IPCDN Internet Draft Eugene Nechamkin Document: draft-ietf-ipcdn-pktc-mtamib-01.txt Broadcom Corp. Jean-Francois Mule Cablelabs Expires: October 2003 May 2003 Multimedia Terminal Adapter (MTA) Management Information Base for PacketCable/IPCablecom compliant devices Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC 2026 [RFC2026]. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Copyright Notice Copyright (C) The Internet Society (2003). All Rights Reserved. Abstract This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it defines a basic set of managed objects for SNMP- based management of PacketCable/IPCablecom compliant Multimedia Terminal Adapter devices. Nechamkin/Mule Expires - November 2003 [Page 1] PacketCable/IPCablecom MTA MIB May 2003 Table of Contents 1. The Internet-Standard Management Framework....................2 2. Terminology...................................................3 2.1 DOCSIS....................................................3 2.2 Cable Modem...............................................3 2.3 Multimedia Terminal Adapter...............................3 2.4 Endpoint..................................................3 2.5 X.509 Certificate.........................................4 2.6 Voice Over IP.............................................4 2.7 Public Key Certificate....................................4 2.8 DHCP......................................................4 2.9 Call Management Server....................................4 2.10 Voice Coder-Decoder......................................4 2.11 Operations Systems Support...............................4 2.12 Key Distribution Center..................................4 2.13 Fully Qualified Domain Name..............................5 2.14 Security Association.....................................5 3. Overview......................................................5 3.1 Structure of the MIB......................................5 3.2 pktcMtaDevBase............................................5 3.3 pktcMtaDevServer..........................................6 3.4 pktcMtaDevSecurity........................................6 3.5 Relationship between MIB Objects in MTA MIB...............7 4. Definitions...................................................8 5. Acknowledgments..............................................35 6. Normative References.........................................36 7. Informative References.......................................37 8. Security Considerations......................................37 9. Intellectual Property........................................40 10. Authors' Addresses..........................................40 11. Full Copyright Statement....................................40 1. The Internet-Standard Management Framework For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 [RFC3410]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. Nechamkin/Mule Expires - November 2003 [Page 2] PacketCable/IPCablecom MTA MIB May 2003 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL", when used in the guidelines in this memo, are to be interpreted as described in RFC 2119 [RFC2119]. The terms "MIB module" and "information module" are used interchangeably in this memo. As used here, both terms refer to any of the three types of information modules defined in Section 3 of RFC 2578 [RFC2578]. The terms in this document are derived from the documents associated with the PacketCable Provisioning Specification [PKT-SP-PROV-IO6- 030415] and Security Specification [PKT-SP-SEC-I08-030415]. 2.1 DOCSIS "Data Over Cable Service Interface Specification". A term referring to the ITU-T J.112 Annex B standard for cable modem systems [ITU-T-J112]. 2.2 Cable Modem A Cable Modem (CM) acts as a data transport agent used to transfer call management and voice data packets over the DOCSIS compliant cable systems. 2.3 Multimedia Terminal Adapter Multimedia Terminal Adapter (MTA) is used to refer to any PacketCable/IPCablecom compliant device providing telephony services over the cable or hybrid system used to deliver video signals to a community. MTA can be Embedded (E-MTA) or Standalone (S-MTA). E-MTA contains both an MTA and a CM. S-MTA does not contain the CM part relying on the presence of some external DOCSIS agent to provide the data transport over the cable. MTA Contains the interface(s) to a physical voice device, a network interface, CODECs, and all signaling and encapsulation functions required for VoIP transport, class feature signaling and QoS signaling. 2.4 Endpoint A standard RJ-11 telephony physical port located on the MTA and used for attaching the telephone device to the MTA. Nechamkin/Mule Expires - November 2003 [Page 3] PacketCable/IPCablecom MTA MIB May 2003 2.5 X.509 Certificate A public key certificate specification developed as part of the ITU- T X.500 standards directory. 2.6 Voice Over IP Voice Over IP (VoIP) is a technology providing the means to transfer the digitized packets with the voice information over the IP networks. 2.7 Public Key Certificate Public Key Certificate (also Digital Certificate) - a binding between an entity's public key and one or more attributes relating to its identity. 2.8 DHCP Dynamic Host Configuration Protocol as defined in [RFC2131]. 2.9 Call Management Server Call Management Server (CMS) - the element of the PacketCable infrastructure which controls the audio connections between different MTAs. 2.10 Voice Coder-Decoder Voice COder-DECoder (CODEC) - is an algorithm used to transform the audio information to the packets of digitized Data being transferred over the IP networks. 2.11 Operations Systems Support Operations Systems Support (OSS) - system of the back office software components used for configuration, performance, fault, accounting and security management working in interaction with each other and providing the operations support in deployed PacketCable systems. 