Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4T
IPsec--SNMP Support
Download this chapter
IPsec--SNMP SupportIPsec--SNMP Support
Download the complete book
Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4TCisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4T (PDF - 8 MB)
give_us_feedback

Table Of Contents

IPsec—SNMP Support

Feature Overview

Benefits

Restrictions

Related Features and Technologies

Related Documents

Supported Platforms

Supported Standards, MIBs, and RFCs

Configuration Tasks

Enabling IPsec SNMP Notifications

Configuring IPsec Failure History Table Size

Configuring IPsec Tunnel History Table Size

Verifying IPsec MIB Configuration

Monitoring and Maintaining IPsec MIB

Configuration Examples

Enabling IPsec Notifications Examples

Specifying History Table Size Examples

Command Reference

Glossary


IPsec—SNMP Support

Feature History

Release
Modification

12.1(4)E

This feature was introduced on the Cisco 7100, 7200, and 7500 series.

12.1(5a)E

Support for CISCO-IPSEC-FLOW-MONITOR-MIB notifications was added.

12.2(4)T

Support for this feature was added for platforms in Release 12.2 T.

12.2(8)T, 12.1(11b)E

The following Command Line Interface (CLI) commands were added to enable and disable IP Security (IPsec) MIB notifications:

•snmp-server enable traps ipsec

•snmp-server enable traps isakmp

12.2(14)S

This feature was integrated into Cisco IOS Release 12.2(14)S.

Cisco IOS XE Release 2.1

This feature was introduces on the Cisco ASR 1000 Series Routers.


This document describes the IPsec—SNMP Support feature in Cisco IOS Release 12.1 E, 12.2 T, and 12.2 S and includes the following sections:

•Feature Overview

•Supported Platforms

•Supported Standards, MIBs, and RFCs

•Configuration Tasks

•Monitoring and Maintaining IPsec MIB

•Configuration Examples

•Command Reference

•Glossary

Note This document focuses on Cisco IOS CLI support for the Cisco IPsec MIBs. This document also lists which elements of the MIBs are currently supported. This document does not describe SNMP configuration (from a Network Management Station) of the Cisco IPsec MIBs.

Feature Overview

The IP Security (IPsec) - SNMP Support feature introduces support for industry-standard IPsec MIBs and Cisco IOS-software specific IPsec MIBs.

The IPsec MIBs allow IPsec configuration monitoring and IPsec status monitoring using SNMP, and can be integrated in a variety of Virtual Private Network (VPN) management solutions.

For example, this feature allows you to specify the desired size of a tunnel history table or a tunnel failure table using the Cisco IOS CLI. The history table archives attribute and statistic information about the tunnel; the failure table archives tunnel failure reasons along with the time failure occurred. A failure history table can be used as a simple method to distinguish between a normal and an abnormal tunnel termination. That is, if a tunnel entry in the tunnel history table has no associated failure record, the tunnel must have terminated normally. However, a tunnel history table does not accompany every failure table because every failure does not correspond to a tunnel. Thus, supported setup failures are recorded in the failure table, but an associated history table is not recorded because a tunnel was never set up.

This feature also provides IPsec Simple Network Management Protocol (SNMP) notifications for use with network management systems.

Benefits

The commands in this feature allow you to examine the version of the IPsec MIB feature, to enable and disable SNMP traps, and to monitor and control the size of the buffers used by this feature.

Restrictions

Only the following tunnel setup failure logs are supported with the IPsec - SNMP Support feature:

•NOTIFY_MIB_IPSEC_PROPOSAL_INVALID

"A tunnel could not be established because the peer did not supply an acceptable proposal."

•NOTIFY_MIB_IPSEC_ENCRYPT_FAILURE

"A tunnel could not be established because it failed to encrypt a packet to be sent to a peer."

•NOTIFY_MIB_IPSEC_SYSCAP_FAILURE

"A tunnel could not be established because the system ran out of resources."

•NOTIFY_MIB_IPSEC_LOCAL_FAILURE

"A tunnel could not be established because of an internal error."

Note that these failure notices are recorded in the failure tables, but are not available as SNMP notifications (traps).

The following functions are not supported with the IPsec MIB feature:

•Checkpointing

•The Dynamic Cryptomap table of the CISCO-IPSEC-MIB

Note CISCO-IPSEC-FLOW-MONITOR-MIB notifications are not supported before Cisco IOS Release 12.1(5a)E.

The CISCO-IPSEC-POLICY-MAP-MIB (ciscoIpSecPolMap) defines no notifications (the "IPSec Policy Map Notifications Group" is empty).

