FEC-IPSEC-MIB Table View

This table contains the list of currently active IPSec security
associations.

ipsecSaEntry row .0.3.1

This object contains an IPSec security association.

Indexes

ipsecSaSecProto ipsecSaSpi

Column	Syntax	OID
ipsecSaIndex A unique index for this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.1
ipsecSaState The current state of the security association Possible values: alive(1), -- The SA is alive expired(2), -- The SA is expired negotiating(4),-- This SA is currently negotiated established(5) -- The SA is alive an…	Enumeration Enumerated Values: 2 expired 4 negotiating 5 established	.0.3.1.3
ipsecSaDir This object specifies whether the SA is used for inbound or outbound processing. Possible values: inbound(1), -- An inbound security association outbound(2) -- An outbound security association.	Enumeration Enumerated Values: 1 inbound 2 outbound	.0.3.1.5
ipsecSaMode This object specifies whether the SA is in tunnel or transport mode. Possible values: tunnel(1), -- A tunnel mode SA transport(2) -- A transport mode SA.	Enumeration Enumerated Values: 1 tunnel 2 transport	.0.3.1.6
ipsecSaSecProto This object specifies the security protocol applied by this SA. Possible values: esp(50), -- Encapsulating Security Payload ah(51), -- Authentication Header ipcomp(108) -- Internet Payload Compression Protocol.	Enumeration Enumerated Values: 50 esp 51 ah 108 ipcomp	.0.3.1.7
ipsecSaSpi The Security Parameters Index of this SA.		.0.3.1.17
ipsecSaAuthAlg The hash algorithm used, if any. Possible Values: none(2), -- No hash algorithm applied md5-96(4), -- The MD5 hash algorithm sha1-96(6) -- The Secure Hash Algorithm.	Enumeration Enumerated Values: 2 none 4 md5-96 6 sha1-96	.0.3.1.18
ipsecSaEncAlg The encryption algorithm used, if any. Possible Values: none(1), -- No encryption applied des-cbc(2), -- DES in CBC mode des3-cbc(3), -- Triple DES in CBC mode blowfish-cbc(4), -- Blowfish in CBC…	Enumeration Enumerated Values: 1 none 2 des-cbc 3 des3-cbc 4 blowfish-cbc 5 cast128-cbc 6 twofish-cbc 7 aes-cbc	.0.3.1.19
ipsecSaCompAlg The compression algorithm used, if any. Possible Values: none(1), -- No compression deflate(2) -- DEFLATE compression algorithm.	Enumeration Enumerated Values: 2 none 3 deflate	.0.3.1.20
ipsecSaAuthKeyLen The length in bytes of the key used for authentication, if any.	bytesInteger32 Type Constraints: range: -2147483648..2147483647	.0.3.1.21
ipsecSaEncKeyLen The length in bytes of the key used for encryption, if any.	bytesInteger32 Type Constraints: range: -2147483648..2147483647	.0.3.1.22
ipsecSaReplayErrors The number of replayed packets detected for this SA.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.33
ipsecSaRecvErrors The number of receive errors (replayed packets not counted) detected for this SA.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.34
ipsecSaDecryptErrors The number of decryption errors (ESP only) detected for this SA.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.35
ipsecSaBundle unique id of SA-bundle within this SA is used.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.39
ipsecSaBundleNesting place of SA within SA-Bundle.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.40
ipsecSaSpiSize The size of the SPI in bytes.	bytesInteger32 Type Constraints: range: -2147483648..2147483647	.0.3.1.45
ipsecSaEncKey	OctetString	.0.3.1.64
ipsecSaAuthKey	OctetString	.0.3.1.65
ipsecSaIkeMajVersion The IKE major version number.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.66
ipsecSaIkeMinVersion The IKE minor version number.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.3.1.67

This table contains the list of currently active IKE security
associations.

ikeSaEntry row .0.4.1

This object contains an IKE security association.

Indexes

ikeSaIndex

Column	Syntax	OID
ikeSaIndex A unique index for this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.1
ikeSaState This object specifies the state of the SA. Possible values: negotiating(1), -- the SA is still being negotiated established(2), -- the SA negotiation is finished waiting-for-remove(3), -- the SA is wait…	Enumerationr/w Enumerated Values: 1 negotiating 2 established 3 waiting-for-remove 7 delete	.0.4.1.3
ikeSaXchType The exchange mode used to create the SA. Possible values: base(1), -- IKE base mode mode id-protect(2), -- IKE identity protection -- (oakley main mode) authentication-only(3), -- Authentication …	Enumeration Enumerated Values: 1 base 2 id-protect 4 aggressive 256 any	.0.4.1.4
ikeSaAuthMethod The authenticatin method used when negotiating this SA. Possible values: pre-sh-key(1), -- Authentication using pre shared keys dss-sig(2), -- Authentication using DSS signatures rsa-sig(3), -- Authentication …	Enumeration Enumerated Values: 1 pre-sh-key 2 dss-sig 3 rsa-sig 4 rsa-enc 5 rsa-enc-rev	.0.4.1.5
ikeSaRole This object specifies by which side the SA negotiation was initiated. Possible values: initiator(1), -- this end initiated the SA negotiation responder(2) -- the remote end initiated the SA negotiation.	Enumeration Enumerated Values: 1 initiator 2 responder	.0.4.1.7
ikeSaLocalId The local ID used for authentication.	SNMPv2-TCDisplayString Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.4.1.8
ikeSaRemoteId The remote ID used for authentication.	SNMPv2-TCDisplayString Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.4.1.9
ikeSaLocalIp The local IP address used in the IKE communication.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.4.1.10
ikeSaRemoteIp The remote IP address used in the IKE communication.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.4.1.11
ikeSaCookieI The cookie of the initiator.	OctetString	.0.4.1.12
ikeSaCookieR The cookie of the responder.	OctetString	.0.4.1.13
ikeSaNumCerts The number of certificates received from the remote side when negotiating this SA.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.15
ikeSaNumNegotiations This object specifies the number of currently active negotiations for this SA.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.16
ikeSaBytes Number of bytes transmitted using this SA.	bytesInteger32 Type Constraints: range: -2147483648..2147483647	.0.4.1.17
ikeSaMajVersion The IKE major version number.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.18
ikeSaMinVersion The IKE minor version number.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.19
ikeSaPeerIndex The index of the peer for which this SA was created.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.20
ikeSaHeartbeatsEnabled This object specifies whether heartbeats are sent/expected over this SA possible values: send(1), -- send heartbeats expect(2), -- expect heartbeats both(3), -- send and expect heartbeats none(4) -- neither sen…	Enumeration Enumerated Values: 1 send 2 expect 3 both 4 none	.0.4.1.21
ikeSaHeartbeatsSent Number of Heartbeats sent over this SA.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.22
ikeSaHeartbeatsReceived Number of Heartbeats received over this SA.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.4.1.23
ikeSaCreated Time the SA was created.		.0.4.1.24
ikeSaLastUsed Time the SA was used last.		.0.4.1.25
ikeSaEncAlg The encryption algorithm used.	Enumeration Enumerated Values: 1 des 2 idea 3 blowfish 4 rc5 5 des3 6 cast128 7 aes 9 twofish	.0.4.1.26
ikeSaHashAlg The hash algorithm used.	Enumeration Enumerated Values: 1 md5 2 sha 3 tiger 4 ripemd160	.0.4.1.27
ikeSaPrfAlg The hash algorithm used for the pseudo random function.	Enumeration Enumerated Values: 1 md5 2 sha 3 tiger 4 ripemd160	.0.4.1.28
ikeSaExpires Time the SA will expire.		.0.4.1.29
ikeSaLocalPort Local port currently used for the SA.	Integer32 Constraints: range: 0-65535	.0.4.1.30
ikeSaRemotePort Remote port currently used for the SA.	Integer32 Constraints: range: 0-65535	.0.4.1.31
ikeSaXauthType This object displayes whether XAUTH is used or not after complete establishment of the SA. If XAUTH is used then the type of the extended authentication is displayed.	Enumeration Enumerated Values: 0 generic 1 radius-chap 2 otp 3 s-key 32768 none	.0.4.1.32
ikeSaXauthUser User name used for Extended Authentication.	SNMPv2-TCDisplayString Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.4.1.33

This table contains the list of IPSec peers.

ipsecPeerEntry row .0.5.1

This object contains the description of an IPSec peer.

