STATUS current
DESCRIPTION
"The number of seconds remaining until the
registration is expired. It has the same initial value
as haMobilityBindingTimeGranted, and is counted down
by the home agent."
::= { haMobilityBindingEntry 8 }
-- Home Agent Registration Group Counters
-- Home agent registration Counters per node
haCounterTable OBJECT-TYPE
SYNTAX SEQUENCE OF HaCounterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing registration statistics for all
mobile nodes authorized to use this home agent."
::= { haRegistration 2 }
haCounterEntry OBJECT-TYPE
SYNTAX HaCounterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Registration statistics for one mobile node."
INDEX { haMobilityBindingMN }
::= { haCounterTable 1 }
HaCounterEntry ::= SEQUENCE {
haServiceRequestsAccepted Counter32,
haServiceRequestsDenied Counter32,
haOverallServiceTime Gauge32,
haRecentServiceAcceptedTime TimeStamp,
haRecentServiceDeniedTime TimeStamp,
haRecentServiceDeniedCode INTEGER
}
haServiceRequestsAccepted OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of service requests for the mobile node
accepted by the home agent (Code 0 + Code 1)."
::= { haCounterEntry 2 }
haServiceRequestsDenied OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of service requests for the mobile node
denied by the home agent (sum of all registrations
denied with Code 128 through Code 159)."
::= { haCounterEntry 3 }
haOverallServiceTime OBJECT-TYPE
SYNTAX Gauge32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Overall service time (in seconds) that has
accumulated for the mobile node since the home agent
last rebooted."
::= { haCounterEntry 4 }
haRecentServiceAcceptedTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time at which the most recent Registration
Request was accepted by the home agent for this mobile
node."
::= { haCounterEntry 5 }
haRecentServiceDeniedTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time at which the most recent Registration
Request was denied by the home agent for this mobile
node."
::= { haCounterEntry 6 }
haRecentServiceDeniedCode OBJECT-TYPE
SYNTAX INTEGER {
reasonUnspecified(128),
admProhibited(129),
insufficientResource(130),
mnAuthenticationFailure(131),
faAuthenticationFailure(132),
idMismatch(133),
poorlyFormedRequest(134),
tooManyBindings(135),
unknownHA(136)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The Code indicating the reason why the most recent
Registration Request for this mobile node was rejected
by the home agent."
::= { haCounterEntry 7 }
-- Home agent registration Counters for all mobile nodes.
haRegistrationAccepted OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests accepted by
home agent (Code 0)."
::= { haRegistration 3 }
haMultiBindingUnsupported OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests accepted by
home agent -- simultaneous mobility bindings
unsupported (Code 1)."
::= { haRegistration 4 }
haReasonUnspecified OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- reason unspecified (Code 128)."
::= { haRegistration 5 }
haAdmProhibited OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- administratively prohibited (Code 129)."
::= { haRegistration 6 }
haInsufficientResource OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- insufficient resources (Code 130)."
::= { haRegistration 7 }
haMNAuthenticationFailure OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- mobile node failed authentication (Code
131)."
::= { haRegistration 8 }
haFAAuthenticationFailure OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- foreign agent failed authentication (Code
132)."
::= { haRegistration 9 }
haIDMismatch OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- Identification mismatch (Code 133)."
::= { haRegistration 10 }
haPoorlyFormedRequest OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- poorly formed request (Code 134)."
::= { haRegistration 11 }
haTooManyBindings OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- too many simultaneous mobility bindings (Code
135)."
::= { haRegistration 12 }
haUnknownHA OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests denied by home
agent -- unknown home agent address (Code 136)."
::= { haRegistration 13 }
haGratuitiousARPsSent OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of gratuition ARPs sent by the home
agent on behalf of mobile nodes."
::= { haRegistration 14 }
haProxyARPsSent OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of proxy ARPs sent by the home agent on
behalf of mobile nodes."
::= { haRegistration 15 }
haRegRequestsReceived OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests received by
home agent."
::= { haRegistration 16 }
haDeRegRequestsReceived OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Requests received by the
home agent with a Lifetime of zero (requests to
deregister)."
::= { haRegistration 17 }
haRegRepliesSent OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Replies sent by the home
agent."
::= { haRegistration 18 }
haDeRegRepliesSent OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of Registration Replies sent by the home
agent in response to requests to deregister."
::= { haRegistration 19 }
mipMIBNotificationPrefix OBJECT IDENTIFIER ::= { mipMIB 2 }
mipMIBNotifications OBJECT IDENTIFIER ::=
{ mipMIBNotificationPrefix 0 }
mipAuthFailure NOTIFICATION-TYPE
OBJECTS { mipSecViolatorAddress,
mipSecRecentViolationSPI,
mipSecRecentViolationIDLow,
mipSecRecentViolationIDHigh,
mipSecRecentViolationReason
}
STATUS current
DESCRIPTION
"The mipAuthFailure indicates that the Mobile IP
entity has an authentication failure when it validates
the mobile Registration Request or Reply.
