this interface."
::= { mplsFTNMapEntry 3 }
mplsFTNMapRowStatus OBJECT-TYPE
SYNTAX RowStatus {
active(1),
createAndGo(4),
destroy(6)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Used for controlling the creation and deletion of this
row.
All writable objects in this row may be modified at any
time.
If a conceptual row in mplsFTNMapTable points to a
conceptual row in mplsFTNTable which is subsequently
deleted, the corresponding conceptual row in
mplsFTNMapTable MUST also be deleted by the agent."
::= { mplsFTNMapEntry 4 }
mplsFTNMapStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type for this entry. Conceptual rows
having the value ’permanent’ need not allow write-
access to any columnar objects in this row."
DEFVAL { nonVolatile }
::= { mplsFTNMapEntry 5 }
-- End of mplsFTNMapTable
-- FTN entry performance table
mplsFTNPerfTable OBJECT-TYPE
SYNTAX SEQUENCE OF MplsFTNPerfEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table contains performance statistics on FTN
entries on a per-interface basis."
::= { mplsFTNObjects 6 }
mplsFTNPerfEntry OBJECT-TYPE
SYNTAX MplsFTNPerfEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains performance information for the
specified interface and an FTN entry mapped to this
interface."
INDEX { mplsFTNPerfIndex, mplsFTNPerfCurrIndex }
::= { mplsFTNPerfTable 1 }
MplsFTNPerfEntry ::= SEQUENCE {
mplsFTNPerfIndex InterfaceIndexOrZero,
mplsFTNPerfCurrIndex MplsFTNEntryIndex,
mplsFTNPerfMatchedPackets Counter64,
mplsFTNPerfMatchedOctets Counter64,
mplsFTNPerfDiscontinuityTime TimeStamp
}
mplsFTNPerfIndex OBJECT-TYPE
SYNTAX InterfaceIndexOrZero
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The interface index of an interface that an FTN entry
has been applied/mapped to. Each instance of this
object corresponds to an instance of mplsFTNMapIndex."
::= { mplsFTNPerfEntry 1 }
mplsFTNPerfCurrIndex OBJECT-TYPE
SYNTAX MplsFTNEntryIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Index of an FTN entry that has been applied/mapped to
the specified interface. Each instance of this object
corresponds to an instance of mplsFTNMapCurrIndex."
::= { mplsFTNPerfEntry 2 }
mplsFTNPerfMatchedPackets OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of packets that matched the specified FTN entry
if it is applied/mapped to the specified interface.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
mplsFTNDiscontinuityTime."
::= { mplsFTNPerfEntry 3 }
mplsFTNPerfMatchedOctets OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of octets that matched the specified FTN entry
if it is applied/mapped to the specified interface.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
mplsFTNDiscontinuityTime."
::= { mplsFTNPerfEntry 4 }
mplsFTNPerfDiscontinuityTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime on the most recent occasion at
which any one or more of this entry’s counters suffered
a discontinuity. If no such discontinuities have
occurred since the last re-initialization of the local
management subsystem, then this object contains a zero
value."
::= { mplsFTNPerfEntry 5 }
-- End of mplsFTNPerfTable
-- Module compliance.
-- Top level object IDs.
mplsFTNGroups
OBJECT IDENTIFIER ::= { mplsFTNConformance 1 }
mplsFTNCompliances
OBJECT IDENTIFIER ::= { mplsFTNConformance 2 }
-- Compliance requirement for fully compliant implementations.
mplsFTNModuleFullCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"Compliance statement for agents that provide full
support for MPLS-FTN-STD-MIB."
MODULE IF-MIB -- The Interfaces Group MIB, RFC 2863.
MANDATORY-GROUPS {
ifGeneralInformationGroup,
ifCounterDiscontinuityGroup
}
MODULE -- This module.
MANDATORY-GROUPS {
mplsFTNRuleGroup,
mplsFTNMapGroup,
mplsFTNPerfGroup
}
OBJECT mplsFTNAddrType
SYNTAX InetAddressType { ipv4(1), ipv6(2) }
DESCRIPTION
"An implementation is only required to support IPv4
and/or IPv6 addresses. An implementation is only
required to support the address types that are actually
supported on the LSR."
OBJECT mplsFTNSourceAddrMin
SYNTAX InetAddress (SIZE (4 | 20))
DESCRIPTION
"An implementation is only required to support IPv4
and/or IPv6 addresses. An implementation is only
required to support the address types that are actually
supported on the LSR."
OBJECT mplsFTNSourceAddrMax
SYNTAX InetAddress (SIZE (4 | 20))
DESCRIPTION
"An implementation is only required to support IPv4
and/or IPv6 addresses. An implementation is only
required to support the address types that are actually
supported on the LSR."
