VRRP Working Group Kalyan Tata, INTERNET-DRAFT Nokia Inc. Expires: December 2004 . June 06, 2004 Definitions of Managed Objects for the VRRP over IPv4 and IPv6 Status of this memo By submitting this Internet-Draft, I (we) certify that any applicable patent or other IPR claims of which I am (we are) aware have been disclosed, and any of which I (we) become aware will be disclosed, in accordance with RFC 3668 (BCP 79). By submitting this Internet-Draft, I (we) accept the provisions of Section [3] of RFC 3667 (BCP 78). Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or cite them other than as "work in progress". The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/lid-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html This document is an individual submission to the IETF. Comments should be directed to the authors. This document is a submission of the IETF VRRP WG. Comments should be directed to the VRRP WG mailing list, vrrp@ietf.org. Tata [Page 1] INTERNET-DRAFT VRRP unified MIB June 6, 2004 Abstract This specification defines a Management Information Base (MIB) for use with SNMP-based network management. In particular, it defines objects for configuring, monitoring, and controlling routers that employ the Virtual Router Redundancy Protocol for both IPv4 and IPv6 as defined in RFC 3768 and RFC xxxx ( RFC-editor, this is currently draft-ietf-vrrp-ipv6-spec-06.txt ). This memo obsoletes RFC 2787. Table of Contents 1. Introduction.....................................................2 2. Terminology......................................................3 3. Relationship to RFC 2338.........................................3 4. Relation to Interface Group (IF-MIB).............................3 5. Multi-Stack Implementations......................................3 6. VRRP MIB Structure...............................................3 7. VRRP MIB Table Design............................................3 8. VRRP Multistack Scenario.........................................4 9. Definitions......................................................7 10. Security Consideration.........................................41 11. Acknowledgments................................................41 12. Authors' Addresses.............................................42 13. References.....................................................42 13.1. Normative references......................................42 13.2. Informative References....................................42 1. Introduction VRRP protocols as defined in RFC 3768[5] and draft-ietf-vrrp-ipv6- spec-06.txt [6] are inherently IP version specific.Though both the protocols are similar they are not identical and can coexist on a network element. RFC2787 [7] defines managed objects that are specific to VRRP protocol for IPv4 networks as defined in RFC 3768 [5]. This document defines an IP version independent managed objects for configuring and monitoring VRRP protocols. VRRP over IPv4 (VRRPv2) and VRRP over IPv6 (VRRPv3) protocols are similar in operation to an extent and hence the MIB defined has common groups that should be implemented by devices running either of the VRRP over IPv4 and IPv6 protocols. This specification also defines MIB groups that are specific to a particular VRRP protocol and should only be implemented in devices supporting the specified version of VRRP protocol. Tata [Page 2] INTERNET-DRAFT VRRP unified MIB June 6, 2004 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD, "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [1]. 3. Relationship to RFC 2338 RFC2787 [7] defines managed objects for VRRP over IPv4 and has been deprecated by this memo. 4. Relation to Interface Group (IF-MIB) Since a router can be participating in VRRP on one or more physical interfaces, "ifIndex" is used as an index into the tables defined in the VRRP MIB. 5. Multi-Stack Implementations This MIB is designed to support Multi-Stack implementations that run VRRP over IPv4 and IPv6 protocols. IP version, VRID and ifIndex are used to uniquely identify rows in a multi stack implementation. 6. VRRP MIB Structure The VRRP MIB contains three groups: - vrrpOperations Group: Objects related to VRRP router's configuration and control. - vrrpStatistics Group: Objects containing information useful in monitoring the operation of VRRP routers. - vrrpNotifications Group: Consists of objects and definitions for use in SNMP notifications sent by VRRP routers. Tables in the MIB include the following: (1) The vrrpOperationsTable, which contains objects that define the operational characteristics of a VRRP router. Rows in this table correspond to instances of virtual routers. (2) The vrrpRouterStatisticsTable which contains the operating statistics for a VRRP router. (3) The vrrpAssociatedIpAddrTable, contains the addresses of the virtual router(s) that a given VRRP router is backing up. This table is required only for VRRP for IPv4 implementations. 7. VRRP MIB Table Design Tata [Page 3] INTERNET-DRAFT VRRP unified MIB June 6, 2004 The tables in the VRRP MIB are structured with the assumption that a VRRP network management application would likely be designed to display information or provide configuration about a VRRP router over a IP version "per-virtual-router basis". Thus, the tables defined in the MIB consist of conceptual rows which are indexed in a manner to present a view of individual virtual routers with a minimal number of SNMP operations. 8. VRRP Multistack Scenario The following section provides examples of how some of the objects in this MIB are instantiated. KEY: ---- The labels in the following tables and diagrams correspond to the actual MIB objects as follows: IpVer = vrrpOperationsIpVersion if = IfIndex VrId = vrrpOperationsVrId State = vrrpOperationsState Prior = vrrpOpeartionsPriority AddrType= vrrpOperationsIpAddrType IpAddr = vrrpOperationsMasterIpAddr The following figure shows a hypothetical network with two VRRP routers configured with two virtual routers. Addresses in '()' indicate the address of the default gateway for a given host, H1 - H4 are IPv4 hosts and H5 to H8 are IPv6 hosts. In the diagram, "Interface" is used in the context defined in IF-MIB. Tata [Page 4] INTERNET-DRAFT VRRP unified MIB June 6, 2004 +------+ +------+ | VR1 | | VR2 | | | | | +------+ +------+ | | Intf = I1 Intf = I2 IP A| | IP X IP B | IP Y VRID = 1 | VRID=1 VRID=2 | VRID = 2 | | ----+------+------+-+-------+--------+--------+-++----+--------+--- ^ ^ ^ ^ ^ ^ ^ ^ | | | | | | | | (IP A) (IP A) (IP B) (IP B (IP X) (IP X) (IP Y) (IP Y) | | | | | | | | +----+ +----+ +----+ +----+ +----+ +----+ +----+ +----+ | H1 | | H2 | | H3 | | H4 | | H5 | | H6 | | H7 | | H8 | +----+ +----+ +----+ +----+ +----+ +----+ +----+ +----+ ----- MIB Tables For VRRP Router "VR 1": ----- vrrpOperationsTable ------------------- | if |IpVer | VrId | State | Prior | IpAddr | | +----+------+--------+-------+-------+------ --+--(..)