2.12 Key Distribution Center Key Distribution Center (KDC) - is an element of the OSS functioning as a Kerberos Security Server providing mutual authentication of the various components of the PacketCable system (e.g. MTA and CMS, or MTA and the Provisioning Server). Nechamkin/Mule Expires - November 2003 [Page 4] PacketCable/IPCablecom MTA MIB May 2003 2.13 Fully Qualified Domain Name Fully Qualified Domain Name (FQDN) - refer to [RFC1034] and [RFC1035] for definition and details. 2.14 Security Association Security Association (SA) - is a one-way relationship between sender and receiver offering security services on the communication flow. 3. Overview This MIB provides a set of objects required for the management of PacketCable/IPCablecom compliant MTA Devices. The MTA Module MIB is derived in part from the parameters described in PacketCable 1.0 MTA MIB Specification [PKT-SP-MIB-MTA-IO6-030415]. 3.1 Structure of the MIB This MIB is identified by pktcMtaMib and is structured in three groups: - Management information pertinent to MTA Device Itself (pktcMtaDevBase) - Management information pertinent to the Provisioning back office Servers (pktcMtaDevServer) - Management information pertinent to elements of and logic providing the PacketCable Security mechanisms (pktcMtaDevSecurity) First two groups contain only scalar information describing the corresponding characteristics of the MTA device and back office servers. Third group contains two tables controlling the necessary logical associations between KDC realms and back office servers (CMS and provisioning). Rows in the tables can be created automatically (e.g. by the device according to the current state information) or can be created by the management station depending on the operational situation. Tables may and generally will have a mixture of both types of rows. 3.2 pktcMtaDevBase Contains management information describing the parameters of the MTA device itself. Also, this group contains some objects controlling the MTA state. Some of the MIB objects are as follows: Nechamkin/Mule Expires - November 2003 [Page 5] PacketCable/IPCablecom MTA MIB May 2003 - pktcMtaDevSerialNumber - Contains the MTA Serial Number, - pktcMtaDevEndPntCount - Contains the number of End Points present in MTA, - pktcMtaDevProvisioningState - This object contains the information describing the completion state of the initialization process, - pktcMtaDevEnabled - Controls the state of the MTA enabling or disabling telephony services on the device, - pktcMtaDevResetNow - This object is used to instruct the MTA to reset itself. 3.3 pktcMtaDevServer Contains management information describing the back office servers and the parameters assigned to the communication timeouts. Also, this group contains some objects controlling the initial MTA interaction with the Provisioning Server. Some of the MIB objects are as follows: - pktcMtaDevServerDhcp1 - This object contains the IP Address of the Primary DHCP server designated for MTA provisioning, - pktcMtaDevServerDhcp2 - This object contains the IP Address of the Secondary DHCP server designated for MTA provisioning, - pktcMtaDevServerDns1 - This object contains the IP Address of the Primary DNS used by MTA to resolve the FQDN and IP Addresses, - pktcMtaDevServerDns2 - This object contains the IP Address of the Secondary DNS used by MTA to resolve the FQDN and IP Addresses, - pktcMtaDevConfigFile - This object contains the name of the provisioning configuration file to download from the Provisioning Server by the MTA, - pktcMtaDevProvConfigHash - This object is used to supply the hash value of MTA Configuration File calculated over its content. 3.4 pktcMtaDevSecurity Contains management information describing the security related characteristics of the MTA. Nechamkin/Mule Expires - November 2003 [Page 6] PacketCable/IPCablecom MTA MIB May 2003 Also, this group contains two tables containing logical dependencies and parameters necessary to establish security association between the MTA and other components of the back office. - pktcMtaDevRealmTable - This table is used in conjunction with any server which needs a Security Association with an MTA (CMS or Provisioning Sever), - pktcMtaDevCmsTable - This table contains the parameters describing the SA establishment between an MTA and a CMS. 3.5 Relationship between MIB Objects in MTA MIB This section clarifies the relationship between various MIB Objects in MTA MIB in respect to the role these objects are playing in the process of the Security Association establishment. Relationships between the MTA MIB Objects are defined by process of the establishment of the Security Association which is described in the PacketCable Security Specification [PKT-SP-SEC-I08-030415]. The SA establishment process between the MTA and other back office Application Servers (CMS or Provisioning Server) consists of two steps: - AS-exchange providing mutual authentication of the parties (MTA and the Application Server), - AP-exchange providing the Key Distribution between the parties (MTA and the Application Server). Each Server-MTA Security Association has a one-to-one correspondence to a single Realm. The process of AS-exchange is defined by the number of parameters grouped per each Realm. These parameters are collected in the Realm Table. Realm Table is indexed by the Index Counter and contains conceptual column with the Kerberos Realm Name. CMS Table contains the parameters defining the process of the AP- exchange between the MTA and the CMS when MTA is exchanging the keys for SA with CMS. CMS Table is indexed by the Index Counter and contains conceptual column with CMS FQDN. Each row of the Table also contains the Realm Name corresponding to each CMS FQDN in the row. This allows for multiple realms, each with its own Security Association. MTA MIB also contains the group of the scalar MIB Objects which define the Parameters for AP-exchange process between the MTA and the Provisioning Server. These objects are: - pktcMtaDevProvUnsolicitedKeyMaxTimeout, - pktcMtaDevProvUnsolicitedKeyNomTimeout, - pktcMtaDevProvUnsolicitedKeyMaxRetries, - pktcMtaDevProvSolicitedKeyTimeout. Nechamkin/Mule Expires - November 2003 [Page 7] PacketCable/IPCablecom MTA MIB May 