Network Working Group Kalyan Tata Internet Draft Check Point Software Document: draft-ietf-vrrp-unified-mib-09.txt April 2011 Obsoletes: 2787 (if approved) Intended Status: Proposed Standard Expires: Oct 2011 Definitions of Managed Objects for VRRPv3 <draft-ietf-vrrp-unified-mib-09.txt> Abstract This specification defines a portion of the Management Information Base (MIB) for use with SNMP-based network management. In particular, it defines objects for configuring, monitoring, and controlling routers that employ the Virtual Router Redundancy Protocol Version 3 for both IPv4 and IPv6 as defined in RFC 5798. This memo obsoletes RFC 2787. Status of this Memo This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79. This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. Tata Expires Oct 2011 [Page 1]
Internet Draft VRRP unified MIB Apr 2011 The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire in Oct, 2011. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC2119 [RFC2119]. Table of Contents 1. The Internet-Standard Management Framework.....................3 2. Introduction...................................................3 3. Terminology....................................................3 4. Relationship to RFC 2787.......................................3 5. Relation to Interface Group (IF-MIB)...........................3 6. Multi-Stack Implementations....................................3 7. VRRP MIB Structure and Design..................................4 8. VRRP Multistack Scenario.......................................4 9. Definitions....................................................7 10. Security Considerations......................................26 11. IANA Considerations..........................................27 12. Normative References.........................................28 13. Informative References.......................................28 14. Acknowledgments..............................................28 15. Author's Address.............................................29 Tata Expires Oct 2011 [Page 2]
Internet Draft VRRP unified MIB Apr 2011 1. The Internet-Standard Management Framework For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 [RFC3410]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. 2. Introduction This specification defines a portion of the Management Information Base (MIB) for use with SNMP-based network management. In particular, it defines objects for configuring, monitoring, and controlling routers that employ the Virtual Router Redundancy Protocol Version 3 for both IPv4 and IPv6 as defined in RFC 5798 [RFC5798]. 3. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 4. Relationship to RFC 2787 This document obsoletes RFC2787 [RFC2787]. The major changes in this document reflect changes in VRRP protocol between RFC 2338 [RFC2338] and RFC 5798 [RFC5798]. This document is also updated to conform to current MIB conventions. 5. Relation to Interface Group (IF-MIB) Since a router can be participating in VRRP on one or more interfaces, "ifIndex" is used as an index into the tables defined in the VRRP MIB. This MIB module imports ifIndex from the IF-MIB. At this time, the latest version of IF-MIB is from RFC2863 [RFC2863]. 6. Multi-Stack Implementations This MIB module is designed to support Multi-Stack implementations Tata Expires Oct 2011 [Page 3]
Internet Draft VRRP unified MIB Apr 2011 that run VRRP over IPv4 and IPv6. IP version, VRID and ifIndex are used to uniquely identify rows in a multi stack implementation. 7. VRRP MIB Structure and Design This MIB module contains three tables: (1) The vrrpv3OperationsTable, which contains objects that define the operational characteristics of a VRRP router. Rows in this table correspond to instances of virtual routers. (2) The vrrpv3StatisticsTable which contains the operating statistics for a VRRP router. (3) The vrrpv3AssociatedIpAddrTable, contains the addresses of the virtual router(s) that a given VRRP router is backing up. Tables are indexed on ifIndex, VRID and the IP version to uniquely identify a VRRP router. Notifications in this MIB module are controlled using the mechanisms defined in [RFC3413]. 8. VRRP Multistack Scenario The following section provides examples of how some of the objects in this MIB are instantiated. KEY: ---- The labels in the following tables and diagrams correspond to the actual MIB objects as follows: if = IfIndex AddrType= vrrpv3OperationsInetAddrType VrId = vrrpv3OperationsVrId State = vrrpv3OperationsStatus Prior = vrrpOpeartionsPriority IpAddr = vrrpv3OperationsMasterIpAddr The following figure shows a hypothetical network with two VRRP routers VR1 & VR2, configured with two virtual routers. Addresses in '()' indicate the address of the default gateway for a given host, H1 to H4 are IPv4 hosts and H5 to H8 are IPv6 hosts. A, B and C are IPv4 Tata Expires Oct 2011 [Page 4]