--+ | I1 | 1 | 01 | M | 255 | A | | +----+------+--------+-------+-------+------- -+--(..)--| | I1 | 1 | 02 | B | 1-254 | B | | +----+------+--------+-------+-------+---------+--(..)--+ | I1 | 2 | 01 | B | 1-254 | X | | +----+------+--------+-------+-------+---------+--(..)--- | I1 | 2 | 02 | M | 255 | Y | | +----+------+--------+-------+-------+---------+--------+ vrrpAssociatedIpAddrTable ------------------------- | if | VrId | AddrType | IP | RowStat | +----+------+----------+------+---------+ | | | | | | | I1 | 01 | 1 | A | active | | | | | | | +----+------+----------+------+---------+ | | | | | | | I1 | 02 | 1 | B | active | | | | | | | +----+------+----------+------+---------+ ----- MIB Tables For VRRP Router "VR 2": ----- Tata [Page 5] INTERNET-DRAFT VRRP unified MIB June 6, 2004 vrrpOperationsTable ------------------- | if |IpVer | VrId | State | Prior | IpAddr | | +----+------+--------+-------+-------+------ --+--(..)--+ | I2 | 1 | 01 | B | 1-254 | A | | +----+------+--------+-------+-------+------- -+--(..)--| | I2 | 1 | 02 | M | 255 | B | | +----+------+--------+-------+-------+---------+--(..)--+ | I2 | 2 | 01 | M | 255 | X | | +----+------+--------+-------+-------+---------+--(..)--- | I2 | 2 | 02 | B | 1-254 | Y | | +----+------+--------+-------+-------+---------+--------+ vrrpAssociatedIpAddrTable ------------------------- | if | VrId | AddrType | IP | RowStat | +----+------+----------+------+---------+ | | | | | | | I3 | 01 | 1 | A | active | | | | | | | +----+------+----------+------+---------+ | | | | | | | I3 | 02 | 1 | B | active | | | | | | | +----+------+----------+------+---------+ NOTES: 1) "I1" and "I3" are used to designate IF indices on each respective routers IPv4 interfaces. 2) "I2" and "I4" are used to designate IF indices on each respective routers IPv6 interfaces. 3) For "State": M = Master; B = Backup. 4) In the vrrpOperationsTable, a "priority" of 255 indicates that the respective router owns the IP address, e.g., this IP address is native to the router (i.e., "the IP Address Owner" ). Tata [Page 6] INTERNET-DRAFT VRRP unified MIB June 6, 2004 9. Definitions VRRP-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Counter32, Integer32, mib-2, Unsigned32 FROM SNMPv2-SMI TEXTUAL-CONVENTION, RowStatus, MacAddress, TruthValue, TimeStamp FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF ifIndex FROM IF-MIB InetAddressType, InetAddress FROM INET-ADDRESS-MIB; vrrpMIB MODULE-IDENTITY LAST-UPDATED "200405180000Z" ORGANIZATION "IETF VRRP Working Group" CONTACT-INFO "Kalyan Tata Nokia Inc. 313 Fair Child Dr. Mountain View, CA 94043" DESCRIPTION "This MIB describes objects used for managing Virtual Router Redundancy Protocol (VRRP) over IPv4 and IPv6 protocols. This MIB supports VRRP for IPv4 and IPv6 protocols simultaneously running on a given interface of a router. Copyright (C) The Internet Society (2004). This version of this MIB module is part of RFC xxxx; see the RFC itself for full legal notices." REVISION "200405180000Z" -- 18 May 2004 DESCRIPTION "Initial version as published in xxxx" ::= { mib-2 68 } -- -- Textual Conventions Tata [Page 7] INTERNET-DRAFT VRRP unified MIB June 6, 2004 -- VrId ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "A number which,along with IP version and interface index (IfIndex), serves to uniquely identify a virtual router on a given VRRP router. A set of one or more associated addresses is assigned to a VRID for VRRPv2 protocol." SYNTAX Integer32 (1..255) -- -- VRRP MIB Groups -- vrrpOperations OBJECT IDENTIFIER ::= { vrrpMIB 1 } vrrpStatistics OBJECT IDENTIFIER ::= { vrrpMIB 2 } vrrpConformance OBJECT IDENTIFIER ::= { vrrpMIB 3 } -- -- Start of MIB objects -- vrrpNodeVersion OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "This value identifies the particular version of the VRRP supported by this node." ::= { vrrpOperations 1 } vrrpNotificationCntl OBJECT-TYPE SYNTAX INTEGER { enabled (1), disabled (2) } MAX-ACCESS read-write STATUS current DESCRIPTION "Indicates whether the VRRP-enabled router will generate SNMP traps for events defined in this MIB. 'Enabled' results in SNMP traps; 'disabled', no traps are sent." DEFVAL { enabled } ::= { vrrpOperations 2 } --- vrrpOperTable(3) & vrrpAssoIpAddrTable(4) have been --- deprecated and should not be used. Tata [Page 8] INTERNET-DRAFT VRRP unified MIB June 6, 2004 -- -- Depricated VRRP Oper Table -- vrrpOperTable OBJECT-TYPE SYNTAX SEQUENCE OF VrrpOperEntry MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "Operations table for a VRRP router which consists of a sequence (i.e., one or more conceptual rows) of 'vrrpOperEntry' items. This table has been deprecated as a new IP version neutral 'vrrpOperationsTable' has been added. " ::= { vrrpOperations 3 } vrrpOperEntry OBJECT-TYPE SYNTAX VrrpOperEntry MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "An entry in the vrrpOperTable containing the operational characteristics of a virtual router. On a VRRP router, a given virtual router is identified by a combination of the IF index and VRID. Rows in the table cannot be modified unless the value of `vrrpOperAdminState' is `disabled' and the `vrrpOperState' has transitioned to `initialize'." INDEX { ifIndex, vrrpOperVrId } ::= { vrrpOperTable 1 } VrrpOperEntry ::= SEQUENCE { vrrpOperVrId VrId, vrrpOperVirtualMacAddr MacAddress, vrrpOperState INTEGER, vrrpOperAdminState INTEGER, vrrpOperPriority Integer32, vrrpOperIpAddrCount Integer32, vrrpOperMasterIpAddr IpAddress, Tata [Page 9] INTERNET-DRAFT VRRP unified MIB June 6, 2004 vrrpOperPrimaryIpAddr IpAddress, vrrpOperAuthType INTEGER, vrrpOperAuthKey OCTET STRING, vrrpOperAdvertisementInterval Integer32, vrrpOperPreemptMode TruthValue, vrrpOperVirtualRouterUpTime TimeStamp, vrrpOperProtocol INTEGER, vrrpOperRowStatus RowStatus } vrrpOperVrId OBJECT-TYPE SYNTAX VrId MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "This object contains the Virtual Router Identifier (VRID)." ::= { vrrpOperEntry 1 } vrrpOperVirtualMacAddr OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The virtual MAC address of the virtual router. Although this object can be derived from the 'vrrpOperVrId' object, it is defined so that it is easily obtainable by a