2003 4. Definitions PKTC-IETF-MTA-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Unsigned32, NOTIFICATION-TYPE, mib-2 FROM SNMPv2-SMI RowStatus, TruthValue, TEXTUAL-CONVENTION FROM SNMPv2-TC OBJECT-GROUP, MODULE-COMPLIANCE, NOTIFICATION-GROUP FROM SNMPv2-CONF InetAddressType, InetAddress FROM INET-ADDRESS-MIB sysDescr FROM SNMPv2-MIB SnmpAdminString FROM SNMP-FRAMEWORK-MIB ifPhysAddress FROM IF-MIB; pktcMtaMib MODULE-IDENTITY LAST-UPDATED "200305070000Z" -- May 07, 2003 ORGANIZATION "IETF IPCDN Working Group " CONTACT-INFO "Eugene Nechamkin Broadcom Corporation, 200-13711 International Place, Richmond, BC, V6V 2Z8 CANADA Phone: +1 604 233 8500 Fax: +1 604 233 8501 Email: enechamkin@broadcom.com Jean-Francois Mule Cable Television Laboratories, Inc. 400 Centennial Parkway, Louisville, CO 80027-1266 U.S.A. Phone: +1 303 661 9100 Nechamkin/Mule Expires - November 2003 [Page 8] PacketCable/IPCablecom MTA MIB May 2003 Fax: +1 303 661 9199 Email: jf.mule@ cablelabs.com IETF IPCDN Working Group General Discussion: ipcdn@ietf.org Subscribe: http://www.ietf.org/mailman/listinfo/ipcdn Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn Co-Chair: Jean-Francois Mule, jf.mule@cablelabs.com Co-Chair: Richard Woundy, Richard_Woundy@cable.comcast.com" DESCRIPTION "This MIB module supplies the basic management object for the Multimedia Terminal Adapter Devices compliant with PacketCable/IPCablecom set if requirements. Copyright (C) The Internet Society (2003). This version of this MIB module is part of RFC yyyy; see the RFC itself for full legal notices." -- RFC Ed: replace yyyy with actual RFC number and remove this note REVISION "200305070000Z" DESCRIPTION "Initial version, published as RFC yyyy." -- RFC Ed: replace yyyy with actual RFC number and remove this note ::= { mib-2 XXX } -- RFC Ed: replace XXX with IANA-assigned number and remove this -- note -- Textual Conventions -- -- The following textual convention will be imported from BPI+ RFC -- when introduced there. -- DocsX509ASN1DEREncodedCertificate ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION " An X509 digital certificate encoded as an ASN.1 DER object." SYNTAX OCTET STRING (SIZE (0..4096)) --================================================================= -- The MTA MIB only supports a single provisioning server. Nechamkin/Mule Expires - November 2003 [Page 9] PacketCable/IPCablecom MTA MIB May 2003 --================================================================= pktcMtaMibObjects OBJECT IDENTIFIER ::= { pktcMtaMib 1 } pktcMtaDevBase OBJECT IDENTIFIER ::= { pktcMtaMibObjects 1 } pktcMtaDevServer OBJECT IDENTIFIER ::= { pktcMtaMibObjects 2 } pktcMtaDevSecurity OBJECT IDENTIFIER ::= { pktcMtaMibObjects 3 } -- -- The following group describes the base objects in the MTA -- pktcMtaDevResetNow OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION " Setting this object to true(1) causes the device to reset. Reading this object always returns false(2). When pktcMtaDevResetNow is set to true, the following actions occur: 1. All connections (if present) are flushed locally. 2. All current actions such as ringing immediately terminate. 3. Requests for notifications such as notification based on digit map recognition are flushed. 4. All endpoints are disabled. 5. The provisioning flow is started at step MTA-1." REFERENCE " PacketCable Provisioning Specification." ::= { pktcMtaDevBase 1 } pktcMtaDevSerialNumber OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (1..128)) MAX-ACCESS read-only STATUS current DESCRIPTION " The manufacturer's serial number for this MTA." ::= { pktcMtaDevBase 2 } pktcMtaDevSwCurrentVers OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION " The version of the software currently operating in MTA. Any MTA MUST return a string descriptive of the current software load. This object should use the syntax defined by the individual vendor to identify the software Nechamkin/Mule Expires - November 2003 [Page 10] PacketCable/IPCablecom MTA MIB May 2003 version. The data presented in this object MUST be consistent with the software version information embedded in the 'sysDecr' MIB Object for the MTA." ::= { pktcMtaDevBase 3 } pktcMtaDevFQDN OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION " The Fully Qualified Domain Name for this MTA." ::= { pktcMtaDevBase 4 } pktcMtaDevEndPntCount OBJECT-TYPE SYNTAX Unsigned32 (1..255) MAX-ACCESS read-only STATUS current DESCRIPTION " The physical end points for this MTA." ::= { pktcMtaDevBase 5 } pktcMtaDevEnabled OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION " The MTA Admin Status of this device, where true(1) means the voice feature is enabled and false(2) indicates that it is disabled." ::= { pktcMtaDevBase 6 } pktcMtaDevTypeIdentifier OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION " This is a copy of the device type identifier used in the DHCP option 60 exchanged between the MTA and the DHCP server." ::= { pktcMtaDevBase 7 } pktcMtaDevProvisioningState OBJECT-TYPE SYNTAX INTEGER { pass (1), inProgress (2), failConfigFileError (3), passWithWarning (4), passWithIncompleteParsing (5), Nechamkin/Mule Expires - November 2003 [Page 11] PacketCable/IPCablecom MTA MIB May 2003 failureInternalError (6), failOtherReason (7) } MAX-ACCESS read-only STATUS current DESCRIPTION " This parameter indicates the completion state of the MTA Device provisioning process. This parameter is sent as part of the final INFORM (step 25 of the MTA provisioning process). Refer to the MTA Device provisioning spec for explanation on how an MTA chooses a particular state to report." REFERENCE " PacketCable Provisioning Specification." ::= { pktcMtaDevBase 8 } pktcMtaDevHttpAccess OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION " This indicates whether HTTP file access is supported for MTA configuration file transfer." ::= { pktcMtaDevBase 9 } pktcMtaDevProvisioningTimer OBJECT-TYPE SYNTAX Unsigned32 (0..30) UNITS "minutes" MAX-ACCESS read-write STATUS current DESCRIPTION " This object enables setting the duration of the provisioning timeout