isisOrigLSPBuffSizeMismatch,
isisProtocolsSupportedMismatch,
isisAdjacencyChange,
isisLSPErrorDetected
}
STATUS current
DESCRIPTION
"The collections of notifications sent by an IS."
::= { isisGroups 5 }
isisISPDUCounterGroup OBJECT-GROUP
OBJECTS {
isisPacketCountIIHello,
isisPacketCountISHello,
isisPacketCountESHello,
isisPacketCountLSP,
isisPacketCountCSNP,
isisPacketCountPSNP,
isisPacketCountUnknown
}
STATUS current
DESCRIPTION
"The collections of objects used to count protocol PDUs."
::= { isisGroups 6 }
isisRATableGroup OBJECT-GROUP
OBJECTS {
isisRAExistState,
isisRAAdminState,
isisRAAddrPrefix,
isisRAMapType,
isisRAMetric,
isisRAMetricType,
isisRASNPAAddress,
isisRASNPAMask,
isisRASNPAPrefix,
isisRAType
}
STATUS current
DESCRIPTION
"The collections of objects used to manage the
reachable NSAP prefixes."
::= { isisGroups 7 }
isisISIPRADestGroup OBJECT-GROUP
OBJECTS {
isisIPRANextHopType,
isisIPRANextHop,
isisIPRAType,
isisIPRAExistState,
isisIPRAAdminState,
isisIPRAMetric,
isisIPRAFullMetric,
isisIPRAMetricType,
isisIPRASNPAAddress,
isisIPRASourceType
}
STATUS current
DESCRIPTION
"The collections of objects used to manage configured
IP addresses."
::= { isisGroups 8 }
isisLSPGroup OBJECT-GROUP
OBJECTS {
isisLSPSeq,
isisLSPZeroLife,
isisLSPChecksum,
isisLSPLifetimeRemain,
isisLSPPDULength,
isisLSPAttributes,
isisLSPTLVSeq,
isisLSPTLVChecksum,
isisLSPTLVType,
isisLSPTLVLen,
isisLSPTLVValue
}
STATUS current
DESCRIPTION
"The collections of objects used to observe the LSP
Database."
::= { isisGroups 9 }
END
5. IANA Considerations
The MIB module in this document uses the following IANA-assigned
OBJECT IDENTIFIER values recorded in the SMI Numbers registry:
Descriptor OBJECT IDENTIFIER value
---------- -----------------------
isisMIB { mib-2 138 }
6. Acknowledgements
This MIB is based on a March 1994 document by Chris Gunner, who
should be held blameless for the errors introduced since then. This
version has been modified to include MIB-II syntax, to exclude
portions of the protocol that are not relevant to IP, such as the
ES-IS protocol, and to add management support for current practice.
We would like to thank the following individuals for constructive and
valuable comments: Mike Bartlett, Neal Castagnoli, Ken Chapman, Joan
Cucchiara, Satish Dattatri, Nagi Jonnala, Adrian Farrel, Shamik
Ganguly, Les Ginsberg, Don Goodspeed, Jeff Gross, Jim Halpin, Jon
Harrison, Dimitri Haskin, C. M. Heard, Peter Higginson, Christian
Hopps, Laura Liu, Gavin McPherson, Kay Noguchi, Serge Maskalik, Z.
Opalka, Jeff Pickering, Sundar Ramachandran, Swaminatha Ramalingam,
Aravind Ravikumar, Juergen Schoenwaelder, Koen Vermeulen, Hans De
Vleeschouwer, Bert Wijnen, and Bingzhang Zhao.
7. Security Considerations
Management information defined in this MIB may be considered
sensitive in some network environments.
7.1. Discussion
This MIB may be used to manage an IP router, which is used to direct
network traffic. The control of network traffic allows an attacker
to deny service to a region of the network or to forward traffic to
adversaries. By raising or lowering metrics, traffic may be directed
to insecure portions of the network. By disabling the protocol on an
interface, the network may be partitioned. Changes to the network
topology will force all routers to recompute their routes. Periodic
route changes have brought down networks in the past by subjecting
routers to stressful recomputations.
There are a number of management objects defined in this MIB that
have a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations. Authentication of received SNMP requests and
controlled access to management information should be employed in
such environments.
We identify a set of threats and then list attributes that can be
used in each form of attack. We discuss the effects that can be
obtained by a single change to the variable in each class.
7.2. Threats
- Drop an Adjacency
- Drop all Peers
- Drop Subnetwork
- Split the Network
- Intermittent Outages
- Redirect Traffic
- Delay Convergence
- Avoid Detection
- Prevent Updates
- Hijack LAN
- Create Problems for CLNS Networks
7.2.1. Drop an Adjacency
By changing attributes that are used to peer, we can disrupt an
adjacency and bring a link down.
isisCirc3WayEnabled
isisCircAdminState
isisCircExistState
isisCircLevelDRHelloTimer
isisCircLevelHelloTimer
isisCircLevelType
isisCircSmallHellos
7.2.2. Drop All Adjacencies
These attributes can be used to break some or all of a router’s
adjacencies. In the case of System ID, the adjacency may be
restored. However, it will subject the network to additional stress.
isisSysLevelType
isisManAreaAddrExistState
isisSysAdminState
isisSysID
7.2.3. Drop Subnetwork
This attribute can be used to stop advertisement of a subnetwork
reachable through a single interface.