Internet Draft VRRP unified MIB Apr 2011 addresses and X, Y and Z are IPv6 addresses. In the diagram, "Interface" is used in the context defined in IF-MIB. +------+ +------+ | VR1 | | VR2 | | | | | +------+ +------+ | | Intf = I1 Intf = I2 IP A | IP X IP B | IP Y IP C | | IP Z VRID = 1 | VRID=2 VRID=2 | VRID = 1 | | ----+------+------+-+-------+--------+--------++------+--------+--- ^ ^ ^ ^ ^ ^ ^ ^ | | | | | | | | (IP A) (IP A) (IP B) (IP B) (IP X) (IP X) (IP Y) (IP Y) | | | | | | | | +----+ +----+ +----+ +----+ +----+ +----+ +----+ +----+ | H1 | | H2 | | H3 | | H4 | | H5 | | H6 | | H7 | | H8 | +----+ +----+ +----+ +----+ +----+ +----+ +----+ +----+ ----- MIB Tables For VRRP Router "VR1": ----- vrrpv3OperationsTable ------------------- | if | VrId |AddrType| State | Prior |IpAddr| | +----+------+--------+-------+-------+------+--(..)--+ | I1 | 01 | 1 | M | 255 | A | | +----+------+--------+-------+-------+------+--(..)--+ | I1 | 01 | 2 | B | 1-254 | Y | | +----+------+--------+-------+-------+------+--(..)--+ | I1 | 02 | 1 | B | 1-254 | B | | +----+------+--------+-------+-------+------+--(..)--+ | I1 | 02 | 2 | M | 255 | X | | +----+------+--------+-------+-------+------+--------+ vrrpv3AssociatedIpAddrTable ------------------------- | if | VrId | AddrType | IP | RowStat | Tata Expires Oct 2011 [Page 5]
Internet Draft VRRP unified MIB Apr 2011 +----+------+----------+------+---------+ | I1 | 01 | 1 | A | active | +----+------+----------+------+---------+ | I1 | 01 | 1 | C | active | +----+------+----------+------+---------+ | I1 | 01 | 2 | Y | active | +----+------+----------+------+---------+ | I1 | 01 | 2 | Z | active | +----+------+----------+------+---------+ | I1 | 02 | 1 | B | active | +----+------+----------+------+---------+ | I1 | 02 | 2 | X | active | +----+------+----------+------+---------+ ----- MIB Tables For VRRP Router "VR2": ----- vrrpv3OperationsTable ------------------- | if | VrId |AddrType| State | Prior |IpAddr| | +----+------+--------+-------+-------+------+--(..)--+ | I2 | 01 | 1 | B | 1-254 | A | | +----+------+--------+-------+-------|------+--(..)--+ | I2 | 01 | 2 | M | 255 | Y | | +----+------+--------+-------+-------+------+--(..)--+ | I2 | 02 | 1 | M | 255 | B | | +----+------+--------+-------+-------+------+--(..)--+ | I2 | 02 | 2 | B | 1-254 | X | | +----+------+--------+-------+-------+------+--------+ vrrpv3AssociatedIpAddrTable ------------------------- | if | VrId |AddrType| IP | RowStat | +----+------+--------+------+---------+ | I2 | 01 | 1 | A | active | +----+------+--------+------+---------+ | I2 | 01 | 1 | C | active | +----+------+--------+------+---------+ | I2 | 01 | 2 | Y | active | +----+------+--------+------+---------+ | I2 | 01 | 2 | Z | active | +----+------+--------+------+---------+ | I2 | 02 | 1 | B | active | +----+------+--------+------+---------+ | I2 | 02 | 2 | X | active | +----+------+--------+------+---------+ Tata Expires Oct 2011 [Page 6]
Internet Draft VRRP unified MIB Apr 2011 NOTES: 1) For "State": M = Master; B = Backup. In the vrrpv3OperationsTable, a "priority" of 255 indicates that the respective router owns the IP address, e.g., this IP address is native to the router (i.e., "the IP Address Owner"). 9. Definitions This MIB module makes reference to the following documents [RFC2578], [RFC2579], [RFC2580], [RFC2863], and [RFC4001]. VRRPV3-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Counter32, Integer32, mib-2, Unsigned32, Counter64, TimeTicks FROM SNMPv2-SMI -- RFC2578 TEXTUAL-CONVENTION, RowStatus, MacAddress, TruthValue, TimeStamp, TimeInterval FROM SNMPv2-TC -- RFC2579 MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF -- RFC2580 ifIndex FROM IF-MIB -- RFC2863 InetAddressType, InetAddress FROM INET-ADDRESS-MIB; -- RFC4001 vrrpv3MIB MODULE-IDENTITY LAST-UPDATED "201104220000Z" -- Apr 22, 2011 ORGANIZATION "IETF VRRP Working Group" CONTACT-INFO "WG E-Mail: vrrp@ietf.org Editor: Kalyan Tata Check Point Software 800 Bridge Park Way, Redwood City, CA 94065 Tata_kalyan@yahoo.com" DESCRIPTION Tata Expires Oct 2011 [Page 7]