management application and can be included in VRRP-related SNMP traps." ::= { vrrpOperEntry 2 } vrrpOperState OBJECT-TYPE SYNTAX INTEGER { initialize(1), backup(2), master(3) } MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The current state of the virtual router. This object has three defined values: Tata [Page 10] INTERNET-DRAFT VRRP unified MIB June 6, 2004 - `initialize', which indicates that all the virtual router is waiting for a startup event. - `backup', which indicates the virtual router is monitoring the availability of the master router. - `master', which indicates that the virtual router is forwarding packets for IP addresses that are associated with this router. Setting the `vrrpOperAdminState' object (below) initiates transitions in the value of this object." ::= { vrrpOperEntry 3 } vrrpOperAdminState OBJECT-TYPE SYNTAX INTEGER { up(1), down(2) } MAX-ACCESS read-create STATUS deprecated DESCRIPTION "This object will enable/disable the virtual router function. Setting the value to `up', will transition the state of the virtual router from `initialize' to `backup' or `master', depending on the value of `vrrpOperPriority'. Setting the value to `down', will transition the router from `master' or `backup' to `initialize'. State transitions may not be immediate; they sometimes depend on other factors, such as the interface (IF) state. The `vrrpOperAdminState' object must be set to `down' prior to modifying the other read-create objects in the conceptual row. The value of the `vrrpOperRowStatus' object (below) must be `active', signifying that the conceptual row is valid (i.e., the objects are correctly set), in order for this object to be set to `up'." DEFVAL { down } ::= { vrrpOperEntry 4 } vrrpOperPriority OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-create STATUS deprecated DESCRIPTION "This object specifies the priority to be used for the virtual router master election process. Higher values imply higher priority. Tata [Page 11] INTERNET-DRAFT VRRP unified MIB June 6, 2004 A priority of '0', although not settable, is sent by the master router to indicate that this router has ceased to participate in VRRP and a backup virtual router should transition to become a new master. A priority of 255 is used for the router that owns the associated IP address(es)." DEFVAL { 100 } ::= { vrrpOperEntry 5 } vrrpOperIpAddrCount OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The number of IP addresses that are associated with this virtual router. This number is equal to the number of rows in the vrrpAssoIpAddrTable that correspond to a given IF index/VRID pair." ::= { vrrpOperEntry 6 } vrrpOperMasterIpAddr OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The master router's real (primary) IP address. This is the IP address listed as the source in VRRP advertisement last received by this virtual router." ::= { vrrpOperEntry 7 } vrrpOperPrimaryIpAddr OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-create STATUS deprecated DESCRIPTION "In the case where there is more than one IP address for a given `ifIndex', this object is used to specify the IP address that will become the `vrrpOperMasterIpAddr', should the virtual router transition from backup to master. If this object is set to 0.0.0.0, the IP address which is numerically lowest will be selected." DEFVAL { '00000000'H } -- 0.0.0.0 ::= { vrrpOperEntry 8 } vrrpOperAuthType OBJECT-TYPE SYNTAX INTEGER { noAuthentication(1), -- VRRP protocol exchanges are -- not authenticated. simpleTextPassword(2), -- Exchanges are authenticated Tata [Page 12] INTERNET-DRAFT VRRP unified MIB June 6, 2004 -- by a clear text password. ipAuthenticationHeader(3) -- Exchanges are authenticated -- using the IP authentication -- header. } MAX-ACCESS read-create STATUS deprecated DESCRIPTION "Authentication type used for VRRP protocol exchanges between virtual routers. This value of this object is the same for a given ifIndex. New enumerations to this list can only be added via a new RFC on the standards track." DEFVAL { noAuthentication } ::= { vrrpOperEntry 9 } vrrpOperAuthKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0..16)) MAX-ACCESS read-create STATUS deprecated DESCRIPTION "The Authentication Key. This object is set according to the value of the 'vrrpOperAuthType' object ('simpleTextPassword' or 'ipAuthenticationHeader'). If the length of the value is less than 16 octets, the agent will left adjust and zero fill to 16 octets. The value of this object is the same for a given ifIndex. When read, vrrpOperAuthKey always returns an Octet String of length zero." ::= { vrrpOperEntry 10 } vrrpOperAdvertisementInterval OBJECT-TYPE SYNTAX Integer32 (1..255) UNITS "seconds" MAX-ACCESS read-create STATUS deprecated DESCRIPTION "The time interval, in seconds, between sending advertisement messages. Only the master router sends VRRP advertisements." DEFVAL { 1 } ::= { vrrpOperEntry 11 } vrrpOperPreemptMode OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS deprecated DESCRIPTION Tata [Page 13] INTERNET-DRAFT VRRP unified MIB June 6, 2004 "Controls whether a higher priority virtual router will preempt a lower priority master." DEFVAL { true } ::= { vrrpOperEntry 12 } vrrpOperVirtualRouterUpTime OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS deprecated DESCRIPTION "This is the value of the `sysUpTime' object when this virtual router (i.e., the `vrrpOperState') transitioned out of `initialized'." ::= { vrrpOperEntry 13 } vrrpOperProtocol OBJECT-TYPE SYNTAX INTEGER { ip (1), bridge (2), decnet (3), other (4) } MAX-ACCESS read-create STATUS deprecated DESCRIPTION "The particular protocol being controlled by this Virtual Router. New enumerations to this list can only be added via a new RFC on the standards track." DEFVAL { ip } ::= { vrrpOperEntry 14 } vrrpOperRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS deprecated DESCRIPTION "The row status variable, used in accordance to installation and removal conventions for conceptual rows. The rowstatus of a currently active row in the vrrpOperTable is constrained by the operational state of the corresponding virtual router. When `vrrpOperRowStatus' is set to active(1), no other objects in the conceptual row, with the exception of `vrrpOperAdminState', can be modified. Prior to setting the `vrrpOperRowStatus' object from `active' to a different value, the `vrrpOperAdminState' object must be set to `down' and the `vrrpOperState' object be transitioned to `initialize'. Tata [Page 14] INTERNET-DRAFT VRRP unified MIB June 6, 2004 To create a row in this table, a