MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRTDescr
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRTStorageType
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrIfIndex
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrType
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrNextHopAS
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrMetric1
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrMetric2
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrMetric3
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrMetric4
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrMetric5
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteXCPointer
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT mplsL3VpnVrfRteInetCidrStatus
SYNTAX RowStatus { active(1) }
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
::= { mplsL3VpnCompliances 2 }
-- Units of conformance.
mplsL3VpnScalarGroup OBJECT-GROUP
OBJECTS { mplsL3VpnConfiguredVrfs,
mplsL3VpnActiveVrfs,
mplsL3VpnConnectedInterfaces,
mplsL3VpnNotificationEnable,
mplsL3VpnVrfConfMaxPossRts,
mplsL3VpnVrfConfRteMxThrshTime,
mplsL3VpnIllLblRcvThrsh
}
STATUS current
DESCRIPTION
"Collection of scalar objects required for MPLS VPN
management."
::= { mplsL3VpnGroups 1 }
mplsL3VpnVrfGroup OBJECT-GROUP
OBJECTS { mplsL3VpnVrfVpnId,
mplsL3VpnVrfDescription,
mplsL3VpnVrfRD,
mplsL3VpnVrfCreationTime,
mplsL3VpnVrfOperStatus,
mplsL3VpnVrfActiveInterfaces,
mplsL3VpnVrfAssociatedInterfaces,
mplsL3VpnVrfConfMidRteThresh,
mplsL3VpnVrfConfHighRteThresh,
mplsL3VpnVrfConfMaxRoutes,
mplsL3VpnVrfConfLastChanged,
mplsL3VpnVrfConfRowStatus,
mplsL3VpnVrfConfAdminStatus,
mplsL3VpnVrfConfStorageType
}
STATUS current
DESCRIPTION
"Collection of objects needed for MPLS VPN VRF
management."
::= { mplsL3VpnGroups 2 }
mplsL3VpnIfGroup OBJECT-GROUP
OBJECTS { mplsL3VpnIfVpnClassification,
mplsL3VpnIfVpnRouteDistProtocol,
mplsL3VpnIfConfStorageType,
mplsL3VpnIfConfRowStatus
}
STATUS current
DESCRIPTION
"Collection of objects needed for MPLS VPN interface
management."
::= { mplsL3VpnGroups 3 }
mplsL3VpnPerfGroup OBJECT-GROUP
OBJECTS { mplsL3VpnVrfPerfRoutesAdded,
mplsL3VpnVrfPerfRoutesDeleted,
mplsL3VpnVrfPerfCurrNumRoutes
}
STATUS current
DESCRIPTION
"Collection of objects needed for MPLS VPN
performance information."
::= { mplsL3VpnGroups 4 }
mplsL3VpnPerfRouteGroup OBJECT-GROUP
OBJECTS { mplsL3VpnVrfPerfRoutesDropped,
mplsL3VpnVrfPerfDiscTime
}
STATUS current
DESCRIPTION
"Collection of objects needed to track MPLS VPN
routing table dropped routes."
::= { mplsL3VpnGroups 5 }
mplsL3VpnSecGroup OBJECT-GROUP
OBJECTS { mplsL3VpnVrfSecIllegalLblVltns,
mplsL3VpnVrfSecDiscontinuityTime }
STATUS current
DESCRIPTION
"Collection of objects needed for MPLS VPN
security-related information."
::= { mplsL3VpnGroups 7 }
mplsL3VpnVrfRteGroup OBJECT-GROUP
OBJECTS {
mplsL3VpnVrfRteInetCidrIfIndex,
mplsL3VpnVrfRteInetCidrType,
mplsL3VpnVrfRteInetCidrProto,
mplsL3VpnVrfRteInetCidrAge,
mplsL3VpnVrfRteInetCidrNextHopAS,
mplsL3VpnVrfRteInetCidrMetric1,
mplsL3VpnVrfRteInetCidrMetric2,
mplsL3VpnVrfRteInetCidrMetric3,
mplsL3VpnVrfRteInetCidrMetric4,
mplsL3VpnVrfRteInetCidrMetric5,
mplsL3VpnVrfRteXCPointer,
mplsL3VpnVrfRteInetCidrStatus
}
STATUS current
DESCRIPTION
"Objects required for VRF route table management."