timer. The timer covers the provisioning sequence from step MTA-1 to step MTA-23. The value is in minutes and setting the timer to 0 disables this timer." REFERENCE " PacketCable Provisioning Specification." DEFVAL {10} ::= {pktcMtaDevBase 10} pktcMtaDevErrorOidsTable OBJECT-TYPE SYNTAX SEQUENCE OF PktcMtaDevErrorOidsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION " Parsing of the MTA Configuration File might result error situation due to various reasons, e.g. wrong OIDs of the Configuration File Objects, wrong values of the Objects, Nechamkin/Mule Expires - November 2003 [Page 12] PacketCable/IPCablecom MTA MIB May 2003 wrong (unrecognizable)OIDs, etc. If pktcMtaDevProvisioningState reported anything other than 'pass(1)' then this table must be populated with the corresponding information, pertaining to the details of each instance of an error. Even if different parameters share the same error type (e.g., all Realm Names are invalid), all observed errors must be reported as different instances. Errors are placed into the table in no particular order." ::= {pktcMtaDevBase 11 } pktcMtaDevErrorOidsEntry OBJECT-TYPE SYNTAX PktcMtaDevErrorOidsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION " This contains the necessary information an MTA must attempt to provide in case the configuration file not parsed and/or accepted in its entirety." INDEX { pktcMtaDevErrorOidIndex } ::= {pktcMtaDevErrorOidsTable 1} PktcMtaDevErrorOidsEntry ::= SEQUENCE { pktcMtaDevErrorOidIndex Unsigned32, pktcMtaDevErrorOid OBJECT IDENTIFIER, pktcMtaDevErrorValue SnmpAdminString, pktcMtaDevErrorReason SnmpAdminString } pktcMtaDevErrorOidIndex OBJECT-TYPE SYNTAX Unsigned32 (1..1024) MAX-ACCESS not-accessible STATUS current DESCRIPTION " This is the index to pktcMtaDevErrorOidsEntry: an integer an integer value which starts from the value of 1 and is incremented for each error encountered in the configuration file." ::= {pktcMtaDevErrorOidsEntry 1} pktcMtaDevErrorOid OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS read-only STATUS current DESCRIPTION " The OID of the Configuration File Parameter, which caused the particular error, is placed into this MIB Object. If the error was due to a reason which cannot be associated Nechamkin/Mule Expires - November 2003 [Page 13] PacketCable/IPCablecom MTA MIB May 2003 with 'recognizable' OID of the parameter, then this MIB object must contain an empty value." ::= {pktcMtaDevErrorOidsEntry 2} pktcMtaDevErrorValue OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION " If the error was due to unrecognizable OID of the parameter in the Configuration File, then this MIB Object contains the value of the OID as interpreted MTA. Otherwise (the error happens due to a wrong value of the parameter) - the MIB Object contains the value from the Configuration File converted to SnmpAdminString." ::= {pktcMtaDevErrorOidsEntry 3} pktcMtaDevErrorReason OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION " This indicates the reason for the error, as per the MTA's interpretation, in human readable form. E.g.: 'VALUE NOT IN RANGE', 'VALUE DOES NOT MATCH TYPE', 'UNSUPPORTED VALUE', 'LAST 4 BITS MUST BE SET TO ZERO', 'OUT OF MEMORY - CANNOT STORE', etc. This may also contain vendor specific errors for vendor specific OIDs and any proprietary error codes/messages which can help diagnose errors better, in a manner the vendor deems fit." ::= {pktcMtaDevErrorOidsEntry 4} -- -- The following group describes server access and parameters used -- for initial provisioning and bootstrapping. -- pktcMtaDevServerAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-write STATUS current DESCRIPTION " The type of Internet address used in MIB Objects describing PacketCable servers in MTA MIB. This object defines the address type for the following servers: pktcMtaDevServerDhcp1, pktcMtaDevServerDhcp2, Nechamkin/Mule Expires - November 2003 [Page 14] PacketCable/IPCablecom MTA MIB May 2003 pktcMtaDevServerDns1, pktcMtaDevServerDns2, pktcMtaDevTimeServer." DEFVAL { ipv4 } ::= { pktcMtaDevServer 1} pktcMtaDevServerDhcp1 OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION " The IP address of the primary DHCP server which would cater to the MTA during its provisioning. Contains 255.255.255.255 if there was no preference given with respect to the DHCP servers for MTA provisioning. PacketCable compliant DHCP Servers and MTAs must support DHCP Option for CableLabs Client Configuration." REFERENCE " PacketCable Provisioning Specification. RFC 3495." ::= { pktcMtaDevServer 2 } pktcMtaDevServerDhcp2 OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION " The IP address of the Secondary DHCP server which could cater to the MTA during its provisioning. Contains 0.0.0.0 if there is no specific secondary DHCP server to be considered during MTA provisioning. PacketCable compliant DHCP Servers and MTAs must support DHCP Option for CableLabs Client Configuration." REFERENCE " PacketCable Provisioning Specification. RFC 3495." ::= { pktcMtaDevServer 3 } pktcMtaDevServerDns1 OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-write STATUS current DESCRIPTION " The IP address of the primary DNS server to be used by the MTA to resolve the FQDNs. As defined in RFC-3495, PacketCable compliant MTAs receive the IP Address of the primary DNS Server in the DHCP Option-6." REFERENCE " PacketCable Provisioning Specification. RFC 3495." ::= { pktcMtaDevServer 4 } pktcMtaDevServerDns2 OBJECT-TYPE Nechamkin/Mule Expires - November 2003 [Page 15] PacketCable/IPCablecom MTA MIB May 2003 SYNTAX InetAddress MAX-ACCESS read-write STATUS current DESCRIPTION " The IP address of the Secondary DNS server to be usaed by the MTA to resolve the FQDNs. Contains 0.0.0.0 if there is no Secondary DNS server specified for the MTA under consideration. As defined in RFC-3495, PacketCable compliant MTAs receive the IP Address of the secondary DNS Server in the DHCP Option-6." REFERENCE " PacketCable Provisioning Specification. RFC 3495." ::= { pktcMtaDevServer 5 } pktcMtaDevTimeServer OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-write STATUS current DESCRIPTION " This holds the IP address of the Time Server used for Time Synchronization and must be populated in the case of SMTA. Contains 0.0.0.0 if the Time Protocol is not used for time synchronization." ::= { pktcMtaDevServer 6} pktcMtaDevConfigFile OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-write STATUS current DESCRIPTION " The Configuration File Name set by Provisioning Application. MTA MUST support TFTP access method, and MAY support HTTP access method. In the case of the TFTP access method, the filename MUST encoded in the following format: tftp://[IPv4] or FQDN of access server/mta-configfilename In the case of HTTP access method, the filename MUST be URL-encoded in the following format: http://[IPv4] or FQDN of access server/ mta-configfilename The object returns NULL if the server address is unknown." ::= { pktcMtaDevServer 7 } pktcMtaDevSnmpEntity OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-write STATUS current DESCRIPTION " The FQDN of the SNMPv3 entity of the Provisioning Nechamkin/Mule Expires - November 2003 [Page 16] PacketCable/IPCablecom MTA MIB May 2003 Server to which the MTA has to communicate in order to receive the access method, location and the name of the Configuration file during MTA provisioning. This would also be the entity which caters to the end-point provisioning needs of the MTA and is the destination for all provisioning informs. It may be also used for post-provisioning SNMP operations. FQDN of the SNMP V3 entity of the Provisioning Server is supplied to the MTA via suboption-3 of the DHCP Option CCC as defined in RFC-3495." REFERENCE "RFC-3495" ::= { pktcMtaDevServer 8 } pktcMtaDevProvConfigHash OBJECT-TYPE SYNTAX OCTET STRING (SIZE(16|20)) MAX-ACCESS read-write STATUS current DESCRIPTION " Hash of the contents of the config file, calculated and sent to the MTA prior to sending the config file. If the authenthenication algorithm is MD5, the length is 128 bits. If the authentication algorithm is SHA-1, the length is 160 bits." ::= { pktcMtaDevServer 9 } pktcMtaDevProvConfigKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE(0|8)) MAX-ACCESS read-write STATUS current DESCRIPTION " Key used to encrypt/decrypt the config file, sent to the MTA prior to sending the config file. If the privacy algorithm is null, the length is 0. If the privacy algorithm is DES, the length is 64 bits." ::= { pktcMtaDevServer 10 } pktcMtaDevProvSolicitedKeyTimeout OBJECT-TYPE SYNTAX Unsigned32 (15..600) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION " This timeout applies only when the Provisioning Sever initiated key management (with a Wake Up message) for SNMPv3. It is the period during which the MTA will save a nonce (inside the sequence number field) from the sent out AP Request and wait for the matching AP Reply from the Provisioning Server." Nechamkin/Mule Expires - November 2003 [Page 17] PacketCable/IPCablecom MTA MIB May 2003 DEFVAL { 120 } ::= { pktcMtaDevServer 11 } --================================================================= -- -- Unsolicited Key Updates are based on an exponential backoff -- mechanism with two timers for AS replies. The fast timers -- has a maximum timer (pktcMtaDevProvUnsolicitedKeyMaxTimeout -- seconds and a nominal timer -- pktcMtaDevProvUnsolicitedKeyNomTimeout seconds) from which the -- backoff timer determinations are made. -- --================================================================= --================================================================= -- -- Timeouts for unsolicited key management updates are only -- pertinent before the first SNMP message is sent between the MTA -- and the CMS and before the configuration file is loaded. No -- SNMP communications can exist under PacketCable without the -- security association existing. The following object is provided -- only for diagnosistic purposes and are only useful if the MTA -- can be brought up without any security. -- --================================================================= pktcMtaDevProvUnsolicitedKeyMaxTimeout OBJECT-TYPE SYNTAX Unsigned32 (15..600) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION " This timeout applies to MTA initiated AP-REQ/REP key management exchange with Provisioning Server. The maximum timeout is the value which may not be exceeded in the exponential backoff algorithm. If provided, DHCP-Option- 122-Sub-option 5 overrides this value." REFERENCE " PacketCable Security Specification" DEFVAL {600} ::= { pktcMtaDevServer 12 } pktcMtaDevProvUnsolicitedKeyNomTimeout OBJECT-TYPE SYNTAX Unsigned32 (15..600) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION " Defines the starting value of the timeout for the Nechamkin/Mule Expires - November 2003 [Page 18] PacketCable/IPCablecom MTA MIB May 2003 AP-REQ/REP Backoff and Retry mechanism with exponential timeout. If provided, DHCP-Option-122-Sub-option 5 override this value." REFERENCE " PacketCable Security Specification" DEFVAL {30} ::= { pktcMtaDevServer 13} pktcMtaDevProvUnsolicitedKeyMaxRetries OBJECT-TYPE SYNTAX Unsigned32 (1..32) MAX-ACCESS read-only STATUS current DESCRIPTION " This retries number applies to MTA initiated AP-REQ/REP key management exchange with Provisioning Server. This is the maximum number of retries before the MTA gives up attempting to establish an SNMPv3 security association with Provisioning Server. If provided, DHCP-Option-122- Sub-option 5 overrides this value." REFERENCE " PacketCable Security Specification " DEFVAL {8} ::= { pktcMtaDevServer 14 } pktcMtaDevProvKerbRealmName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..255)) MAX-ACCESS read-only STATUS current DESCRIPTION " The name of the associated Provisioning Kerberos Realm acquired during MTA4 (DHCP Ack). This is used as an index into the pktcMtaDevRealmTable. The upper case ASCII representation of the associated Kerberos Realm name MUST be used by both the Manager(SNMPv3 Entity) and the MTA. Kerberos Name for the Provisioning Application is supplied to the MTA via suboption-6 of the DHCP