manager sets this object to either createAndGo(4) or createAndWait(5). Until instances of all corresponding columns are appropriately configured, the value of the corresponding instance of the `vrrpOperRowStatus' column will be read as notReady(3). In particular, a newly created row cannot be made active(1) until (minimally) the corresponding instance of `vrrpOperVrId' has been set and there is at least one active row in the `vrrpAssoIpAddrTable' defining an associated IP address for the virtual router." ::= { vrrpOperEntry 15 } -- -- Drprecated VRRP Associated IP Address Table -- vrrpAssoIpAddrTable OBJECT-TYPE SYNTAX SEQUENCE OF VrrpAssoIpAddrEntry MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "The table of addresses associated with this virtual router." ::= { vrrpOperations 4 } vrrpAssoIpAddrEntry OBJECT-TYPE SYNTAX VrrpAssoIpAddrEntry MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "An entry in the table contains an IP address that is associated with a virtual router. The number of rows for a given ifIndex and VrId will equal the number of IP addresses associated (e.g., backed up) by the virtual router (equivalent to 'vrrpOperIpAddrCount'). Rows in the table cannot be modified unless the value of `vrrpOperAdminState' is `disabled' and the `vrrpOperState' has transitioned to `initialize'." INDEX { ifIndex, vrrpOperVrId, vrrpAssoIpAddr } ::= { vrrpAssoIpAddrTable 1 } VrrpAssoIpAddrEntry ::= SEQUENCE { vrrpAssoIpAddr IpAddress, vrrpAssoIpAddrRowStatus Tata [Page 15] INTERNET-DRAFT VRRP unified MIB June 6, 2004 RowStatus } vrrpAssoIpAddr OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "The assigned IP addresses that a virtual router is responsible for backing up." ::= { vrrpAssoIpAddrEntry 1 } vrrpAssoIpAddrRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS deprecated DESCRIPTION "The row status variable, used according to installation and removal conventions for conceptual rows. Setting this object to active(1) or createAndGo(4) results in the addition of an associated address for a virtual router. Destroying the entry or setting it to notInService(2) removes the associated address from the virtual router. The use of other values is implementation-dependent." ::= { vrrpAssoIpAddrEntry 2 } -- -- VRRP Operations Table -- vrrpOperationsTable OBJECT-TYPE SYNTAX SEQUENCE OF VrrpOperationsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Unified Operations table for a VRRP router which consists of a sequence (i.e., one or more conceptual rows) of 'vrrpOperationsEntry' items." ::= { vrrpOperations 7 } vrrpOperationsEntry OBJECT-TYPE SYNTAX VrrpOperationsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the vrrpOperationsTable containing the operational characteristics of a virtual router. On a VRRP router, a given virtual router is identified by a combination of the IP version, VRID and ifIndex. Tata [Page 16] INTERNET-DRAFT VRRP unified MIB June 6, 2004 Note that rows in this table can be distinguished on a Multi-stacked device running both VRRP over IPv4 and IPv6 interfaces. Rows in the table cannot be modified unless the value of 'vrrpOperationsAdminState' is 'disabled' and the 'vrrpOperationsState' has transitioned to 'initialize'" INDEX {vrrpOperationsIpVersion, vrrpOperationsVrId, ifIndex } ::= { vrrpOperationsTable 1 } VrrpOperationsEntry ::= SEQUENCE { vrrpOperationsIpVersion INTEGER, vrrpOperationsVrId VrId, vrrpOperationsVirtualMacAddr MacAddress, vrrpOperationsState INTEGER, vrrpOperationsAdminState INTEGER, vrrpOperationsPriority Integer32, vrrpOperationsVersion Integer32, vrrpOperationsIpv4AddrCount Integer32, vrrpOperationsMasterIpAddrType InetAddressType, vrrpOperationsMasterIpAddr InetAddress, vrrpOperationsPrimaryIpAddrType InetAddressType, vrrpOperationsPrimaryIpAddr InetAddress, vrrpOperationsAdvInterval Integer32, vrrpOperationsPreemptMode TruthValue, vrrpOperationsUpTime TimeStamp, vrrpOperationsRowStatus RowStatus } vrrpOperationsIpVersion OBJECT-TYPE Tata [Page 17] INTERNET-DRAFT VRRP unified MIB June 6, 2004 SYNTAX INTEGER { ipv4 (1), ipv6 (2) } MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object contains the IP version on which this VRRP instance is running." ::= { vrrpOperationsEntry 1 } vrrpOperationsVrId OBJECT-TYPE SYNTAX VrId MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object contains the Virtual Router Identifier (VRID)." ::= { vrrpOperationsEntry 2 } vrrpOperationsVirtualMacAddr OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The virtual MAC address of the virtual router. Although this object can be derived from the 'vrrpOperationsVrId' object, it is defined so that it is easily obtainable by a management application and can be included in VRRP-related SNMP traps." ::= { vrrpOperationsEntry 3 } vrrpOperationsState OBJECT-TYPE SYNTAX INTEGER { initialize(1), backup(2), master(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The current state of the virtual router. This object has three defined values: - `initialize', which indicates that all the virtual router is waiting for a startup event. Tata [Page 18] INTERNET-DRAFT VRRP unified MIB June 6, 2004 - `backup', which indicates the virtual router is monitoring the availability of the master router. - `master', which indicates that the virtual router is forwarding packets for IP addresses that are associated with this router. Setting the `vrrpOperationsAdminState' object (below) Initiates transitions in the value of this object." ::= { vrrpOperationsEntry 4 } vrrpOperationsAdminState OBJECT-TYPE SYNTAX INTEGER { up(1), down(2) } MAX-ACCESS read-create STATUS current DESCRIPTION "This object will enable/disable the virtual router function. Setting the value to `up', will transition the state of the virtual router from `initialize' to `backup' or `master', depending on the value of `vrrpOperationsPriority'. Setting the value to `down', will transition the router from `master' or `backup' to `initialize'. State transitions may not be immediate; they sometimes depend on other factors, such as the interface (IF) state. The `vrrpOperationsAdminState' object must be set to `down' Prior to modifying the other read-create objects in the conceptual row. The value of the vrrpOperationsRowStatus' Object (below) must be `active', signifying that the conceptual row is valid (i.e., the objects are correctly set), in order for this object to be set to `up'." DEFVAL { down } ::= { vrrpOperationsEntry 5 } vrrpOperationsPriority OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-create STATUS current DESCRIPTION "This object specifies the priority