Implementation of this trap is optional."
::= { mipMIBNotifications 1 }
mipMIBConformance OBJECT IDENTIFIER ::= { mipMIB 3 }
mipGroups OBJECT IDENTIFIER ::= { mipMIBConformance 1 }
mipCompliances OBJECT IDENTIFIER ::= { mipMIBConformance 2 }
-- compliance statements
mipCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for SNMPv2 entities which
implement the Mobile IP MIB."
MODULE
MANDATORY-GROUPS { mipSystemGroup }
GROUP mipSecAssociationGroup
DESCRIPTION
"This group is mandatory for Mobile IP entities (MN,
FA, and HA) which support security associations.
Mobile Nodes and Home Agents must implement this
group. Foreign Agents must implement this group if
they maintain any security associations."
GROUP mipSecViolationGroup
DESCRIPTION
"This group is mandatory for Mobile IP entities (MN,
FA, and HA) that can log security violations."
GROUP mnSystemGroup
DESCRIPTION
"This group is mandatory for mobile node."
GROUP mnDiscoveryGroup
DESCRIPTION
"This group is mandatory for mobile nodes which
implement the Agent Discovery function."
GROUP mnRegistrationGroup
DESCRIPTION
"This group is mandatory for mobile nodes."
GROUP maAdvertisementGroup
DESCRIPTION
"This group is mandatory for the mobility agents (HA
and FA) since they must implement Agent
Advertisement."
GROUP faSystemGroup
DESCRIPTION
"This group is mandatory for foreign agents."
GROUP faAdvertisementGroup
DESCRIPTION
"This group is mandatory for foreign agents."
GROUP faRegistrationGroup
DESCRIPTION
"This group is mandatory for foreign agents."
GROUP haRegistrationGroup
DESCRIPTION
"This group is mandatory for home agents."
GROUP haRegNodeCountersGroup
DESCRIPTION
"This group is mandatory for home agents which log
registration counters for each individual mobile
node."
GROUP mipSecNotificationsGroup
DESCRIPTION
"This group is mandatory for Mobile IP entities (MN,
FA, and HA) that can report the security violations."
::= { mipCompliances 1 }
-- Units of conformance
mipSystemGroup OBJECT-GROUP
OBJECTS { mipEntities, mipEnable, mipEncapsulationSupported }
STATUS current
DESCRIPTION
"A collection of objects providing the basic Mobile IP
entity's management information."
::= { mipGroups 1 }
mipSecAssociationGroup OBJECT-GROUP
OBJECTS { mipSecAlgorithmType, mipSecAlgorithmMode,
mipSecKey, mipSecReplayMethod }
STATUS current
DESCRIPTION
"A collection of objects providing the management
information for security associations of Mobile IP
entities."
::= { mipGroups 2 }
mipSecViolationGroup OBJECT-GROUP
OBJECTS { mipSecTotalViolations,
mipSecViolationCounter, mipSecRecentViolationSPI,
mipSecRecentViolationTime,
mipSecRecentViolationIDLow,
mipSecRecentViolationIDHigh,
mipSecRecentViolationReason }
STATUS current
DESCRIPTION
"A collection of objects providing the management
information for security violation logging of Mobile
IP entities."
::= { mipGroups 3 }
mnSystemGroup OBJECT-GROUP
OBJECTS { mnState, mnCurrentHA, mnHomeAddress,
mnHAStatus }
STATUS current
DESCRIPTION
"A collection of objects providing the basic
management information for mobile nodes."
::= { mipGroups 4 }
mnDiscoveryGroup OBJECT-GROUP
OBJECTS { mnFAAddress, mnCOA, mnAdvSourceAddress,
mnAdvSequence, mnAdvFlags, mnAdvMaxRegLifetime,
mnAdvMaxAdvLifetime, mnAdvTimeReceived,
mnSolicitationsSent, mnAdvertisementsReceived,
mnAdvsDroppedInvalidExtension,
mnAdvsIgnoredUnknownExtension, mnMoveFromHAToFA,
mnMoveFromFAToFA, mnMoveFromFAToHA,
mnGratuitousARPsSend, mnAgentRebootsDectected }
STATUS current
DESCRIPTION
"A collection of objects providing management
information for the Agent Discovery function within a
mobile node."