OBJECT mplsFTNDestAddrMin
SYNTAX InetAddress (SIZE (4 | 20))
DESCRIPTION
"An implementation is only required to support IPv4
and/or IPv6 addresses. An implementation is only
required to support the address types that are actually
supported on the LSR."
OBJECT mplsFTNDestAddrMax
SYNTAX InetAddress (SIZE (4 | 20))
DESCRIPTION
"An implementation is only required to support IPv4
and/or IPv6 addresses. An implementation is only
required to support the address types that are actually
supported on the LSR."
::= { mplsFTNCompliances 1 }
-- Compliance requirement for read-only implementations.
mplsFTNModuleReadOnlyCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"Compliance requirement for implementations that only
provide read-only support for MPLS-FTN-STD-MIB. Such
devices can then be monitored but cannot be configured
using this MIB module."
MODULE IF-MIB -- The interfaces Group MIB, RFC 2863
MANDATORY-GROUPS {
ifGeneralInformationGroup,
ifCounterDiscontinuityGroup
}
MODULE -- This module
MANDATORY-GROUPS {
mplsFTNRuleGroup,
mplsFTNMapGroup,
mplsFTNPerfGroup
}
OBJECT mplsFTNIndexNext
MIN-ACCESS not-accessible
DESCRIPTION
"This object is not needed when mplsFTNTable is
implemented as read-only."
OBJECT mplsFTNRowStatus
SYNTAX RowStatus { active(1) }
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required, and active is the only
status that needs to be supported."
OBJECT mplsFTNDescr
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNMask
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNAddrType
SYNTAX InetAddressType { ipv4(1), ipv6(2) }
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required. An implementation is only
required to support IPv4 and IPv6 addresses."
OBJECT mplsFTNSourceAddrMin
SYNTAX InetAddress (SIZE (4 | 20))
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required. An implementation is only
required to support IPv4 and IPv6 addresses."
OBJECT mplsFTNSourceAddrMax
SYNTAX InetAddress (SIZE (4 | 20))
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required. An implementation is only
required to support IPv4 and IPv6 addresses."
OBJECT mplsFTNDestAddrMin
SYNTAX InetAddress (SIZE (4 | 20))
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required. An implementation is only
required to support IPv4 and IPv6 addresses."
OBJECT mplsFTNDestAddrMax
SYNTAX InetAddress (SIZE (4 | 20))
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required. An implementation is only
required to support IPv4 and IPv6 addresses."
OBJECT mplsFTNSourcePortMin
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNSourcePortMax
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNDestPortMin
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNDestPortMax
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNProtocol
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNActionType
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNActionPointer
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNDscp
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNStorageType
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT mplsFTNMapRowStatus
SYNTAX RowStatus { active(1) }
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required, and active(1) is the only
status that needs to be supported."
OBJECT mplsFTNMapStorageType
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
::= { mplsFTNCompliances 2 }
-- Units of conformance.
mplsFTNRuleGroup OBJECT-GROUP
OBJECTS {
mplsFTNIndexNext,
mplsFTNTableLastChanged,
mplsFTNRowStatus,
mplsFTNDescr,
mplsFTNMask,
mplsFTNAddrType,
mplsFTNSourceAddrMin,
mplsFTNSourceAddrMax,
mplsFTNDestAddrMin,
mplsFTNDestAddrMax,
mplsFTNSourcePortMin,
mplsFTNSourcePortMax,
mplsFTNDestPortMin,
mplsFTNDestPortMax,
mplsFTNProtocol,
mplsFTNActionType,
mplsFTNActionPointer,
mplsFTNDscp,
mplsFTNStorageType
}
STATUS current
DESCRIPTION
"Collection of objects that implement MPLS FTN rules."
::= { mplsFTNGroups 1 }
mplsFTNMapGroup OBJECT-GROUP
OBJECTS {
mplsFTNMapTableLastChanged,
mplsFTNMapRowStatus,
mplsFTNMapStorageType
}
STATUS current
DESCRIPTION
"Collection of objects that implement activation of MPLS
FTN entries on interfaces."
::= { mplsFTNGroups 2 }
mplsFTNPerfGroup OBJECT-GROUP
OBJECTS {
mplsFTNPerfMatchedPackets,
mplsFTNPerfMatchedOctets,
mplsFTNPerfDiscontinuityTime
}
STATUS current
DESCRIPTION
"Collection of objects providing MPLS FTN performance
information."
::= { mplsFTNGroups 3 }
END
10. Security Considerations
This MIB module can be used to configure LSRs to redirect non-MPLS
traffic into an MPLS cloud. As such, improper manipulation of the
objects represented in this MIB module may result in traffic being
redirected to unintended destinations, potentially resulting in
denial of service to end-users.