Indexes

ipsecPeerTrafficList

Column	Syntax	OID
ipsecPeerIndex A unique index identifying this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.5.1.1
ipsecPeerDescription An optional description for this peer.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.5.1.3
ipsecPeerPeerIds The IDs of the peer which are accepted for authentication. Syntax: - X500 distinguished name: <obj-name=obj-value, obj-ID=obj-value, ...> - IPV4-Address: |123.456.789.012| with or without '|' - IPV4 Addres…	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.5.1.5
ipsecPeerLocalAddress The local address used for IPSec encrypted packets.	SNMPv2-SMIIpAddressr/w Type Constraints: range: 4	.0.5.1.8
ipsecPeerTrafficList This object specifies the first entry of possibly a chain of traffic entries from the ipsecTrafficTable which should be protected with IPSec using this peer.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.5.1.11
ipsecPeerDynamicAddress The IP-address of the peer. This object may contain either an IP address or a domain name.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.5.1.14
ipsecPeerVirtualInterface This object specifies if a virtual interface should be created for this peer. If set to enabled, all traffic routed towards this peer will be protected. The traffic list for this peer is ignored then. The index of the …	Enumerationr/w Enumerated Values: 1 disabled 2 enabled	.0.5.1.15
ipsecPeerStartMode This object specifies the events which make the IPSec peer go up. Possible values: on-demand(1), -- packet triggered start, -- fall back to dormant if unused always-up(2) -- always set up and keep up.	Enumerationr/w Enumerated Values: 1 on-demand 2 always-up	.0.5.1.16
ipsecPeerPreSharedKey The pre-shared-key used with this peer, if pre-shared-keys are used for authentication. This field serves only as an input field and its contents are replaced with a single asterisk immediately after it is set.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.5.1.21
ipsecPeerIsdnCB Switch for turning ISDN call back feature on and off specifically for peer. Default value is disabled.	Enumerationr/w Enumerated Values: 1 enabled 2 disabled 3 passive 4 active	.0.5.1.45
ipsecPeerPriority Defines the matching priority.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.5.1.47
ipsecPeerIkeProfile When ipsecPeerIkeVersion is set to ikev1 this is an index from the ikeProfileTable containing a special phase 1 profile to use for this peer. When ipsecPeerIkeVersion is set to ikev2 this is an index from the ikev2Pr…	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.5.1.48
ipsecPeerIpsecProfile The index from the ipsecProfileTable containing a special phase 2 profile to use for this peer.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.5.1.49
ipsecPeerAdminStatus Peer administrative state.	Enumerationr/w Enumerated Values: 1 up 2 down 4 dialup 5 callback 15 delete	.0.5.1.50
ipsecPeerPreSharedKeyData Field used for storing the pre-shared-key permanently.	OctetString	.0.5.1.63
ipsecPeerIsdnCBMode Define callback mode. The following modes are defined: compat(1) -- compatibility to old callback auto(2) -- automatically detect best method auto-d(3) -- automatically detect best D channel method d(4) --…	Enumerationr/w Enumerated Values: 1 compat 2 auto 3 auto-d 4 d 5 db 6 b	.0.5.1.66
ipsecPeerIsdnCBDChanMode Define callback D channel mode. The following modes are defined: llc(1) -- code token into LLC information element only subaddr(2) -- code token into SUBADDR information element only llc-and-subad…	Enumerationr/w Enumerated Values: 1 llc 2 subaddr 3 llc-and-subaddr 4 llc-subaddr 5 subaddr-llc	.0.5.1.67
ipsecPeerType The type of the peer. Dynamic peer entries are duplicated whenever an incoming IKE request matches the ID and/or address information of the remote side. Note: - For traffic list peers the duplication also includes th…	Enumerationr/w Enumerated Values: 1 fixed 2 dynamic-client	.0.5.1.73
ipsecPeerDynAddrPoolId Identifier of Dynamic Address Pool if IP address is assigned via IKE Configuration Method. A value of -1 means that no Pool is assigned.	Integer32r/w Constraints: range: -1-65535	.0.5.1.78
ipsecPeerDynAddrLocalIp The local IP address used in the IKE communication when remote IP address is taken from IP address pool.	SNMPv2-SMIIpAddressr/w Type Constraints: range: 4	.0.5.1.79
ipsecPeerXauthProfile The index from the xauthProfileTable containing a special XAUTH profile to use for this peer. A value of 0 means that no XAUTH profile is assigned.	Unsigned32r/w Constraints: range: 0-4294967295	.0.5.1.80
ipsecPeerDynAddrRole Determines if IKE Config Mode is used and which role is performed: none(1), -- no IP address assignemt via IKE Config Mode client(2) -- get IP address via IKE Config Mode from remote server(3) -- assign IP address via …	Enumerationr/w Enumerated Values: 1 none 2 client 3 server	.0.5.1.81
ipsecPeerIkeVersion Indicates the major version of IKE protocol to use. If set to ikev1 the value of ipsecPeerIkeProfile is used as index into ikeProfileTable. If set to ikev2 the value of ipsecPeerIkeProfile is used as index into ikev2P…	Enumerationr/w Enumerated Values: 1 ikev1 2 ikev2	.0.5.1.82
ipsecPeerLocalId The local ID used for authentication with this profile. Syntax: - X500 distinguished name: <obj-name=obj-value, obj-ID=obj-value, ...> - IPV4-Address: |123.456.789.012| with or without '|' - Key-ID: arbitr…	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.5.1.83
ipsecPeerAuthMethod This object specifies the authentication method used by default. If the ipsecPeerAuthMethod field of an ipsecPeerEntry and the ikePropAuthMethod field of the ikeProposalTableEntry used are set to 'default', this value …	Enumerationr/w Enumerated Values: 1 pre-sh-key 2 dss-sig 3 rsa-sig	.0.5.1.84
ipsecPeerCert The index of the certificate used for authentication in the certTable. Ignored for AuthMethod == pre_shared_key. (only for IKEv2).	Integer32r/w Constraints: range: 0-32767	.0.5.1.85
ipsecPeerCaCerts Receives a comma separated list with indices (0..32767) of special certificate authority certificates accepted for this profile. (only for IKEv2).	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.5.1.86
ipsecPeerDynAddrMode When IP address assignment via IKE Config Mode is configured (ipsecPeerDynAddrRole != none) this object specifies the used mode: pull(1), -- the client will request IP address and the gateway will answer the reque…	Enumerationr/w Enumerated Values: 1 pull 2 push	.0.5.1.87
ipsecPeerMobike This object indicates whether the peer supports MOBIKE or not. Only when both sides of a VPN connection support MOBIKE an IP address change is possible. Possible values: enabled(1), -- Peer supports MOBIKE and …	Enumerationr/w Enumerated Values: 1 enabled 2 disabled	.0.5.1.88
ipsecPeerPublicIfIndex The index value which uniquely identifies the physical interface that should be used for all ipsec traffic as initiator. When multiple eqivalent routes to the given peer are available this is used as additional paramete…	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.5.1.90
ipsecPeerPublicIfIndexMode This object defines the mode used in conjunction with ipsecPeerPublicIfIndex. force(1), -- the given interface is used, even if a route with lower metric is available. preferred(2) -- the given interface is used, …	Enumerationr/w Enumerated Values: 1 force 2 preferred	.0.5.1.91

This table contains the list of IKE proposals. The
entries may be concatenated on a logical or basis
using the NextChoice field to choices of multiple
proposals.

ikeProposalEntry row .0.6.1

This object contains an IKE proposal, i.e. the
encryption algorithm and the hash algorithm used to
protect traffic sent over an IKE SA.