::= { mipGroups 5 }
mnRegistrationGroup OBJECT-GROUP
OBJECTS { mnRegAgentAddress, mnRegCOA, mnRegFlags, mnRegIDLow,
mnRegIDHigh, mnRegTimeRequested, mnRegTimeRemaining,
mnRegTimeSent, mnRegIsAccepted, mnCOAIsLocal,
mnRegRequestsSent, mnRegRepliesRecieved,
mnDeRegRequestsSent, mnDeRegRepliesRecieved,
mnRepliesInvalidHomeAddress, mnRepliesUnknownHA,
mnRepliesUnknownFA, mnRepliesInvalidID,
mnRepliesDroppedInvalidExtension,
mnRepliesIgnoredUnknownExtension,
mnRepliesHAAuthenticationFailure,
mnRepliesFAAuthenticationFailure,
mnRegRequestsAccepted, mnRegRequestsDeniedByHA,
mnRegRequestsDeniedByFA,
mnRegRequestsDeniedByHADueToID,
mnRegRequestsWithDirectedBroadcast }
STATUS current
DESCRIPTION
"A collection of objects providing management
information for the registration function within a
mobile node."
::= { mipGroups 6 }
maAdvertisementGroup OBJECT-GROUP
OBJECTS { maAdvMaxRegLifetime,
maAdvPrefixLengthInclusion, maAdvAddress,
maAdvMaxInterval, maAdvMinInterval,
maAdvMaxAdvLifetime,
maAdvResponseSolicitationOnly, maAdvStatus,
maAdvertisementsSent, maAdvsSentForSolicitation,
maSolicitationsReceived }
STATUS current
DESCRIPTION
"A collection of objects providing management
information for the Agent Advertisement function
within mobility agents."
::= { mipGroups 7 }
faSystemGroup OBJECT-GROUP
OBJECTS { faCOAStatus}
STATUS current
DESCRIPTION
"A collection of objects providing the basic
management information for foreign agents."
::= { mipGroups 8 }
faAdvertisementGroup OBJECT-GROUP
OBJECTS { faIsBusy, faRegistrationRequired }
STATUS current
DESCRIPTION
"A collection of objects providing supplemental
management information for the Agent Advertisement
function within a foreign agent."
::= { mipGroups 9 }
faRegistrationGroup OBJECT-GROUP
OBJECTS { faVisitorIPAddress, faVisitorHomeAddress,
faVisitorHomeAgentAddress, faVisitorTimeGranted,
faVisitorTimeRemaining, faVisitorRegFlags,
faVisitorRegIDLow, faVisitorRegIDHigh,
faVisitorRegIsAccepted, faRegRequestsReceived,
faRegRequestsRelayed, faReasonUnspecified,
faAdmProhibited, faInsufficientResource,
faMNAuthenticationFailure, faRegLifetimeTooLong,
faPoorlyFormedRequests,
faEncapsulationUnavailable,
faVJCompressionUnavailable, faHAUnreachable,
faRegRepliesRecieved, faRegRepliesRelayed,
faHAAuthenticationFailure, faPoorlyFormedReplies }
STATUS current
DESCRIPTION
"A collection of objects providing management
information for the registration function within a
foreign agent."
::= { mipGroups 10 }
haRegistrationGroup OBJECT-GROUP
OBJECTS { haMobilityBindingMN, haMobilityBindingCOA,
haMobilityBindingSourceAddress,
haMobilityBindingRegFlags,
haMobilityBindingRegIDLow,
haMobilityBindingRegIDHigh,
haMobilityBindingTimeGranted,
haMobilityBindingTimeRemaining,
haRegistrationAccepted, haMultiBindingUnsupported,
haReasonUnspecified, haAdmProhibited,
haInsufficientResource, haMNAuthenticationFailure,
haFAAuthenticationFailure, haIDMismatch,
haPoorlyFormedRequest, haTooManyBindings,
haUnknownHA, haGratuitiousARPsSent,
haProxyARPsSent, haRegRequestsReceived,
haDeRegRequestsReceived, haRegRepliesSent,
haDeRegRepliesSent }
STATUS current
DESCRIPTION
"A collection of objects providing management
information for the registration function within a
home agent."
::= { mipGroups 11 }
haRegNodeCountersGroup OBJECT-GROUP
OBJECTS { haServiceRequestsAccepted,
haServiceRequestsDenied, haOverallServiceTime,
haRecentServiceAcceptedTime,
haRecentServiceDeniedTime,
haRecentServiceDeniedCode }
STATUS current
DESCRIPTION
"A collection of objects providing management
information for counters related to the registration
function within a home agent."
::= { mipGroups 12 }
mipSecNotifcationsGroup NOTIFICATION-GROUP
NOTIFICATIONS { mipAuthFailure }
STATUS current
DESCRIPTION
"The notification related to security violations."
