spdIpOffFiltOffset OBJECT-TYPE SYNTAX Integer32 (0..65535) MAX-ACCESS read-create STATUS current DESCRIPTION "This is the byte offset from the front of the IP packet where the value or arithmetic comparison is done. A value of '0' indicates the first byte in the packet." ::= { spdIpOffsetFilterEntry 2 } spdIpOffFiltType OBJECT-TYPE SYNTAX INTEGER { equal(1), notEqual(2), arithmeticLess(3), arithmeticGreaterOrEqual(4), arithmeticGreater(5), arithmeticLessOrEqual(6) } MAX-ACCESS read-create STATUS current Baer, et al. Expires April 20, 2005 [Page 33] Internet-Draft IPsec SPD configuration MIB October 2004 DESCRIPTION "This defines the various tests that are used when evaluating a given filter. Once a row is 'active', this object's value may not be changed unless the column, spdIpOffFiltValue, has been appropriately configured. The various tests definable in this table are as follows: equal: - Tests if the OCTET STRING, 'spdIpOffFiltValue', matches a value in the packet starting at the given offset in the packet and comparing the entire OCTET STRING of 'spdIpOffFiltValue'. Any numeric values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. notEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', does not match a value in the packet starting at the given offset in the packet and comparing to the entire OCTET STRING of 'spdIpOffFiltValue'. Any numeric values compared this way are assumed to be unsigned integer values in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticLess: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than ('<') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticGreaterOrEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically greater than or equal to ('>=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'. arithmeticGreater: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically greater than ('>') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network Baer, et al. Expires April 20, 2005 [Page 34] Internet-Draft IPsec SPD configuration MIB October 2004 byte order of the same length as 'spdIpOffFiltValue'. arithmeticLessOrEqual: - Tests if the OCTET STRING, 'spdIpOffFiltValue', is arithmetically less than or equal to ('<=') the value starting at the given offset within the packet. The value in the packet is assumed to be an unsigned integer in network byte order of the same length as 'spdIpOffFiltValue'." ::= { spdIpOffsetFilterEntry 3 } spdIpOffFiltValue OBJECT-TYPE SYNTAX OCTET STRING (SIZE(0..1024)) MAX-ACCESS read-create STATUS current DESCRIPTION "spdIpOffFiltValue is used for match comparisons of a packet at spdIpOffFiltOffset. This object is only used if one of the match types is chosen in spdIpOffFiltType." ::= { spdIpOffsetFilterEntry 4 } spdIpOffFiltLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdIpOffsetFilterEntry 5 } spdIpOffFiltStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdIpOffsetFilterEntry 6 } spdIpOffFiltRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create Baer, et al. Expires April 20, 2005 [Page 35] Internet-Draft IPsec SPD configuration MIB October 2004 STATUS current DESCRIPTION "This object indicates the conceptual status of this row. This object may not be set to active if the requirements of the spdIpOffFiltType object are not met. In other words, if the associated value columns needed by a particular test have not been set, then attempting to change this row to an active state will result in an inconsistentValue error. See the spdIpOffFiltType object description for further details." ::= { spdIpOffsetFilterEntry 7 } -- -- Time/scheduling filter table -- spdTimeFilterTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdTimeFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Defines a table of filters which can be used to effectively enable or disable policies based on a valid time range." ::= { spdConfigObjects 10 } spdTimeFilterEntry OBJECT-TYPE SYNTAX SpdTimeFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A row describing a given time frame for which a policy may be filtered on to place the rule active or inactive." INDEX { spdTimeFiltName } ::= { spdTimeFilterTable 1 } SpdTimeFilterEntry ::= SEQUENCE { spdTimeFiltName SnmpAdminString, spdTimeFiltPeriodStart DateAndTime, spdTimeFiltPeriodEnd DateAndTime, spdTimeFiltMonthOfYearMask BITS, spdTimeFiltDayOfMonthMask OCTET STRING, spdTimeFiltDayOfWeekMask BITS, spdTimeFiltTimeOfDayMaskStart DateAndTime, spdTimeFiltTimeOfDayMaskEnd DateAndTime, Baer, et al. Expires April 20, 2005 [Page 36] Internet-Draft IPsec SPD configuration MIB October 2004 spdTimeFiltLastChanged TimeStamp, spdTimeFiltStorageType StorageType, spdTimeFiltRowStatus RowStatus } spdTimeFiltName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "An administratively assigned name for this filter." ::= { spdTimeFilterEntry 1 } spdTimeFiltPeriodStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-create