There are a number of management objects defined in this MIB module
with a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations. These are the tables and objects and their
sensitivity/vulnerability:
- mplsFTNTable and mplsFTNMapTable can be used to create packet
matching rules for classifying IPv4 or IPv6 traffic and
redirecting matched packets into the MPLS cloud. Modifying
objects in these tables can result in the misdirection of traffic
and potential denial of service to end-users. It may also result
in traffic which was intended to be redirected into the MPLS cloud
being routed through the IP network instead, potentially resulting
in degradation of service quality or outright denial of service.
Some of the readable objects in this MIB module (i.e., objects with a
MAX-ACCESS other than not-accessible) may be considered sensitive or
vulnerable in some network environments. It is thus important to
control even GET and/or NOTIFY access to these objects and possibly
to even encrypt the values of these objects when sending them over
the network via SNMP. These are the tables and objects and their
sensitivity/vulnerability:
- mplsFTNPerfTable provides counters for monitoring the performance
of packet classification rules defined in mplsFTNTable and
mplsFTNMapTable. Unauthorized read access to objects in these
tables may be used to gain traffic flow information.
SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPSec),
even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the objects
in this MIB module.
It is RECOMMENDED that implementers consider the security features as
provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for
authentication and privacy).
Further, deployment of SNMP versions prior to SNMPv3 is NOT
RECOMMENDED. Instead, it is RECOMMENDED that SNMPv3 be deployed and
cryptographic security be enabled. It is then a customer/operator
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module is properly configured to give access to
the objects to only those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
11. IANA Considerations
As described in [MPLSMGMT] and as requested in [RFC3811], MPLS
related standards-track MIB modules should be rooted under the
mplsStdMIB subtree. New assignments can only be made by a standards
action as specified in [RFC2434].
11.1. IANA Considerations for MPLS-FTN-STD-MIB
The IANA has assigned mplsStdMIB 8 to the MPLS-FTN-STD-MIB module
specified in this document.
12. References
12.1. Normative References
[RFC2119] Bradner, S., "Key Words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Structure of Management Information Version 2 (SMIv2)",
STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Textual Conventions for SMIv2", STD 58, RFC 2579, April
1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Conformance Statements for SMIv2", STD 58, RFC 2580,
April 1999.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
MIB", RFC 2863, June 2000.
[RFC3031] Rosen, E., Viswanathan, A., and R. Callon, "Multiprotocol
Label Switching Architecture", RFC 3031, January 2001.
[RFC3289] Baker, F., Chan, K., and A. Smith, "Management Information
Base for the Differentiated Services Architecture", RFC
3289, May 2002.
[RFC3291] Daniele, M., Haberman, B., Routhier, S., and J.
Schoenwaelder, "Textual Conventions for Internet Network
Addresses", RFC 3291, May 2002.
[RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An
Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
December 2002.
[RFC3813] Srinivasan, C., Viswanathan, A., and T. Nadeau,
"Multiprotocol Label Switching (MPLS) Label Switching
Router (LSR) Management Information Base (MIB)", RFC 3813,
June 2004.
[RFC3811] Nadeau, T., and J. Cucchiara, J., Editors, "Definition of
Textual Conventions (TCs) for Multi-Protocol Label
Switching (MPLS) Management", RFC 3811, June 2004.
[RFC3812] Srinivasan, C., Viswanathan, A., and T. Nadeau,
"Multiprotocol Label Switching (MPLS) Traffic Engineering
(TE) Management Information Base (MIB)", RFC 3812, June
2004.
12.2. Informative References
[MPLSMGMT] Nadeau, T., Srinivasan, C., and A. Farrel, "Multiprotocol
Label Switching (MPLS) Management Overview", Work in
Progress, September 2003.
[RFC791] Postel, J., "Internet Protocol", STD 5, RFC 791, September
1981.
[RFC1519] Fuller, V., Li, T., Yu, J., and K. Varadhan, "Classless
Inter-Domain Routing (CIDR): an Address Assignment and
Aggregation Strategy", RFC 1519, September 1993.
[RFC2026] Bradner, S., "The Internet Standards Process -- Revision
3", BCP 9, RFC 2026, October 1996.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 2434,
October 1998.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460, December 1998.
[RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black,
"Definition of the Differentiated Services Field (DS
Field) in the IPv4 and IPv6 Headers", RFC 2474, December
1998.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
13. Acknowledgements
We would particularly like to thank Bert Wijnen for the substantial
time and effort he spent in helping us improve this document. We
would also like to thank David Perkins, Joan Cucchiara, Mike Piecuch,
and Adrien Grise for their insightful comments and additions to this
document.
14. Authors’ Addresses
Thomas D. Nadeau
Cisco Systems, Inc.
300 Apollo Drive