Option 122 as defined in RFC-3495. Value of the Kerberos Name for the Provisioning Application supplied in the MTA Configuration file must match a value supplied in the suboption-6." REFERENCE " PacketCable Provisioning Specification, RFC 3495" ::= { pktcMtaDevServer 15 } pktcMtaDevProvState OBJECT-TYPE SYNTAX INTEGER { operational (1), waitingForSnmpSetInfo (2), waitingForTftpAddrResponse (3), Nechamkin/Mule Expires - November 2003 [Page 19] PacketCable/IPCablecom MTA MIB May 2003 waitingForConfigFile (4) } MAX-ACCESS read-only STATUS current DESCRIPTION " If operational(1), the device has completed loading and processing of initialization parameters. If waitingForSnmpSetInfo(2) then the device is waiting on config file download access information. If waitingForTftpAddrResponse(3) then a DNS request has been transmitted and no reply has yet been received. If waitingForConfigFile(4) then a TFTP request has been transmitted and no reply has yet been received or a download is in progress." REFERENCE " PacketCable Provisioning Specification, PacketCable Security Specification " ::= { pktcMtaDevServer 16 } -- -- The following group describes the security objects in the -- MTA. -- pktcMtaDevManufacturerCertificate OBJECT-TYPE SYNTAX DocsX509ASN1DEREncodedCertificate MAX-ACCESS read-only STATUS current DESCRIPTION " ASN.1 DER encoding of the MTA Manufacturer's X.509 public-key certificate, called MTA Manufacturer Certificate. It is issued to each MTA manufacturer and is installed into each MTA either in the factory or with a code download. The provisioning server cannot update this certificate. Specific requirements to certificate are per corresponding PacketCable/IPCablecom specification." REFERENCE " PacketCable Security Specification." ::= {pktcMtaDevSecurity 1} pktcMtaDevCertificate OBJECT-TYPE SYNTAX DocsX509ASN1DEREncodedCertificate MAX-ACCESS read-only STATUS current DESCRIPTION " ASN.1 DER encoding of the MTA's X.509 public-key certificate issued by the manufacturer and installed into the embedded-MTA in the factory. This certificate, called Nechamkin/Mule Expires - November 2003 [Page 20] PacketCable/IPCablecom MTA MIB May 2003 MTA Device Certificate, contains the MTA's MAC address. It cannot be updated by the provisioning server. Specific requirements to certificate are per corresponding PacketCable/IPCablecom specification." REFERENCE " PacketCable Security Specification." ::= { pktcMtaDevSecurity 2 } pktcMtaDevCorrelationId OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION " Random value generated by the MTA for use in registration authorization. It is for use only in the MTA initialization messages and for MTA configuration file download." ::= { pktcMtaDevSecurity 3 } pktcMtaDevTelephonyRootCertificate OBJECT-TYPE SYNTAX DocsX509ASN1DEREncodedCertificate MAX-ACCESS read-only STATUS current DESCRIPTION " ASN.1 DER encoding of the IP Telephony Root X.509 public-key certificate stored in the MTA non-volatile memory and updateable with a code download. This certificate is used to validate the initial AS Reply from the KDC received during the MTA initialization. Specific requirements to certificate are per corresponding PacketCable/IPCablecom specification." REFERENCE " PacketCable Security Specification." ::= { pktcMtaDevSecurity 4 } --================================================================= -- -- Procedures for setting up security associations: -- -- A security association may be setup either via configuration or -- via NCS signaling. -- -- I. Security association setup via configuration. -- -- The realm must be configured first. Associated with the realm -- is a KDC. The realm table (pktcMtaDevRealmTable) indicates -- information about realm (e.g., name, organization name) and Nechamkin/Mule Expires - November 2003 [Page 21] PacketCable/IPCablecom MTA MIB May 2003 -- parameters associated with KDC communications (e.g., grace -- periods, AS request/AS reply adaptive backoff parameters). -- -- Once the realm is established, one or more servers may be -- defined in the realm. For PacketCable 1.0, these are Call -- Management Servers (CMSs). Associated with each CMS -- entry in the pktcMtaDevCmsTable is an explicit reference -- to a Realm via the realm ( pktcMtaDevCmsKerbRealmName), -- the FQDN of the CMS, and parameters associated with IPSec -- key management with the CMS (e.g., clock skew, AP request/ -- AP reply adaptive backoff parameters). -- -- II. Security association setup via NCS signaling. -- -- The procedure of establishing of the Security Association -- for NCS Signaling is described in the PacketCable Security -- Specification. -- It involves the analysis of the EndPointNcsTable row -- for the corresponding end-point number and correlating -- the CMS FQDN from this row with the CMS Table and -- consequently - with the Realm Table. Both of these tables -- are defined below. -- -- III. When the MTA receives wake-up or re-key messages from a -- CMS, it performs key management based on the corresponding -- entry in the CMS table. If the matching CMS entry does not -- exist, it must ignore the wake-up or re-key messages. -- --================================================================= --================================================================= -- -- pktcMtaDevRealmTable -- -- The pktcMtaDevRealmTable shows the KDC realms. The table is -- indexed with pktcMtaDevRealmIndex. The Realm Table contains the -- pktcMtaDevRealmName in conjunction with any server which needs -- a security association with an MTA. Upper case must be use to -- compare the pktcMtaDevRealmName content. -- The server table (today the CMS) has a security association. -- Each server-MTA security association is associated with a -- single Realm. This allows for multiple realms, each with its -- own security association. -- --================================================================= pktcMtaDevRealmAvailSlot OBJECT-TYPE SYNTAX Unsigned32 (0..64) MAX-ACCESS read-only STATUS current Nechamkin/Mule Expires - November 2003 [Page 22] PacketCable/IPCablecom MTA MIB May 2003 