STATUS current DESCRIPTION "The starting time period for this filter. In addition to a normal DateAndTime string, this object may be set to the OCTET STRING value THISANDPRIOR which indicates that the filter is valid from any time before now up until (at least) now." DEFVAL { '00000101000000002b0000'H } ::= { spdTimeFilterEntry 2 } spdTimeFiltPeriodEnd OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-create STATUS current DESCRIPTION "The ending time period for this filter. In addition to a normal DateAndTime string, this object may be set to the OCTET STRING value THISANDFUTURE which indicates that the filter is valid without an ending date and/or time." DEFVAL { '99991231235959092b0000'H } ::= { spdTimeFilterEntry 3 } spdTimeFiltMonthOfYearMask OBJECT-TYPE SYNTAX BITS { january(0), february(1), march(2), april(3), may(4), june(5), july(6), august(7), september(8), october(9), november(10), december(11) } MAX-ACCESS read-create STATUS current Baer, et al. Expires April 20, 2005 [Page 37] Internet-Draft IPsec SPD configuration MIB October 2004 DESCRIPTION "A bit mask which overlays the spdTimeFiltPeriodStart to spdTimeFiltPeriodEnd date range to further restrict the time period to a restricted set of months of the year." DEFVAL { { january, february, march, april, may, june, july, august, september, october, november, december } } ::= { spdTimeFilterEntry 4 } spdTimeFiltDayOfMonthMask OBJECT-TYPE SYNTAX OCTET STRING (SIZE(4)) MAX-ACCESS read-create STATUS current DESCRIPTION "Defines which days of the month this time period is valid for. It is a sequence of 32 BITS, where each BIT represents a corresponding day of the month starting from the left most bit being equal to the first day of the month. The last bit in the string MUST be zero." DEFVAL { 'fffffffe'H } ::= { spdTimeFilterEntry 5 } spdTimeFiltDayOfWeekMask OBJECT-TYPE SYNTAX BITS { monday(0), tuesday(1), wednesday(2), thursday(3), friday(4), saturday(5), sunday(6) } MAX-ACCESS read-create STATUS current DESCRIPTION "A bit mask which overlays the spdTimeFiltPeriodStart to spdTimeFiltPeriodEnd date range to further restrict the time period to a restricted set of days within a given week." DEFVAL { { monday, tuesday, wednesday, thursday, friday, saturday, sunday } } ::= { spdTimeFilterEntry 6 } spdTimeFiltTimeOfDayMaskStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-create STATUS current DESCRIPTION "Indicates the starting time of day for which this filter evaluates to true. The date portions of the DateAndTime TC are ignored for purposes of evaluating this mask and only the time specific portions are used." DEFVAL { '00000000000000002b0000'H } ::= { spdTimeFilterEntry 7 } Baer, et al. Expires April 20, 2005 [Page 38] Internet-Draft IPsec SPD configuration MIB October 2004 spdTimeFiltTimeOfDayMaskEnd OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-create STATUS current DESCRIPTION "Indicates the ending time of day for which this filter evaluates to true. The date portions of the DateAndTime TC are ignored for purposes of evaluating this mask and only the time specific portions are used. If this starting and ending time values indicated by the spdTimeFiltTimeOfDayMaskStart and spdTimeFiltTimeOfDayMaskEnd objects are equal, the filter is expected to be evaluated over the entire 24 hour period." DEFVAL { '00000000000000002b0000'H } ::= { spdTimeFilterEntry 8 } spdTimeFiltLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdTimeFilterEntry 9 } spdTimeFiltStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdTimeFilterEntry 10 } spdTimeFiltRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row." ::= { spdTimeFilterEntry 11 } -- Baer, et al. Expires April 20, 2005 [Page 39] Internet-Draft IPsec SPD configuration MIB October 2004 -- IPSO protection authority filtering -- spdIpsoHeaderFilterTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdIpsoHeaderFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table contains a list of IPSO header filter definitions to be used within the spdRuleDefinitionTable or the spdSubfilterTable. IPSO headers and their values are described in RFC1108." ::= { spdConfigObjects 11 } spdIpsoHeaderFilterEntry OBJECT-TYPE SYNTAX SpdIpsoHeaderFilterEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A definition of a particular filter." INDEX { spdIpsoHeadFiltName } ::= { spdIpsoHeaderFilterTable 1 } SpdIpsoHeaderFilterEntry ::= SEQUENCE { spdIpsoHeadFiltName SnmpAdminString, spdIpsoHeadFiltType BITS, spdIpsoHeadFiltClassification INTEGER, spdIpsoHeadFiltProtectionAuth INTEGER, spdIpsoHeadFiltLastChanged TimeStamp, spdIpsoHeadFiltStorageType StorageType, spdIpsoHeadFiltRowStatus RowStatus } spdIpsoHeadFiltName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The administrative name for this filter." ::= { spdIpsoHeaderFilterEntry 1 } spdIpsoHeadFiltType OBJECT-TYPE SYNTAX BITS { classificationLevel(0), protectionAuthority(1) } MAX-ACCESS read-create STATUS current DESCRIPTION "The IPSO header fields to match the value against." Baer, et al. Expires April 20, 2005 [Page 40] Internet-Draft IPsec SPD configuration MIB October 2004 ::= { spdIpsoHeaderFilterEntry 2 } spdIpsoHeadFiltClassification OBJECT-TYPE SYNTAX INTEGER { topSecret(61), secret(90), confidential(150), unclassified(171) } MAX-ACCESS read-create STATUS current DESCRIPTION "The IPSO classification header field value must match the value in this column if the classificationLevel bit is set in the spdIpsoHeadFiltType field. The values of these enumerations are defined by RFC1108." ::= { spdIpsoHeaderFilterEntry 3 } spdIpsoHeadFiltProtectionAuth OBJECT-TYPE SYNTAX INTEGER { genser(0), siopesi(1), sci(2), nsa(3), doe(4) } MAX-ACCESS read-create STATUS current DESCRIPTION "The IPSO protection authority header field value must match the value in this column if the protection authority bit is set in the spdIpsoHeadFiltType field. The values of these enumerations are defined by RFC1108. Hence the reason the SMIv2 convention of not using 0 in enum lists is violated here." ::= { spdIpsoHeaderFilterEntry 4 } spdIpsoHeadFiltLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdIpsoHeaderFilterEntry 5 } spdIpsoHeadFiltStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a Baer, et al. Expires April 20, 2005 [Page 41] Internet-Draft IPsec SPD configuration MIB October 2004 storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdIpsoHeaderFilterEntry 6 } spdIpsoHeadFiltRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. This object may not be set to active if the requirements of the spdIpsoHeadFiltType object are not met. In other words, if the associated value columns needed by a particular test have not been set, then attempting to change this row to an active state will result in an inconsistentValue error. See the spdIpsoHeadFiltType object description for further details." ::= { spdIpsoHeaderFilterEntry 7 } -- -- compound actions table -- spdCompoundActionTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdCompoundActionEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table used to allow multiple actions to be associated with a rule. It uses the spdSubactionsTable to do this." ::= { spdConfigObjects 12 } spdCompoundActionEntry OBJECT-TYPE SYNTAX SpdCompoundActionEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A row in the spdCompoundActionTable." INDEX { spdCompActName } ::= { spdCompoundActionTable 1 } SpdCompoundActionEntry ::= SEQUENCE { spdCompActName SnmpAdminString, spdCompActExecutionStrategy INTEGER, spdCompActLastChanged TimeStamp, spdCompActStorageType StorageType, Baer, et al. Expires April 20, 2005 [Page 42] Internet-Draft IPsec SPD configuration MIB October 2004 spdCompActRowStatus RowStatus } spdCompActName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This is an administratively assigned name of this compound action." ::= { spdCompoundActionEntry 1 } spdCompActExecutionStrategy OBJECT-TYPE SYNTAX INTEGER { reserved(0), doAll(1), doUntilSuccess(2), doUntilFailure(3) } MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates how the sub-actions are executed based on the success of the actions as they finish executing. doAll - run each sub-action regardless of the exit status of the previous action. This parent action is always considered to have acted successfully. doUntilSuccess - run each sub-action until one succeeds, at which point stop processing the sub-actions within this parent compound action. If one of the sub-actions did execute successfully, this parent action is also considered to have executed sucessfully. doUntilFailure - run each sub-action until one fails, at which point stop processing the sub-actions within this compound action. If any sub-action fails, the result of this parent action is considered to have failed." DEFVAL { doUntilSuccess } ::= { spdCompoundActionEntry 2 } spdCompActLastChanged OBJECT-TYPE SYNTAX TimeStamp Baer, et al. Expires April 20, 2005 [Page 43] Internet-Draft IPsec SPD configuration MIB October 2004 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdCompoundActionEntry 3 } spdCompActStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdCompoundActionEntry 4 } spdCompActRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified. Once a row in the spdCompoundActionTable has been made active, this object may not be set to destroy without first destroying all the contained rows listed in the spdSubactionsTable." ::= { spdCompoundActionEntry 5 } -- -- actions contained within a compound action -- spdSubactionsTable OBJECT-TYPE SYNTAX SEQUENCE OF SpdSubactionsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table contains a list of the sub-actions within a given compound action. Compound actions executing these actions MUST execute them in series based on