Request for Comments: 4382 H. van der Linde, Ed.
Category: Standards Track Cisco Systems, Inc.
February 2006
MPLS/BGP Layer 3 Virtual Private Network (VPN)
Management Information Base
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols in the Internet community.
In particular, it describes managed objects to configure and/or
monitor Multiprotocol Label Switching Layer-3 Virtual Private
Networks on a Multiprotocol Label Switching (MPLS) Label Switching
Router (LSR) supporting this feature.
Table of Contents
1. Introduction ....................................................2
2. Terminology .....................................................3
3. The Internet-Standard Management Framework ......................3
4. Assumptions and Prerequisites ...................................3
5. Brief Description of MIB Objects ................................3
5.1. mplsL3VpnVrfTable ..........................................3
5.2. mplsL3VpnIfConfTable .......................................4
5.3. mplsL3VpnVrfPerfTable ......................................4
5.4. mplsL3VpnVrfRouteTable .....................................4
5.5. MplsVpnVrfRTTable ..........................................4
6. Example of MPLS L3VPN Setup .....................................4
7. MPLS-L3VPN-STD-MIB Module Definitions ...........................5
8. Security Considerations ........................................38
9. IANA Considerations ............................................40
9.1. IANA Considerations for MPLS-L3VPN-STD-MIB ................40
10. Dedication ....................................................40
11. Acknowledgements ..............................................40
12. References ....................................................40
12.1. Normative References .....................................40
12.2. Informative References ...................................41
1. Introduction
This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols in the Internet community.
In particular, it describes managed objects to configure and/or
monitor Multiprotocol Label Switching Layer-3 Virtual Private
Networks on a Multi-Protocol Label Switching (MPLS) Label Switching
Router (LSR) supporting this feature.
This document adopts the definitions, acronyms, and mechanisms
described in [RFC4364]. Unless otherwise stated, the mechanisms of
[RFC4364] apply and will not be re-described here.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
2. Terminology
This document uses terminology from the document describing the MPLS
architecture [RFC3031] and from the document describing MPLS Layer-3
VPNs (L3VPN) [RFC4364], as well as the MPLS architecture [RFC3031].
Throughout this document, the use of the terms "Provider Edge (PE)
and Customer Edge (CE)" or "PE/CE" will be replaced by "PE" in all
cases except when a network device is a CE when used in the carrier’s
carrier model.
3. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of
RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in STD 58,
RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
[RFC2580].
4. Assumptions and Prerequisites
It is assumed that certain things are configured and operational in
order for the tables and objects described in this MIB to function
correctly. These things are outlined below:
- MPLS in general, must be configured and operational.
- Label Distribution Protocol (LDP) paths or traffic-engineered
tunnels [RFC3812] should be configured between PEs and CEs.
5. Brief Description of MIB Objects
The following subsections describe the purpose of each of the
objects contained in the MPLS-L3VPN-STD-MIB.
5.1. mplsL3VpnVrfTable
This table represents the MPLS L3VPNs that are configured. A
Network Management System (NMS) or SNMP agent creates an entry in
this table for every MPLS L3VPN configured on the LSR being
examined. The Virtual Routing and Forwarding (VRF) that is
configured at a particular device represents an instance of some
VPN, but not the entire VPN (unless it is the only VRF, of course).
The collective set of VRF instances comprises the actual VPN. This
information is typically only known in its entirety at the NMS.
That is, specific devices generally only know of their local VRF
information, but not that of other LSRs’ VRFs.
5.2. mplsL3VpnIfConfTable
This table represents the MPLS L3VPN-enabled interfaces that are
associated with a specific VRF as represented in the aforementioned
mplsL3VpnVrfTable. Each entry in this table corresponds to an
entry in the Interfaces MIB. In addition, each entry extends its
corresponding entry in the Interfaces MIB to contain specific MPLS
L3VPN information. Due to this correspondence, certain objects
such as traffic counters are not found in this MIB to avoid
overlap, but instead are found in the Interfaces MIB [RFC2863].
5.3. mplsL3VpnVrfPerfTable
This table contains objects to measure the performance of MPLS
L3VPNs and augments the mplsL3VpnVrfTable. High capacity counters
are provided for objects that are likely to wrap around quickly on
objects such as high-speed interface counters.
