-- extracted from draft-ietf-midcom-mib-03.txt -- at Fri Oct 29 06:24:00 2004 MIDCOM-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Unsigned32, mib-2 FROM SNMPv2-SMI -- RFC2578 TEXTUAL-CONVENTION, TruthValue, TestAndIncr, StorageType, RowStatus FROM SNMPv2-TC -- RFC2579 MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF -- RFC2580 SnmpAdminString FROM SNMP-FRAMEWORK-MIB -- RFC3411 SnmpTagList FROM SNMP-TARGET-MIB -- RFC3413 InetAddressType, InetAddress, InetPortNumber FROM INET-ADDRESS-MIB -- RFC 3291 ifIndex FROM IF-MIB -- RFC2863 NatBindIdOrZero FROM NAT-MIB; -- RFCXXYY -- currently from draft-ietf-nat-natmib-09.txt midcomMIB MODULE-IDENTITY LAST-UPDATED "200407191111Z" -- July 19, 2004 ORGANIZATION "IETF Middlebox Communication Working Group" CONTACT-INFO "WG charter: http://www.ietf.org/html.charters/midcom-charter.html Mailing Lists: General Discussion: midcom@ietf.org To Subscribe: midcom-request@ietf.org In Body: subscribe your_email_address Editor: Juergen Quittek NEC Europe Ltd. Network Laboratories Kurfuersten-Anlage 36 69115 Heidelberg Germany Tel: +49 6221 90511-15 Email: quittek@ccrle.nec.de" DESCRIPTION "This MIB module defines a set of basic objects for configuring middleboxes, such as firewalls and network address translators, in order to enable communication across these devices. Managed objects defined in this MIB module are structured in three branches: - transaction objects required according to the MIDCOM protocol requirements defined in RFC 3304 and according to the MIDCOM protocol semantics defined in RFC XXXX, - optional configuration objects that can be used for setting parameters of the implementation of objects in the transaction branch, - optional monitoring objects that provide information about used resource and statistics In the transaction objects branch, there are three groups of managed objects defined: - objects modeling MIDCOM sessions in the midcomSessionTable - objects modeling MIDCOM policy rules in the midcomRuleTable - objects modeling MIDCOM policy rule groups in the midcomGroupTable Note that typically, objects in the configuration branch are not intended to be written by MIDCOM clients. In general, access to these objects needs to be restricted more strictly than access to objects in the transaction branch. Copyright (C) The Internet Society (2004). This version of this MIB module is part of RFC yyyy; see the RFC itself for full legal notices." -- RFC Ed.: replace yyyy with actual RFC number & remove this notice REVISION "200407191111Z" -- July 19, 2004 DESCRIPTION "Initial version, published as RFC yyyy." -- RFC Ed.: replace yyyy with actual RFC number & remove this notice ::= { mib-2 44444 } -- 44444 to be assigned by IANA. -- -- main components of this MIB module -- midcomObjects OBJECT IDENTIFIER ::= { midcomMIB 1 } midcomNotifications OBJECT IDENTIFIER ::= { midcomMIB 2 } midcomConformance OBJECT IDENTIFIER ::= { midcomMIB 3 } -- Transaction objects required according to the MIDCOM -- protocol requirements defined in RFC 3304 and according to -- the MIDCOM protocol semantics defined in RFC XXXX midcomTransaction OBJECT IDENTIFIER ::= { midcomObjects 1 } -- Configuration objects that can be used for retrieving -- middlebox capability information (mandatory) and for -- setting parameters of the implementation of objects in -- the transaction branch (optional) midcomConfig OBJECT IDENTIFIER ::= { midcomObjects 2 } -- Optional monitoring objects that provide information about -- used resource and statistics midcomMonitoring OBJECT IDENTIFIER ::= { midcomObjects 3 } -- -- Transaction Objects -- -- Transaction objects are structured according to the MIDCOM -- protocol semantics into three groups: -- - the session group containing objects that model MIDCOM -- sessions, -- - the policy rules group containing objects that model -- policy rules, and -- - the group group containing objects modeling policy rule -- groups. -- -- Session group -- -- The midcomSessionTable models MIDCOM sessions. -- MIDCOM clients ( = SNMP managers ) that want to -- read, create or modify entries in the midcomRuleTable -- or midcomGroupTable need to have an entry in this table. -- -- The table contains objects identifying a destination for -- notifications to be sent to the MIDCOM client. -- Also it serves for creating new rows in the -- midcomRuleTable. -- midcomSessionTable OBJECT-TYPE SYNTAX SEQUENCE OF MidcomSessionEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table lists open MIDCOM sessions. There is no real concept of a session in the SNMP world. Authenticated, and other protection mechanisms are executed on a per message base. However, one property of a MIDCOM session still is modeled by this table. The MIDCOM client ( = SNMP manager ) needs to create an entry in this session if it wants to receive notifications concerning policy rules in the midcomRuleTable to which it has access. The midcomSessionTable is indexed by its owner identified as SNMP manager. Object midcomSessionOwner SHOULD uniquely identify an authenticated MIDCOM client. It is of type SnmpAdminString, that can be trivially mapped to a securityName or groupName as idefined in the View-Based Access Control Model (RFC 3415, VACM) and allows an management application to identify its entries. MIDCOM MIB implementations may terminate sessions at any time without a prior request of a MIDCOM client by removing the corresponding entry from the midcomSessionTable. MIDCOM MIB implementations do send an asynchronous session termination (AST) notification to the particular session owner indexed by the midcomSessionOwner. Previous received requests are processed and afterwards the corresponding row in midcomSessionTable is removed immediately. No further requests for the session closed are accepted and no further asynchronous notifications are sent anymore. Note that session termination, either requested or asynchronously, does not affect entries in midcomRuleTable and midcomGroupTable." ::= { midcomTransaction 2 } midcomSessionEntry OBJECT-TYPE SYNTAX MidcomSessionEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry describing a particular MIDCOM session." INDEX { midcomSessionOwner } ::= { midcomSessionTable 1 } MidcomSessionEntry ::= SEQUENCE { midcomSessionOwner SnmpAdminString, midcomSessionLock TestAndIncr, midcomSessionTagList SnmpTagList, midcomSessionStorageType StorageType, midcomSessionRowStatus RowStatus } midcomSessionOwner OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..32)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The manager who owns this row in the midcomSessionTable. This object SHOULD uniquely identify an authenticated MIDCOM client. It is of type SnmpAdminString, a textual convention that allows for use of the SNMPv3 View-Based Access Control Model (RFC 3415, VACM) and allows an management application to identify its entries." ::= { midcomSessionEntry 1 } midcomSessionLock OBJECT-TYPE SYNTAX TestAndIncr MAX-ACCESS read-write STATUS current DESCRIPTION "This object is used to facilitate modification of object midcomSessionTagList in the same entry by multiple managers. The procedure for modifying the midcomSessionTagList object is as follows: 1. Retrieve the value of midcomSessionLock and of midcomSessionTagList. 2. Generate a new value for midcomSessionTagList. 