Indexes

ikePropEncAlg

Column	Syntax	OID
ikePropIndex A unique index identifying this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.6.1.1
ikePropNextChoice This object specifies the index of the next proposal of a choice of proposals. If this object is 0, this marks the end of a proposal chain.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.6.1.2
ikePropDescription An optional textual description of the proposal chain beginning at this entry.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.6.1.3
ikePropEncAlg This object specifies the encryption algorithm used to protect traffic sent over an IKE SA. Possible values: none(1), -- No encryption applied des-cbc(2), -- DES in CBC mode des3-cbc(3), -- Triple DE…	Enumerationr/w Enumerated Values: 1 none 2 des-cbc 3 des3-cbc 4 blowfish-cbc 5 cast128-cbc 6 twofish-cbc 7 aes-cbc 31 rijndael-cbc	.0.6.1.4
ikePropHashAlg This object specifies the hash algorithm used to protect traffic sent over an IKE SA. Possible values: delete(1), -- Delete this entry none(2), -- No hash algorithm md5(3), -- The MD5 hash algorithm sha1(4), --…	Enumerationr/w Enumerated Values: 1 delete 2 none 3 md5 4 sha1 5 ripemd160 6 tiger192	.0.6.1.5
ikePropGroup Index of the IKE group used with this proposal. It may be overridden by a valid IKE group index of an IPSec peer or in ipsecGlobDefaultIkeGroup. Possible values: 0 (use default setting in ipsecPeerIkeGroup or…	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.6.1.7
ikePropAuthMethod This object specifies the authentication method used with this proposal. It may be overridden by the setting in the ipsecPeerEntry table. If set to 'default' the value in ipsecGlobDefaultAuthMethod is used. Possible …	Enumerationr/w Enumerated Values: 1 pre-sh-key 2 dss-sig 3 rsa-sig 4 rsa-enc 33 default	.0.6.1.8
ikePropEncKeySize This object specifies the encryption key size used with this proposal. The limits for the individual algorithms can be seen in the ipsecAlgorithmTable. If a length outside the limits for the specified algorithm is spec…	bitsInteger32r/w Constraints: range: 0-2048	.0.6.1.9
ikePropEncKeySizeMin This object specifies the maximum encryption key size accepted with this proposal. The limits for the individual algorithms can be seen in the ipsecAlgorithmTable. If a length outside the limits for the specified algo…	bitsInteger32r/w Constraints: range: 0-2048	.0.6.1.10
ikePropEncKeySizeMax This object specifies the maximum encryption key size accepted with this proposal. The limits for the individual algorithms can be seen in the ipsecAlgorithmTable. If a length outside the limits for the specified algo…	bitsInteger32r/w Constraints: range: 0-2048	.0.6.1.11

This table contains lists of Traffic and the actions
which should be applied to it, together with the
necessary parameters.

ipsecTrafficEntry row .0.7.1

This object contains a description of a type of IP
traffic and the action which should be applied to it
together with the necessary parameters.