Internet Draft VRRP unified MIB Apr 2011 "This MIB describes objects used for managing Virtual Router Redundancy Protocol version 3 (VRRPv3). Copyright (C) The Internet Society (2011). This version of MIB module is part of RFC YYYY. Please see the RFC for full legal notices." REVISION "201104220000Z" -- Apr 22, 2011 DESCRIPTION "Initial version as published in RFC YYYY." -- EdNote: Please replace YYYY with actual RFC number for -- this draft and remove this note. ::= { mib-2 ZZZ } -- EdNote: Please replace ZZZ with IANA assigned number -- and remove this note. -- Textual Conventions Vrrpv3VrIdTC ::= TEXTUAL-CONVENTION DISPLAY-HINT "d" STATUS current DESCRIPTION "The value of the virtual router identifier noted as (VRID) in RFC5798. This along with interface index (ifIndex) and IP version, serves to uniquely identify a virtual router on a given VRRP router." REFERENCE " RFC 5798 (Sections 3 and 5.2.3)" SYNTAX Integer32 (1..255) -- VRRPv3 MIB Groups vrrpv3Notifications OBJECT IDENTIFIER ::= { vrrpv3MIB 0 } vrrpv3Objects OBJECT IDENTIFIER ::= { vrrpv3MIB 1 } vrrpv3Conformance OBJECT IDENTIFIER ::= { vrrpv3MIB 2 } -- VRRPv3 MIB Objects vrrpv3Operations OBJECT IDENTIFIER ::= { vrrpv3Objects 1 } vrrpv3Statistics OBJECT IDENTIFIER ::= { vrrpv3Objects 2 } -- VRRPv3 Operations Table vrrpv3OperationsTable OBJECT-TYPE SYNTAX SEQUENCE OF Vrrpv3OperationsEntry MAX-ACCESS not-accessible STATUS current Tata Expires Oct 2011 [Page 8]
Internet Draft VRRP unified MIB Apr 2011 DESCRIPTION "Unified Operations table for a VRRP router which consists of a sequence (i.e., one or more conceptual rows) of 'vrrpv3OperationsEntry' items each of which describe the operational characteristics of a virtual router." ::= { vrrpv3Operations 1 } vrrpv3OperationsEntry OBJECT-TYPE SYNTAX Vrrpv3OperationsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the vrrpv3OperationsTable containing the operational characteristics of a virtual router. On a VRRP router, a given virtual router is identified by a combination of ifIndex, VRID and the IP version. ifIndex represents a interface of the router. A row must be created with vrrpv3OperationsStatus set to initialize(1) and cannot transition to backup(2) or master(3) until vrrpv3OperationsRowStatus is transitioned to active(1). The information in this table is persistent and when written the entity SHOULD save the change to non- volatile storage." INDEX { ifIndex, vrrpv3OperationsVrId, vrrpv3OperationsInetAddrType } ::= { vrrpv3OperationsTable 1 } Vrrpv3OperationsEntry ::= SEQUENCE { vrrpv3OperationsVrId Vrrpv3VrIdTC, vrrpv3OperationsInetAddrType InetAddressType, vrrpv3OperationsMasterIpAddr InetAddress, vrrpv3OperationsPrimaryIpAddr InetAddress, vrrpv3OperationsVirtualMacAddr MacAddress, vrrpv3OperationsStatus Tata Expires Oct 2011 [Page 9]
Internet Draft VRRP unified MIB Apr 2011 INTEGER, vrrpv3OperationsPriority Unsigned32, vrrpv3OperationsAddrCount Integer32, vrrpv3OperationsAdvInterval TimeInterval, vrrpv3OperationsPreemptMode TruthValue, vrrpv3OperationsAcceptMode TruthValue, vrrpv3OperationsUpTime TimeTicks, vrrpv3OperationsRowStatus RowStatus } vrrpv3OperationsVrId OBJECT-TYPE SYNTAX Vrrpv3VrIdTC MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object contains the Virtual Router Identifier (VRID)." REFERENCE "RFC 4001" ::= { vrrpv3OperationsEntry 1 } vrrpv3OperationsInetAddrType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The IP address type of Vrrpv3OperationsEntry and Vrrpv3AssociatedIpAddrEntry. This value determines the type for vrrpv3OperationsMasterIpAddr, vrrpv3OperationsPrimaryIpAddr and vrrpv3AssociatedIpAddrAddress. ipv4(1) and ipv6(2) are the only two values supported in this MIB module." REFERENCE "RFC 4001" ::= { vrrpv3OperationsEntry 2 } vrrpv3OperationsMasterIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The master router's real IP address. Master router would set this address to vrrpv3OperationsPrimaryIpAddr Tata Expires Oct 2011 [Page 10]
Internet Draft VRRP unified MIB Apr 2011 while transitioning to master state. For backup routers, this is the IP address listed as the source in VRRP advertisement last received by this virtual router." REFERENCE " RFC 5798" ::= { vrrpv3OperationsEntry 3 } vrrpv3OperationsPrimaryIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION "In the case where there is more than one IP Address (associated IP addresses) for a given `ifIndex', this object is used to specify the IP address that will become the vrrpv3OperationsMasterIpAddr', should the virtual router transition from backup state to master." ::= { vrrpv3OperationsEntry 4 } vrrpv3OperationsVirtualMacAddr OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The virtual MAC address of the virtual router. Although this object can be derived from the 'vrrpv3OperationsVrId' object, it is defined so that it is easily obtainable by a management application and can be included in VRRP-related SNMP notifications." ::= { vrrpv3OperationsEntry 5 } vrrpv3OperationsStatus OBJECT-TYPE SYNTAX INTEGER { initialize(1), backup(2), master(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The current state of the virtual router. This object has three defined values: - `initialize', which indicates that the virtual router is waiting for a startup event. Tata Expires Oct 2011 [Page 11]