3. Set the value of midcomSessionLock to the retrieved value, and the value of midcomSessionTagList to the new value. If the set fails for the midcomSessionLock object, go back to step 1." ::= { midcomSessionEntry 2 } midcomSessionTagList OBJECT-TYPE SYNTAX SnmpTagList MAX-ACCESS read-create STATUS current DESCRIPTION "This object contains a list of tag values which are used to select target addresses for midcom notifications. The value of this field is checked by a MIDCOM MIB implementation if an event occurs for which a notification needs to be sent to the corresponding MIDCOM clients. Then this notification is generated for each each occurrence of any of the tags in this list in an snmpTargetAddrTagList object in any entry of the snmpTargetAddrTable of the SNMP-TARGET-MIB (RFC 3413)." DEFVAL { "" } ::= { midcomSessionEntry 3 } midcomSessionStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-create STATUS current DESCRIPTION "When retrieved, this object returns the storage type of the session. Writing to this object can change the storage type of the particular row from volatile(2) to nonVolatile(3) or vice versa. Attempts to set this object to permanent will always fail with an inconsistentValue error. If midcomSessionStorageType has the value permanent(4), then all objects in this row whose MAX-ACCESS value is read-create must be read-only." DEFVAL { volatile } ::= { midcomSessionEntry 4 } midcomSessionRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "A control that allows entries to be added and removed from this table. Attempts to destroy(6) a row or to set a row notInService(2) where the value of the midcomSessionStorageType object is permanent(4) or readOnly(5) will result in an inconsistentValue error. The value of this object has no effect on whether other objects in this conceptual row can be modified." ::= { midcomSessionEntry 5 } -- -- Policy rule group -- -- The midcomRuleTable lists policy rules -- including policy reserve rules and policy enable rules. -- midcomRuleTable OBJECT-TYPE SYNTAX SEQUENCE OF MidcomRuleEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table lists policy rules. It is indexed by the midcomSessionOwner, the midcomGroupIndex and the midcomRuleIndex. This implies that a rule is member of exactly one group and that group membership cannot be changed. Entries can be deleted by writing to midcomGroupLifetime or midcomRuleLifetime and potentially also to midcomRuleStorageTime." ::= { midcomTransaction 3 } midcomRuleEntry OBJECT-TYPE SYNTAX MidcomRuleEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry describing a particular MIDCOM policy rule." INDEX { midcomSessionOwner, midcomGroupIndex, midcomRuleIndex } ::= { midcomRuleTable 1 } MidcomRuleEntry ::= SEQUENCE { midcomRuleIndex Unsigned32, midcomRuleAdminStatus INTEGER, midcomRuleOperStatus INTEGER, midcomRuleStorageType StorageType, midcomRuleStorageTime Unsigned32, midcomRuleError SnmpAdminString, midcomRuleInterface Unsigned32, midcomRuleFlowDirection INTEGER, midcomRuleMaxIdleTime Unsigned32, midcomRuleTransportProtocol Unsigned32, midcomRulePortRange INTEGER, midcomRuleInternalIpVersion InetAddressType, midcomRuleExternalIpVersion InetAddressType, midcomRuleInternalIpAddr InetAddress, midcomRuleInternalIpPrefixLength Unsigned32, midcomRuleInternalPort InetPortNumber, midcomRuleExternalIpAddr InetAddress, midcomRuleExternalIpPrefixLength Unsigned32, midcomRuleExternalPort InetPortNumber, midcomRuleInsideIpAddr InetAddress, midcomRuleInsidePort InetPortNumber, midcomRuleOutsideIpAddr InetAddress, midcomRuleOutsidePort InetPortNumber, midcomRuleLifetime Unsigned32, midcomRuleRowStatus RowStatus } midcomRuleIndex OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object must be unique in combination with the values of the objects midcomSessionOwner and midcomGroupIndex in this row." ::= { midcomRuleEntry 3 } midcomRuleAdminStatus OBJECT-TYPE SYNTAX INTEGER { reserve(1), enable(2) } MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object indicates the desired status of the policy rule. See the definition of midcomRuleOperStatus for a description of the values. When the midcomRuleAdminStatus object is set, then the MIDCOM MIB implementation will try to read the respective relvant objects of the entry and try to achieve the corresponding midcomRuleOperStatus. Setting midcomRuleAdminStatus to value reserve(1) when object midcomRuleOperStatus has a value of reserved(7) does not have any effect on the policy rule. Setting midcomRuleAdminStatus to value enable(2) when object midcomRuleOperStatus has a value of enabled(8) does not have any effect on the policy rule. Depending on whether the midcomRuleAdminStatus is set to reserve(1) or enable(2) several objects must be set in advance. They serve as parameters of the policy rule to be established When object midcomRuleAdminStatus is set to reserve(1), then the following objects in the same entry are of relevance: - midcomRuleInterface - midcomRuleTransportProtocol - midcomRulePortRange - midcomRuleInternalIpVersion - midcomRuleExternalIpVersion - midcomRuleInternalIpAddr - midcomRuleInternalIpPrefixLength - midcomRuleInternalPort - midcomRuleLifetime MIDCOM MIB implementation may also consider the value of object midcomRuleMaxIdleTime when establishing a reserve rule. When object midcomRuleAdminStatus is set to enable(2), then the following objects in the same entry are of relevance: - midcomRuleInterface - midcomRuleFlowDirection - midcomRuleMaxIdleTime - midcomRuleTransportProtocol - midcomRulePortRange - midcomRuleInternalIpVersion - midcomRuleExternalIpVersion - midcomRuleInternalIpAddr - midcomRuleInternalIpPrefixLength - midcomRuleInternalPort - midcomRuleExternalIpAddr - midcomRuleExternalIpPrefixLength - midcomRuleExternalPort - midcomRuleLifetime When retrieved, the object returns the last set value. If no value has been set, it returns one of the two possible values." ::= { midcomRuleEntry 4 } midcomRuleOperStatus OBJECT-TYPE SYNTAX INTEGER { newEntry(1), setting(2), checkingRequest(3), incorrectRequest(4), processingRequest(5), requestRejected(6), reserved(7), enabled(8), timedOut(9), terminatedOnRequest(10), terminated(11), genericError(12) } MAX-ACCESS read-only STATUS current DESCRIPTION "The actual status of the policy rule. The midcomRuleOperStatus object may have the following values: - newEntry(1) indicates that the entry in the midcomRuleTable was created, but not modified yet. Such an entry needs to be filled with values specifying a request first. - setting(2) indicates that the entry has been already modified after generating it, but no request was made yet. - checkingRequest(3) indicates that midcomRuleAdminStatus has recently been set and that the MIDCOM MIB implementation is currently checking the parameters of the request. This is a transient state. The value of this object will change to either incorrectRequest(4) or processingRequest(5) without any external interaction. A MIDCOM MIB implementation MAY return this value while checking request parameters. - incorrectRequest(4) indicates that checking a request resulted in detecting an incorrect value in one of the objects containing request parameters. The failure reason is indicated by the value of midcomRuleError. - processingRequest(5) indicates that midcomRuleAdminStatus has recently been set and that the MIDCOM MIB implementation is currently processing the request and trying to configure the middlebox accordingly. This is a transient state. The value of this object will change to either requestRejected(6), reserved(7) or enabled(8) without any external interaction. A MIDCOM MIB implementation MAY return this value while processing a request. - requestRejected(6) indicates that a request to establish a policy rule specified by the entry was rejected. The reason of rejection is indicated by the value of midcomRuleError. - reserved(7) indicates that the entry describes an established policy reserve rule. These values of MidcomRuleEntry can be retrieved for a reserved policy rule: - midcomRuleMaxIdleTime - midcomRuleInterface - midcomRuleTransportProtocol - midcomRulePortRange - midcomRuleInternalIpVersion - midcomRuleExternalIpVersion - midcomRuleInternalIpAddr - midcomRuleInternalIpPrefixLength - midcomRuleInternalPort - midcomRuleOutsideIpAddr - midcomRuleOutsidePort - midcomRuleLifetime - enabled(8) indicates that the entry describes an established policy enable rule. These values of MidcomRuleEntry can be retrieved for an enabled policy rule - midcomRuleFlowDirection - midcomRuleInterface - midcomRuleMaxIdleTime - midcomRuleTransportProtocol - midcomRulePortRange - midcomRuleInternalIpVersion - midcomRuleExternalIpVersion - midcomRuleInternalIpAddr - midcomRuleInternalIpPrefixLength - midcomRuleInternalPort - midcomRuleExternalIpAddr - midcomRuleExternalIpPrefixLength - midcomRuleExternalPort - midcomRuleInsideIpAddr - midcomRuleInsidePort - midcomRuleOutsideIpAddr - midcomRuleOutsidePort - midcomRuleLifetime - timedOut(9) indicates that the lifetime of a previously