the Baer, et al. Expires April 20, 2005 [Page 44] Internet-Draft IPsec SPD configuration MIB October 2004 spdSubActPriority value, with the lowest value executing first." ::= { spdConfigObjects 13 } spdSubactionsEntry OBJECT-TYPE SYNTAX SpdSubactionsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A row containing a reference to a given compound-action sub-action." INDEX { spdCompActName, spdSubActPriority } ::= { spdSubactionsTable 1 } SpdSubactionsEntry ::= SEQUENCE { spdSubActPriority Integer32, spdSubActSubActionName VariablePointer, spdSubActLastChanged TimeStamp, spdSubActStorageType StorageType, spdSubActRowStatus RowStatus } spdSubActPriority OBJECT-TYPE SYNTAX Integer32 (0..65535) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The priority of a given sub-action within a compound action. The order in which sub-actions should be executed are based on the value from this column, with the lowest numeric value executing first." ::= { spdSubactionsEntry 1 } spdSubActSubActionName OBJECT-TYPE SYNTAX VariablePointer MAX-ACCESS read-create STATUS current DESCRIPTION "This column points to the action to be taken. It may, but is not limited to, point to a row in one of the following tables: spdCompoundActionTable - Allowing recursion spdSaPreconfiguredActionTable spdIkeActionTable spdIpsecActionTable It may also point to one of the scalar objects beneath Baer, et al. Expires April 20, 2005 [Page 45] Internet-Draft IPsec SPD configuration MIB October 2004 spdStaticActions. If this object is set to a pointer to a row in an unsupported (or unknown) table, an inconsistentValue error should be returned. If this object is set to point to a non-existent row in an otherwise supported table, an inconsistentName error should be returned." ::= { spdSubactionsEntry 2 } spdSubActLastChanged OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means." ::= { spdSubactionsEntry 3 } spdSubActStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent." DEFVAL { nonVolatile } ::= { spdSubactionsEntry 4 } spdSubActRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object indicates the conceptual status of this row. The value of this object has no effect on whether other objects in this conceptual row can be modified." ::= { spdSubactionsEntry 5 } -- -- Static Actions -- -- these are static actions which can be pointed to by the Baer, et al. Expires April 20, 2005 [Page 46] Internet-Draft IPsec SPD configuration MIB October 2004 -- spdRuleDefAction or the spdSubActSubActionName objects to -- drop, accept or reject packets. spdStaticActions OBJECT IDENTIFIER ::= { spdConfigObjects 14 } spdDropAction OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "This scalar indicates that a packet should be dropped WITHOUT action/packet logging. This object returns a value of 1 for IPsec policy implementations that support the drop static action." ::= { spdStaticActions 1 } spdDropActionLog OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "This scalar indicates that a packet should be dropped WITH action/packet logging. This object returns a value of 1 for IPsec policy implementations that support the drop static action with logging." ::= { spdStaticActions 2 } spdAcceptAction OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "This Scalar indicates that a packet should be accepted (pass-through) WITHOUT action/packet logging. This object returns a value of 1 for IPsec policy implementations that support the accept static action." ::= { spdStaticActions 3 } spdAcceptActionLog OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "This scalar indicates that a packet should be accepted (pass-through) WITH action/packet logging. This object returns a value of 1 for IPsec policy implementations that support the accept static action with logging." ::= { spdStaticActions 4 } Baer, et al. Expires April 20, 2005 [Page 47] Internet-Draft IPsec SPD configuration MIB October 2004 -- -- -- Notification objects information -- -- spdNotificationVariables OBJECT IDENTIFIER ::= { spdNotificationObjects 1 } spdNotifications OBJECT IDENTIFIER ::= { spdNotificationObjects 0 } spdActionExecuted OBJECT-TYPE SYNTAX VariablePointer MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Points to the action instance that was executed that resulted in the notification being sent." ::= { spdNotificationVariables 1 } spdIPInterfaceType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Contains the interface type for the interface that the packet which triggered the notification in question is passing through." ::= { spdNotificationVariables 2 } spdIPInterfaceAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Contains the interface address for the interface that the packet which triggered the notification in question is passing through." ::= { spdNotificationVariables 3 } spdIPSourceType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Contains