5.4. mplsL3VpnVrfRouteTable
The table contains the objects necessary to configure and monitor
routes used by a particular VRF. This includes a cross-connect
pointer into the MPLS-LSR-STD-MIB’s mplsXCTable, which may be used
to refer that entry to its label stack used to label switch that
entry.
5.5. MplsVpnVrfRTTable
The table contains the objects necessary to configure and monitor
route targets for a particular VRF.
6. Example of MPLS L3VPN Setup
In this section, we provide a brief example of using the MIB
objects described in the following section. While this example is
not meant to illustrate every nuance of the MIB, it is intended as
an aid to understanding some of the key concepts. It is our intent
that it is read only after the reader has gone through the MIB
itself.
This configuration is under the assumption that 1) MPLS has been
pre-configured in the network, through enabling LDP or Resource
Reservation Protocol - Traffic Engineering (RSVP-TE); 2) OSPF or
Intermediate System to Intermediate System (IS-IS) has been pre-
configured; and 3) BGP sessions have been established between PEs.
Defining the VRF, the route target, and route distinguisher:
In mplsL3VpnVrfTable:
{
mplsL3VpnVrfName = "RED",
mplsL3VpnVrfDescription = "Intranet of Company ABC",
mplsL3VpnVrfRD = "100:1", -- octet string
mplsL3VpnVrfRowStatus = createAndGo(4)
}
In mplsL3VpnVrfRouteTable:
{
mplsL3VpnVrfRTRowStatus."Red"."100:1".import = createAndGo,
mplsL3VpnVrfRTRowStatus."Red"."100:1".export = createAndGo
}
7. MPLS-L3VPN-STD-MIB Module Definitions
MPLS-L3VPN-STD-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,
Integer32, Counter32, Unsigned32, Gauge32
FROM SNMPv2-SMI -- [RFC2578]
MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP
FROM SNMPv2-CONF -- [RFC2580]
TEXTUAL-CONVENTION, TruthValue, RowStatus,
TimeStamp, StorageType
FROM SNMPv2-TC -- [RFC2579]
InterfaceIndex, InterfaceIndexOrZero
FROM IF-MIB -- [RFC2863]
VPNIdOrZero
FROM VPN-TC-STD-MIB -- [RFC4265]
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB -- [RFC3411]
IANAipRouteProtocol
FROM IANA-RTPROTO-MIB -- [RTPROTO]
InetAddress, InetAddressType,
InetAddressPrefixLength,
InetAutonomousSystemNumber
FROM INET-ADDRESS-MIB -- [RFC4001]
mplsStdMIB
FROM MPLS-TC-STD-MIB -- [RFC3811]
MplsIndexType
FROM MPLS-LSR-STD-MIB -- [RFC3813]
;
mplsL3VpnMIB MODULE-IDENTITY
LAST-UPDATED "200601230000Z" -- 23 January 2006
ORGANIZATION "IETF Layer-3 Virtual Private
Networks Working Group."
CONTACT-INFO
" Thomas D. Nadeau
tnadeau@cisco.com
Harmen van der Linde
havander@cisco.com
Comments and discussion to l3vpn@ietf.org"
DESCRIPTION
"This MIB contains managed object definitions for the
Layer-3 Multiprotocol Label Switching Virtual
Private Networks.
Copyright (C) The Internet Society (2006). This
version of this MIB module is part of RFC4382; see
the RFC itself for full legal notices."
-- Revision history.
REVISION
"200601230000Z" -- 23 January 2006
DESCRIPTION
"Initial version. Published as RFC 4382."
::= { mplsStdMIB 11 }
-- Textual Conventions.
MplsL3VpnName ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"An identifier that is assigned to each MPLS/BGP VPN and
is used to uniquely identify it. This is assigned by the
system operator or NMS and SHOULD be unique throughout
the MPLS domain. If this is the case, then this identifier
can then be used at any LSR within a specific MPLS domain
to identify this MPLS/BGP VPN. It may also be possible to
preserve the uniqueness of this identifier across MPLS
domain boundaries, in which case this identifier can then
be used to uniquely identify MPLS/BGP VPNs on a more global
basis. This object MAY be set to the VPN ID as defined in
RFC 2685."
REFERENCE
"RFC 2685 Fox B., et al, ’Virtual Private
Networks Identifier’, September 1999."
SYNTAX OCTET STRING (SIZE (0..31))
MplsL3VpnRouteDistinguisher ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Syntax for a route distinguisher and route target
as defined in [RFC4364]."