isisCircPassiveCircuit
7.2.4. Split the Network
If the network design depends upon Wide Metrics or TE, we can use
these attributes to prevent traffic from passing through a router.
isisSysLevelMetricStyle
isisSysLevelOrigLSPBuffSize
isisSysLevelSPFConsiders
isisSysLevelTEEnabled
isisSysReceiveLSPBufferSize
7.2.5. Intermittent Outages
We can use these attributes to subject the network to a series of
topology changes, or otherwise force extensive recomputations of
routes.
isisSysLevelMinLSPGenInt
isisSysLevelSetOverload
isisSysLevelSetOverloadUntil
isisSysMaxAge
isisSysMaxLSPGenInt
isisSysL2toL1Leaking
isisSysID
7.2.6. Redirect Traffic
By changing attributes such as metrics, we can push traffic to
different parts of the network. This may allow an intruder to
observe data traffic from otherwise remote parts of the network.
We may also use these attributes to deny service to parts of the
network.
isisSysMaxPathSplits
isisCircLevelMetric
isisCircLevelWideMetric
isisIPRAAdminState
isisIPRAExistState
isisIPRAFullMetric
isisIPRAMetric
isisIPRAMetricType
isisIPRANextHop
isisIPRANextHopType
isisIPRASNPAAddress
isisIPRAType
isisRedistributeAddrExistState
isisSummAddrExistState
isisSummAddrFullMetric
isisSummAddrMetric
isisSysL2toL1Leaking
7.2.7. Delay Convergence
These attributes can be used to slow convergence by increasing the
minimal interval required to update a packet.
isisCircLevelCSNPInterval
isisCircLevelLSPThrottle
isisCircLevelMinLSPRetransInt
isisCircLevelPartSNPInterval
isisSysWaitTime
isisCircPassiveCircuit
7.2.8. Avoid Detection
By turning off traps, we can prevent a Network Management station
from observing problems in the network caused by other aspects of an
attack.
isisSysNotificationEnable
7.2.9. Prevent Updates
Mesh Groups can be used to prevent the transmission of Link State
PDUs on certain interfaces, delaying or preventing the propagation of
updates.
isisCircMeshGroup
isisCircMeshGroupEnabled
7.2.10. Hijack LAN
If we have compromised a router, we can use this attribute to become
the designated router and lie about the topology of a LAN.
isisCircLevelISPriority
7.2.11. Create Problems for CLNS Networks
This attribute can be used to modify the handling of CLNS traffic.
isisRAAddrPrefix
isisRAAdminState
isisRAExistState
isisRAMapType
isisRAMetric
isisRAMetricType
isisRASNPAAddress
isisRASNPAMask
isisRASNPAPrefix
isisRAType
isisSysPollESHelloRate
7.2.12. Mostly Harmless
The following writable attributes do not pose a known security risk.
isisCircExtDomain
isisCircExtendedCircID
isisCircIfIndex
isisCircLevelHelloMultiplier
isisCircType
7.2.13. Recommendations
Much of the MIB is used to set or read attributes which are readily
visible to any intruder who has access to traffic. None of the
security attributes are setable or visible through the MIB. Read
access to the MIB does not pose additional risks or vulnerabilities.
If write access is to be provided, it is RECOMMENDED that
implementers consider the security features as provided by the SNMPv3
framework (see [RFC3410], section 8), including full support for the
SNMPv3 cryptographic mechanisms (for authentication and privacy).
SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPSec),
even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the objects
in this MIB module.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED.
Instead, it is RECOMMENDED to deploy SNMPv3 and to enable
cryptographic security. It is then a customer/operator
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module is properly configured to give access to
the objects only to those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
8. Normative References
[ISO10589] ISO 10589, "Intermediate system to Intermediate system
routeing information exchange protocol for use in
conjunction with the Protocol for providing the
Connectionless-mode Network Service (ISO 8473)," ISO/IEC
10589:2002.
[ISO10733] ISO 10733, "Information Processing Systems - Open Systems
Interconnection - Specification of the elements of
Management Information related to OSI Network layer
Standards", September 1998.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC1195] Callon, R., "Use of OSI IS-IS for routing in TCP/IP and
dual environments", RFC 1195, December 1990.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
MIB", RFC 2863, June 2000.
[RFC3289] Baker, F., Chan, K., and A. Smith, "Management Information
Base for the Differentiated Services Architecture", RFC
3289, May 2002.
[RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An
Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
December 2002.
[RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Structure of Management Information Version 2 (SMIv2)",
STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Textual Conventions for SMIv2", STD 58, RFC 2579, April
1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Conformance Statements for SMIv2", STD 58, RFC 2580,
April 1999.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J.
Schoenwaelder, "Textual Conventions for Internet Network
Addresses", RFC 4001, February 2005.
9. Informative References
[RFC2973] Balay, R., Katz, D., and J. Parker, "IS-IS Mesh Groups",
RFC 2973, October 2000.
[RFC3373] Katz, D. and R. Saluja, "Three-Way Handshake for
Intermediate System to Intermediate System (IS-IS) Point-
to-Point Adjacencies", RFC 3373, September 2002.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
Authors’ Address
Jeff Parker
Department of Computer Science
Middlebury College,
Middlebury, Vermont 05753
EMail: jeffp@middlebury.edu
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).