Related Features and Technologies

The IPsec—SNMP Support feature was designed to support the VPN Device Manager (VDM). VDM enables network administrators to manage and configure site-to-site VPNs on a single device from a web browser and to see the effects of changes in real time. VDM implements a wizard-based graphical user interface (GUI) to simplify the process of configuring site-to-site VPNs using the IPsec protocol. VDM software is installed directly on Cisco VPN routers, and is designed for use and compatibility with future Device Manager products.

For more information on Cisco VDM, refer to the following URL:

http://www.cisco.com/warp/public/cc/pd/nemnsw/vpdvmn/

Related Documents

IPsec and Related Security Information

•Configuring Security for VPNs with IPsec

•Cisco IOS Security Command Reference

SNMP Configuration Information

•Cisco IOS Configuration Fundamentals Configuration Guide on Cisco.com

•Cisco IOS Configuration Fundamentals Command Reference

For the Cisco IOS Release12.1 E implementation of security and SNMP features, refer to the Cisco IOS Release 12.1 versions of these documents. For Cisco IOS Release 12.2 T and 12.2 S implementation of these features, refer to the Cisco IOS Release 12.2 versions of these documents.

Supported Platforms

The IPsec MIB feature is supported on the following platforms in Cisco IOS Release 12.1(4)E:

•Cisco 7100 series

•Cisco 7200 series

•Cisco 7500 series (RSP7000 and 7500)

The IPsec MIB feature is supported on the following platforms in Cisco IOS Release 12.2(4)T:

•Cisco 800 series (800, 805, 806, 820, 827, 828)

•Cisco 900 series

•Cisco 1600 and 1600R series

•Cisco 1700 series (1710, 1720, 1750, 1751, 1760)

•Cisco 2400 series

•Cisco 2600 and 2600XM series

•Cisco 3600 series (Cisco 3620, 3640, and 3660)

•Cisco 3745

•Cisco 4000

•Cisco 4500

•Cisco 5300 series

•Cisco 5400 series

•Cisco 5800 series

•Cisco 7100 series

•Cisco 7200 series

•Cisco 7400 series

•Cisco 7500 series (Cisco IOS Release 12.2(4)T2 and later releases)

•Cisco 7700 series

•Cisco MC3810

•Cisco uBR900 series (uBR900, uBR904, uBR905, uBR910, uBR920, uBR925

•Cisco uBR7200

The IPsec MIB feature is supported on the following platforms in Cisco IOS Release 12.2(14)S:

•Cisco 7200 series

•Cisco 7400 series

•Cisco 7500 series

Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

Availability of Cisco IOS Software Images

Platform support for particular Cisco IOS software releases is dependent on the availability of the software images for those platforms. Software images for some platforms may be deferred, delayed, or changed without prior notice. For updated information about platform support and availability of software images for each Cisco IOS software release, refer to the online release notes or, if supported, Cisco Feature Navigator.

Supported Standards, MIBs, and RFCs

Standards

No new or modified standards are supported by this feature.

MIBs

The following MIBs are supported by the IPsec—SNMP Support feature:

•CISCO-IPSEC-FLOW-MONITOR- MIB

•CISCO-IPSEC-MIB

•CISCO-IPSEC-POLICY-MAP-MIB

To locate and download MIBs for selected platforms, Cisco IOS software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

No new or modified RFCs are supported by this feature.

Configuration Tasks

See the following sections for configuration tasks for the IPsec—SNMP Support feature. Each task in the list is identified as either required or optional:

•Enabling IPsec SNMP Notifications (required)

•Configuring IPsec Failure History Table Size (optional)

•Configuring IPsec Tunnel History Table Size (optional)

Enabling IPsec SNMP Notifications

To enable a router to send IPsec trap or inform notifications to a specified host, use the following commands in global configuration mode:

 
Command
Purpose

Step 1  

Router(config)# snmp-server enable traps ipsec 
cryptomap [add | delete | attach | detach]

Enables a router to send IPsec SNMP notifications.

Step 2  

Router(config)# snmp-server enable traps isakmp 
[policy {add | delete} | tunnel {start | stop}]

Enables a router to send IPsec ISAKMP SNMP notifications.

Step 3 

Router(config)# snmp-server host host-address traps community-string ipsec

Specifies the recipient of IPsec SNMP notification operations.

For more information on configuring SNMP, refer to the chapter "Configuring SNMP Support" in the Cisco IOS Configuration Fundamentals Configuration Guide.

Configuring IPsec Failure History Table Size

The default failure history table size is 200. To change the size of the failure history table, use the following command in global configuration mode:

Command
Purpose

Router(config)# crypto mib ipsec flowmib history failure size number

Changes the size of the IPsec failure history table.