Indexes

ipsecTrProto

Column	Syntax	OID
ipsecTrIndex A unique index identifying this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.7.1.1
ipsecTrNextIndex This object specifies the index of the next traffic entry in hierarchy.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.7.1.2
ipsecTrDescription An optional human readable description for this traffic entry.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.7.1.3
ipsecTrLocalAddress The source IP-address of this traffic entry. It maybe either a single address, a network address (in combination with ipsecTrSrcMask), or the first address of an address range (in combination with ipsecTrLocalRange).	SNMPv2-SMIIpAddressr/w Type Constraints: range: 4	.0.7.1.4
ipsecTrLocalMaskLen The length of the network mask for a source network.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.7.1.5
ipsecTrLocalRange The last address of a source address range. If this field is nonzero, the ipsecTrLocalMaskLen field is ignored and the source is considered as a range of addresses beginning with ipsecTrLocalAddress and ending with ipse…	SNMPv2-SMIIpAddressr/w Type Constraints: range: 4	.0.7.1.6
ipsecTrRemoteAddress The destination IP-address of this traffic entry. It maybe either a single address, a network address (in combination with ipsecTrDstMask), or the first address of an address range (in combination with ipsecTrRemoteRang…	SNMPv2-SMIIpAddressr/w Type Constraints: range: 4	.0.7.1.7
ipsecTrRemoteMaskLen The length of the network mask for a destination network.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.7.1.8
ipsecTrRemoteRange The last address of a destination address range. If this field is nonzero, the ipsecTrRemoteMaskLen field is ignored and the source is considered as a range of addresses beginning with ipsecTrRemoteAddress and ending wi…	SNMPv2-SMIIpAddressr/w Type Constraints: range: 4	.0.7.1.9
ipsecTrProto The transport protocol defined for this entry.	Enumerationr/w Enumerated Values: 1 icmp 2 igmp 3 ggp 4 ipip 5 st 6 tcp 7 cbt 8 egp 9 igp 10 bbn 11 nvp 12 pup 13 argus 14 emcon 15 xnet 16 chaos 17 udp 18 mux 19 dcn 20 hmp 21 prm 22 xns 23 trunk1 24 trunk2 25 leaf1 26 leaf2 27 rdp 28 irtp 29 isotp4 30 netblt 31 mfe 32 merit 33 sep 34 pc3 35 idpr 36 xtp 37 ddp 38 idprc 39 tp 40 il 41 ipv6 42 sdrp 43 ipv6route 44 ipv6frag 45 idrp 46 rsvp 47 gre 48 mhrp 49 bna 50 esp 51 ah 52 inlsp 53 swipe 54 narp 55 mobile 56 tlsp 57 skip 58 ipv6icmp 59 ipv6nonxt 60 ipv6opts 61 ipproto-61 62 cftp 63 local 64 sat 65 kryptolan 66 rvd 67 ippc 68 distfs 69 satmon 70 visa 71 ipcv 72 cpnx 73 cphb 74 wsn 75 pvp 76 brsatmon 77 sunnd 78 wbmon 79 wbexpak 80 isoip 81 vmtp 82 securevmtp 83 vines 84 ttp 85 nsfnet 86 dgp 87 tcf 88 eigrp 89 ospfigp 90 sprite 91 larp 92 mtp 93 ax25 94 ipwip 95 micp 96 scc 97 etherip 98 encap 99 encrypt 100 gmtp 101 ifmp 102 pnni 103 pim 104 aris 105 scps 106 qnx 107 an 108 ippcp 109 snp 110 compaq 111 ipxip 112 vrrp 113 pgm 114 hop0 115 l2tp 116 ipproto-116 117 ipproto-117 118 ipproto-118 119 ipproto-119 120 ipproto-120 121 ipproto-121 122 ipproto-122 123 ipproto-123 124 ipproto-124 125 ipproto-125 126 ipproto-126 127 ipproto-127 128 ipproto-128 129 ipproto-129 130 ipproto-130 131 ipproto-131 132 ipproto-132 133 ipproto-133 134 ipproto-134 135 ipproto-135 136 ipproto-136 137 ipproto-137 138 ipproto-138 139 ipproto-139 140 ipproto-140 141 ipproto-141 142 ipproto-142 143 ipproto-143 144 ipproto-144 145 ipproto-145 146 ipproto-146 147 ipproto-147 148 ipproto-148 149 ipproto-149 150 ipproto-150 151 ipproto-151 152 ipproto-152 153 ipproto-153 154 ipproto-154 155 ipproto-155 156 ipproto-156 157 ipproto-157 158 ipproto-158 159 ipproto-159 160 ipproto-160 161 ipproto-161 162 ipproto-162 163 ipproto-163 164 ipproto-164 165 ipproto-165 166 ipproto-166 167 ipproto-167 168 ipproto-168 169 ipproto-169 170 ipproto-170 171 ipproto-171 172 ipproto-172 173 ipproto-173 174 ipproto-174 175 ipproto-175 176 ipproto-176 177 ipproto-177 178 ipproto-178 179 ipproto-179 180 ipproto-180 181 ipproto-181 182 ipproto-182 183 ipproto-183 184 ipproto-184 185 ipproto-185 186 ipproto-186 187 ipproto-187 188 ipproto-188 189 ipproto-189 190 ipproto-190 191 ipproto-191 192 ipproto-192 193 ipproto-193 194 ipproto-194 195 ipproto-195 196 ipproto-196 197 ipproto-197 198 ipproto-198 199 ipproto-199 200 ipproto-200 201 ipproto-201 202 ipproto-202 203 ipproto-203 204 ipproto-204 205 ipproto-205 206 ipproto-206 207 ipproto-207 208 ipproto-208 209 ipproto-209 210 ipproto-210 211 ipproto-211 212 ipproto-212 213 ipproto-213 214 ipproto-214 215 ipproto-215 216 ipproto-216 217 ipproto-217 218 ipproto-218 219 ipproto-219 220 ipproto-220 221 ipproto-221 222 ipproto-222 223 ipproto-223 224 ipproto-224 225 ipproto-225 226 ipproto-226 227 ipproto-227 228 ipproto-228 229 ipproto-229 230 ipproto-230 231 ipproto-231 232 ipproto-232 233 ipproto-233 234 ipproto-234 235 ipproto-235 236 ipproto-236 237 ipproto-237 238 ipproto-238 239 ipproto-239 240 ipproto-240 241 ipproto-241 242 ipproto-242 243 ipproto-243 244 ipproto-244 245 ipproto-245 246 ipproto-246 247 ipproto-247 248 ipproto-248 249 ipproto-249 250 ipproto-250 251 ipproto-251 252 ipproto-252 253 ipproto-253 254 ipproto-254 255 dont-verify	.0.7.1.10
ipsecTrLocalPort The source port defined for this traffic entry.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.7.1.11
ipsecTrRemotePort The destination port defined for this traffic entry.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.7.1.12
ipsecTrAction The action to be applied to traffic matching this entry. Possible values: delete(1), -- Delete this entry always-plain(2), -- Forward the packets without -- protection even if there is a -- matc…	Enumerationr/w Enumerated Values: 1 delete 2 always-plain 3 pass 4 protect 5 drop	.0.7.1.13
ipsecTrProposal This object specifies an index in the ipsecProposalTable. This may be the first proposal of possibly a choice of multiple, optionally nested proposals which is to be offered with IKE (automatic keying) or a manual propo…	Integer32 Type Constraints: range: -2147483648..2147483647	.0.7.1.14
ipsecTrForceTunnelMode This object specifies the strategy when transport mode is used. By default, the system always uses transport mode, if possible. If this variable is set to true, always tunnel mode will be used for this traffic entry, ev…	Enumeration Enumerated Values: 1 true 2 false	.0.7.1.15
ipsecTrLifeTime This object specifies an index in the ipsecLifeTimeTable. This lifetime overwrites the lifetimes specified for all proposals referenced by this traffic entry. It may itself be overwritten by an explicit lifetime specifi…	Integer32 Type Constraints: range: -2147483648..2147483647	.0.7.1.16
ipsecTrGranularity This object specifies the granularity with which SA's must be created for this kind of traffic. Possible values: default(1), -- use the setting from the ipsecPeerTable coarse(2), -- Create only one SA for each Tra…	Enumeration Enumerated Values: 1 default 2 coarse 3 ip 4 proto 5 port	.0.7.1.17
ipsecTrKeepAlive This object specifies whether SA's created for this kind of traffic should be rekeyed on expiration of soft lifetimes even if there has not been sent any traffic over them. Possible values: true(1), -- rekey SA's ev…	Enumeration Enumerated Values: 1 true 2 false 3 default	.0.7.1.18
ipsecTrInterface This object specifies the interface for which the traffic entry should be valid (pass, drop and protect entries). If this object is set to -1, there is no interface restriction.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.7.1.19
ipsecTrDirection This object specifies the direction for which this traffic entry should match. It only applies for pass and drop entries, for protect entries it is meaningless. Possible values: bidirectional(1), -- matches packets…	Enumerationr/w Enumerated Values: 1 bidirectional 2 inbound 3 outbound	.0.7.1.20
ipsecTrLocalAddressType The type of the local address specification. This may be either a statically configured address or a dynamic address which is taken from some state information.	Enumerationr/w Enumerated Values: 1 fixed 2 ph1	.0.7.1.21
ipsecTrRemoteAddressType The type of the remote address specification. This may be either a statically configured address or a dynamic address which is taken from some state information.	Enumerationr/w Enumerated Values: 1 fixed 2 ph1 3 dhcp	.0.7.1.22
ipsecTrProfile The index from the ipsecProfileTable containing a special phase 2 profile to use for this traffic entry.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.7.1.23
ipsecTrCreator This object shows the creator of the traffic entry.	Enumeration Enumerated Values: 1 config 2 radius-preset 3 radius 4 ike	.0.7.1.36

This table contains the list of IPSec proposals known to the
system. 
The combinations of algorithms allowed are
constructed from any combinations of algorithms
enabled in an entry, in the order of the preferences
specified.

ipsecProposalEntry row .0.8.1

This object contains an IPSec proposal, i.e. a
proposed set of security parameters applied to
traffic sent over an IPSec security association.