established policy rule is expired and that the policy rule is terminated for this reason. - terminatedOnRequest(10) indicates that a previously established policy rule was terminated by an SNMP manager setting the midcomRuleLifetime to 0 or setting midcomGroupLifetime to 0. - terminated(11) indicates that a previously established policy rule was terminated by the MIDCOM MIB implementation for another reason than lifetime expiration or an explicit request from an SNMP manager. - genericError(12) indicates that the policy rule specified by the entry is not established due to an error condition not listed above. The states timedOut(9), terminatedOnRequest(10) and terminated(11) are referred to as termination states. The states incorrectRequest(4), requestRejected(6) and genericError(12) are referred to as error states. The checkingRequest(3) and processingRequest(4) states are transient states which will either lead to one of the error states or the reserved(7) state or the enabled(8) states. MIDCOM MIB implementations MAY return these values when checking or processing requests." DEFVAL { newEntry } ::= { midcomRuleEntry 5 } midcomRuleStorageType OBJECT-TYPE SYNTAX StorageType MAX-ACCESS read-write STATUS current DESCRIPTION "When retrieved, this object returns the storage type of the policy rule. Writing to this object can change the storage type of the particular row from volatile(2) to nonVolatile(3) or vice versa. Attempts to set this object to permanent will always fail with an inconsistentValue error. If midcomRuleStorageType has the value permanent(4), then all objects in this row whose MAX-ACCESS value is read-write must be read-only." DEFVAL { volatile } ::= { midcomRuleEntry 6 } midcomRuleStorageTime OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object specifies how long this row can exist in the midcomRuleTable after the midcomRuleOperState switched to a termination state or to an error state. This object returns the remaining time that the row may exist before it is aged out. The object is initialized with the value of the associated midcomSessionStorageTime object. After expiration or termination of the context, the value of this object ticks backwards. The entry in the midcomRuleTable is destroyed when the value reaches 0. The value of this object may be set in order to increase or reduce the remaining time that the row may exist. Setting the value to 0 will destroy this entry as soon as the midcomRuleOperState switched to a termination state or to an error state. Note that there is no guarantee that the row is stored as long as this object indicates. At any time, the MIDCOM MIB implementation may decide to remove a row describing a terminated policy rule before the storage time of the corresponding row in the midcomRuleTable reaches the value of 0. In this case the information stored in this row is not anymore available." DEFVAL { 0 } ::= { midcomRuleEntry 7 } midcomRuleError OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "This object contains a descriptive error message if the transition into the operational status reserved(7) or enabled(8) failed. Implementations must reset the error message to a zero-length string when a new attempt to change the policy rule status to reserved(7) or enabled(8) is started. RECOMMENDED values to be returned in particular cases include - 'lack of IP addresses' - 'lack of port numbers' - 'lack of resources' - 'specified NAT interface does not exist' - 'specified NAT interface does not support NAT' - 'conflict with already existing policy rule' - 'no internal IP wildcarding allowed' - 'no external IP wildcarding allowed'" DEFVAL { ''H } ::= { midcomRuleEntry 8 } midcomRuleInterface OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-write STATUS current DESCRIPTION "This object indicates the IP interface for which enforcement of a policy rule is requested or performed, respectively. The interface is identified by its index in the ifTable (see IF-MIB in RFC2863). If the object has a value of 0, then no particular interface is indicated. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has the value newEntry(1) or setting(2), then this object can be written by a manager in order to request its preference concerning the interface at which it requests NAT service. The default value of 0 indicates that the manager does not have a preferred interface or does not have sufficient topology information for specifying one. Writing to this object in any state other than newEntry(1) or setting(2) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value reserved(7) or enabled(8), then this object indicates the interface at which NAT service for this rule is performed. If not NAT service is required for enforcing the policy rule, then the value of this object is 0. Also if the MIDCOM MIB implementation cannot indicate an interface, because it does not have this information or because NAT service is not offered at a particular single interface, then the value of the object is 0. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 0 } ::= { midcomRuleEntry 9 } midcomRuleFlowDirection OBJECT-TYPE SYNTAX INTEGER { inbound(1), outbound(2), biDirectional(3) } MAX-ACCESS read-write STATUS current DESCRIPTION "This parameter specifies the direction of enabled communication, either inbound(1), outbound(2), or biDirectional(3). The semantics of this object depends on the protocol the rule relates to. If the rule is independent of the transport protocol (midcomRuleTransportProtocol has value of 0) or if the transport protocol is UDP, then the value of midcomRuleFlowDirection indicates the direction of packets traversing the middlebox. In this case, value inbound(1) indicates that packets are traversing from outside to inside, value outbound(2) indicates that packets are traversing from inside to outside. For both values, inbound(1) and outbound(2) packets can traverse the middelbox only uni-directional. A bi-directional flow is indicated by value biDirectional(3). If the transport protocol is TCP, the packet flow is always bi-directional, but the value of midcomRuleFlowDirection indicates that: - inbound(1): bi-directional TCP packet flow. First packet, with TCP SYN flag set, must arrive at an outside interface of the middlebox. - outbound(2): bi-directional TCP packet flow. First packet, with TCP SYN flag set, must arrive at an inside interface of the middlebox. - biDirectional(3): bi-directional TCP packet flow. First packet, with TCP SYN flag set, may arrive at an inside or an outside interface of the middlebox. This object is used as input to a request for establishing a policy enable rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has a value of either newEntry(1), setting(2) or reserved(7), then this object can be written by a manager in order to specify a requested direction to be enabled by a policy rule. Writing to this object in any state other than newEntry(1), setting(2) or reserved(7) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value enabled(8), then this object indicates the enabled flow direction. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." ::= { midcomRuleEntry 10 } midcomRuleMaxIdleTime OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "Maximum idle time of the policy rule in seconds. If no packet to which the policy rule applies passes the middlebox for the specified midcomRuleMaxIdleTime, then the policy rule enters the termination state timedOut(9). A value of 0 indicates that the policy does require an individual idle time and that instead, a default idle time chosen by the middlebox is used. A value of 4294967295 ( = 2^32 - 1 ) indicates that the policy does not time out if it is idle. This object is used as input to a request for establishing a policy enable rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has a value of either newEntry(1), setting(2) or reserved(7), then this object can be written by a manager in order to specify a maximum idle time for the policy rule to be requested. Writing to this object in any state other than newEntry(1), setting(2) or reserved(7) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value enabled(8), then this object indicates the maximum idle time of the policy rule. Note that even if a maximum idle time greater than zero was requested, the middlebox may not be able to support maximum idle times and set the value of thie object to zero when entering state enabled(8). If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 0 } ::= { midcomRuleEntry 11 } midcomRuleTransportProtocol OBJECT-TYPE SYNTAX Unsigned32 (0..255) MAX-ACCESS read-write STATUS current DESCRIPTION "The transport protocol. Valid values for midcomRuleTransportProtocol are the onces defined at: http://www.iana.org/assignments/protocol-numbers This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has a value of either newEntry(1) or setting(2), then this object can be written by a manager in order to specify a requested transport protocol. If translation of a full IP address is requested, then this object must have the default value 0. Writing to this object in any state other than newEntry(1) or setting(2) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value reserved(7) or enabled(8), then this object indicates which transport protocol is enforced by this policy rule. A value of 0 indicates a rule acting on IP addresses only. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 0 } ::= { midcomRuleEntry 12 } midcomRulePortRange OBJECT-TYPE SYNTAX INTEGER { single(1), pair(2) } MAX-ACCESS read-write STATUS current DESCRIPTION "The range of port numbers. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. It is relevant to the operation of the MIDCOM MIB implementation only if the value of object midcomTransportProtocol in the same entry has a value other than 0. If object midcomRuleOperStatus of the same entry has the value newEntry(1) or setting(2), then this object can be written by a manager in order to specify the requested size of the port range. With single(1) just a single port number is requested, with pair(2) a consecutive pair of port numbers is requested with the lower number being even. Requestimng the a consecutive pair of port numbers is required for supporting the RTP and RTCP protocols, see RFC1889. Writing to this object in any state other than newEntry(1), setting(2) or reserved(7) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has a value of either reserved(7) or enabled(8), then this object will have the value which it had before the transition to this state. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { single } ::= { midcomRuleEntry 13} midcomRuleInternalIpVersion OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-write STATUS current DESCRIPTION "IP version of the internal address (A0) and the inside address (A1). Allowed values are ipv4(1) and ipv6(2). This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has the value newEntry(1) or setting(2), then this object can be written by a manager in order to specify the IP version reuqired at the inside of the middlebox. Writing to this object in any state other than newEntry(1) or setting(2) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value reserved(7) or enabled(8), then this object indicates the internal/inside IP version. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { ipv4 } ::= { midcomRuleEntry 14 } midcomRuleExternalIpVersion OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-write STATUS current DESCRIPTION "IP version of the external address (A3) and the outside address (A2). Allowed values are ipv4(1) and ipv6(2). This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has the value newEntry(1) or setting(2), then this object can be written by a manager in order to specify the IP version reuqired at the outside of the middlebox. Writing to this object in any state other than newEntry(1) or setting(2) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value reserved(7) or enabled(8), then this object indicates the external/outside IP version. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { ipv4 } ::= { midcomRuleEntry 15 } midcomRuleInternalIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-write STATUS current DESCRIPTION "The internal IP address. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has the value newEntry(1) or setting(2), then this object can be written by a manager in order to specify the internal IP address for which a reserve policy rule or a enable policy rule is requested to be established. Writing to this object in any state other than newEntry(1) or setting(2) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value reserved(7) or enabled(8), then this object will have the value which it had before the transition to this state. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." ::= { midcomRuleEntry 16 } midcomRuleInternalIpPrefixLength OBJECT-TYPE SYNTAX Unsigned32 (0..128) MAX-ACCESS read-write STATUS current DESCRIPTION "The prefix length of the internal IP address used for wildcarding. A value of 0 indicates a full wildcard; in this case the value of midcomRuleInternalIpAddr is irrelevant. If midcomRuleInternalIpVersion has a value of ipv4(1) then a value > 31 indicates no wildcarding at all. If midcomRuleInternalIpVersion has a value of ipv4(2) then a value > 127 indicates no wildcarding at all. A MIDCOM MIB implementation that does not support IP address wildcarding MUST implement this object as read-only with a value of 128. A MIDCOM that does not support wildcarding based on prefix length MAY restrict allowed values for this object to 0 and 128. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has the value newEntry(1) or setting(2), then this object can be written by a manager in order to specify the internal IP address for which a reserve policy rule or a enable policy rule is requested to be established. Writing to this object in any state other than newEntry(1) or setting(2) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value reserved(7) or enabled(8), then this object will have the value which it had before the transition to this state. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 128 } ::= { midcomRuleEntry 17 } midcomRuleInternalPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-write STATUS current DESCRIPTION "The internal port number. A value of 0 is a wildcard. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. It is relevant to the operation of the MIDCOM MIB implementation only if the value of object midcomTransportProtocol in the same entry has a value other than 0. If object midcomRuleOperStatus of the same entry has the value newEntry(1) or setting(2), then this object can be written by a manager in order to specify the port number for which a reserve policy rule or a enable policy rule is requested to be established. Writing to this object in any state other than newEntry(1) or setting(2) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value reserved(7) or enabled(8), then this object will have the value which it had before the transition to this state. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 0 } ::= { midcomRuleEntry 18 } midcomRuleExternalIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-write STATUS current DESCRIPTION "The external IP address. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has the value newEntry(1), setting(2) or reserved(7), then this object can be written by a manager in order to specify the external IP address for which an enable policy rule is requested to be established. Writing to this object in any state other than newEntry(1), setting(2) or reserved(7) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value enabled(8), then this object will have the value which it had before the transition to this state. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." ::= { midcomRuleEntry 19 } midcomRuleExternalIpPrefixLength OBJECT-TYPE SYNTAX Unsigned32 (0..128) MAX-ACCESS read-write STATUS current DESCRIPTION "The prefix length of the external IP address used for wildcarding. A value of 0 indicates a full wildcard; in this case the value of midcomRuleExternalIpAddr is irrelevant. If midcomRuleExternalIpVersion has a value of ipv4(1) then a value > 31 indicates no wildcarding at all. If midcomRuleExternalIpVersion has a value of ipv4(2) then a value > 127 indicates no wildcarding at all. A MIDCOM MIB implementation that does not support IP address wildcarding MUST implement this object as read-only with a value of 128. A MIDCOM that does not support wildcarding based on prefix length MAY restrict allowed values for this object to 0 and 128. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has the value newEntry(1), setting(2) or reserved(7), then this object can be written by a manager in order to specify the external IP address for which an enable policy rule is requested to be established. Writing to this object in any state other than newEntry(1), setting(2) or reserved(7) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value enabled(8), then this object will have the value which it had before the transition to this state. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 128 } ::= { midcomRuleEntry 20 } midcomRuleExternalPort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-write STATUS current DESCRIPTION "The external port number. A value of 0 is a wildcard. This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. It is relevant to the operation of the MIDCOM MIB implementation only if the value of object midcomTransportProtocol in the same entry has a value other than 0. If object midcomRuleOperStatus of the same entry has the value newEntry(1), setting(2) or reserved(7), then this object can be written by a manager in order to specify the external port number for which an enable policy rule is requested to be established. Writing to this object in any state other than newEntry(1), setting(2) or reserved(7) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has the value enabled(8), then this object will have the value which it had before the transition to this state. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 0 } ::= { midcomRuleEntry 21 } midcomRuleInsideIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The inside IP address at the middlebox. This the value of this object is relevant only if object midcomRuleOperStatus of the same entry has a value of either reserved(7) or enabled(8)." ::= { midcomRuleEntry 22 } midcomRuleInsidePort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-only STATUS current DESCRIPTION "The inside port number at the middlebox. A value of 0 is a wildcard. This the value of this object is relevant only if object midcomRuleOperStatus of the same entry has a value of either reserved(7) or enabled(8)." ::= { midcomRuleEntry 23 } midcomRuleOutsideIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The outside IP address at the middlebox. This the value of this object is relevant only if object midcomRuleOperStatus of the same entry has a value of either reserved(7) or enabled(8)." ::= { midcomRuleEntry 24 } midcomRuleOutsidePort OBJECT-TYPE SYNTAX InetPortNumber MAX-ACCESS read-only STATUS current DESCRIPTION "The outside port number at the middlebox. A value of 0 is a wildcard. This the value of this object is relevant only if object midcomRuleOperStatus of the same entry has a value of either reserved(7) or enabled(8)." ::= { midcomRuleEntry 25 } midcomRuleLifetime OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The remaining lifetime in seconds of this policy rule. Lifetime of a policy rule starts when object midcomRuleOperStatus in the same entry enters either state reserved(7) or state enabled(8). This object is used as input to a request for establishing a policy rule as well as for indicating the properties of an established policy rule. If object midcomRuleOperStatus of the same entry has a value of either newEntry(1) or setting(2), then this object can be written by a manager in order to specify the requested lifetime of a policy rule to be established. If object midcomRuleOperStatus of the same entry has a value of either reserved(7) or enabled(8), indicates the (continuously decreasing) remaining lifetime of the established policy rule. Note that when entering state reserved(7) or enabled(8), the MIDCOM MIB implementation can choose a lifetime shorter than the one requested. Unlike other parameters of the policy rule, this parameter can still be written in state reserved(7) and enabled(8). Writing to this object is processed by the MIDCOM MIB implementation by choosing a lifetime value that is greater than zero and less than or equal to the minimum of the requested value and the maximum lifetime specified by the MIDCOM MIB implementation at session startup: 0 <= lt_granted <= MINIMUM(lt_requested, lt_maximum) whereas: - lt_granted is the actually granted lifetime by the MIDCOM MIB implementation - lt_requested is the requested lifetime of the MIDCOM client - lt_maximum is the maximum lifetime specified at session setup SNMP set requests to this object may be rejected or the value of the object after an accepted set operation may be less than the value that was contained in the SNMP set request. Successfully writing a value of 0 terminates the policy rule. Note that after a policy rule is terminated, still the entry will exist as long as indicated by the value of midcomRuleStorageTime. Writing to this object in any state other than newEntry(1), setting(2), reserved(7) or enabled(7) will always fail with an inconsistentValue error. If object midcomRuleOperStatus of the same entry has a value other than newEntry(1), setting(2), reserved(7) or enabled(8), then the value of this object is irrelevant." DEFVAL { 180 } ::= { midcomRuleEntry 26 } midcomRuleRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "A control that allows entries to be added and removed from this table. Attempts to destroy(6) a row or to set a row notInService(2) where the value of the midcomRuleStorageType object is permanent(4) or readOnly(5) will result in an inconsistentValue error. The value of this object has no effect on whether other objects in this conceptual row can be modified." ::= { midcomRuleEntry 27 } -- -- Policy rule group group -- -- The midcomGroupTable lists all current policy rule groups. -- midcomGroupTable OBJECT-TYPE SYNTAX SEQUENCE OF MidcomGroupEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table lists all current policy rule groups. Entries in this table are created or removed implicitely when entries in the midcomRuleTable are created or removed, respectively. A group entry in this table only exists as long as there are member rules of this group in the policyRuleTable. Like the midcomSessionTable and the midcomRuleTable, this table is indexed by an owner and an index that is unique per owner. The table serves for listing the existing groups and their remaining lifetimes and for changing lifetimes of groups and implicitly of all group members. Groups and all their member policy rules can be deleted by setting midcomGroupLifetime to 0." ::= { midcomTransaction 4 } midcomGroupEntry OBJECT-TYPE SYNTAX MidcomGroupEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry describing a particular MIDCOM session." INDEX { midcomSessionOwner, midcomGroupIndex } ::= { midcomGroupTable 1 } MidcomGroupEntry ::= SEQUENCE { midcomGroupIndex Unsigned32, midcomGroupLifetime Unsigned32 } midcomGroupIndex OBJECT-TYPE SYNTAX Unsigned32 (1..4294967295) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of this group for the midcomSessionOwner. A group is identified by the combination of midcomSessionOwner and midcomGroupIndex. The value of this index must be unique per midcomSessionOwner." ::= { midcomGroupEntry 2 } midcomGroupLifetime OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "When retrieved, this object delivers the the maximum lifetime in seconds of all member rules of this group, i.e. of all rows in the midcomRuleTable that have the same values for midcomSessionOwner and midcomGroupIndex. Successfully writing to this object modifies the lifetime of all member policies. Successfully writing a value of 0 terminates all member policies and implicitly deletes the group as soon as all member entries are removed from the midcomRuleTable. Note that after a group's lifetime is expired or is set to 0, still the corresponding entry in the midcomGroupTable will exist as long as terminated member policy rules