Internet Draft VRRP unified MIB Apr 2011 - `backup', which indicates the virtual router is monitoring the availability of the master router. - `master', which indicates that the virtual router is forwarding packets for IP addresses that are associated with this router." REFERENCE " RFC 5798" ::= { vrrpv3OperationsEntry 6 } vrrpv3OperationsPriority OBJECT-TYPE SYNTAX Unsigned32 (0..255) MAX-ACCESS read-create STATUS current DESCRIPTION "This object specifies the priority to be used for the virtual router master election process. Higher values imply higher priority. A priority of '0', although not settable, is sent by the master router to indicate that this router has ceased to participate in VRRP and a backup virtual router should transition to become a new master. A priority of 255 is used for the router that owns the associated IP address(es) for VRRP over IPv4 and hence not settable. A 'badValue(3)' should be returned when a user tries to set 0 or 255 for this object. " REFERENCE " RFC 5798 section 6.1" DEFVAL { 100 } ::= { vrrpv3OperationsEntry 7 } vrrpv3OperationsAddrCount OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The number of IP addresses that are associated with this virtual router. This number is equal to the number of rows in the vrrpv3AssociatedAddrTable that correspond to a given ifIndex/VRID/IP version." REFERENCE "RFC 5798 Section 6.1" ::= { vrrpv3OperationsEntry 8 } vrrpv3OperationsAdvInterval OBJECT-TYPE SYNTAX TimeInterval (1..4095) UNITS "centiseconds" MAX-ACCESS read-create Tata Expires Oct 2011 [Page 12]
Internet Draft VRRP unified MIB Apr 2011 STATUS current DESCRIPTION "The time interval, in centiseconds, between sending advertisement messages. Only the master router sends VRRP advertisements." REFERENCE " RFC 5798 section 6.1" DEFVAL { 100} ::= { vrrpv3OperationsEntry 9 } vrrpv3OperationsPreemptMode OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION "Controls whether a higher priority virtual router will preempt a lower priority master." REFERENCE " RFC 5798 section 6.1" DEFVAL { true } ::= { vrrpv3OperationsEntry 10 } vrrpv3OperationsAcceptMode OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION "Controls whether a virtual router in Master state will accept packets addressed to the address owner's IPv6 address as its own if it is not the IPv6 address owner. Default is false(2). This object is not relevant for rows representing VRRP over IPv4 and should be set to false(2)." DEFVAL { false } ::= { vrrpv3OperationsEntry 11 } vrrpv3OperationsUpTime OBJECT-TYPE SYNTAX TimeTicks MAX-ACCESS read-only STATUS current DESCRIPTION "This value represents the amount of time since this virtual router (i.e., the ` vrrpv3OperationsStatus') transitioned out of `initialize'." REFERENCE " RFC 5798 section 6.1" ::= { vrrpv3OperationsEntry 12 } vrrpv3OperationsRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current Tata Expires Oct 2011 [Page 13]
Internet Draft VRRP unified MIB Apr 2011 DESCRIPTION "The RowStatus variable should be used in accordance to installation and removal conventions for conceptual rows. To create a row in this table, a manager sets this object to either createAndGo(4) or createAndWait(5). Until instances of all corresponding columns are appropriately configured, the value of the Corresponding instance of the `vrrpv3OperationsRowStatus' column will be read as notReady(3). In particular, a newly created row cannot be made active(1) until (minimally) the corresponding instance of vrrpv3OperationsInetAddrType, vrrpv3OperationsVrId and vrrpv3OperationsPrimaryIpAddr has been set and there is at least one active row in the `vrrpv3AssociatedIpAddrTable' defining an associated IP address. notInService(2) should be used to administratively bring the row down. A typical order of operation to add a row is: 1. Create a row in vrrpv3OperationsTable with createAndWait(5). 