Indexes

ipsecPropProto

Column	Syntax	OID
ipsecPropIndex A unique index for this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.8.1.1
ipsecPropNext The index of the next Proposal in the actual chain.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.8.1.2
ipsecPropDescription An optional human readable description for this proposal.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.8.1.4
ipsecPropProto The security protocol to apply. Possible values: esp(1), -- Encapsulating Security Payload ah(2), -- Authentication Header esp-ah(3), -- ESP and AH delete(8) -- delete this entry.	Enumerationr/w Enumerated Values: 1 esp 2 ah 3 esp-ah 8 delete	.0.8.1.6
ipsecPropIpcomp This object specifies the use of IPComP in the proposal. Possible values: enabled(1), -- Enable IPComP disabled(2), -- Disable IPComP force(3) -- Force use of IPComP.	Enumerationr/w Enumerated Values: 1 enabled 2 disabled 3 force	.0.8.1.20
ipsecPropEspAes This object specifies the use of the AES encryption algorithm in the proposal. Possible values: 0, -- disables AES 1..7 -- enables AES and specifies its priority among the encryption algorithms.	Integer32r/w Constraints: range: 0-7	.0.8.1.40
ipsecPropEspTwofish This object specifies the use of the Twofish encryption algorithm in the proposal. Possible values: 0, -- disables Twofish 1..7 -- enables Twofish and specifies its priority among the encryption algor…	Integer32r/w Constraints: range: 0-7	.0.8.1.41
ipsecPropEspBlowfish This object specifies the use of the Blowfish encryption algorithm in the proposal. Possible values: 0, -- disables Blowfish 1..7 -- enables Blowfish and specifies its priority among the encryption al…	Integer32r/w Constraints: range: 0-7	.0.8.1.42
ipsecPropEspCast This object specifies the use of the Cast encryption algorithm in the proposal. Possible values: 0, -- disables Cast 1..7 -- enables Cast and specifies its priority among the encryption algorithms.	Integer32r/w Constraints: range: 0-7	.0.8.1.43
ipsecPropEspDes3 This object specifies the use of the DES3 encryption algorithm in the proposal. Possible values: 0, -- disables DES3 1..7 -- enables DES3 and specifies its priority among the encryption algorithms.	Integer32r/w Constraints: range: 0-7	.0.8.1.44
ipsecPropEspDes This object specifies the use of the DES encryption algorithm in the proposal. Possible values: 0, -- disables DES 1..7 -- enables DES and specifies its priority among the encryption algorithms.	Integer32r/w Constraints: range: 0-7	.0.8.1.45
ipsecPropEspNull This object specifies the use of the DES encryption algorithm in the proposal. Possible values: 0, -- disables DES 1..7 -- enables DES and specifies its priority among the encryption algorithms.	Integer32r/w Constraints: range: 0-7	.0.8.1.46
ipsecPropEspRijndael This object specifies the use of the Rijndael encryption algorithm in the proposal. The use of this object is deprecated since rijndael has been accepted as the algorithm for AES. Its value is transferred to ipsecPropEs…	Integer32r/w Constraints: range: -1-7	.0.8.1.49
ipsecPropEspMd5 This object specifies the use of the MD5 authentication algorithm for ESP in the proposal. Possible values: 0, -- disables MD5 1..3 -- enables MD5 and specifies its priority among the authentication …	Integer32r/w Constraints: range: 0-3	.0.8.1.50
ipsecPropEspSha1 This object specifies the use of the Sha1 authentication algorithm for ESP in the proposal. Possible values: 0, -- disables SHA-1 1..3 -- enables SHA-1 and specifies its priority among the authentica…	Integer32r/w Constraints: range: 0-3	.0.8.1.51
ipsecPropEspNoMac This object specifies whether ESP without authentication is allowed in the proposal. Possible values: 0, -- disables ESP 1..3 -- enables ESP without authentication and specifies its priority among the…	Integer32r/w Constraints: range: 0-3	.0.8.1.52
ipsecPropAhMd5 This object specifies the use of the MD5 authentication algorithm for AH in the proposal. Possible values: 0, -- disables MD5 1..2 -- enables MD5 and specifies its priority among the authentication a…	Integer32r/w Constraints: range: 0-2	.0.8.1.60
ipsecPropAhSha1 This object specifies the use of the Sha1 authentication algorithm for AH in the proposal. Possible values: 0, -- disables SHA-1 1..2 -- enables SHA-1 and specifies its priority among the authenticat…	Integer32r/w Constraints: range: 0-2	.0.8.1.61
ipsecPropIpcompDeflate This object specifies the use of the DEFLATE compression algorithm in the proposal. Possible values: 0, -- disables DEFLATE 1..1 -- enables DEFLATE and specifies its priority among the compression alg…	Integer32r/w Constraints: range: 0-1	.0.8.1.70
ipsecPropAesKeySize This object specifies the key size in bits for the AES algorithm, if enabled. Possible Values: aes128(128), -- use 128 bit AES aes192(192), -- use 192 bit AES aes256(256) -- use 256 bit AES.	bitsEnumerationr/w Enumerated Values: 128 aes128 192 aes192 256 aes256	.0.8.1.80
ipsecPropAesKeySizeMin This object specifies the minimum accepted key size in bits for the AES algorithm, if enabled. Possible Values: aes128(128), -- use 128 bit AES aes192(192), -- use 192 bit AES aes256(256) -- use 256 bit AES.	bitsEnumerationr/w Enumerated Values: 128 aes128 192 aes192 256 aes256	.0.8.1.81
ipsecPropAesKeySizeMax This object specifies the maximum accepted key size in bits for the AES algorithm, if enabled. Possible Values: aes128(128), -- use 128 bit AES aes192(192), -- use 192 bit AES aes256(256) -- use 256 bit AES.	bitsEnumerationr/w Enumerated Values: 128 aes128 192 aes192 256 aes256	.0.8.1.82
ipsecPropBlowfishKeySize This object specifies the key size in bits for the Blowfish algorithm, if enabled. Note: the key size must be a multiple of 8 bits. If not, it will be rounded up to the next 8 bit boundary.	bitsInteger32r/w Constraints: range: 40-448	.0.8.1.83
ipsecPropBlowfishKeySizeMin This object specifies the minimum accepted key size in bits for the Blowfish algorithm, if enabled.	bitsInteger32r/w Constraints: range: 40-448	.0.8.1.84
ipsecPropBlowfishKeySizeMax This object specifies the maximum accepted key size in bits for the Blowfish algorithm, if enabled.	bitsInteger32r/w Constraints: range: 40-448	.0.8.1.85
ipsecPropTwofishKeySize This object specifies the key size in bits for the Twofish algorithm, if enabled. Possible Values: twofish128(128), -- use 128 bit Twofish twofish192(192), -- use 192 bit Twofish twofish256(256) -- use 256 bi…	bitsEnumerationr/w Enumerated Values: 128 twofish128 192 twofish192 256 twofish256	.0.8.1.86
ipsecPropTwofishKeySizeMin This object specifies the minimum accepted key size in bits for the Twofish algorithm, if enabled. Possible Values: twofish128(128), -- use 128 bit Twofish twofish192(192), -- use 192 bit Twofish twofish256(25…	bitsEnumerationr/w Enumerated Values: 128 twofish128 192 twofish192 256 twofish256	.0.8.1.87
ipsecPropTwofishKeySizeMax This object specifies the maximum accepted key size in bits for the AES algorithm, if enabled. Possible Values: twofish128(128), -- use 128 bit Twofish twofish192(192), -- use 192 bit Twofish twofish256(256) …	bitsEnumerationr/w Enumerated Values: 128 twofish128 192 twofish192 256 twofish256	.0.8.1.88

This table contains the list of defined lifetimes for IPsec 
and IKE SAs.

ipsecLifeTimeEntry row .0.9.1

This object contains a lifetime, i.e. the soft and hard
expiry limits for IPsec and IKE SA's.
The usage of this table is deprecated, use the ikePrfLifeXxx
and ipsecPrfLifeXxx variables in the ikeProfileTable
and ipsecP…

Indexes

ipsecLifeType

Column	Syntax	OID
ipsecLifeIndex A unique index identifying this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.9.1.1
ipsecLifeType This object specifies the type of a lifetime entry.	Enumeration Enumerated Values: 1 delete 2 generic	.0.9.1.2
ipsecLifeHardKb The maximum amount of data (in KB) which may be protected by an SA before it is deleted.	kilo bytesInteger32 Type Constraints: range: -2147483648..2147483647	.0.9.1.5
ipsecLifeHardSec The maximum time (in seconds) after which an SA will be refreshed,.	secondsInteger32 Type Constraints: range: -2147483648..2147483647	.0.9.1.6
ipsecLifePolicy This object specifies the way the lifetime information is applied. Possible values: loose(1), -- accept and use anything proposed strict(2), -- accept and use only what is configured notify(3) -- accept anything, if…	Enumeration Enumerated Values: 1 loose 2 strict 3 notify	.0.9.1.7
ipsecLifeSoftPercent The percentage of the hard lifetimes (traffic and time based) after which rekeying is started.	Integer32 Constraints: range: 50-100	.0.9.1.8

This table contains dial entries specifying all parameters
needed for ISDN triggered call back.

ipsecDialEntry row .0.12.1

This object contains a dial entry used for mapping ISDN
numbers to peers for ISDN call back feature.