are stored as entries in the midcomRuleTable. Writing to this object is processed by the MIDCOM MIB implementation by choosing a lifetime value that is greater than zero and less than or equal to the minimum of the requested value and the maximum lifetime specified by the MIDCOM MIB implementation at session startup: 0 <= lt_granted <= MINIMUM(lt_requested, lt_maximum) whereas: - lt_granted is the actually granted lifetime by the MIDCOM MIB implementation - lt_requested is the requested lifetime of the MIDCOM client - lt_maximum is the maximum lifetime specified at session setup SNMP set requests to this object may be rejected or the value of the object after an accepted set operation may be less than the value that was contained in the SNMP set request." ::= { midcomGroupEntry 3 } -- -- Configuration Objects -- -- Configuration objects that can be used for retrieving -- middlebox capability information (mandatory) and for -- setting parameters of the implementation of objects in -- the transaction branch (optional). -- -- Note that typically, objects in the configuration branch -- are not intended to be written by MIDCOM clients. In general, -- write access to these objects needs to be restricted more -- strictly than write access to objects in the transaction branch. -- -- -- Capabilities Group -- -- This group contains objects to which MIDCOM clients should -- have read access. -- midcomConfigMaxLifetime OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "When retrieved, this object returns the maximum lifetime in seconds, that this middlebox allows policy rules to have." ::= { midcomConfig 1 } midcomConfigPersistentRules OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "When retrieved, this object returns true(1) if the MIDCOM-MIB implementation can store policy rules persistently. Otherwise, it returns false(2)." ::= { midcomConfig 2 } midcomConfigIfTable OBJECT-TYPE SYNTAX SEQUENCE OF MidcomConfigIfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table capabilities of the MIDCOM-MIB implementation per IP interface. It is indexed by ifIndex. If an entry with ifIndex = 0 occurs, then bits set in objects of this entry apply to all interfaces." ::= { midcomConfig 3 } midcomConfigIfEntry OBJECT-TYPE SYNTAX MidcomConfigIfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry describing The capabilites of a middlebox with respect to the indexed IP interface." INDEX { ifIndex } ::= { midcomConfigIfTable 1 } MidcomConfigIfEntry ::= SEQUENCE { midcomConfigIfBits BITS, midcomConfigIfEnabled TruthValue } midcomConfigIfBits OBJECT-TYPE SYNTAX BITS { ipv4(0), ipv6(1), addressWildcards(2), portWildcards(3), firewall(4), nat(5), portTranslation(6), protocolTranslation(7), twiceNat(8), inside(9) } MAX-ACCESS read-only STATUS current DESCRIPTION "When retrieved, this object returns a set of bits indicating the capabilities (or configuration) of the middlebox with repect to the referenced IP interface. If the index equals 0, then all set bits apply to all interfaces. If the ipv4(0) bit is set, then the middlebox supports IPv4 at the indexed IP interface. If the ipv6(1) bit is set, then the middlebox supports IPv6 at the indexed IP interface. If the addressWildcards(2) bit is set, then the middlebox supports IP address wildcarding at the indexed IP interface. If the portWildcards(3) bit is set, then the middlebox supports port wildcarding at the indexed IP interface. If the firewall(4) bit is set, then the middlebox offers firewall functionality at the indexed interface. If the nat(5) bit is set, then the middlebox offers network address translation service at the indexed interface. If the portTranslation(6) bit is set, then the middlebox offers port translation service at the indexed interface. This bit is only relevant if nat(5) is set. If the protocolTranslation(7) bit is set, then the middlebox offers protocol translation service between IPv4 and IPv6 at the indexed interface. This bit is only relevant if nat(5) is set. If the twiceNat(8) bit is set, then the middlebox offers twice network address translation service at the indexed interface. This bit is only relevant if nat(5) is set. If the inside(9) bit is set, then the indexed interface is an inside interface with respect to NAT functionality. Otherwise, it is an outside interface. This bit is only relevant if nat(5) is set. An SNMP agent supporting both, the MIDCOM-MIB module and the NAT-MIB module SHOULD ensure that the value of this object is consistent with the values of corresponding objects in the NAT-MIB module." ::= { midcomConfigIfEntry 2 } midcomConfigIfEnabled OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object indicates the availability of the middlebox service described by midcomCapabilitiesBits at the indexed IP interface. By writing to this object, the MIDCOM support for the entire IP interface can be switched on or off. Setting this object to false(2) immeadiately stops middlebox support at the indexed IP interface. This implies that all policy rules that use NAT or firewall resources at the indexed IP interface are terminated immediately. In this case, The midcom agent MUST send notifications to all MIDCOM clients with open sessions that have access to one of the terminated rules." DEFVAL { true } ::= { midcomConfigIfEntry 3 } -- -- Firewall Group -- -- This group contains the firewall configuration table -- midcomConfigFirewallTable OBJECT-TYPE SYNTAX SEQUENCE OF MidcomConfigFirewallEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table lists the firewall configuration per IP interface. It can be used for configuring how policy rules created by MIDCOM clients are realized as firewall rules of a firewall implementation. Particularly, the priority used for MIDCOM policy rules can be configured. For a single firewall implementation at a particular IP interface, all MIDCOM policy rules are realized as firewall rules with the same priority. Also a firewall rule group name can be configured. The table is indexed by the IP interface index." ::= { midcomConfig 4 } midcomConfigFirewallEntry OBJECT-TYPE SYNTAX MidcomConfigFirewallEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry describing a particular set of firewall resources." INDEX { ifIndex } ::= { midcomConfigFirewallTable 1 } MidcomConfigFirewallEntry ::= SEQUENCE { midcomConfigFirewallGroupId SnmpAdminString, midcomConfigFirewallPriority Unsigned32 -- Wes, what should be here? } midcomConfigFirewallGroupId OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-write STATUS current DESCRIPTION "The firewall rule group to which all firewall rules of the MIDCOM server are assigned." ::= { midcomConfigFirewallEntry 2 } midcomConfigFirewallPriority OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-write STATUS current DESCRIPTION "The priority assigned to all firewall rules of the MIDCOM server." ::= { midcomConfigFirewallEntry 3 } -- -- Monitoring Objects -- -- Monitoring objects are structured into two groups, -- the midcomResourceGroup providing infomation about used -- resources and the midcomStatisticsGroup providing information -- about MIDCOM transaction statistics. -- -- Resources group -- -- The MIDCOM resources group contains a set of managed -- objects describing the currently used resources of NAT -- and firewall implementations. -- -- -- Textual conventions for objects of the resource group -- MidcomNatBindMode ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "An indicator of the kind of NAT resources used by a policy rule. This definition corresponds to the definition of NatBindMode in the NAT-MIB (RFCXXXX). Value none(3) can be used to indicate that the policy rule does not use any NAT binding. " SYNTAX INTEGER { addressBind(1), addressPortBind(2), none(3) } MidcomNatSessionIdOrZero ::= TEXTUAL-CONVENTION DISPLAY-HINT "d" STATUS current DESCRIPTION "A unique ID that is assigned to each NAT session by a NAT implementation. This definition corresponds to the definition of NatSessionId in the NAT-MIB (RFCXXXX). Value 0 can be used to indicate that policy rule does not use any NAT binding" SYNTAX Unsigned32 -- -- The MIDCOM resource table -- midcomResourceTable OBJECT-TYPE SYNTAX SEQUENCE