2. Create one or more corresponding rows in vrrpv3AssociatedIpAddrTable. 3. Populate the vrrpv3OperationsEntry. 4. set vrrpv3OperationsRowStatus to active(1). A typical order of operation to delete an entry is: 1. Set vrrpv3OperationsRowStatus to notInService(2). 2. Set the corresponding rows in vrrpv3AssociatedIpAddrTable to destroy(6) to delete the entry. 3. set vrrpv3OperationsRowStatus to destroy(6) to delete the entry." ::= { vrrpv3OperationsEntry 13 } -- VRRP Associated Address Table vrrpv3AssociatedIpAddrTable OBJECT-TYPE SYNTAX SEQUENCE OF Vrrpv3AssociatedIpAddrEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The table of addresses associated with each virtual Tata Expires Oct 2011 [Page 14]
Internet Draft VRRP unified MIB Apr 2011 router." ::= { vrrpv3Operations 2 } vrrpv3AssociatedIpAddrEntry OBJECT-TYPE SYNTAX Vrrpv3AssociatedIpAddrEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the table contains an IP address that is associated with a virtual router. The number of rows for a given IP version, VrID and ifIndex will equal the number of IP addresses associated (e.g., backed up) by the virtual router (equivalent to 'vrrpv3OperationsIpAddrCount'). Rows in the table cannot be modified unless the value of `vrrpv3OperationsStatus' for the corresponding entry in the vrrpv3OperationsTable has transitioned to initialize(1). The information in this table is persistent and when written the entity SHOULD save the change to non- volatile storage." INDEX { ifIndex, vrrpv3OperationsVrId, vrrpv3OperationsInetAddrType, vrrpv3AssociatedIpAddrAddress } ::= { vrrpv3AssociatedIpAddrTable 1 } Vrrpv3AssociatedIpAddrEntry ::= SEQUENCE { vrrpv3AssociatedIpAddrAddress InetAddress, vrrpv3AssociatedIpAddrRowStatus RowStatus } vrrpv3AssociatedIpAddrAddress OBJECT-TYPE SYNTAX InetAddress (SIZE (0|4|16)) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The assigned IP addresses that a virtual router is responsible for backing up. The IP address type is determined by the value of vrrpv3OperationsInetAddrType in the index of this row" Tata Expires Oct 2011 [Page 15]
Internet Draft VRRP unified MIB Apr 2011 REFERENCE " RFC 5798 " ::= { vrrpv3AssociatedIpAddrEntry 1 } vrrpv3AssociatedIpAddrRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The row status variable, used according to installation and removal conventions for conceptual rows. To create a row in this table, a manager sets this object to either createAndGo(4) or createAndWait(5). Setting this object to active(1) results in the addition of an associated address for a virtual router. Setting this object to notInService(2) results in administratively bringing down the row. Destroying the entry or setting it to destroy(6) removes the associated address from the virtual router. The use of other values is implementation-dependent. Implementations should not allow deletion of the last row corresponding to an active row in vrrpv3OperationsTable. Refer to description of vrrpv3OperationsRowStatus for a typical row creation and deletion scenarios." ::= { vrrpv3AssociatedIpAddrEntry 2 } -- VRRP Router Statistics vrrpv3RouterChecksumErrors OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received with an invalid VRRP checksum value. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3GlobalStatisticsDiscontinuityTime." REFERENCE " RFC 5798 Section 5.2.8" ::= { vrrpv3Statistics 1 } vrrpv3RouterVersionErrors OBJECT-TYPE Tata Expires Oct 2011 [Page 16]
Internet Draft VRRP unified MIB Apr 2011 SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received with an unknown or unsupported version number. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3GlobalStatisticsDiscontinuityTime." REFERENCE " RFC 5798 Section 5.2.1" ::= { vrrpv3Statistics 2 } vrrpv3RouterVrIdErrors OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received with a VRID that is not valid for any virtual router on this router. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3GlobalStatisticsDiscontinuityTime." REFERENCE " RFC 5798 Section 5.2.3" ::= { vrrpv3Statistics 3 } vrrpv3GlobalStatisticsDiscontinuityTime OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime on the most recent occasion at which one of vrrpv3RouterChecksumErrors, vrrpv3RouterVersionErrors and vrrpv3RouterVrIdErrors suffered a discontinuity. If no such discontinuities have occurred since the last re-initialization of the local management subsystem, then this object contains a zero value." ::= { vrrpv3Statistics 4 } -- VRRP Router Statistics Table Tata Expires Oct 2011 [Page 17]