Indexes

ipsecDialIfIndex

Column	Syntax	OID
ipsecDialIfIndex Index that maps to a peer in a unique way.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.12.1.1
ipsecDialDirection Calling direction for which entry applies.	Enumerationr/w Enumerated Values: 1 incoming 2 outgoing 3 both 4 delete	.0.12.1.2
ipsecDialNumber Party number of remote peer. Used for matching calling party number on incoming calls and for called party number on outgoing calls.	OctetStringr/w Constraints: range: 0-63	.0.12.1.3
ipsecDialSubAddress Subaddress of remote peer. Used for matching calling party subaddress on incoming calls and for called party subaddress on outgoing calls.	OctetStringr/w	.0.12.1.4
ipsecDialTypeOfSubAddr Type of subaddress of remote peer. Used for matching calling party subaddress on incoming calls and for called party subaddress on outgoing calls.	Enumerationr/w Enumerated Values: 1 nsap 2 user-specified 3 reserved	.0.12.1.5
ipsecDialLocalNumber Local Party number. Used for matching called party number on incoming calls and for calling party number on outgoing calls. Special value '*' is treated as wildcard, i.e. calls with any called party number will be accep…	OctetStringr/w Constraints: range: 0-63	.0.12.1.6
ipsecDialLocalSubAddress Local subaddress. Used for matching called party subaddress on incoming calls and for calling party subaddress on outgoing calls. Special value '*' is treated as wildcard, i.e. calls with any called party subaddress (of…	OctetStringr/w	.0.12.1.7
ipsecDialTypeOfLocalSubAddr Type of local subaddress. Used for matching called party subaddress on incoming calls and for calling party subaddress on outgoing calls. Subaddress type is only checked as long as subaddress is not '*'. Default value i…	Enumerationr/w Enumerated Values: 1 nsap 2 user-specified 3 reserved	.0.12.1.8
ipsecDialAdminStatus Administrative status for dial entry. This object allows for temporarily disabling ipsecDial entries without the need to actually deletion them. This is achieved by assigning value inactive. Default value is active.	Enumerationr/w Enumerated Values: 1 active 2 inactive	.0.12.1.9
ipsecDialOperStatus Operational status for dial entry. This object indicates current status ipsecDial entry is in. Beside values defined for ipsecDialAdminStatus, status blocked-for-outgoing is defined, which is used in case triggering cal…	Enumeration Enumerated Values: 1 active 2 inactive 3 blocked-for-outgoing	.0.12.1.10

This table contains the list of IKE (Phase 1) profiles.

ikeProfileEntry row .0.14.1

This object contains an IPSec phase 1 profile.

Indexes

ikePrfProposal

Column	Syntax	OID
ikePrfIndex A unique index identifying this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.14.1.1
ikePrfDescription An optional description for this profile.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.14.1.2
ikePrfAuthMethod This object specifies the authentication method used for this profile. Possible values: pre-sh-key(1), -- Authentication using pre shared keys dss-sig(2), -- Authentication using DSS signatures rsa-sig(3), -- A…	Enumerationr/w Enumerated Values: 1 pre-sh-key 2 dss-sig 3 rsa-sig 4 rsa-enc 14 default 15 delete	.0.14.1.3
ikePrfMode This object specifies the exchange mode used for IKE SA negotiation. Possible values: id-protect(1), -- Use identity protection (main) mode aggressive(2), -- Use aggressive mode default(3), -- Use default s…	Enumerationr/w Enumerated Values: 1 id-protect 2 aggressive 3 default 4 id-protect-only 5 aggressive-only	.0.14.1.4
ikePrfProposal The index of the first IKE proposal which may be used for IKE SA negotiation with this profile.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.14.1.5
ikePrfGroup This object specifies the IKE group to use with this profile. Possible values: 1: a 768-bit MODP group 2: a 1024-bit MODP group 5: a 1536-bit MODP group	Integer32r/w Constraints: range: 1-5	.0.14.1.6
ikePrfCert The index of the certificate used for authentication in the certTable. Ignored for AuthMethod == pre_shared_key.	Integer32r/w Constraints: range: 0-32767	.0.14.1.7
ikePrfLocalId The local ID used for authentication with this profile. Syntax: - X500 distinguished name: <obj-name=obj-value, obj-ID=obj-value, ...> - IPV4-Address: |123.456.789.012| with or without '|' - IPV4 Address R…	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.14.1.8
ikePrfCaCerts Receives a comma separated list with indices (0..32767) of special certificate authority certificates accepted for this profile.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.14.1.9
ikePrfLifeTime This object specifies an index in the ipsecLifeTimeTable with the lifetime settings to be used for IKE SA negotiation with this profile. If the lifetime pointed to by this index does not exist or is inappropriate, the …	Integer32 Type Constraints: range: -2147483648..2147483647	.0.14.1.10
ikePrfPfsIdentity This object specifies whether IKE SA's should be deleted immediately after a phase 2 (IPSec-) SA pair has been negotiated. The consequence of enabling this feature is that before each phase 2 negotiation there always …	Enumerationr/w Enumerated Values: 1 true 2 false 3 default	.0.14.1.11
ikePrfHeartbeats This object specifies whether heartbeats should be sent over phase 1 SAs for this profile (heartbeats are not used for IPv6). Possible values: none(1), -- neither send nor expect heartbeats expect(2), -- exp…	Enumerationr/w Enumerated Values: 1 none 2 expect 3 send 4 both 5 default 6 auto 7 dpd 8 dpd-idle	.0.14.1.12
ikePrfBlockTime This object specifies the time in seconds for which a peer is blocked for any IPSec operations after a phase 1 initiator negotiation failed. Special values: -1: use settings from global profile (do not block by defau…	secondsInteger32r/w Constraints: range: -1-86400	.0.14.1.13
ikePrfNatT This object specifies whether NAT-Traversal is enabled Possible values: enabled(1), -- enable Nat-Traversal disabled(2), -- disable Nat-Traversal default(3) -- use value from default profile -- (disa…	Enumerationr/w Enumerated Values: 1 enabled 2 disabled 3 default 4 enforce	.0.14.1.14
ikePrfMtuMax The maximum MTU value allowed for ipsecPeerStatMtu. Zero means use value from global profile, if this is the global profile, 1418 is assumed. Nonzero values smaller than 214 are reset to the minimum of 214.	Integer32r/w Constraints: range: 0-65535	.0.14.1.15
ikePrfLifeSeconds The maximum time (in seconds) after which an SA will be deleted.	secondsSNMPv2-SMIUnsigned32r/w Type Constraints: range: 0..4294967295	.0.14.1.16
ikePrfLifeKBytes The maximum amount of data (in KB) which may be protected by an SA before it is deleted.	kilo bytesSNMPv2-SMIUnsigned32r/w Type Constraints: range: 0..4294967295	.0.14.1.17
ikePrfLifeRekeyPercentobsolete WARNING: this object is obsolete and must not be used.	Integer32r/w Constraints: range: 50-100	.0.14.1.18
ikePrfLifePolicy This object specifies the way a lifetime proposal is handled. Possible values: loose(1), -- accept and use anything proposed strict(2), -- accept and use only what is configured notify(3), -- accept anything, if own…	Enumerationr/w Enumerated Values: 1 loose 2 strict 3 notify 4 use-default-lifetime	.0.14.1.19

This table contains the list of IPSec (Phase 2) profiles.

ipsecProfileEntry row .0.15.1

This object contains an IPSec phase 1 profile.