REFERENCE
"[RFC4364]"
SYNTAX OCTET STRING(SIZE (0..256))
MplsL3VpnRtType ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Used to define the type of a route target usage.
Route targets can be specified to be imported,
exported, or both. For a complete definition of a
route target, see [RFC4364]."
REFERENCE
"[RFC4364]"
SYNTAX INTEGER { import(1), export(2), both(3) }
-- Top level components of this MIB.
mplsL3VpnNotifications OBJECT IDENTIFIER ::= { mplsL3VpnMIB 0 }
mplsL3VpnObjects OBJECT IDENTIFIER ::= { mplsL3VpnMIB 1 }
mplsL3VpnScalars OBJECT IDENTIFIER ::= { mplsL3VpnObjects 1 }
mplsL3VpnConf OBJECT IDENTIFIER ::= { mplsL3VpnObjects 2 }
mplsL3VpnPerf OBJECT IDENTIFIER ::= { mplsL3VpnObjects 3 }
mplsL3VpnRoute OBJECT IDENTIFIER ::= { mplsL3VpnObjects 4 }
mplsL3VpnConformance OBJECT IDENTIFIER ::= { mplsL3VpnMIB 2 }
--
-- Scalar Objects
--
mplsL3VpnConfiguredVrfs OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of VRFs that are configured on this node."
::= { mplsL3VpnScalars 1 }
mplsL3VpnActiveVrfs OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of VRFs that are active on this node.
That is, those VRFs whose corresponding mplsL3VpnVrfOperStatus
object value is equal to operational (1)."
::= { mplsL3VpnScalars 2 }
mplsL3VpnConnectedInterfaces OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Total number of interfaces connected to a VRF."
::= { mplsL3VpnScalars 3 }
mplsL3VpnNotificationEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"If this object is true, then it enables the
generation of all notifications defined in
this MIB. This object’s value should be
preserved across agent reboots."
REFERENCE
"See also [RFC3413] for explanation that
notifications are under the ultimate control of the
MIB modules in this document."
DEFVAL { false }
::= { mplsL3VpnScalars 4 }
mplsL3VpnVrfConfMaxPossRts OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Denotes maximum number of routes that the device
will allow all VRFs jointly to hold. If this value is
set to 0, this indicates that the device is
unable to determine the absolute maximum. In this
case, the configured maximum MAY not actually
be allowed by the device."
::= { mplsL3VpnScalars 5 }
mplsL3VpnVrfConfRteMxThrshTime OBJECT-TYPE
SYNTAX Unsigned32
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Denotes the interval in seconds, at which the route max threshold
notification may be reissued after the maximum value has been
exceeded (or has been reached if mplsL3VpnVrfConfMaxRoutes and
mplsL3VpnVrfConfHighRteThresh are equal) and the initial
notification has been issued. This value is intended to prevent
continuous generation of notifications by an agent in the event
that routes are continually added to a VRF after it has reached
its maximum value. If this value is set to 0, the agent should
only issue a single notification at the time that the maximum
threshold has been reached, and should not issue any more
notifications until the value of routes has fallen below the
configured threshold value. This is the recommended default
behavior."
DEFVAL { 0 }
::= { mplsL3VpnScalars 6 }
mplsL3VpnIllLblRcvThrsh OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The number of illegally received labels above which
the mplsNumVrfSecIllglLblThrshExcd notification
is issued. The persistence of this value mimics
that of the device’s configuration."
::= { mplsL3VpnScalars 7 }
-- VPN Interface Configuration Table
mplsL3VpnIfConfTable OBJECT-TYPE
SYNTAX SEQUENCE OF MplsL3VpnIfConfEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table specifies per-interface MPLS capability
and associated information."
::= { mplsL3VpnConf 1 }
mplsL3VpnIfConfEntry OBJECT-TYPE
SYNTAX MplsL3VpnIfConfEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in this table is created by an LSR for
every interface capable of supporting MPLS L3VPN.
Each entry in this table is meant to correspond to
an entry in the Interfaces Table."
INDEX { mplsL3VpnVrfName, mplsL3VpnIfConfIndex }
::= { mplsL3VpnIfConfTable 1 }
MplsL3VpnIfConfEntry ::= SEQUENCE {
mplsL3VpnIfConfIndex InterfaceIndex,
mplsL3VpnIfVpnClassification INTEGER,
mplsL3VpnIfVpnRouteDistProtocol BITS,
mplsL3VpnIfConfStorageType StorageType,
mplsL3VpnIfConfRowStatus RowStatus
}
mplsL3VpnIfConfIndex OBJECT-TYPE
SYNTAX InterfaceIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This is a unique index for an entry in the
mplsL3VpnIfConfTable. A non-zero index for an
entry indicates the ifIndex for the corresponding
interface entry in the MPLS-VPN-layer in the ifTable.