::= { mipGroups 13 }
END
5. Acknowledgments
This document was produced by the Mobile IP working group. The
editors wish to thank Bob Stewart (Cisco Systems), for his help in
converting from SNMPv1 to SNMPv2. We also want to thank Jim Solomon,
for his encouragement, patience, and help. Thanks to Fredrick Tarberg
and Fredrik Broman (KTH) for their initial efforts in defining a
Mobile IP MIB. Thanks to Frank Kastenholz (FTP Software) for his
comments on the initial MIB from KTH. Thanks to Gerald Maguire (KTH)
for his comments on the first version of this MIB. Thanks to Mike
Roels (Motorola) for his help in testing this MIB.
6. Security Considerations
The Mobile IP MIB affords the network operator the ability to
configure and control the Mobile IP links of a particular system,
including the Mobile IP authentication protocols, and shared secret
key. This represents a security risk.
These risks are addressed in the following manners:
(1) All variables which represent a significant security risk are
placed in separate MIB Groups. By providing Agent Capability
Statements, the implementor of the MIB may elect not to
implement these groups.
(2) The MIB allows the manager station to create the security
association for Mobile IP entities. However, the agent should
always return 0 length octet string when the manager station
retrieves the shared security key in the mipSecAssocTable. In
this way, the Mobile IP entities can prevent the key leaking
from SNMP GET, GET-NEXT, or GET-BULK requests.
(3) The MIB defines a trap for Mobile IP entities to send a
notification to the manager station if there is a security
violation. In this way, the operator can notice the source of
an intruder.
(4) The MIB also defines a table to log the security violations
in the Mobile IP entities. The manager station can retrieve
this log to analyze the security violation instances in the
system.
Thus, in order to preserve the integrity, security and privacy of the
Mobile IP security features, an implementation SHOULD allow access to
this MIB only via SNMPv2 and with other security enhancement such as
SNMPv2Sec. The other way to access this information is in concert
with the IP security protocols (IP Authentication Header and IP
Encapsulating Security Payload).
7.0 References
[1] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and
S. Waldbusser, "Structure of Management Information for version
2 of the Simple Network Management Protocol (SNMPv2)", RFC1902,
January 1996.
[2] McCloghrie, K., and M. Rose, Editors, "Management Information
Base for Network Management of TCP/IP-based internets: MIB-II",
STD 17, RFC1213, March 1991.
[3] Case, J., Fedor, M., Schoffstall, M., and J. Davin, "Simple
Network Management Protocol", RFC1157, May 1990.
[4] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and
S. Waldbusser, "Protocol Operations for version 2 of the Simple
Network Management Protocol (SNMPv2)", RFC1905, January 1996.
[5] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and
S. Waldbusser, "Management Information Base for version 2 of the
Simple Network Management Protocol (SNMPv2)", RFC1907, January
1996.
[6] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and
S. Waldbusser, "Textual Conventions for version 2 of the Simple
Network Management Protocol (SNMPv2)", RFC1903, January 1996.
[7] Solomon J., "Mobile IP Protocol Applicability Statement",
RFC2005, October 1996.
[8] Perkins C., "IP Mobility Support", RFC2002, Octoer 1996.
[9] Perkins C., "IP Encapsulation within IP", RFC2003,
October 1996.
[10] Perkins C., "Minimal Encapsulation within IP", RFC2004,
October 1996.
[11] Hanks S. et. al., "Generic Routing Encapsulation (GRE)",
RFC1701, October 1994.
[12] Deering, S., "ICMP Router Discovery Messages", RFC1256,
September 1991.
[13] Atkinson, R., "IP Authentication Header", RFC1826, August
1995.
[14] Atkinson, R., "IP Encapsulating Security Payload (ESP)", RFC
1827, August 1995.
8. Chair's Address
The working group can be contacted via the current chair:
Jim Solomon
Motorola, Inc.
1301 E. Algonquin Rd.
Schaumburg, IL 60196
Work: +1-847-576-2753
Fax: +1-847-576-3240
EMail: solomon@comm.mot.com
9. Editors' Addresses
Questions about this memo can also be directed to:
David Cong
Room 3149
Motorola
1301 East Algonquin Rd.
Schaumburg, IL 60196
Work: +1-847-576-1357
Fax: +1-847-538-3472
EMail: cong@comm.mot.com
Mark Hamlen
Room 4413
Motorola
1301 East Algonquin Rd.
Schaumburg, IL 60196
Work: +1-847-576-0346
Fax: +1-847-538-6150
EMail: hamlen@comm.mot.com
Charles Perkins
Room J1-A25
T. J. Watson Research Center
IBM Corporation
30 Saw Mill River Rd.
Hawthorne, NY 10532
Work: +1-914-784-7350
Fax: +1-914-784-7007
EMail: perk@watson.ibm.com