::= { mplsL3VpnGroups 8 }
mplsL3VpnVrfRTGroup OBJECT-GROUP
OBJECTS { mplsL3VpnVrfRTDescr,
mplsL3VpnVrfRT,
mplsL3VpnVrfRTRowStatus,
mplsL3VpnVrfRTStorageType
}
STATUS current
DESCRIPTION
"Objects required for VRF route target management."
::= { mplsL3VpnGroups 9 }
mplsL3VpnNotificationGroup NOTIFICATION-GROUP
NOTIFICATIONS { mplsL3VpnVrfUp,
mplsL3VpnVrfDown,
mplsL3VpnVrfRouteMidThreshExceeded,
mplsL3VpnVrfNumVrfRouteMaxThreshExceeded,
mplsL3VpnNumVrfSecIllglLblThrshExcd,
mplsL3VpnNumVrfRouteMaxThreshCleared
}
STATUS current
DESCRIPTION
"Objects required for MPLS VPN notifications."
::= { mplsL3VpnGroups 10 }
END
-- End of MPLS-VPN-MIB
8. Security Considerations
It is clear that these MIB modules are potentially useful for
monitoring of MPLS LSRs supporting L3 MPLS VPN. This MIB module can
also be used for configuration of certain objects, and anything that
can be configured can be incorrectly configured, with potentially
disastrous results.
There are a number of management objects defined in this MIB module
with a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations. These are the tables and objects and their
sensitivity/vulnerability:
o the mplsL3VpnVrfRouteTable, mplsL3VpnIfConfTable, and
mplsL3VpnVrfTable tables collectively contain objects that may
be used to provision MPLS VRF interfaces and configuration.
Unauthorized access to objects in these tables could result in
disruption of traffic on the network. This is especially true
if these VRFs have been previously provisioned and are in use.
The use of stronger mechanisms such as SNMPv3 security should be
considered where possible. Specifically, SNMPv3 VACM and USM
MUST be used with any v3 agent that implements this MIB module.
Administrators should consider whether read access to these
objects should be allowed, since read access may be undesirable
under certain circumstances.
Some of the readable objects in this MIB module (i.e., objects with a
MAX-ACCESS other than not-accessible) may be considered sensitive or
vulnerable in some network environments. It is thus important to
control even GET and/or NOTIFY access to these objects and possibly
to even encrypt the values of these objects when sending them over
the network via SNMP. These are the tables and objects and their
sensitivity/vulnerability:
o the mplsL3VpnVrfTable, mplsL3VpnIfConfTable tables collectively
show the VRF interfaces and associated VRF configurations as
well as their linkages to other MPLS-related configuration
and/or performance statistics. Administrators not wishing to
reveal this information should consider these objects
sensitive/vulnerable and take precautions so they are not
revealed.
SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPSec),
even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the objects
in this MIB module.
It is RECOMMENDED that implementers consider the security features as
provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for
authentication and privacy).
Further, deployment of SNMP versions prior to SNMPv3 is NOT
RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to
enable cryptographic security. It is then a customer/operator
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module, is properly configured to give access to
the objects only to those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
9. IANA Considerations
As described in MPLS-TC-STD-MIB [RFC3811], MPLS related standards
track MIB modules should be rooted under the mplsStdMIB subtree.
There is one MPLS-related MIB module contained in this document. The
following subsection requests IANA for a new assignment under the
mplsStdMIB subtree. New assignments can only be made via a Standards
Action as specified in [RFC2434].
9.1. IANA Considerations for MPLS-L3VPN-STD-MIB
The IANA has assigned { mplsStdMIB 11 } to the MPLS-L3VPN-STD-MIB
module specified in this document.