OF MidcomResourceEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table lists all used middlebox resources per MIDCOM policy rule. The midcomResourceTable is indexed by session owner, group index, rule index." ::= { midcomMonitoring 1 } midcomResourceEntry OBJECT-TYPE SYNTAX MidcomResourceEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry describing a particular set of middlebox resources." -- INDEX { midcomSessionOwner, midcomGroupIndex, midcomRuleIndex } AUGMENTS { midcomRuleEntry } ::= { midcomResourceTable 1 } MidcomResourceEntry ::= SEQUENCE { midcomRscNatInternalAddrBindMode MidcomNatBindMode, midcomRscNatInternalAddrBindId NatBindIdOrZero, midcomRscNatInsideAddrBindMode MidcomNatBindMode, midcomRscNatInsideAddrBindId NatBindIdOrZero, midcomRscNatSessionId1 MidcomNatSessionIdOrZero, midcomRscNatSessionId2 MidcomNatSessionIdOrZero, midcomRscFirewallRuleId Unsigned32 } midcomRscNatInternalAddrBindMode OBJECT-TYPE SYNTAX MidcomNatBindMode MAX-ACCESS read-only STATUS current DESCRIPTION "An indication whether this policy rule uses an address NAT bind or an address-port NAT bind for binding the internal address. If the MIDCOM MIB is operated together with the NAT MIB (RFC XXYY) then object midcomRscNatInternalAddrBindMode contains the same value as the corresponding object natSessionPrivateSrcEPBindMode of the NAT MIB." ::= { midcomResourceEntry 4 } midcomRscNatInternalAddrBindId OBJECT-TYPE SYNTAX NatBindIdOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "This object references to the allocated internal NAT bind that is used by this policy rule. A NAT bind describes the mapping of internal addresses to outside addresses. MIDCOM MIB implementations can read this object to learn the corresponding NAT bind resource for this particular policy rule. If the MIDCOM MIB is operated together with the NAT MIB (RFC XXYY) then object midcomRscNatInternalAddrBindId contains the same value as the corresponding object natSessionPrivateSrcEPBindId of the NAT MIB." ::= { midcomResourceEntry 5 } midcomRscNatInsideAddrBindMode OBJECT-TYPE SYNTAX MidcomNatBindMode MAX-ACCESS read-only STATUS current DESCRIPTION "An indication whether this policy rule uses an address NAT bind or an address-port NAT bind for binding the external address. If the MIDCOM MIB is operated together with the NAT MIB (RFC XXYY) then object midcomRscNatInsideAddrBindMode contains the same value as the corresponding object natSessionPrivateDstEPBindMode of the NAT MIB." ::= { midcomResourceEntry 6 } midcomRscNatInsideAddrBindId OBJECT-TYPE SYNTAX NatBindIdOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "This object references to the allocated external NAT bind that is used by this policy rule. A NAT bind describes the mapping of external addresses to inside addresses. MIDCOM MIB implementations can read this object to learn the corresponding NAT bind resource for this particular policy rule. If the MIDCOM MIB is operated together with the NAT MIB (RFC XXYY) then object midcomRscNatInsideAddrBindId contains the same value as the corresponding object natSessionPrivateDstEPBindId of the NAT MIB." ::= { midcomResourceEntry 7 } midcomRscNatSessionId1 OBJECT-TYPE SYNTAX MidcomNatSessionIdOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "This object references to the first allocated NAT session for this policy rule. MIDCOM MIB implementations can read this object to learn whether a NAT session for a particular policy rule is used or not. A value of 0 means that no NAT session is allocated for this policy rule. A value other than 0 references to the NAT session." ::= { midcomResourceEntry 8 } midcomRscNatSessionId2 OBJECT-TYPE SYNTAX MidcomNatSessionIdOrZero MAX-ACCESS read-only STATUS current DESCRIPTION "This object references to the first allocated NAT session for this policy rule. MIDCOM MIB implementations can read this object to learn whether a NAT session for a particular policy rule is used or not. A value of 0 means that no NAT session is allocated for this policy rule. A value other than 0 references to the NAT session." ::= { midcomResourceEntry 9 } midcomRscFirewallRuleId OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "This object references to the allocated firewall rule in the firewall engine for this policy rule. MIDCOM MIB implementations can read this value to learn whether a firewall rule for this particular policy rule is used or not. A value of 0 means that no firewall rule is allocated for this policy rule. A value other than 0 references to the firewall rule number within the firewall engine." ::= { midcomResourceEntry 10 } -- -- Statistics group -- -- The MIDCOM statistics group contains a set of managed -- objects providing statistics about the usage of objects -- in the transaction branch. -- midcomStatistics OBJECT IDENTIFIER ::= { midcomMonitoring 2 } midcomSessionsRejected OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of rejected MIDCOM sessions. The MIDCOM MIB module can rejected sessions that are not authorized or unknown." ::= { midcomStatistics 1 } midcomSessionsCurrent OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of currently established MIDCOM sessions. This object equals the number of rows in the midcomSessionTable and gives the number of MIDCOM clients (=SNMP managers) that are allowed to read, create, or modify entries in the MIDCOM MIB module." ::= { midcomStatistics 2 } midcomSessionsTotal OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The summarized number of all current and past established MIDCOM sessions." ::= { midcomStatistics 3 } midcomRuleEntriesRejected OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of failed attempts to create an entry in the midcomRuleTable." ::= { midcomStatistics 4 } midcomRulesIncomplete OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy rules that are incomplete. Policy rules are loaded via row entries in midcomRuleTable. This object counts policy rules that are loaded but not fully specified, i.e. the associated action (reserved or enable) is not set. Those rule are typically removed after sometime and counted." ::= { midcomStatistics 5 } midcomReserveRulesIncorrect OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy reserve rules that failed parameter check and entered state incorrectRequest(4)." ::= { midcomStatistics 6 } midcomReserveRulesRejected OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy reserve rules that failed while being processed and entered state requestRejected(6)." ::= { midcomStatistics 7 } midcomReserveRulesActive OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of currently active policy reserve rules." ::= { midcomStatistics 8 } midcomReserveRulesExpired OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of expired policy reserve rules (entered termination state timedOut(9))." ::= { midcomStatistics 9 } midcomReserveRulesTerminatedOnRq OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy reserve rules that were terminated on request (entered termination state terminatedOnRequest(10))." ::= { midcomStatistics 10 } midcomReserveRulesTerminated OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy reserve rules that were terminated, but not on request. (entered termination state terminated(11))." ::= { midcomStatistics 11 } midcomEnableRulesIncorrect OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy enable rules that failed parameter check and entered state incorrectRequest(4)." ::= { midcomStatistics 12 } midcomEnableRulesRejected OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy enable rules that failed while being processed and entered state requestRejected(6)." ::= { midcomStatistics 13 } midcomEnableRulesActive OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of currently active policy enable rules." ::= { midcomStatistics 14 } midcomEnableRulesExpired OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of expired policy enable rules (entered termination state timedOut(9))." ::= { midcomStatistics 15 } midcomEnableRulesTerminatedOnRq OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy enable rules that were terminated on request (entered termination state terminatedOnRequest(10))." ::= { midcomStatistics 