DESCRIPTION " The index number of the first available entry in the pktcMtaDevRealmTable table, or the value of zero indicating that all entries are assigned. A management station should create new entries in the pktcMtaDevRealmTable table using this algorithm: first, issue a management protocol retrieval operation to determine the value of pktcMtaDevRealmSlot; and, second, issue a management protocol set operation to create an instance of the pktcMtaDevRealmAvailSlot object setting its value to createAndWait(5). If the operation succeeds, then the management station may continue modifying theinstances corresponding to the newly created conceptual row, without fear of collision with othermanagement stations. When all necessary conceptual columns of the table are properly set or get their default values, the management station may set the pktcMtaDevRealmStatus to active." ::= { pktcMtaDevSecurity 5 } pktcMtaDevRealmTable OBJECT-TYPE SYNTAX SEQUENCE OF PktcMtaDevRealmEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION " Contains per Kerberos realm security parameters." ::= { pktcMtaDevSecurity 6 } pktcMtaDevRealmEntry OBJECT-TYPE SYNTAX PktcMtaDevRealmEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION " List of security parameters for a single Kerberos realm." INDEX { pktcMtaDevRealmIndex } ::= { pktcMtaDevRealmTable 1 } PktcMtaDevRealmEntry ::= SEQUENCE { pktcMtaDevRealmIndex Unsigned32, pktcMtaDevRealmName SnmpAdminString, pktcMtaDevRealmPkinitGracePeriod Unsigned32, pktcMtaDevRealmTgsGracePeriod Unsigned32, pktcMtaDevRealmOrgName SnmpAdminString, pktcMtaDevRealmUnsolicitedKeyMaxTimeout Unsigned32, pktcMtaDevRealmUnsolicitedKeyNomTimeout Unsigned32, pktcMtaDevRealmUnsolicitedKeyMaxRetries Unsigned32, pktcMtaDevRealmStatus RowStatus } Nechamkin/Mule Expires - November 2003 [Page 23] PacketCable/IPCablecom MTA MIB May 2003 pktcMtaDevRealmIndex OBJECT-TYPE SYNTAX Unsigned32 (1..32) MAX-ACCESS not-accessible STATUS current DESCRIPTION " The index into the pktcMtaDevRealmTable." ::= { pktcMtaDevRealmEntry 1} pktcMtaDevRealmName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..255)) MAX-ACCESS read-create STATUS current DESCRIPTION " Kerberos Realm name in upper case characters. Each MTA MUST prohibit the instantiation of any two rows with identical Kerberos Realm Name. Each MTA MUST also verify that any search operations involving Kerberos Realm Name are done using the upper case ASCII representation of the characters." ::= { pktcMtaDevRealmEntry 2 } pktcMtaDevRealmPkinitGracePeriod OBJECT-TYPE SYNTAX Unsigned32 (15..600) UNITS "minutes" MAX-ACCESS read-create STATUS current DESCRIPTION " For the purposes of the key management with an Application Server (CMS or Provisioning Server), the MTA MUST obtain a new Kerberos ticket (with a PKINIT exchange) this many minutes before the old ticket expires. This MIB Object MAY also be used with other Kerberized applications." DEFVAL { 30 } ::= { pktcMtaDevRealmEntry 3 } pktcMtaDevRealmTgsGracePeriod OBJECT-TYPE SYNTAX Unsigned32 (1..600) UNITS "minutes" MAX-ACCESS read-create STATUS current DESCRIPTION " When the MTA implementation uses TGS Request/TGS Reply Kerbersos messages for the purpose of the key management with an Application Server (CMS or Provisioning Server), the MTA MUST obtain a new service ticket for the Application Server (with a TGS Request) this many minutes before the old ticket expires. This parameter MAY also be used with other Kerberized applications." DEFVAL { 10 } Nechamkin/Mule Expires - November 2003 [Page 24] PacketCable/IPCablecom MTA MIB May 2003 ::= { pktcMtaDevRealmEntry 4 } pktcMtaDevRealmOrgName OBJECT-TYPE SYNTAX SnmpAdminString(SIZE (1..64)) MAX-ACCESS read-create STATUS current DESCRIPTION " The value of the X.500 organization name attribute in the subject name of the Service provider certificate. The value of the organization name is encoded with the prefix 'O=' in the Subject field of the Certificate." REFERENCE " PacketCable Security Specification" ::= { pktcMtaDevRealmEntry 5 } --================================================================= -- -- Unsolicited Key Updates are based on an exponential backoff -- mechanism with two timers for AS replies. The backoff timers -- has a maximum value of pktcMtaDevRealmUnsolicitedKeyMaxTimeout -- seconds and a nominal timer has a -- pktcMtaDevRealmUnsolicitedKeyNomTimeout seconds from which -- the backoff timer determinations are made. After -- pktcMatDevRealmUnsolicitedMaxRetries have occurred no more -- attempts are made. -- --================================================================= pktcMtaDevRealmUnsolicitedKeyMaxTimeout OBJECT-TYPE SYNTAX Unsigned32 (1..600) UNITS "seconds" MAX-ACCESS read-create STATUS current DESCRIPTION " This timeout applies only when the MTA initiated key management. The maximum timeout is the value which may not be exceeded in the exponential backoff algorithm." REFERENCE " PacketCable Security Specification" DEFVAL { 30 } ::= { pktcMtaDevRealmEntry 6 } pktcMtaDevRealmUnsolicitedKeyNomTimeout OBJECT-TYPE SYNTAX Unsigned32 (100..600000) UNITS "milliseconds" MAX-ACCESS read-create STATUS current DESCRIPTION Nechamkin/Mule Expires - November 2003 [Page 25] PacketCable/IPCablecom MTA MIB May 2003 " This timeout applies only when the MTA initiated key management. This value should account for the average roundtrip time between the MTA and the KDC as well as for the processing delay on the KDC." REFERENCE " PacketCable Security Specification" DEFVAL { 10000 } ::= { pktcMtaDevRealmEntry 7 } pktcMtaDevRealmUnsolicitedKeyMaxRetries OBJECT-TYPE SYNTAX Unsigned32 (0..1024) MAX-ACCESS read-create STATUS current DESCRIPTION " This is the maximum number of retries before the MTA gives up attempting to establish a security association." REFERENCE " PacketCable Security Specification" DEFVAL { 5 } ::= { pktcMtaDevRealmEntry 8 } pktcMtaDevRealmStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION " The status of this conceptual row in the pktcMtaDevRealmTable. An entry in this table is not qualified for activation until