Internet Draft VRRP unified MIB Apr 2011 vrrpv3StatisticsTable OBJECT-TYPE SYNTAX SEQUENCE OF Vrrpv3StatisticsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of virtual router statistics." ::= { vrrpv3Statistics 5 } vrrpv3StatisticsEntry OBJECT-TYPE SYNTAX Vrrpv3StatisticsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the table, containing statistics information about a given virtual router." AUGMENTS { vrrpv3OperationsEntry } ::= { vrrpv3StatisticsTable 1 } Vrrpv3StatisticsEntry ::= SEQUENCE { vrrpv3StatisticsMasterTransitions Counter32, vrrpv3StatisticsNewMasterReason INTEGER, vrrpv3StatisticsRcvdAdvertisements Counter64, vrrpv3StatisticsAdvIntervalErrors Counter64, vrrpv3StatisticsIpTtlErrors Counter64, vrrpv3StatisticsProtoErrReason INTEGER, vrrpv3StatisticsRcvdPriZeroPackets Counter64, vrrpv3StatisticsSentPriZeroPackets Counter64, vrrpv3StatisticsRcvdInvalidTypePackets Counter64, vrrpv3StatisticsAddressListErrors Counter64, vrrpv3StatisticsPacketLengthErrors Counter64, vrrpv3StatisticsRowDiscontinuityTime TimeStamp, vrrpv3StatisticsRefreshRate Unsigned32 } Tata Expires Oct 2011 [Page 18]
Internet Draft VRRP unified MIB Apr 2011 vrrpv3StatisticsMasterTransitions OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of times that this virtual router's state has transitioned to MASTER. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." ::= { vrrpv3StatisticsEntry 1 } vrrpv3StatisticsNewMasterReason OBJECT-TYPE SYNTAX INTEGER { notMaster (0), priority (1), preempted (2), masterNoResponse (3) } MAX-ACCESS read-only STATUS current DESCRIPTION "This indicates the reason for the virtual router to transition to MASTER state. If the virtual router never transitioned to master state, this SHOULD be set to notmaster(0). Otherwise this indicates the reason this virtual router transitioned to master state the last time. Used by vrrpv3NewMaster notification." ::= { vrrpv3StatisticsEntry 2 } vrrpv3StatisticsRcvdAdvertisements OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP advertisements received by this virtual router. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." Tata Expires Oct 2011 [Page 19]
Internet Draft VRRP unified MIB Apr 2011 ::= { vrrpv3StatisticsEntry 3 } vrrpv3StatisticsAdvIntervalErrors OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP advertisement packets received for which the advertisement interval is different from the vrrpv3OperationsAdvInterval configured on this virtual router. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." ::= { vrrpv3StatisticsEntry 4 } vrrpv3StatisticsIpTtlErrors OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received by the Virtual router with IPv4 TTL (for VRRP over IPv4) or IPv6 Hop Limit (for VRRP over IPv6) not equal to 255. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." REFERENCE "RFC 5798 Section 5.1.1.3" ::= { vrrpv3StatisticsEntry 5 } vrrpv3StatisticsProtoErrReason OBJECT-TYPE SYNTAX INTEGER { noError (0), ipTtlError (1), versionError (2), checksumError (3), vrIdError(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "This indicates the reason for the last protocol error. This SHOULD be set to noError(0) when no protocol errors are encountered. Used by vrrpv3ProtoError Tata Expires Oct 2011 [Page 20]
Internet Draft VRRP unified MIB Apr 2011 notification." ::= { vrrpv3StatisticsEntry 6 } vrrpv3StatisticsRcvdPriZeroPackets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received by the virtual router with a priority of '0'. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." REFERENCE "RFC 5798 Section 5.2.4" ::= { vrrpv3StatisticsEntry 7 } vrrpv3StatisticsSentPriZeroPackets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets sent by the virtual router with a priority of '0'. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." REFERENCE "RFC 5798 Section 5.3.4" ::= { vrrpv3StatisticsEntry 8 } vrrpv3StatisticsRcvdInvalidTypePackets OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of VRRP packets received by the virtual router with an invalid value in the 'type' field. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." ::= { vrrpv3StatisticsEntry 9 } Tata Expires Oct 2011 [Page 21]