the source address type of the packet which triggered the notification in question." Baer, et al. Expires April 20, 2005 [Page 48] Internet-Draft IPsec SPD configuration MIB October 2004 ::= { spdNotificationVariables 4 } spdIPSourceAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Contains the source address of the packet which triggered the notification in question." ::= { spdNotificationVariables 5 } spdIPDestinationType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Contains the destination address type of the packet which triggered the notification in question." ::= { spdNotificationVariables 6 } spdIPDestinationAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Contains the destination address of the packet which triggered the notification in question." ::= { spdNotificationVariables 7 } spdPacketDirection OBJECT-TYPE SYNTAX INTEGER { inbound(1), outbound(2) } MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Indicates if the packet whic triggered the action in questions was inbound our outbound." ::= { spdNotificationVariables 8 } spdPacketPart OBJECT-TYPE SYNTAX OCTET STRING MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "Is the front part of the packet that triggered this notification. The size is determined by the value of 'SpdIPPacketLogging' or the size of the packet, whichever is smaller." ::= { spdNotificationVariables 9 } Baer, et al. Expires April 20, 2005 [Page 49] Internet-Draft IPsec SPD configuration MIB October 2004 spdActionNotification NOTIFICATION-TYPE OBJECTS { spdActionExecuted, spdIPInterfaceType, spdIPInterfaceAddress, spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, spdIPDestinationAddress, spdPacketDirection } STATUS current DESCRIPTION "Notification that an action was executed by a rule. Only actions with logging enabled will result in this notification getting sent. The objects sent must include the spdActionExecuted object which will indicate which action was executed within the scope of the rule. Additionally the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress objects must be included to indicate the packet source and destination of the packet that triggered the action. Finally the spdIPInterfaceType, spdIPInterfaceAddress, and spdPacketDirection objects are included to indicate which interface the action was executed in association with and if the packet was inbound or outbond through the endpoint. Note that compound actions with multiple executed subactions may result in multiple notifications being sent from a single rule execution." ::= { spdNotifications 1 } spdPacketNotification NOTIFICATION-TYPE OBJECTS { spdActionExecuted, spdIPInterfaceType, spdIPInterfaceAddress, spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, spdIPDestinationAddress, spdPacketDirection, spdPacketPart } STATUS current DESCRIPTION "Notification that a packet passed through an SA. Only SA's created by actions with packet logging enabled will result in this notification getting sent. The objects sent must include the spdActionExecuted which will indicate which action was executed within the scope of the rule. Additionally, the spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, and spdIPDestinationAddress, objects must be included to indicate the packet source and destination of the packet Baer, et al. Expires April 20, 2005 [Page 50] Internet-Draft IPsec SPD configuration MIB October 2004 that triggered the action. The spdIPInterfaceType, spdIPInterfaceAddress, and spdPacketDirection objects are included to indicate which endpoint the packet was associated with. Finally, spdPacketPart is including for sending a variable sized part of the front of the packet depending on the value of SpdIPPacketLogging." ::= { spdNotifications 2 } -- -- -- Conformance information -- -- spdCompliances OBJECT IDENTIFIER ::= { spdConformanceObjects 1 } spdGroups OBJECT IDENTIFIER ::= { spdConformanceObjects 2 } -- -- Compliance statements -- -- spdRuleFilterCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for SNMP entities that include an IPsec MIB implementation with Endpoint, Rules, and filters support." MODULE -- This Module MANDATORY-GROUPS { spdEndpointGroup, spdGroupContentsGroup, spdRuleDefinitionGroup, spdIPHeaderFilterGroup, spdStaticFilterGroup, spdStaticActionGroup } GROUP spdIpsecSystemPolicyNameGroup DESCRIPTION "This group is mandatory for IPsec Policy implementations which support a system policy group name." GROUP spdCompoundFilterGroup DESCRIPTION "This group is mandatory for IPsec Policy Baer, et al. Expires April 20, 2005 [Page 51] Internet-Draft IPsec SPD configuration MIB October 2004 implementations which support compound filters." GROUP spdIPOffsetFilterGroup DESCRIPTION "This group is mandatory for IPsec Policy implementations which support IP Offset filters. In general, this SHOULD be supported by a compliant IPsec Policy implementation." GROUP