to be used for the virtual router master election process. Higher values imply higher priority. A priority of '0', although not settable, is sent by the master router to indicate that this router has Tata [Page 19] INTERNET-DRAFT VRRP unified MIB June 6, 2004 ceased to participate in VRRP and a backup virtual router should transition to become a new master. A priority of 255 is used for the router that owns the associated IP address(es) for VRRP over IPv4." DEFVAL { 100 } ::= { vrrpOperationsEntry 6 } vrrpOperationsVersion OBJECT-TYPE SYNTAX INTEGER { vrrpv2 (1), vrrpv3 (2) } MAX-ACCESS read-create STATUS current DESCRIPTION "This object contains the IP version on which this VRRP instance is running." ::= { vrrpOperationsEntry 7 } vrrpOperationsIpv4AddrCount OBJECT-TYPE SYNTAX Integer32 (0..255) MAX-ACCESS read-only STATUS current DESCRIPTION "The number of IPv4 addresses that are associated with this virtual router. This number is equal to the number of rows in the vrrpAssociatedAddrTable that correspond to a given ifIndex/VRID pair. This object can be sparse and should not be implemented For rows corresponding to VRRP over Ipv6." ::= { vrrpOperationsEntry 8 } vrrpOperationsMasterIpAddrType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "This specifies the type of vrrpOperationsMasterIpAddr in this row." ::= { vrrpOperationsEntry 9 } vrrpOperationsMasterIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The master router's real (primary for vrrp over IPv4) Tata [Page 20] INTERNET-DRAFT VRRP unified MIB June 6, 2004 IP address. This is the IP address listed as the Source in VRRP advertisement last received by this virtual router." ::= { vrrpOperationsEntry 10 } vrrpOperationsPrimaryIpAddrType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-create STATUS current DESCRIPTION "This specifies the the type of vrrpOperationsPrimaryIpAddr. This is applicable for rows describing VRRP for IPv4 only. This object can be sparse and should not be implemented for rows indicating VRRP over Ipv6" ::= { vrrpOperationsEntry 11 } vrrpOperationsPrimaryIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION "This is applicable for rows that describe VRRP over IPv4. In the case where there is more than one IP Address for a given `ifIndex', this object is used to specify the IP address that will become the vrrpOperationsMasterIpAddr', should the virtual router transition from backup to master. If this object is set to 0.0.0.0, the IP address which Is numerically lowest will be selected. This object can be sparse and should not be implemented for rows indicating VRRP for Ipv6 " DEFVAL { '00000000'H } -- 0.0.0.0 ::= { vrrpOperationsEntry 12 } vrrpOperationsAdvInterval OBJECT-TYPE SYNTAX Integer32 (1..255) UNITS "seconds" MAX-ACCESS read-create STATUS current DESCRIPTION "The time interval, in seconds, between sending advertisement messages. Only the master router sends VRRP advertisements." DEFVAL { 1 } ::= { vrrpOperationsEntry 13 } vrrpOperationsPreemptMode OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create Tata [Page 21] INTERNET-DRAFT VRRP unified MIB June 6, 2004 STATUS current DESCRIPTION "Controls whether a higher priority virtual router will preempt a lower priority master." DEFVAL { true } ::= { vrrpOperationsEntry 14 } vrrpOperationsUpTime OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "This is the value of the `sysUpTime' object when this virtual router (i.e., the `vrrpOperState') transitioned out of `initialized'." ::= { vrrpOperationsEntry 15 } vrrpOperationsRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The row status variable, used in accordance to installation and removal conventions for conceptual rows. The rowstatus of a currently active row in the vrrpOperationsTable is constrained by the operational state of the corresponding virtual router. When `vrrpOperationsRowStatus' is set to active(1), no other objects in the conceptual row, with the exception of `vrrpOperationsAdminState', can be modified. Prior to setting the `vrrpOperationsRowStatus' object from `active' to a different value, the `vrrpOperationsAdminState' object must be set to `down' and the `vrrpOperState' object be transitioned to `initialize'. To create a row in this table, a manager sets this Object to either createAndGo(4) or createAndWait(5). Until instances of all corresponding columns are Appropriately configured, the value of the Corresponding instance of the `vrrpOperationsRowStatus' column will be read as notReady(3). In particular, a newly created row cannot be made active(1) until (minimally) the corresponding instance of `vrrpOperationsVrId' has been set and there is at least one active row in the `vrrpAssociatedIpAddrTable' defining an associated IP address for the IPv4 virtual router." ::= { vrrpOperationsEntry 16 } Tata [Page 22] INTERNET-DRAFT VRRP unified MIB June 6, 2004 -- -- VRRP Associated Address Table - for VRRP over IPv4 only -- vrrpAssociatedIpAddrTable OBJECT-TYPE SYNTAX SEQUENCE OF VrrpAssociatedIpAddrEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The table of addresses associated with this VRRP for IPv4 virtual router." ::= { vrrpOperations 8 } vrrpAssociatedIpAddrEntry OBJECT-TYPE SYNTAX VrrpAssociatedIpAddrEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the table contains an IP address that is associated with a virtual router. The number of rows for a given ifIndex and VrId will equal the number of IP addresses associated (e.g., backed up) by the virtual router (equivalent to 'vrrpOperationsIpAddrCount'). Rows in the table cannot be modified unless the value of `vrrpOperationsAdminState' is `disabled' and the `vrrpOperationsState' has transitioned to`initialize'." INDEX { ifIndex, vrrpOperationsVrId, vrrpAssociatedIpAddrType, vrrpAssociatedIpAddr } ::= { vrrpAssociatedIpAddrTable 1 } VrrpAssociatedIpAddrEntry ::= SEQUENCE { vrrpAssociatedIpAddrType InetAddressType, vrrpAssociatedIpAddr InetAddress, vrrpAssociatedIpAddrRowStatus RowStatus } vrrpAssociatedIpAddrType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION Tata [Page 23] INTERNET-DRAFT VRRP unified MIB June 6, 2004 "The IP addresses type of vrrpAssociatedIpAddr in this row. The only value possible is IPv4." ::= { vrrpAssociatedIpAddrEntry 1 } vrrpAssociatedIpAddr OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The assigned IP addresses that a virtual router is responsible for backing up." ::= { vrrpAssociatedIpAddrEntry 2 } vrrpAssociatedIpAddrRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The row status variable, used according to installation and