Indexes

ipsecPrfProposal

Column	Syntax	OID
ipsecPrfIndex A unique index identifying this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.15.1.1
ipsecPrfDescription An optional description for this profile.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.0.15.1.2
ipsecPrfProposal The index of the IPSec proposal used for this profile.	Integer32r/w Type Constraints: range: -2147483648..2147483647	.0.15.1.3
ipsecPrfPfsGroup The Diffie Hellman group used for additional Perfect Forward Secrecy (PFS) DH exponentiations. Possible values: -1: do not use PFS 0: use value from default profile (do not use PFS if this is the default prof…	Integer32r/w Constraints: range: -1-5	.0.15.1.4
ipsecPrfLifeTime This object specifies an index in the ipsecLifeTimeTable. The usage of this object is deprecated, use the ipsecPrfLifeXxx variables directly instead.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.15.1.5
ipsecPrfHeartbeats This object specifies whether heartbeats should be sent over phase 2 SAs for this profile (heartbeats are not used for IPv6). Possible values: none(1), -- neither send nor expect heartbeats expect(2), -- exp…	Enumerationr/w Enumerated Values: 1 none 2 expect 3 send 4 both 5 default 6 auto	.0.15.1.6
ipsecPrfPmtuDiscovery This object specifies the PMTU discovery policy for this peer. Possible values: disabled(1), -- do not perform PMTU discovery enabled(2) -- perform PMTU discovery default(3) -- use settings from peer or global…	Enumerationr/w Enumerated Values: 1 disabled 2 enabled 3 default	.0.15.1.7
ipsecPrfGranularity This object specifies the granularity with which SA's are created with this profile. Possible values: default(1), -- use granulaity settings from default profile -- (coarse if this is the default profile) coarse(…	Enumerationr/w Enumerated Values: 1 default 2 coarse 3 ip 4 proto 5 port 6 local-services	.0.15.1.8
ipsecPrfKeepAlive This object specifies whether IKE SA's are rekeyed even if there was no data transferred over them. Possible values: true(1), -- rekey SA's even if no data was transferred false(2), -- do not rekey SA's if no data…	Enumerationr/w Enumerated Values: 1 true 2 false 3 default 4 delete	.0.15.1.9
ipsecPrfVerifyPad This object is a compatibility option for older ipsec implementations. It enables or disables an old way of ESP padding (no self describing padding). Possible values: true(1), -- normal, self-describing ESP padding…	Enumerationr/w Enumerated Values: 1 true 2 false 3 default	.0.15.1.10
ipsecPrfForceTunnelMode This object specifies the strategy when transport mode is used. By default, the system always uses transport mode, if possible. If this variable is set to true, always tunnel mode will be used for this traffic entry, ev…	Enumerationr/w Enumerated Values: 1 true 2 false 3 default	.0.15.1.11
ipsecPrfLifeSeconds The maximum time (in seconds) after which an SA will be deleted.	secondsSNMPv2-SMIUnsigned32r/w Type Constraints: range: 0..4294967295	.0.15.1.16
ipsecPrfLifeKBytes The maximum amount of data (in KB) which may be protected by an SA before it is deleted.	kilo bytesSNMPv2-SMIUnsigned32r/w Type Constraints: range: 0..4294967295	.0.15.1.17
ipsecPrfLifeRekeyPercent The percentage of the lifetimes (traffic and time based) after which rekeying is started.	Integer32r/w Constraints: range: 50-100	.0.15.1.18
ipsecPrfLifePolicy This object specifies the way a lifetime proposal is handled. Possible values: loose(1), -- accept and use anything proposed strict(2), -- accept and use only what is configured notify(3) -- accept anything, if own …	Enumerationr/w Enumerated Values: 1 loose 2 strict 3 notify 4 use-default-lifetime	.0.15.1.19

This table contains the list of currently active IPSec security
associations.

ipsecBundleEntry row .0.16.1

This object contains an IPSec security association.