spdTimeFilterGroup DESCRIPTION "This group is mandatory for IPsec Policy implementations which support time filters." GROUP spdIpsoHeaderFilterGroup DESCRIPTION "This group is mandatory for IPsec Policy implementations which support IPSO Header filters." GROUP spdCompoundActionGroup DESCRIPTION "This group is mandatory for IPsec Policy implementations which support compound actions." OBJECT spdEndGroupRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdEndGroupLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdGroupContComponentType SYNTAX INTEGER { rule(2) } DESCRIPTION "Support of the value group(1) is only required for implementations which support Policy Groups within Policy Groups." OBJECT spdGroupContRowStatus SYNTAX RowStatus { Baer, et al. Expires April 20, 2005 [Page 52] Internet-Draft IPsec SPD configuration MIB October 2004 active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdGroupContLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdRuleDefRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdRuleDefLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdCompFiltRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdCompFiltLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdSubFiltRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdSubFiltLastChanged MIN-ACCESS not-accessible DESCRIPTION Baer, et al. Expires April 20, 2005 [Page 53] Internet-Draft IPsec SPD configuration MIB October 2004 "This object not required for compliance." OBJECT spdIpHeadFiltIPVersion SYNTAX InetAddressType { ipv4(1), ipv6(2) } DESCRIPTION "Only the ipv4 and ipv6 values make sense for this object." OBJECT spdIpHeadFiltRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdIpHeadFiltLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdIpOffFiltRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdIpOffFiltLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdTimeFiltRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdTimeFiltLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." Baer, et al. Expires April 20, 2005 [Page 54] Internet-Draft IPsec SPD configuration MIB October 2004 OBJECT spdIpsoHeadFiltRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdIpsoHeadFiltLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdCompActRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdCompActLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." OBJECT spdSubActRowStatus SYNTAX RowStatus { active(1), createAndGo(4), destroy(6) } DESCRIPTION "Support of the values notInService(2), notReady(3), and createAndWait(5) is not required." OBJECT spdSubActLastChanged MIN-ACCESS not-accessible DESCRIPTION "This object not required for compliance." ::= { spdCompliances 1 } spdLoggingCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for SNMP entities that support sending notifications when actions are invoked." MODULE -- This Module Baer, et al. Expires April 20, 2005 [Page 55] Internet-Draft IPsec SPD configuration MIB October 2004 MANDATORY-GROUPS { spdActionLoggingObjectGroup, spdActionNotificationGroup } ::= { spdCompliances 2 } -- -- -- Compliance Groups Definitions -- -- -- Endpoint, Rule, Filter Compliance Groups -- spdEndpointGroup OBJECT-GROUP OBJECTS { spdEndGroupName, spdEndGroupLastChanged, spdEndGroupStorageType, spdEndGroupRowStatus } STATUS current DESCRIPTION "The IPsec Policy Endpoint Table Group." ::= { spdGroups 1 } spdGroupContentsGroup OBJECT-GROUP OBJECTS { spdGroupContComponentType, spdGroupContFilter, spdGroupContComponentName, spdGroupContLastChanged, spdGroupContStorageType, spdGroupContRowStatus } STATUS current DESCRIPTION "The IPsec Policy Group Contents Table Group." ::= { spdGroups 2 } spdIpsecSystemPolicyNameGroup OBJECT-GROUP OBJECTS { spdIncomingPolicyGroupName, spdOutgoingPolicyGroupName } STATUS current DESCRIPTION "The System Policy Group Name Group." ::= { spdGroups 3} spdRuleDefinitionGroup OBJECT-GROUP OBJECTS { Baer, et al. Expires April 20, 2005 [Page 56] Internet-Draft IPsec SPD configuration MIB October 2004 spdRuleDefDescription, spdRuleDefFilter, spdRuleDefFilterNegated, spdRuleDefAction, spdRuleDefAdminStatus, spdRuleDefLastChanged, spdRuleDefStorageType, spdRuleDefRowStatus } STATUS current DESCRIPTION "The IPsec Policy Rule Definition Table Group." ::= { spdGroups 4 } spdCompoundFilterGroup OBJECT-GROUP OBJECTS { spdCompFiltDescription, spdCompFiltLogicType, spdCompFiltLastChanged, spdCompFiltStorageType, spdCompFiltRowStatus, spdSubFiltSubfilter, spdSubFiltSubfilterIsNegated, spdSubFiltLastChanged, spdSubFiltStorageType, spdSubFiltRowStatus } STATUS current DESCRIPTION "The IPsec Policy Compound Filter Table and Filters in Compound Filters Table Group." ::= { spdGroups 5 } spdStaticFilterGroup OBJECT-GROUP OBJECTS { spdTrueFilter } STATUS current DESCRIPTION "The static filter group. Currently this is just a true filter." ::= { spdGroups 6 } spdIPHeaderFilterGroup OBJECT-GROUP OBJECTS { spdIpHeadFiltType, spdIpHeadFiltIPVersion, spdIpHeadFiltSrcAddressBegin, spdIpHeadFiltSrcAddressEnd, spdIpHeadFiltDstAddressBegin, spdIpHeadFiltDstAddressEnd, spdIpHeadFiltSrcLowPort, spdIpHeadFiltSrcHighPort, spdIpHeadFiltDstLowPort, spdIpHeadFiltDstHighPort, spdIpHeadFiltProtocol, spdIpHeadFiltIPv6FlowLabel, spdIpHeadFiltLastChanged, spdIpHeadFiltStorageType, spdIpHeadFiltRowStatus } STATUS current DESCRIPTION "The IPsec Policy IP Header Filter Table Group." ::= { spdGroups 7 } Baer, et al. Expires April 20, 2005 [Page 57] Internet-Draft IPsec SPD configuration MIB October 2004 spdIPOffsetFilterGroup OBJECT-GROUP OBJECTS { spdIpOffFiltOffset, spdIpOffFiltType, spdIpOffFiltValue, spdIpOffFiltLastChanged, spdIpOffFiltStorageType, spdIpOffFiltRowStatus } STATUS current DESCRIPTION "The IPsec Policy IP Offset Filter Table Group." ::= { spdGroups 8 } spdTimeFilterGroup OBJECT-GROUP OBJECTS { spdTimeFiltPeriodStart, spdTimeFiltPeriodEnd, spdTimeFiltMonthOfYearMask, spdTimeFiltDayOfMonthMask, spdTimeFiltDayOfWeekMask, spdTimeFiltTimeOfDayMaskStart, spdTimeFiltTimeOfDayMaskEnd, spdTimeFiltLastChanged, spdTimeFiltStorageType, spdTimeFiltRowStatus } STATUS current DESCRIPTION "The IPsec Policy Time Filter Table Group." ::= { spdGroups 9 } spdIpsoHeaderFilterGroup OBJECT-GROUP OBJECTS { spdIpsoHeadFiltType, spdIpsoHeadFiltClassification, spdIpsoHeadFiltProtectionAuth, spdIpsoHeadFiltLastChanged, spdIpsoHeadFiltStorageType, spdIpsoHeadFiltRowStatus } STATUS current DESCRIPTION "The IPsec Policy IPSO Header Filter Table Group." ::= { spdGroups 10 } -- -- action compliance groups -- spdStaticActionGroup OBJECT-GROUP OBJECTS { spdDropAction, spdAcceptAction, spdDropActionLog, spdAcceptActionLog } STATUS current DESCRIPTION "The IPsec Policy Static Actions Group." Baer, et al. Expires April 20, 2005 [Page 58] Internet-Draft IPsec SPD configuration MIB October 2004 ::= { spdGroups 11 } spdCompoundActionGroup OBJECT-GROUP OBJECTS { spdCompActExecutionStrategy, spdCompActLastChanged, spdCompActStorageType, spdCompActRowStatus, spdSubActSubActionName, spdSubActLastChanged, spdSubActStorageType, spdSubActRowStatus } STATUS current DESCRIPTION "The IPsec Policy Compound Action Table and Actions In Compound Action Table Group." ::= { spdGroups 12 } spdActionLoggingObjectGroup OBJECT-GROUP OBJECTS { spdActionExecuted, spdIPInterfaceType, spdIPInterfaceAddress, spdIPSourceType, spdIPSourceAddress, spdIPDestinationType, spdIPDestinationAddress, spdPacketDirection, spdPacketPart } STATUS current DESCRIPTION "Notification objects." ::= { spdGroups 13 } spdActionNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { spdActionNotification, spdPacketNotification } STATUS current DESCRIPTION "Notifications." ::= { spdGroups 14 } END Baer, et al. Expires April 20, 2005 [Page 59] Internet-Draft IPsec SPD configuration MIB October 2004 6. Security Considerations 6.1 Introduction This document defines a MIB module used to configure IPsec policy services. Since IPsec provides security services it is important that the IPsec configuration data be at least as protected as the IPsec provided security service. There are two main threats you need to thwart when configuring IPsec devices. 1. Malicious Configuration: only the official administrators should be allowed to configure a device. In other words, administrators' identities should be authenticated and their access rights checked before they are allowed to do device configuration. The support for SET operations to the IPSP MIB in a non-secure environment, without proper protection, can have a negative effect on the security of the network traffic affected by the IPSP MIB. 2. Disclosure of Configuration: Malicious parties should not be able to read configuration data while the data is in network transit. Any knowledge about a device's IPsec policy configuration could help an unfriendly party compromise that device and/or the network(s) it protects. It is thus important to control even GET access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPsec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module, is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them. Therefore, when configuring data in the IPSEC-SPD-MIB, you SHOULD use Baer, et al. Expires April 20, 2005 [Page 60] Internet-Draft IPsec SPD configuration MIB October 2004 SNMP version 3. The rest of this discussion assumes the use of SNMPv3. This is a real strength, because it allows administrators the ability to load new IPsec configuration on a device and keep the conversation private and authenticated under the protection of SNMPv3 before any IPsec protections are available. Once initial establishment of IPsec configuration on a device has been achieved, it would be possible to set up IPsec SAs to then also provide security and integrity services to the configuration conversation. This may seem redundant at first, but will be shown to have a use for added privacy protection below. 