removal conventions for conceptual rows. Setting this object to active(1) or createAndGo(4) results in the addition of an associated address for a virtual router. Destroying the entry or setting it to notInService(2) removes the associated address from the virtual router. The use of other values is implementation-dependent." ::= { vrrpAssociatedIpAddrEntry 3 } -- -- VRRP Router Statistics -- vrrpRouterChecksumErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received with an invalid VRRP checksum value." ::= { vrrpStatistics 1 } vrrpRouterVersionErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received with an unknown or unsupported version number." ::= { vrrpStatistics 2 } Tata [Page 24] INTERNET-DRAFT VRRP unified MIB June 6, 2004 vrrpRouterVrIdErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received with an invalid VRID for this virtual router." ::= { vrrpStatistics 3 } -- -- Deprecated vrrpRouterStatsTable. -- vrrpRouterStatsTable OBJECT-TYPE SYNTAX SEQUENCE OF VrrpRouterStatsEntry MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "Table of virtual router statistics." ::= { vrrpStatistics 4 } vrrpRouterStatsEntry OBJECT-TYPE SYNTAX VrrpRouterStatsEntry MAX-ACCESS not-accessible STATUS deprecated DESCRIPTION "An entry in the table, containing statistics information about a given virtual router." AUGMENTS { vrrpOperEntry } ::= { vrrpRouterStatsTable 1 } VrrpRouterStatsEntry ::= SEQUENCE { vrrpStatsBecomeMaster Counter32, vrrpStatsAdvertiseRcvd Counter32, vrrpStatsAdvertiseIntervalErrors Counter32, vrrpStatsAuthFailures Counter32, vrrpStatsIpTtlErrors Counter32, vrrpStatsPriorityZeroPktsRcvd Counter32, vrrpStatsPriorityZeroPktsSent Counter32, vrrpStatsInvalidTypePktsRcvd Counter32, vrrpStatsAddressListErrors Tata [Page 25] INTERNET-DRAFT VRRP unified MIB June 6, 2004 Counter32, vrrpStatsInvalidAuthType Counter32, vrrpStatsAuthTypeMismatch Counter32, vrrpStatsPacketLengthErrors Counter32 } vrrpStatsBecomeMaster OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of times that this virtual router's state has transitioned to MASTER." ::= { vrrpRouterStatsEntry 1 } vrrpStatsAdvertiseRcvd OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of VRRP advertisements received by this virtual router." ::= { vrrpRouterStatsEntry 2 } vrrpStatsAdvertiseIntervalErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of VRRP advertisement packets received for which the advertisement interval is different than the one configured for the local virtual router." ::= { vrrpRouterStatsEntry 3 } vrrpStatsAuthFailures OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of VRRP packets received that do not pass the authentication check." ::= { vrrpRouterStatsEntry 4 } vrrpStatsIpTtlErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated Tata [Page 26] INTERNET-DRAFT VRRP unified MIB June 6, 2004 DESCRIPTION "The total number of VRRP packets received by the virtual router with IP TTL (Time-To-Live) not equal to 255." ::= { vrrpRouterStatsEntry 5 } vrrpStatsPriorityZeroPktsRcvd OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of VRRP packets received by the virtual router with a priority of '0'." ::= { vrrpRouterStatsEntry 6 } vrrpStatsPriorityZeroPktsSent OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of VRRP packets sent by the virtual router with a priority of '0'." ::= { vrrpRouterStatsEntry 7 } vrrpStatsInvalidTypePktsRcvd OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The number of VRRP packets received by the virtual router with an invalid value in the 'type' field." ::= { vrrpRouterStatsEntry 8 } vrrpStatsAddressListErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of packets received for which the address list does not match the locally configured list for the virtual router." ::= { vrrpRouterStatsEntry 9 } vrrpStatsInvalidAuthType OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of packets received with an unknown authentication type." Tata [Page 27] INTERNET-DRAFT VRRP unified MIB June 6, 2004 ::= { vrrpRouterStatsEntry 10 } vrrpStatsAuthTypeMismatch OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of packets received with 'Auth Type' not equal to the locally configured authentication method (`vrrpOperAuthType')." ::= { vrrpRouterStatsEntry 11 } vrrpStatsPacketLengthErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The total number of packets received with a packet length less than the length of the VRRP header." ::= { vrrpRouterStatsEntry 12 } -- -- VRRP Router Statistics Table -- vrrpRouterStatisticsTable OBJECT-TYPE SYNTAX SEQUENCE OF VrrpRouterStatisticsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of virtual router statistics." ::= { vrrpStatistics 5 } vrrpRouterStatisticsEntry OBJECT-TYPE SYNTAX VrrpRouterStatisticsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the table, containing statistics information about a given virtual router." INDEX { vrrpOperationsIpVersion, vrrpOperationsVrId, ifIndex} ::= { vrrpRouterStatisticsTable 1 } VrrpRouterStatisticsEntry ::= SEQUENCE { vrrpStatisticsBecomeMaster Counter32, vrrpStatisticsAdvertiseRcvd Counter32, Tata [Page 28] INTERNET-DRAFT VRRP unified MIB June 6, 2004 vrrpStatisticsAdvIntervalErrors Counter32, vrrpStatisticsIpTtlErrors Counter32, vrrpStatisticsPriZeroPktsRcvd Counter32, vrrpStatisticsPriZeroPktsSent Counter32, vrrpStatisticsInvldTypePktsRcvd Counter32, vrrpStatisticsAddressListErrors Counter32, vrrpStatisticsAuthTypeMismatch Counter32, vrrpStatisticsAuthFailures Counter32, vrrpStatisticsPacketLengthErrors Counter32, vrrpStatisticsDiscontinuityTime TimeStamp, vrrpStatisticsRefreshRate Unsigned32 } vrrpStatisticsBecomeMaster OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of times that this virtual router's state has transitioned to MASTER. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 1 } vrrpStatisticsAdvertiseRcvd OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP advertisements received by this virtual router. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at Tata [Page 29] INTERNET-DRAFT VRRP unified MIB June 6, 2004 other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 2 } vrrpStatisticsAdvIntervalErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP advertisement packets received for which the advertisement interval is different than the one configured for the local virtual router. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 3 } vrrpStatisticsIpTtlErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received by the virtual router with IP TTL (Time-To-Live) not equal to 255. It also indicates the number of VRRPv3 packets received by the virtual router with IPv6 hop limit not equal to 255. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 4 } vrrpStatisticsPriZeroPktsRcvd OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received by the Tata [Page 30] INTERNET-DRAFT VRRP unified MIB June 6, 2004 virtual router with a priority of '0'. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 5 } vrrpStatisticsPriZeroPktsSent OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets sent by the virtual router with a priority of '0'. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 6 } vrrpStatisticsInvldTypePktsRcvd OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of VRRP packets received by the virtual router with an invalid value in the 'type' field. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 7 } vrrpStatisticsAddressListErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received for which the address list does not match the locally configured list for the virtual router. Discontinuities in the value of this counter can occur Tata [Page 31] INTERNET-DRAFT VRRP unified MIB June 6, 2004 at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 8 } vrrpStatisticsAuthTypeMismatch OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of packets received with 'Auth Type' not equal to the locally configured authentication method (`vrrpOperationsAuthType'). This is required only for rows indicating VRRP over IPv4. This object can be sparse and should not be implemented for rows indicating VRRP for Ipv6. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 9 } vrrpStatisticsAuthFailures OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of VRRP packets received that do not pass the authentication check. This is required only for rows indicating VRRP over IPv4. This object can be sparse and should not be implemented for rows indicating VRRP for Ipv6. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 10 } vrrpStatisticsPacketLengthErrors OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current Tata [Page 32] INTERNET-DRAFT VRRP unified MIB June 6, 2004 DESCRIPTION "The total number of packets received with a packet length less than the length of the VRRP header. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of vrrpStatisticsDiscontinuityTime." ::= { vrrpRouterStatisticsEntry 11 } vrrpStatisticsDiscontinuityTime OBJECT-TYPE SYNTAX TimeStamp MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime on the most recent occasion at which any one or more of this entry's counters suffered a discontinuity. If no such discontinuities have occurred since the last re-initialization of the local management subsystem, then this object contains a zero value." ::= { vrrpRouterStatisticsEntry 12 } vrrpStatisticsRefreshRate OBJECT-TYPE SYNTAX Unsigned32 UNITS "milli-seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The minimum reasonable polling interval for this entry. This object provides an indication of the minimum Amount of time required to update the counters in this entry." ::= { vrrpRouterStatisticsEntry 13 } -- -- Trap Definitions -- vrrpNotifications OBJECT IDENTIFIER ::= { vrrpMIB 0 } --- --- Objects used in the traps --- vrrpTrapPacketSrc OBJECT-TYPE Tata [Page 33] INTERNET-DRAFT VRRP unified MIB June 6, 2004 SYNTAX IpAddress MAX-ACCESS accessible-for-notify STATUS deprecated DESCRIPTION "The IP address of an inbound VRRP packet. Used by vrrpTrapAuthFailure trap." ::= { vrrpOperations 5 } vrrpTrapAuthErrorType OBJECT-TYPE SYNTAX INTEGER { invalidAuthType (1), authTypeMismatch (2), authFailure (3) } MAX-ACCESS accessible-for-notify STATUS deprecated DESCRIPTION "Potential types of configuration conflicts. Used by vrrpAuthFailure trap." ::= { vrrpOperations 6 } vrrpTrapNewMasterReason OBJECT-TYPE SYNTAX INTEGER { priority (0), preempted (1), masterNoResponse (2) } MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "This indicates the reason for NewMaster trap. Used by vrrpTrapNewMaster trap." ::= { vrrpOperations 9 } vrrpTrapProtoErrReason OBJECT-TYPE SYNTAX INTEGER { hopLimitError (0), versionError (1), checksumError (2), vridError(3) } MAX-ACCESS accessible-for-notify STATUS current DESCRIPTION "This indicates the reason for protocol error trap. Used by vrrpTrapProtoError trap." ::= { vrrpOperations 10 } vrrpTrapNewMaster NOTIFICATION-TYPE Tata [Page 34] INTERNET-DRAFT VRRP unified MIB June 6, 2004 OBJECTS { vrrpOperationsMasterIpAddrType, vrrpOperationsMasterIpAddr, vrrpTrapNewMasterReason } STATUS current DESCRIPTION "The newMaster trap indicates that the sending agent has transitioned to 'Master' state." ::= { vrrpNotifications 1 } --- --- vrrpAuthFailureTrap (2) has been deprecated. --- vrrpTrapAuthFailure NOTIFICATION-TYPE OBJECTS { vrrpTrapPacketSrc, vrrpTrapAuthErrorType } STATUS deprecated DESCRIPTION "A vrrpAuthFailure trap signifies that a packet has been received from a router whose authentication key or authentication type conflicts with this router's authentication key or authentication type. Implementation of this trap is optional." ::= { vrrpNotifications 2 } vrrpTrapProtoError NOTIFICATION-TYPE OBJECTS { vrrpTrapProtoErrReason } STATUS current DESCRIPTION "The error trap indicates that the sending agent has encountered the protocol error indicated by ErrorReason." ::= { vrrpNotifications 3 } -- -- Conformance Information -- vrrpMIBCompliances OBJECT IDENTIFIER ::= { vrrpConformance 1 } vrrpMIBGroups OBJECT IDENTIFIER ::= { vrrpConformance 2 } -- -- Compliance Statements -- vrrpMIBCompliance MODULE-COMPLIANCE Tata [Page 35] INTERNET-DRAFT VRRP unified MIB June 6, 2004 STATUS deprecated DESCRIPTION "This compliance is deprecated in favour of vrrpMIBCompliance2." MODULE -- this module MANDATORY-GROUPS { vrrpOperGroup, vrrpStatsGroup } OBJECT vrrpOperPriority WRITE-SYNTAX Integer32 (1..255) DESCRIPTION "SETable values are from 1 to 255." ::= { vrrpMIBCompliances 1 } vrrpMIBCompliance2 MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for all VRRP implementations VRRP for IPv4 and IPv6." MODULE -- this module MANDATORY-GROUPS { vrrpOperationsGroup, vrrpStatisticsGroup, vrrpTrapInfoGroup, vrrpNotificationsGroup } OBJECT vrrpOperationsPriority WRITE-SYNTAX Integer32 (1..255) DESCRIPTION "SETable values are from 1 to 255." GROUP vrrpIpv4Group DESCRIPTION "This group is mandatory for all systems supporting VRRP for IPv4." ::= { vrrpMIBCompliances 2 } vrrpMIBReadOnlyCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The read-only compliance statement for all VRRP implementations VRRP for IPv4 and IPv6." MODULE -- this module MANDATORY-GROUPS { vrrpOperationsGroup, vrrpStatisticsGroup, Tata [Page 36] INTERNET-DRAFT VRRP unified MIB June 6, 2004 vrrpTrapInfoGroup, vrrpNotificationsGroup } OBJECT vrrpNotificationCntl MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpOperationsAdminState MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpOperationsPriority MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpOperationsPrimaryIpAddrType MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpOperationsPrimaryIpAddr MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpOperationsAdvInterval MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpOperationsRowStatus MIN-ACCESS read-only DESCRIPTION "Write access is not required." OBJECT vrrpAssociatedIpAddrRowStatus MIN-ACCESS read-only DESCRIPTION "Write access is not required." GROUP vrrpIpv4Group DESCRIPTION "This group is mandatory for all systems supporting VRRP for IPv4." ::= { vrrpMIBCompliances 3 } -- -- Conformance Groups -- vrrpOperGroup OBJECT-GROUP OBJECTS { Tata [Page 37] INTERNET-DRAFT VRRP unified MIB June 6, 2004 vrrpNodeVersion, vrrpNotificationCntl, vrrpOperVirtualMacAddr, vrrpOperState, vrrpOperAdminState, vrrpOperPriority, vrrpOperIpAddrCount, vrrpOperMasterIpAddr, vrrpOperPrimaryIpAddr, vrrpOperAuthType, vrrpOperAuthKey, vrrpOperAdvertisementInterval, vrrpOperPreemptMode, vrrpOperVirtualRouterUpTime, vrrpOperProtocol, vrrpOperRowStatus, vrrpAssoIpAddrRowStatus } STATUS deprecated DESCRIPTION "Conformance group for VRRP operations." ::= { vrrpMIBGroups 1 } vrrpStatsGroup OBJECT-GROUP OBJECTS { vrrpRouterChecksumErrors, vrrpRouterVersionErrors, vrrpRouterVrIdErrors, vrrpStatsBecomeMaster, vrrpStatsAdvertiseRcvd, vrrpStatsAdvertiseIntervalErrors, vrrpStatsAuthFailures, vrrpStatsIpTtlErrors, vrrpStatsPriorityZeroPktsRcvd, vrrpStatsPriorityZeroPktsSent, vrrpStatsInvalidTypePktsRcvd, vrrpStatsAddressListErrors, vrrpStatsInvalidAuthType, vrrpStatsAuthTypeMismatch, vrrpStatsPacketLengthErrors } STATUS deprecated DESCRIPTION "Conformance group for VRRP statistics." ::= { vrrpMIBGroups 2 } vrrpTrapGroup OBJECT-GROUP OBJECTS { vrrpTrapPacketSrc, vrrpTrapAuthErrorType Tata [Page 38] INTERNET-DRAFT VRRP unified MIB June 6, 2004 } STATUS deprecated DESCRIPTION "Conformance group for objects contained in VRRP notifications." ::= { vrrpMIBGroups 3 } vrrpNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { vrrpTrapNewMaster, vrrpTrapAuthFailure } STATUS deprecated DESCRIPTION "The VRRP MIB Notification Group." ::= { vrrpMIBGroups 4 } vrrpOperationsGroup OBJECT-GROUP OBJECTS { vrrpNotificationCntl, vrrpOperationsVirtualMacAddr, vrrpOperationsState, vrrpOperationsAdminState, vrrpOperationsPriority, vrrpOperationsMasterIpAddrType, vrrpOperationsMasterIpAddr, vrrpOperationsVersion, vrrpOperationsAdvInterval, vrrpOperationsPreemptMode, vrrpOperationsUpTime, vrrpOperationsRowStatus, vrrpAssociatedIpAddrRowStatus } STATUS current DESCRIPTION "Conformance group for VRRPover IPv4 and IPv6 operations." ::= { vrrpMIBGroups 5 } vrrpStatisticsGroup OBJECT-GROUP OBJECTS { vrrpRouterChecksumErrors, vrrpRouterVersionErrors, vrrpRouterVrIdErrors, vrrpStatisticsBecomeMaster, vrrpStatisticsAdvertiseRcvd, vrrpStatisticsAdvIntervalErrors, vrrpStatisticsPriZeroPktsRcvd, Tata [Page 39] INTERNET-DRAFT VRRP unified MIB June 6, 2004 vrrpStatisticsPriZeroPktsSent, vrrpStatisticsInvldTypePktsRcvd, vrrpStatisticsIpTtlErrors, vrrpStatisticsAddressListErrors, vrrpStatisticsPacketLengthErrors, vrrpStatisticsDiscontinuityTime, vrrpStatisticsRefreshRate } STATUS current DESCRIPTION "Conformance group for VRRP over IPv4 and IPv4 statistics." ::= { vrrpMIBGroups 6 } vrrpIpv4Group OBJECT-GROUP OBJECTS { vrrpOperationsIpv4AddrCount, vrrpOperationsPrimaryIpAddr, vrrpOperationsPrimaryIpAddrType, vrrpAssociatedIpAddrRowStatus, vrrpStatisticsAuthTypeMismatch, vrrpStatisticsAuthFailures } STATUS current DESCRIPTION "Conformance group for VRRP over IPv4 implementations." ::= { vrrpMIBGroups 7 } vrrpTrapInfoGroup OBJECT-GROUP OBJECTS { vrrpTrapNewMasterReason, vrrpTrapProtoErrReason } STATUS current DESCRIPTION "Conformance group for objects contained in VRRP notifications." ::= { vrrpMIBGroups 8 } vrrpNotificationsGroup NOTIFICATION-GROUP NOTIFICATIONS { vrrpTrapNewMaster, vrrpTrapProtoError } STATUS current DESCRIPTION "The VRRP MIB Notification Group." ::= { vrrpMIBGroups 9 } END Tata [Page 40] INTERNET-DRAFT VRRP unified MIB June 6, 2004 10. Security Consideration There are a number of management objects defined in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. These are the tables and objects and their sensitivity/vulnerability: A number of objects in the vrrpOperationsTable possess the read- create attribute. Manipulation of these objects is capable of affecting the operation of a virtual router. Specific examples of this include, but are not limited to: o The vrrpOperationsAdminState object which could be used to disable a virtual router. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them. 11. Acknowledgments Kripakaran Karlekar and Brain Jewell helped in design and initial drafts of this specification. This specification is based on RFC Tata [Page 41] INTERNET-DRAFT VRRP unified MIB June 6, 2004 2787. The authors of RFC2787 are Brian Jewell and David Chuang. The author would also like to thank Bert Wijnen and Dave Thaler for taking time to review the document and provide valuable guidance. 12. Authors' Addresses Srinivas Kalyan Tata Tel: +408 505 0542 Nokia Inc. EMail: kalyan.tata@nokia.com 313, Fair Child Drive, Mountainview, CA, 94043. 13. References 13.1. Normative references [1] S. Bradner, "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997. [2] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [3] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [4] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [5] Robert Hinden, "Virtual Router Redundancy Protocol", RFC3768, April 2004. [6] Robert Hinden, "Virtual Router Redundancy Protocol for IPv6", (draft-ietf-vrrp-ipv6-spec-06.txt), Feb 2004. [7] Jewell & Chuang, "Definitions of Managed Objects for the Virtual Router Redundancy Protocol", RFC 2787, Marc 2000. 13.2. Informative References [8] Case, J., Mundy, R., Partain, D. and B.Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002. [9] Case, J., Mundy, R., Partain, D. and B.Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002. Tata [Page 42] INTERNET-DRAFT VRRP unified MIB June 6, 2004 Copyright Statement Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. This Internet-Draft expires September 24, 2004. Tata [Page 43]