10. Dedication
Steve Brannon passed away suddenly on January 30, 2001. We would
like to dedicate our efforts in this area and this document to his
memory.
11. Acknowledgements
This document has benefited from discussions and input from Bill
Fenner, Gerald Ash, Sumit Mukhopadhyay, Mike Piecuch, and Joan Weiss.
12. References
12.1. Normative References
[RFC2119] Bradner, S., "Key Words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3811] Nadeau, T. and J. Cucchiara, "Definition of Textual
Conventions and for Multiprotocol Label Switching (MPLS)
Management", RFC 3811, June 2004.
[RFC3031] Rosen, E., Viswanathan, A., and R. Callon, "Multiprotocol
Label Switching Architecture", RFC 3031, January 2001.
[RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private
Networks (VPNs)", RFC 4364, February 2006.
[RFC2685] Fox B., et al, "Virtual Private Networks Identifier", RFC
2685, September 1999.
[RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An
Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
December 2002.
[RFC3813] Srinivasan, C., Viswanathan, A., and T. Nadeau, "MPLS
Multiprotocol Label Switching (MPLS) Label Switch Router
Management Information Base ", RFC 3813, June 2004
[RFC3812] Srinivasan, C., Viswanathan, A., and T. Nadeau,
"Multiprotocol Label Switching (MPLS) Traffic Engineering
(TE) Management Information Base (MIB)", RFC 3812, June
2004.
[RFC2096] Baker, F., "IP Forwarding Table MIB", RFC 2096, January
1997.
[RFC4265] Schliesser, B. and T. Nadeau, "Definition of Textual
Conventions for Virtual Private Network (VPN) Management",
RFC 4265, November 2005.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J.
Schoenwaelder, "Textual Conventions for Internet Network
Addresses", RFC 4001, February 2005.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
MIB", RFC 2863, June 2000.
[RTPROTO] IANA, "IP Route Protocol MIB",
http://www.iana.org/assignments/ianaiprouteprotocol-mib,
September 2000.
[RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M., and S. Waldbusser, "Structure of Management
Information Version 2 (SMIv2)", STD 58, RFC 2578, April
1999.
[RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M., and S. Waldbusser, "Textual Conventions for
SMIv2", STD 58, RFC 2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M., and S. Waldbusser, "Conformance Statements for
SMIv2", STD 58, RFC 2580, April 1999.
12.2. Informative References
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
[RFC3413] Levi, D., Meyer, P., and B. Stewart, "Simple Network
Management Protocol (SNMP) Applications", STD 62, RFC
3413, December 2002.
[RFC2434] Narten, T. and H. Alvestrand., "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 2434,
October 1998.
13. Contributors’ Addresses
Luyuan Fang
AT&T
200 Laurel Ave
Middletown, NJ 07748
Phone: +1-732-420-1921
EMail: luyuanfang@att.com
Martin Tatham
British Telecom
BT Adastal Park,
Martlesham Heath,
Ipswich, IP5 3RE
UK
Phone: +44 1473 606349
Fax: +44 1473 606727
EMail: martin.tatham@bt.com
Fabio M. Chiussi
Bell Laboratories,
Lucent Technologies
101 Crawfords Corner Road
Room 4D-521
Holmdel, NJ 07733
Phone: +1-732-949-2407
EMail: fabio@bell-labs.com
Joseph Dube
Avici Systems, Inc.
101 Billerica Avenue
North Billerica, MA 01862
Editors’ Addresses
Thomas D. Nadeau
Cisco Systems, Inc.
1414 Massachusetts Ave.
Boxborough, MA 01719
Phone: +1-978-936-1470
EMail: tnadeau@cisco.com
Harmen van der Linde
Cisco Systems, Inc.
1414 Massachusetts Ave.
Boxborough, MA 01719
Phone: +1-732-420-1916
EMail: havander@cisco.com
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).