6.2 Protecting against in-authentic access The current SNMPv3 User Security Model provides for key based user authentication. Typically, keys are derived from passwords (but are not required to be), and the keys are then used in HMAC algorithms (currently MD5 and SHA-1 HMACs are defined) to authenticate all SNMP data. Each SNMP device keeps a (configured) list of users and keys. Under SNMPv3 user keys may be updated as often as an administrator cares to have users enter new passwords. But Perfect Forward Secrecy for user keys is not yet provided by standards track documents, although RFC2786 defines an experimental method of doing so. 6.3 Protecting against involuntary disclosure While sending IPsec configuration data to a PEP, there are a few critical parameters which MUST NOT be observed by third parties. These include IKE Pre-Shared Keys and possibly the private key of a public/private key pair for use in a PKI. Were either of those parameters to be known to a third party, they could then impersonate your device to other IKE peers. Aside from those critical parameters, policy administrators have an interest in not divulging any of their policy configuration. Any knowledge about a device's configuration could help an unfriendly party compromise that device. SNMPv3 offers privacy security services, but at the time this document was written, the only standardized encryption algorithm supported by SNMPv3 is the DES encryption algorithm. Support for other (stronger) cryptographic algorithms is in the works and may be done as you read this. Policy administrators SHOULD use a privacy security service to configure their IPsec policy which is at least as strong as the desired IPsec policy. E.G., it is unwise to configure IPsec parameters implementing 3DES algorithms while only protecting that conversation with single DES. 6.4 Bootstrapping your configuration Hopefully vendors will not ship new products with a default SNMPv3 user/password pair, but it is possible. Most SNMPv3 distributions Baer, et al. Expires April 20, 2005 [Page 61] Internet-Draft IPsec SPD configuration MIB October 2004 should hopefully require an out-of-band initialization over a trusted medium, such as a local console connection. 7. Acknowledgments Many other people contributed thoughts and ideas that influenced this MIB module. Some special thanks are in order the following people: Lindy Foster (Sparta, Inc.) John Gillis (ADC) Jamie Jason (Intel Corporation) Roger Hartmuller (Sparta, Inc.) David Partain (Ericsson) Lee Rafalow (IBM) Jon Saperia (JDS Consulting) Eric Vyncke (Cisco Systems) 8. References 8.1 Normative References [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002. [RFC3411] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks", STD 62, RFC 3411, December 2002. [RFC3412] Case, J., Harrington, D., Presuhn, R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3412, December 2002. [RFC3413] Levi, D., Meyer, P. and B. Stewart, "Simple Network Management Protocol (SNMP) Applications", STD 62, RFC 3413, December 2002. [RFC3414] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", STD 62, RFC 3414, December 2002. [RFC3415] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3415, December Baer, et al. Expires April 20, 2005 [Page 62] Internet-Draft IPsec SPD configuration MIB October 2004 2002. [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [RFC2580] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [RFC3585] Jason, J., Rafalow, L. and E. Vyncke, "IPsec Configuration Policy Information Model", RFC 3585, August 2003. 8.2 Informative References [RFCXXXX] Baer, M., Charlet, R., Hardaker, W., Story, R. and C. Wang, "IPsec Security Policy IPsec Action MIB", December 2002. [RFCYYYY] Baer, M., Charlet, R., Hardaker, W., Story, R. and C. Wang, "IPsec Security Policy IKE Action MIB", December 2002. [IPPMWP] Lortz, V. and L. Rafalow, "IPsec Policy Model White Paper", November 2000. Authors' Addresses Michael Baer Sparta, Inc. 7075 Samuel Morse Drive Columbia, MD 21046 US EMail: baerm@tislabs.com Ricky Charlet Self EMail: rcharlet@alumni.calpoly.edu Baer, et al. Expires April 20, 2005 [Page 63] Internet-Draft IPsec SPD configuration MIB October 2004 Wes Hardaker Sparta, Inc. P.O. Box 382 Davis, CA 95617 US Phone: +1 530 792 1913 EMail: hardaker@tislabs.com Robert Story Revelstone Software PO Box 1812 Tucker, GA 30085 US EMail: ipsp-mib@revelstone.com Cliff Wang SmartPipes, Inc. Suite 300, 565 Metro Place South Dublin, OH, OH 43017 US EMail: cliffwang2000@yahoo.com Baer, et al. Expires April 20, 2005 [Page 64] Internet-Draft IPsec SPD configuration MIB October 2004 Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright Statement Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society. Baer, et al. Expires April 20, 2005 [Page 65]