Configuring IPsec Tunnel History Table Size

The default tunnel history table size is 200. To change the size of the tunnel history table, use the following command in global configuration mode:

Command
Purpose

Router(config)# crypto mib ipsec flowmib history tunnel size number

Changes the size of the IPsec tunnel history table.


Verifying IPsec MIB Configuration

To verify that the IPsec MIB feature is configured properly, perform the following tasks:

•Enter the show crypto mib ipsec flowmib history failure size privileged EXEC command to display the size of the failure history table: 

Router# show crypto mib ipsec flowmib history failure size


IPSec Failure Window Size: 140

•Enter the show crypto mib ipsec flowmib history tunnel size privileged EXEC command to display the size of the tunnel history table: 

Router# show crypto mib ipsec flowmib history tunnel size


IPSec History Window Size: 130

•Enter the show crypto mib ipsec flowmib version privileged EXEC command to display the MIB version used by the management applications to identify the feature set: 

Router# show crypto mib ipsec flowmib version


IPSec Flow MIB version: 1

•Enter the debug crypto mib command to display the IPsec MIB debug message notifications: 

Router# debug crypto mib


Crypto IPSec Mgmt Entity debugging is on

Monitoring and Maintaining IPsec MIB

To monitor the status of IPsec MIB information, use any of the following commands in EXEC mode:

Command
Purpose

Router# show crypto mib ipsec flowmib history failure size

Displays the size of the IPsec failure history table.

Router# show crypto mib ipsec flowmib history tunnel size

Displays the size of the IPsec tunnel history table.

Router# show crypto mib ipsec flowmib version

Displays the IPsec Flow MIB version used by the router.


Configuration Examples

This section provides the following configuration examples:

•Enabling IPsec Notifications Examples

•Specifying History Table Size Examples

Enabling IPsec Notifications Examples

In the following example, IPsec notifications are enabled: 

snmp-server enable traps ipsec isakmp

In the following example, the router is configured to send IPsec notifications to the host nms1.cisco.com: 

snmp-server host nms1.cisco.com public ipsec isakmp

Translating "nms1.cisco.com"...domain server (171.00.0.01) [OK]

Specifying History Table Size Examples

In the following example, the specified failure history table size is 140: 

crypto mib ipsec flowmib history failure size 140

In the following example, the specified tunnel history table size is 130: 

crypto mib ipsec flowmib history tunnel size 130

Command Reference

The following commands are introduced or modified in the feature or features

•crypto mib ipsec flowmib history failure size

•crypto mib ipsec flowmib history tunnel size

•debug crypto mib

•show crypto mib ipsec flowmib history failure size

•show crypto mib ipsec flowmib history tunnel size

•show crypto mib ipsec flowmib version

•snmp-server enable traps ipsec

•snmp-server enable traps isakmp

•snmp-server host

For information about these commands, see the Cisco IOS Security Command Reference at

http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html.

For information about all Cisco IOS commands, see the Command Lookup Tool at

http://tools.cisco.com/Support/CLILookup or the Master Command List.

Glossary

CA—certificate authority. A certificate authority (CA) is an entity in a network that issues and manages security credentials and public keys (in the form of X509v3 certificates) for message encryption. As part of a public key infrastructure (PKI), a CA checks with a registration authority (RA) to verify information provided by the requestor of a digital certificate. If the RA verifies the requestor's information, the CA can then issue a certificate. Certificates generally include the owner's public key, the expiration date of the certificate, the owner's name, and other information about the public key owner.

IP Security—See IPsec.

IPsec—Internet Protocol Security. A framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers. IPsec provides these security services at the IP layer. IPsec uses Internet Key Exchange (IKE) to handle negotiation of protocols and algorithms based on local policy and to generate the encryption and authentication keys to be used by IPsec. IPsec can be used to protect one or more data flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a host.

Management Information Base—See MIB.

MIB—Management Information Base. Database of network management information that is used and maintained by a network management protocol such as Simple Network Management Protocol (SNMP) or Common Management Information Protocol (MIP). The value of a MIB object can be changed or retrieved using SNMP or CMIP commands, usually through a graphical user interface (GUI) network management system (NMS). MIB objects are organized in a tree structure that includes public (standard) and private (proprietary) branches.

Simple Network Management Protocol—See SNMP.

SNMP—Simple Network Management Protocol. An application-layer protocol that provides a message format for communication between SNMP managers and agents.

trap—Message sent by an SNMP agent to a network management system, console, or terminal to indicate the occurrence of a significant event, such as a specifically defined condition or a threshold that was reached.

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flip Video, Flip Video (Design), Flipshare (Design), Flip Ultra, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0907R)


Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2009 Cisco Systems, Inc. All rights reserved.