DESCRIPTION
"The compliance statement for SNMP entities that
implement the ipForward MIB."
MODULE -- this module
MANDATORY-GROUPS { ipForwardMultiPathGroup }
::= { ipForwardCompliances 2 }
ipForwardMultiPathGroup OBJECT-GROUP
OBJECTS { ipForwardNumber,
ipForwardDest, ipForwardMask, ipForwardPolicy,
ipForwardNextHop, ipForwardIfIndex, ipForwardType,
ipForwardProto, ipForwardAge, ipForwardInfo,
ipForwardNextHopAS,
ipForwardMetric1, ipForwardMetric2, ipForwardMetric3,
ipForwardMetric4, ipForwardMetric5
}
STATUS obsolete
DESCRIPTION
"IP Multipath Route Table."
::= { ipForwardGroups 2 }
END
6. Security Considerations
There are a number of management objects defined in this MIB module
with a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations. These are the tables and objects and their
sensitivity/vulnerability:
1. The inetCidrRouteTable contains routing and forwarding
information that is critical to the operation of the network
node (especially routers). Allowing unauthenticated write
access to this table can compromise the validity of the
forwarding information.
Some of the readable objects in this MIB module (i.e., objects with a
MAX-ACCESS other than not-accessible) may be considered sensitive or
vulnerable in some network environments. It is thus important to
control even GET and/or NOTIFY access to these objects and possibly
to even encrypt the values of these objects when sending them over
the network via SNMP. These are the tables and objects and their
sensitivity/vulnerability:
1. The inetCidrRouteTable contains routing and forwarding
information that can be used to compromise a network.
Specifically, this table can be used to construct a map of the
network in preparation for a denial-of-service attack on the
network infrastructure.
2. The inetCidrRouteProto object identifies the routing protocols
in use within a network. This information can be used to
determine how a denial-of-service attack should be launched.
SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPSec),
even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the objects
in this MIB module.
It is RECOMMENDED that implementers consider the security features as
provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for
authentication and privacy).
Further, deployment of SNMP versions prior to SNMPv3 is NOT
RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to
enable cryptographic security. It is then a customer/operator
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module is properly configured to give access to
the objects only to those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
7. Changes from RFC 2096
This document obsoletes RFC 2096 in the following ways:
1. Replaces ipCidrRouteTable with inetCidrRouteTable. This
applies to corresponding objects and conformance statements.
2. Utilizes the InetAddress TC to support IP version-independent
implementations of the forwarding MIB. This gives common
forwarding MIB support for IPv4 and IPv6.
3. Creates a read-only conformance statement to support
implementations that only wish to retrieve data.
4. Creates the inetCidrRouteDiscards object to replace the
deprecated ipRoutingDiscards and ipv6DiscardedRoutes objects.
The inetCidrRouteTable retains the logical structure of the
ipCidrRouteTable in order to allow the easy upgrade of existing IPv4
implementations to the version-independent MIB.
8. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Structure of Management Information Version 2 (SMIv2)",
STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Textual
Conventions for SMIv2", STD 58, RFC 2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Conformance Statements for SMIv2", STD 58, RFC 2580, April
1999.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
MIB", RFC 2863, June 2000.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J.
Schoenwaelder, "Textual Conventions for Internet Network
Addresses", RFC 4001, February 2005.
[RFC4293] Routhier, S., Ed., "Management Information Base for the
Internet Protocol (IP), RFC 4293, April 2006.
[RTPROTO] IANA, "IP Route Protocol MIB",
http://www.iana.org/assignments/ianaiprouteprotocol-mib,
September 2000.
9. Informative References
[RFC1213] McCloghrie, K. and M. Rose, "Management Information Base
for Network Management of TCP/IP-based internets: MIB-II",
RFC 1213, March 1991.
[RFC1354] Baker, F., "IP Forwarding Table MIB", RFC 1354, July 1992.
[RFC2011] McCloghrie, K., Editor, "SNMPv2 Management Information Base
for the Internet Protocol using SMIv2", RFC 2011, November
1996.
[RFC2096] Baker, F., "IP Forwarding Table MIB", RFC 2096, January
1997.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
[RFC2465] Haskin, D. and S. Onishi, Management Information Base for
IP Version 6: Textual Conventions and General Group", RFC
2465, December 1998.
10. Authors and Acknowledgements
This document was based on RFC 2096 [RFC2096].
The following people provided text for this version of the document,
or were authors of previous versions:
Fred Baker, Cisco
Bill Fenner, AT&T Research
Brian Haberman, Johns Hopkins University - Applied Physics Laboratory
Juergen Schoenwalder, TU Braunschweig
Dave Thaler, Microsoft
Margaret Wasserman, Thingmagic
Dario Accornero, Mark Adam, Qing Li, and Shawn Routhier reviewed the
document and provided helpful feedback.
Mike Heard provided valuable feedback as the MIB Doctor for this
document.
Editors’ Contact Information
Comments or questions regarding this document should be sent to:
Brian Haberman
Johns Hopkins University - Applied Physics Laboratory
Mailstop 17-S442
11100 Johns Hopkins Road
Laurel MD, 20723-6099 USA
Phone: +1-443-778-1319
EMail: brian@innovationslab.net
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).