Internet Draft VRRP unified MIB Apr 2011 vrrpv3StatisticsAddressListErrors OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received for which the address list does not match the locally configured list for the virtual router. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." ::= { vrrpv3StatisticsEntry 10 } vrrpv3StatisticsPacketLengthErrors OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received with a packet length less than the length of the VRRP header. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpv3StatisticsRowDiscontinuityTime." ::= { vrrpv3StatisticsEntry 11 } vrrpv3StatisticsRowDiscontinuityTime OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime on the most recent occasion at which any one or more of this entry's counters suffered a discontinuity. If no such discontinuities have occurred since the last re-initialization of the local management subsystem, then this object contains a zero value." ::= { vrrpv3StatisticsEntry 12 } vrrpv3StatisticsRefreshRate OBJECT-TYPE SYNTAX Unsigned32 UNITS "milli-seconds" MAX-ACCESS read-only Tata Expires Oct 2011 [Page 22]
Internet Draft VRRP unified MIB Apr 2011 STATUS current DESCRIPTION "The minimum reasonable polling interval for this entry. This object provides an indication of the minimum Amount of time required to update the counters in this entry." ::= { vrrpv3StatisticsEntry 13 } -- Notification Definitions -- Notifications may be controlled using SNMP-NOTIFICATION-MIB vrrpv3NewMaster NOTIFICATION-TYPE OBJECTS { vrrpv3OperationsMasterIpAddr, vrrpv3StatisticsNewMasterReason } STATUS current DESCRIPTION "The newMaster notification indicates that the sending agent has transitioned to 'Master' state." ::= { vrrpv3Notifications 1 } vrrpv3ProtoError NOTIFICATION-TYPE OBJECTS { vrrpv3StatisticsProtoErrReason } STATUS current DESCRIPTION "The notification indicates that the sending agent has encountered the protocol error indicated by vrrpv3StatisticsProtoErrReason." ::= { vrrpv3Notifications 2 } -- Conformance Information vrrpv3Compliances OBJECT IDENTIFIER ::= { vrrpv3Conformance 1 } vrrpv3Groups OBJECT IDENTIFIER ::= { vrrpv3Conformance 2 } -- Compliance Statements vrrpv3FullCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement" MODULE -- this module MANDATORY-GROUPS { Tata Expires Oct 2011 [Page 23]
Internet Draft VRRP unified MIB Apr 2011 vrrpv3OperationsGroup, vrrpv3StatisticsGroup, vrrpv3InfoGroup, vrrpv3NotificationsGroup } OBJECT vrrpv3OperationsPriority WRITE-SYNTAX Unsigned32 (1..254) DESCRIPTION "Setable values are from 1 to 254." ::= { vrrpv3Compliances 1 } vrrpv3ReadOnlyCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "When this MIB module is implemented without support for read-create (i.e. in read-only mode), then such an implementation can claim read-only compliance. Such a device can then be monitored but can not be configured with this MIB." MODULE -- this module MANDATORY-GROUPS { vrrpv3OperationsGroup, vrrpv3StatisticsGroup, vrrpv3StatisticsDiscontinuityGroup, vrrpv3InfoGroup, vrrpv3NotificationsGroup } OBJECT vrrpv3OperationsPriority MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpv3OperationsPrimaryIpAddr MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpv3OperationsAdvInterval MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpv3OperationsPreemptMode MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpv3OperationsAcceptMode MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpv3OperationsRowStatus Tata Expires Oct 2011 [Page 24]
Internet Draft VRRP unified MIB Apr 2011 MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpv3AssociatedIpAddrRowStatus MIN-ACCESS read-only DESCRIPTION "Write access is not required." ::= { vrrpv3Compliances 2 } -- Conformance Groups vrrpv3OperationsGroup OBJECT-GROUP OBJECTS { vrrpv3OperationsVirtualMacAddr, vrrpv3OperationsStatus, vrrpv3OperationsPriority, vrrpv3OperationsMasterIpAddr, vrrpv3OperationsAdvInterval, vrrpv3OperationsPreemptMode, vrrpv3OperationsAcceptMode, vrrpv3OperationsUpTime, vrrpv3OperationsRowStatus, vrrpv3OperationsAddrCount, vrrpv3OperationsPrimaryIpAddr, vrrpv3AssociatedIpAddrRowStatus } STATUS current DESCRIPTION "Conformance group for VRRPv3 operations." ::= { vrrpv3Groups 1 } vrrpv3StatisticsGroup OBJECT-GROUP OBJECTS { vrrpv3RouterChecksumErrors, vrrpv3RouterVersionErrors, vrrpv3RouterVrIdErrors, vrrpv3StatisticsMasterTransitions, vrrpv3StatisticsNewMasterReason, vrrpv3StatisticsRcvdAdvertisements, vrrpv3StatisticsAdvIntervalErrors, vrrpv3StatisticsRcvdPriZeroPackets, vrrpv3StatisticsSentPriZeroPackets, vrrpv3StatisticsRcvdInvalidTypePackets, vrrpv3StatisticsIpTtlErrors, vrrpv3StatisticsProtoErrReason, vrrpv3StatisticsAddressListErrors, vrrpv3StatisticsPacketLengthErrors, Tata Expires Oct 2011 [Page 25]