Note that this table does not necessarily correspond
one-to-one with all entries in the Interface MIB
having an ifType of MPLS-layer; rather, only those
that are enabled for MPLS L3VPN functionality."
REFERENCE
"RFC2863"
::= { mplsL3VpnIfConfEntry 1 }
mplsL3VpnIfVpnClassification OBJECT-TYPE
SYNTAX INTEGER { carrierOfCarrier (1),
enterprise (2),
interProvider (3)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Denotes whether this link participates in a
carrier’s carrier, enterprise, or inter-provider
scenario."
DEFVAL { enterprise }
::= { mplsL3VpnIfConfEntry 2 }
mplsL3VpnIfVpnRouteDistProtocol OBJECT-TYPE
SYNTAX BITS { none (0),
bgp (1),
ospf (2),
rip(3),
isis(4),
static(5),
other (6)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Denotes the route distribution protocol across the
PE-CE link. Note that more than one routing protocol
may be enabled at the same time; thus, this object is
specified as a bitmask. For example, static(5) and
ospf(2) are a typical configuration."
::= { mplsL3VpnIfConfEntry 3 }
mplsL3VpnIfConfStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type for this VPN If entry.
Conceptual rows having the value ’permanent’
need not allow write access to any columnar
objects in the row."
REFERENCE
"See RFC2579."
DEFVAL { volatile }
::= { mplsL3VpnIfConfEntry 4 }
mplsL3VpnIfConfRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This variable is used to create, modify, and/or
delete a row in this table. Rows in this
table signify that the specified interface is
associated with this VRF. If the row creation
operation succeeds, the interface will have been
associated with the specified VRF, otherwise the
agent MUST not allow the association. If the agent
only allows read-only operations on this table, it
MUST create entries in this table as they are created
on the device. When a row in this table is in
active(1) state, no objects in that row can be
modified except mplsL3VpnIfConfStorageType and
mplsL3VpnIfConfRowStatus."
::= { mplsL3VpnIfConfEntry 5 }
-- VRF Configuration Table
mplsL3VpnVrfTable OBJECT-TYPE
SYNTAX SEQUENCE OF MplsL3VpnVrfEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table specifies per-interface MPLS L3VPN
VRF Table capability and associated information.
Entries in this table define VRF routing instances
associated with MPLS/VPN interfaces. Note that
multiple interfaces can belong to the same VRF
instance. The collection of all VRF instances
comprises an actual VPN."
::= { mplsL3VpnConf 2 }
mplsL3VpnVrfEntry OBJECT-TYPE
SYNTAX MplsL3VpnVrfEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in this table is created by an LSR for
every VRF capable of supporting MPLS L3VPN. The
indexing provides an ordering of VRFs per-VPN
interface."
INDEX { mplsL3VpnVrfName }
::= { mplsL3VpnVrfTable 1 }
MplsL3VpnVrfEntry ::= SEQUENCE {
mplsL3VpnVrfName MplsL3VpnName,
mplsL3VpnVrfVpnId VPNIdOrZero,
mplsL3VpnVrfDescription SnmpAdminString,
mplsL3VpnVrfRD MplsL3VpnRouteDistinguisher,
mplsL3VpnVrfCreationTime TimeStamp,
mplsL3VpnVrfOperStatus INTEGER,
mplsL3VpnVrfActiveInterfaces Gauge32,
mplsL3VpnVrfAssociatedInterfaces Unsigned32,
mplsL3VpnVrfConfMidRteThresh Unsigned32,
mplsL3VpnVrfConfHighRteThresh Unsigned32,
mplsL3VpnVrfConfMaxRoutes Unsigned32,
mplsL3VpnVrfConfLastChanged TimeStamp,
mplsL3VpnVrfConfRowStatus RowStatus,
mplsL3VpnVrfConfAdminStatus INTEGER,
mplsL3VpnVrfConfStorageType StorageType
}
mplsL3VpnVrfName OBJECT-TYPE
SYNTAX MplsL3VpnName
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The human-readable name of this VPN. This MAY