16 } midcomEnableRulesTerminated OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of policy enable rules that were terminated, but not on request. (entered termination state terminated(11))." ::= { midcomStatistics 17 } midcomTransactionsRejected OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of rejected transactions." ::= { midcomStatistics 18 } midcomTransactionsFailed OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of failed transactions." ::= { midcomStatistics 19 } midcomTransactionsCompleted OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of completed transactions." ::= { midcomStatistics 20 } -- -- Notifications. The definition of midcomEvent makes notification -- registrations reversible (see STD 58, RFC 2578, Section 8.5). -- midcomEvent OBJECT IDENTIFIER ::= { midcomNotifications 0 } midcomSessionTermination NOTIFICATION-TYPE OBJECTS { midcomSessionRowStatus } STATUS current DESCRIPTION "This notification can be generated for indicating that a session is terminated by the middlebox. The value of object midcomSessionRowStatus sent by this notification SHOULD be destroy(6)." ::= { midcomEvent 1 } midcomRuleEvent NOTIFICATION-TYPE OBJECTS { midcomRuleOperStatus, midcomRuleLifetime } STATUS current DESCRIPTION "This notification can be generated whenever the value of midcomRuleOperStatus enters one of the following states: reserved, enabled, any error state, any termination state. In addition, it can be generated when the lifetime of a rule was changed by successfully writing to object midcomRuleLifetime." ::= { midcomEvent 2 } midcomGroupEvent NOTIFICATION-TYPE OBJECTS { midcomGroupLifetime } STATUS current DESCRIPTION "This notification can be generated for indicating that the lifetime of all member rules of the group was changed by successfully writing to object midcomGroupLifetime. Note that this notification is only sent if the lifetime of a group was changed by successfully writing to object midcomGroupLifetime. No notification is sent - if a group's lifetime is changed by writing to object midcomRuleLifetime of any of its member policies, - if a group's lifetime expires (in this case notifications are sent for all member policies) - if the group is terminated by terminating the last of its member policies without writing to object midcomGroupLifetime." ::= { midcomEvent 3 } -- -- Conformance information -- midcomCompliances OBJECT IDENTIFIER ::= { midcomConformance 1 } midcomGroups OBJECT IDENTIFIER ::= { midcomConformance 2 } -- -- compliance statements -- -- This is the MIDCOM compliance definition ... -- midcomCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for SNMP entities that implement the MIDCOM MIB. Note that compliance with this compliance statement requires compliance with the ifCompliance3 MODULE-COMPLIANCE statement of the IF-MIB [RFC2863]." MODULE -- this module MANDATORY-GROUPS { midcomSessionGroup, midcomRuleGroup, midcomNotificationsGroup, midcomCapabilitiesGroup } GROUP midcomGroupGroup DESCRIPTION "A compliant implementation does not have to implement the midcomGroupGroup." GROUP midcomConfigFirewallGroup DESCRIPTION "A compliant implementation does not have to implement the midcomConfigFirewallGroup." GROUP midcomResourceGroup DESCRIPTION "A compliant implementation does not have to implement the midcomResourceGroup." GROUP midcomStatisticsGroup DESCRIPTION "A compliant implementation does not have to implement the midcomStatisticsGroup." OBJECT midcomRuleInternalIpPrefixLength MIN-ACCESS read-only DESCRIPTION "Write access is not required. When write access is not supported return 128 as the value of this object. A value of 128 means that the function represented by this option is not supported." OBJECT midcomRuleExternalIpPrefixLength MIN-ACCESS read-only DESCRIPTION "Write access is not required. When write access is not supported return 128 as the value of this object. A value of 128 means that the function represented by this option is not supported." OBJECT midcomRuleMaxIdleTime MIN-ACCESS read-only DESCRIPTION "Write access is not required. When write access is not supported return 0 as the value of this object. A value of 0 means that the function represented by this option is not supported." OBJECT midcomRuleInterface MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT midcomConfigMaxLifetime MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT midcomConfigPersistentRules MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT midcomConfigIfEnabled MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT midcomConfigFirewallGroupId MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT midcomConfigFirewallPriority MIN-ACCESS read-only DESCRIPTION "Write access is not required." ::= { midcomCompliances 1 } midcomSessionGroup OBJECT-GROUP OBJECTS { midcomSessionLock, midcomSessionTagList, midcomSessionStorageType, midcomSessionRowStatus } STATUS current DESCRIPTION "A collection of objects providing information about MIDCOM sessions." ::= { midcomGroups 1 } midcomRuleGroup OBJECT-GROUP OBJECTS { midcomRuleAdminStatus, midcomRuleOperStatus, midcomRuleStorageType, midcomRuleStorageTime, midcomRuleError, midcomRuleInterface, midcomRuleFlowDirection, midcomRuleMaxIdleTime, midcomRuleTransportProtocol, midcomRulePortRange, midcomRuleInternalIpVersion, midcomRuleExternalIpVersion, midcomRuleInternalIpAddr, midcomRuleInternalIpPrefixLength, midcomRuleInternalPort, midcomRuleExternalIpAddr, midcomRuleExternalIpPrefixLength, midcomRuleExternalPort, midcomRuleInsideIpAddr, midcomRuleInsidePort, midcomRuleOutsideIpAddr, midcomRuleOutsidePort, midcomRuleLifetime, midcomRuleRowStatus } STATUS current DESCRIPTION "A collection of objects providing information about policy rules." ::= { midcomGroups 2 } midcomGroupGroup OBJECT-GROUP OBJECTS { midcomGroupLifetime } STATUS current DESCRIPTION "A collection of objects providing information about policy rule groups." ::= { midcomGroups 3 } midcomCapabilitiesGroup OBJECT-GROUP OBJECTS { midcomConfigMaxLifetime, midcomConfigPersistentRules, midcomConfigIfBits, midcomConfigIfEnabled } STATUS current DESCRIPTION "A collection of objects providing information about the capabilities of a middlebox." ::= { midcomGroups 4 } midcomConfigFirewallGroup OBJECT-GROUP OBJECTS { midcomConfigFirewallGroupId, midcomConfigFirewallPriority } STATUS current DESCRIPTION "A collection of objects providing information about the firewall rule group and firewall rule priority to be used by firewalls loaded through MIDCOM." ::= { midcomGroups 5 } midcomResourceGroup OBJECT-GROUP OBJECTS { midcomRscNatInternalAddrBindMode, midcomRscNatInternalAddrBindId, midcomRscNatInsideAddrBindMode, midcomRscNatInsideAddrBindId, midcomRscNatSessionId1, midcomRscNatSessionId2, midcomRscFirewallRuleId } STATUS current DESCRIPTION "A collection of objects providing information about the used NAT and firewall resources." ::= { midcomGroups 6 } midcomStatisticsGroup OBJECT-GROUP OBJECTS { midcomSessionsRejected, midcomSessionsCurrent, midcomSessionsTotal, midcomRuleEntriesRejected, midcomRulesIncomplete, midcomReserveRulesIncorrect, midcomReserveRulesRejected, midcomReserveRulesActive, midcomReserveRulesExpired, midcomReserveRulesTerminatedOnRq, midcomReserveRulesTerminated, midcomEnableRulesIncorrect, midcomEnableRulesRejected, midcomEnableRulesActive, midcomEnableRulesExpired, midcomEnableRulesTerminatedOnRq, midcomEnableRulesTerminated, midcomTransactionsRejected, midcomTransactionsFailed, midcomTransactionsCompleted } STATUS current DESCRIPTION "A collection of objects providing statistical information about the MIDCOM server." ::= { midcomGroups 7 } midcomNotificationsGroup OBJECT-GROUP OBJECTS { midcomSessionTermination, midcomRuleEvent, midcomGroupEvent } STATUS current DESCRIPTION "The notifications emitted by the midcomMIB." ::= { midcomGroups 8 } END -- -- Copyright (C) The Internet Society (2004). This document is subject -- to the rights, licenses and restrictions contained in BCP 78, and -- except as set forth therein, the authors retain all their rights. -- -- Acknowledgment -- -- Funding for the RFC Editor function is currently provided by the -- Internet Society.