Internet Draft VRRP unified MIB Apr 2011 vrrpv3StatisticsRowDiscontinuityTime, vrrpv3StatisticsRefreshRate } STATUS current DESCRIPTION "Conformance group for VRRPv3 statistics." ::= { vrrpv3Groups 2 } vrrpv3StatisticsDiscontinuityGroup OBJECT-GROUP OBJECTS { vrrpv3GlobalStatisticsDiscontinuityTime } STATUS current DESCRIPTION "Objects providing information statistics counter discontinuities." ::= { vrrpv3Groups 3 } vrrpv3InfoGroup OBJECT-GROUP OBJECTS { vrrpv3StatisticsProtoErrReason, vrrpv3StatisticsNewMasterReason } STATUS current DESCRIPTION "Conformance group for objects contained in VRRPv3 notifications." ::= { vrrpv3Groups 4 } vrrpv3NotificationsGroup NOTIFICATION-GROUP NOTIFICATIONS { vrrpv3NewMaster, vrrpv3ProtoError } STATUS current DESCRIPTION "The VRRP MIB Notification Group." ::= { vrrpv3Groups 5 } END 10. Security Considerations There are a number of management objects defined in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure Tata Expires Oct 2011 [Page 26]
Internet Draft VRRP unified MIB Apr 2011 environment without proper protection can have a negative effect on network operations. These are the tables and objects and their sensitivity/vulnerability: The objects vrrpv3OperationsPriority, vrrpv3OperationsPrimaryIpAddr, vrrpv3OperationsAdvInterval, vrrpv3OperationsPreemptMode, vrrpv3OperationsAcceptMode, vrrpv3OperationsRowStatus and vrrpv3AssociatedIpAddrRowStatus possess the read-create attribute. Manipulation of these objects is capable of affecting the operation of a virtual router. Specific examples of this include, but are not limited to: o The vrrpv3OperationsRowStatus object which could be used to disable a virtual router. While there are other columns that, if changed, could disrupt operations, they can not be changed without first changing the RowStatus object. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them. 11. IANA Considerations The MIB module in this document uses the following IANA-assigned OBJECT IDENTIFIER values recorded in the SMI Numbers registry: Descriptor OBJECT IDENTIFIER value ---------- ----------------------- vrrpv3MIB { mib-2 ZZZ } Tata Expires Oct 2011 [Page 27]
Internet Draft VRRP Unified MIB Aug 2009 [Editor's Note (to be removed prior to publication): The IANA is requested to assign a value for "ZZZ" under the 'mib-2' subtree and to record the assignment in the SMI Numbers registry. When the assignment has been made, the RFC Editor is asked to replace "ZZZ" (here and in the MIB module) with the assigned value. This document obsoletes RFC 2787 and the IANA is requested to deprecate the value 68 under 'mib-2' assigned to VRRP-MIB.] 12. Normative References [RFC2119] Bradner S., "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997. [RFC2578] McCloghrie, K., D. Perkins, J. Schoenwaelder, J. Case, M. Rose, S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [RFC2579] McCloghrie, K., D. Perkins, J. Schoenwaelder, J. Case, M. Rose, S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [RFC2580] McCloghrie, K., D. Perkins, J. Schoenwaelder, J. Case, M. Rose, S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [RFC2338] S.Knight, D.Weaver, D.Whipple, R.Hinden, D.Mitzel, P.Hunt, P.Higginson, M.Shand, A.Lindem, "Virtual Router Redundancy Protocol", RFC 2338, April 1998. [RFC5798] S. Nadas, Ed., "Virtual Router Redundancy Protocol Version 3 for IPv4 and IPv6 ", RFC 5798, Mar 2010. [RFC2787] Jewell, B., D. Chuang, "Definitions of Managed Objects for the Virtual Router Redundancy Protocol", RFC 2787, March 2000. [RFC2863] McCloghrie, K., Kastenholz, F., "The Interfaces Group MIB" RFC2863, June 2000. [RFC4001] Daniele, M., Haberman, B., Routhier, S., and J. Schoenwaelder, "Textual Conventions for Internet Network Addresses", RFC 4001, February 2005. [RFC3413] Levi, D., Meyer, P., Stewart, B., "SNMP Applications", RFC 3413, December 2002. 13. Informative References [RFC3410] Case, J., R. Mundy, D. Partain, B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002. 14. Acknowledgments Kripakaran Karlekar and Brain Jewell helped in design and initial drafts of this specification. This specification is based on RFC Tata Expires Oct 2011 [Page 28]
Internet Draft VRRP Unified MIB Aug 2009 2787. The authors of RFC2787 are Brian Jewell and David Chuang. The author would also like to thank Bert Wijnen, Dave Thaler, Joan Cucchiara, Mukesh Gupta, Steve Bates and Adrian Farrel, for taking time to review the document and provide valuable guidance. 15. Author's Address Srinivas Kalyan Tata Check Point Software 800 Bridge Parkway Redwood City, CA 94065 Phone: +1-408-505-0542 EMail: tata_kalyan@yahoo.com Tata Expires Oct 2011 [Page 29]