Indexes

ipsecBundleIndex

Column	Syntax	OID
ipsecBundleIndex A unique index for this entry.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.1
ipsecBundlePeerIndex The index of the peer for which this bundle was created.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.5
ipsecBundleTrafficIndex The index of the traffic entry for which this bundle was created.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.6
ipsecBundleState The current state of the bundle Possible values: established(1), -- The bundle is alive expired(2), -- The bundle is expired delete (3), -- Mark this bundle for deletion negotiating(4), -- This bundle …	Enumerationr/w Enumerated Values: 1 established 2 expired 3 delete 4 negotiating 5 rekeyed 6 heartbeat-lost 7 failed	.0.16.1.7
ipsecBundleNumSas The number of SAs contained in this bundle.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.8
ipsecBundleRole This object specifies by which side the SA bundle negotiation was initiated. Possible values: initiator(1), -- this end initiated the negotiation responder(2) -- the remote end initiated the negotiation.	Enumeration Enumerated Values: 1 initiator 2 responder	.0.16.1.9
ipsecBundleRekeyedBundle This object indicates upon rekeying, which bundle (actually its BundleIndex) is going to be replaced by that one.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.10
ipsecBundleRekeyingBundle This object indicates upon rekeying, which bundle (actually its BundleIndex) is going to replace that one.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.11
ipsecBundleLastStateChange This object indicates the time in time ticks from system start by which the state of this bundle entry was changed last. To determine the absolute time, the current sysUpTime must be subtracted from this value.	SNMPv2-SMITimeTicks Type Constraints: range: 0..4294967295	.0.16.1.12
ipsecBundleHeartbeatsEnabled This object specifies whether heartbeats are sent and/or expected over this bundle. Possible values: none(1), -- neither sending nor expecting heartbeats expect(2), -- expecting heartbeats send(3), -- se…	Enumeration Enumerated Values: 1 none 2 expect 3 send 4 both	.0.16.1.13
ipsecBundleCreator This object specifies how the SA was created Possible values: manual(1),-- A manually keyed IPSec SA bundle ike(2) -- An automatically keyed SA bundle created by IKE.	Enumeration Enumerated Values: 1 manual 2 ike	.0.16.1.14
ipsecBundleTunnelLocal The local IP address of the outer packet header. For transport mode bundles this address is the same as the ipsecBundleLocalAddress.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.15
ipsecBundleTunnelRemote The remote IP address of the outer packet header. For transport mode bundles, this address is the same as the ipsecBundleRemoteAddress.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.16
ipsecBundlePmtuDiscovery This object specifies the initialization of the DF bit in outgoing IPSec packets for this bundle. It decides whether PMTU discovery is propagated over the IPSec tunnel or not. Possible values: enabled(1), -- copy DF …	Enumeration Enumerated Values: 1 disabled 2 enabled	.0.16.1.17
ipsecBundleKeepAlive This object specifies the circumstances under which this SA bundle will be rekeyed. Possible values: true(1), -- rekey even if no traffic was processed false(2) -- rekey only if at least one packet was processed.	Enumeration Enumerated Values: 1 true 2 false	.0.16.1.18
ipsecBundleVerifyPad This object specifies the kind of padding expected for ESP SAs within this bundle. Possible values: true(1), -- normal, self-describing ESP padding false(2) -- old style ESP padding.	Enumeration Enumerated Values: 1 true 2 false	.0.16.1.19
ipsecBundleLifeSeconds The period in seconds after which this bundle will be destroyed.	secondsSNMPv2-SMIUnsigned32 Type Constraints: range: 0..4294967295	.0.16.1.20
ipsecBundleLifeKBytes The amount of data allowed to be protected by this bundle until it is destroyed (ipsecBundleOutBytes or ipecBundleOutBytes).	kilo bytesSNMPv2-SMIUnsigned32 Type Constraints: range: 0..4294967295	.0.16.1.21
ipsecBundleRekeySeconds The period in seconds after which this bundle will be rekeyed.	secondsInteger32 Type Constraints: range: -2147483648..2147483647	.0.16.1.22
ipsecBundleRekeyKBytes The amount of data allowed to be protected by this bundle until it is rekeyed (ipsecBundleOutBytes or ipecBundleOutBytes).	kilo bytesInteger32 Type Constraints: range: -2147483648..2147483647	.0.16.1.23
ipsecBundleProto The protocol of the traffic selectors.	Enumeration Enumerated Values: 1 icmp 2 igmp 3 ggp 4 ipip 5 st 6 tcp 7 cbt 8 egp 9 igp 10 bbn 11 nvp 12 pup 13 argus 14 emcon 15 xnet 16 chaos 17 udp 18 mux 19 dcn 20 hmp 21 prm 22 xns 23 trunk1 24 trunk2 25 leaf1 26 leaf2 27 rdp 28 irtp 29 isotp4 30 netblt 31 mfe 32 merit 33 sep 34 pc3 35 idpr 36 xtp 37 ddp 38 idprc 39 tp 40 il 41 ipv6 42 sdrp 43 ipv6route 44 ipv6frag 45 idrp 46 rsvp 47 gre 48 mhrp 49 bna 50 esp 51 ah 52 inlsp 53 swipe 54 narp 55 mobile 56 tlsp 57 skip 58 ipv6icmp 59 ipv6nonxt 60 ipv6opts 61 ipproto-61 62 cftp 63 local 64 sat 65 kryptolan 66 rvd 67 ippc 68 distfs 69 satmon 70 visa 71 ipcv 72 cpnx 73 cphb 74 wsn 75 pvp 76 brsatmon 77 sunnd 78 wbmon 79 wbexpak 80 isoip 81 vmtp 82 securevmtp 83 vines 84 ttp 85 nsfnet 86 dgp 87 tcf 88 eigrp 89 ospfigp 90 sprite 91 larp 92 mtp 93 ax25 94 ipwip 95 micp 96 scc 97 etherip 98 encap 99 encrypt 100 gmtp 101 ifmp 102 pnni 103 pim 104 aris 105 scps 106 qnx 107 an 108 ippcp 109 snp 110 compaq 111 ipxip 112 vrrp 113 pgm 114 hop0 115 l2tp 116 ipproto-116 117 ipproto-117 118 ipproto-118 119 ipproto-119 120 ipproto-120 121 ipproto-121 122 ipproto-122 123 ipproto-123 124 ipproto-124 125 ipproto-125 126 ipproto-126 127 ipproto-127 128 ipproto-128 129 ipproto-129 130 ipproto-130 131 ipproto-131 132 ipproto-132 133 ipproto-133 134 ipproto-134 135 ipproto-135 136 ipproto-136 137 ipproto-137 138 ipproto-138 139 ipproto-139 140 ipproto-140 141 ipproto-141 142 ipproto-142 143 ipproto-143 144 ipproto-144 145 ipproto-145 146 ipproto-146 147 ipproto-147 148 ipproto-148 149 ipproto-149 150 ipproto-150 151 ipproto-151 152 ipproto-152 153 ipproto-153 154 ipproto-154 155 ipproto-155 156 ipproto-156 157 ipproto-157 158 ipproto-158 159 ipproto-159 160 ipproto-160 161 ipproto-161 162 ipproto-162 163 ipproto-163 164 ipproto-164 165 ipproto-165 166 ipproto-166 167 ipproto-167 168 ipproto-168 169 ipproto-169 170 ipproto-170 171 ipproto-171 172 ipproto-172 173 ipproto-173 174 ipproto-174 175 ipproto-175 176 ipproto-176 177 ipproto-177 178 ipproto-178 179 ipproto-179 180 ipproto-180 181 ipproto-181 182 ipproto-182 183 ipproto-183 184 ipproto-184 185 ipproto-185 186 ipproto-186 187 ipproto-187 188 ipproto-188 189 ipproto-189 190 ipproto-190 191 ipproto-191 192 ipproto-192 193 ipproto-193 194 ipproto-194 195 ipproto-195 196 ipproto-196 197 ipproto-197 198 ipproto-198 199 ipproto-199 200 ipproto-200 201 ipproto-201 202 ipproto-202 203 ipproto-203 204 ipproto-204 205 ipproto-205 206 ipproto-206 207 ipproto-207 208 ipproto-208 209 ipproto-209 210 ipproto-210 211 ipproto-211 212 ipproto-212 213 ipproto-213 214 ipproto-214 215 ipproto-215 216 ipproto-216 217 ipproto-217 218 ipproto-218 219 ipproto-219 220 ipproto-220 221 ipproto-221 222 ipproto-222 223 ipproto-223 224 ipproto-224 225 ipproto-225 226 ipproto-226 227 ipproto-227 228 ipproto-228 229 ipproto-229 230 ipproto-230 231 ipproto-231 232 ipproto-232 233 ipproto-233 234 ipproto-234 235 ipproto-235 236 ipproto-236 237 ipproto-237 238 ipproto-238 239 ipproto-239 240 ipproto-240 241 ipproto-241 242 ipproto-242 243 ipproto-243 244 ipproto-244 245 ipproto-245 246 ipproto-246 247 ipproto-247 248 ipproto-248 249 ipproto-249 250 ipproto-250 251 ipproto-251 252 ipproto-252 253 ipproto-253 254 ipproto-254 255 dont-verify	.0.16.1.24
ipsecBundleLocalAddress The local address (host or network or range start address) of the traffic selectors, source for outbound, destination for inbound.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.25
ipsecBundleLocalMaskLen The local network masklen of the traffic selectors, source for outbound, destination for inbound.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.26
ipsecBundleLocalRange The local address range end address of the traffic selectors, source for outbound, destination for inbound.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.27
ipsecBundleLocalPort The local port of the traffic selectors, source for outbound, destination for inbound.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.28
ipsecBundleRemoteAddress The remote address (host or network or range start address) of the traffic selectors source for outbound, destination for inbound.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.29
ipsecBundleRemoteMaskLen The remote network masklen of the traffic selectors source for outbound, destination for inbound.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.30
ipsecBundleRemoteRange The remote address range end address of the traffic selectors source for outbound, destination for inbound.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.31
ipsecBundleRemotePort The remote port of the traffic selectors source for outbound, destination for inbound.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.32
ipsecBundleInPkt The total number of inbound packets processed by this bundle.	SNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.33
ipsecBundleInHb The number of heartbeat packets received over this bundle.	SNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.34
ipsecBundleInBytes The number of inbound bytes (including IPSec overhead) processed by this bundle.	bytesSNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.35
ipsecBundleInBytesNetto The number of inbound bytes (netto: IPSec headers excluded) processed by this bundle.	bytesSNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.37
ipsecBundleOutPkt The total number of outbound packets processed by this bundle.	SNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.39
ipsecBundleOutHb The number of heartbeat packets sent for this bundle.	SNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.40
ipsecBundleOutBytes The number of outbound bytes (including IPSec overhead) processed by this bundle.	bytesSNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.41
ipsecBundleOutBytesNetto The number of outbound bytes (netto: IPSec headers excluded) processed by this bundle.	bytesSNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.0.16.1.43
ipsecBundleNatT This object specifies if the udp encapsulation of ESP packets is active within this bundle. Possible values: enabled(1), -- use udp encapsulation disabled(2) -- do not use udp encapsulation.	Enumeration Enumerated Values: 1 enabled 2 disabled	.0.16.1.45
ipsecBundleNatOaLocal The local IP address as seen by the remote side. Only valid for transport mode bundles with NatT enabled.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.46
ipsecBundleNatOaRemote The remote IP address as seen by the remote side. Only valid for transport mode bundles with NatT enabled.	SNMPv2-SMIIpAddress Type Constraints: range: 4	.0.16.1.47
ipsecBundleIkeMajVersion The IKE major version number.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.48
ipsecBundleIkeMinVersion The IKE minor version number.	Integer32 Type Constraints: range: -2147483648..2147483647	.0.16.1.49