instances of all corresponding columns have been initialized, either through default values, or through Set operations. The pktcMtaDevRealmName object must be explicitly set. Until that time, the value of the pktcMtaDevRealmStatus must be 'notReady'. There is no restriction on setting columns in this table when the value of pktcMtaDevRealmStatus is active(1). The RowStatus TC [RFC2579] requires that this DESCRIPTION clause states under which circumstances other objects in this row can be modified: The value of this object has no effect on whether other objects in this conceptual row can be modified." ::= { pktcMtaDevRealmEntry 9 } --================================================================= Nechamkin/Mule Expires - November 2003 [Page 26] PacketCable/IPCablecom MTA MIB May 2003 -- -- pktcMtaDevCmsTable -- -- The pktcMtaDevCmsTable shows the IPSec key management policy -- relating to a particular CMS. The table is indexed with -- pktcMtaDevCmsIndex. The table contains the pktcMtaDevCmsFQDN -- and pktcMtaDevCmsKerbRealmName. The latter is a reference -- point for the MTA to find the corresponding Kerberos realm -- Name in the pktcMtaDevRealmTable. -- --================================================================= pktcMtaDevCmsAvailSlot OBJECT-TYPE SYNTAX Unsigned32 (0..128) MAX-ACCESS read-only STATUS current DESCRIPTION " The index number of the first available entry in the pktcMtaDevCmsTable table, or the value of zero indicating that all entries are assigned. A management station should create new entries in the pktcMtaDevCmsTable table using this algorithm: first, issue a management protocol retrieval operation to determine the value of pktcMtaDevCmsAvailSlot; and, second, issue a management protocol set operation to create an instance of the pktcMtaDevCmsAvailSlot object setting its value to createAndWait(5). If this latter operation succeeds, then the management station may continue modifying the instances corresponding to the newly created conceptual row, without fear of collision with other management stations. When all necessary conceptual columns of the table are properly set or get their default values, the management station may set the pktcMtaDevCmsStatus to active." ::= { pktcMtaDevSecurity 7 } pktcMtaDevCmsTable OBJECT-TYPE SYNTAX SEQUENCE OF PktcMtaDevCmsEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION " Contains per CMS key management policy." ::= { pktcMtaDevSecurity 8 } pktcMtaDevCmsEntry OBJECT-TYPE SYNTAX PktcMtaDevCmsEntry MAX-ACCESS not-accessible STATUS current Nechamkin/Mule Expires - November 2003 [Page 27] PacketCable/IPCablecom MTA MIB May 2003 DESCRIPTION " List of key management parameters for a single MTA-CMS interface." INDEX { pktcMtaDevCmsIndex } ::= { pktcMtaDevCmsTable 1 } PktcMtaDevCmsEntry ::= SEQUENCE { pktcMtaDevCmsIndex Unsigned32, pktcMtaDevCmsFqdn SnmpAdminString, pktcMtaDevCmsKerbRealmName SnmpAdminString, pktcMtaDevCmsSolicitedKeyTimeout Unsigned32, pktcMtaDevCmsMaxClockSkew Unsigned32, pktcMtaDevCmsUnsolicitedKeyMaxTimeout Unsigned32, pktcMtaDevCmsUnsolicitedKeyNomTimeout Unsigned32, pktcMtaDevCmsUnsolicitedKeyMaxRetries Unsigned32, pktcMtaDevCmsIpsecCtrl TruthValue, pktcMtaDevCmsStatus RowStatus } pktcMtaDevCmsIndex OBJECT-TYPE SYNTAX Unsigned32 (1..64) MAX-ACCESS not-accessible STATUS current DESCRIPTION " The index into the pktcMtaDevCmsTable." ::= { pktcMtaDevCmsEntry 1 } pktcMtaDevCmsFqdn OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..255)) MAX-ACCESS read-create STATUS current DESCRIPTION " The Fully Qualified Domain Name of the CMS. Each MTA must prohibit the instantiation of any two rows with identical FQDNs. Each MTA must also verify that any search and/or comparison operations involving CMS FQDN are case insensitive." ::= { pktcMtaDevCmsEntry 2 } pktcMtaDevCmsKerbRealmName OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(1..255)) MAX-ACCESS read-create STATUS current DESCRIPTION " The Kerberos Realm Name in upper case characters for the CMS in the same conceptual row. The value in this object is a reference point to the corresponding Kerberos Realm Name in the pktcMtaDevRealmtable." ::= { pktcMtaDevCmsEntry 3 } Nechamkin/Mule Expires - November 2003 [Page 28] PacketCable/IPCablecom MTA MIB May 2003 pktcMtaDevCmsMaxClockSkew OBJECT-TYPE SYNTAX Unsigned32 (1..1800) UNITS "seconds" MAX-ACCESS read-create STATUS current DESCRIPTION " This is the maximum allowable clock skew between the MTA and CMS." DEFVAL { 300 } ::= { pktcMtaDevCmsEntry 4 } pktcMtaDevCmsSolicitedKeyTimeout OBJECT-TYPE SYNTAX Unsigned32 (100..30000) UNITS "milliseconds" MAX-ACCESS read-create STATUS current DESCRIPTION " This timeout applies only when the CMS initiated key management (with a Wake Up or Rekey message). It is the period during which the MTA will save a nonce (inside the sequence number field) from the sent out AP Request and wait for the matching AP Reply from the CMS." REFERENCE " PacketCable Security Specification" DEFVAL { 1000 } ::= { pktcMtaDevCmsEntry 5 } --================================================================= -- -- Unsolicited Key Updates are based on an exponential backoff -- mechanism with two timers for AP replies. The backoff timers -- has a maximum value of pktcMtaDevCmsUnsolicitedKeyMaxTimeout -- seconds and a nominal timer has a -- pktcMtaDevCmsUnsolicitedKeyNomTimeout seconds from which the -- backoff timer determinations are made. After -- pktcMatDevCmsUnsolicitedMaxRetries have occurred no more -- attempts are made. -- --================================================================= pktcMtaDevCmsUnsolicitedKeyMaxTimeout OBJECT-TYPE SYNTAX Unsigned32 (1..600) UNITS "seconds" MAX-ACCESS read-create STATUS current DESCRIPTION " This timeout applies only when the MTA initiated key Nechamkin/Mule Expires - November 2003 [Page 29] PacketCable/IPCablecom MTA MIB May 2003 management. The maximum timeout is the value which may not be exceeded in the exponential backoff algorithm." REFERENCE " PacketCable Security Specification" DEFVAL { 8 } ::= { pktcMtaDevCmsEntry 6 } pktcMtaDevCmsUnsolicitedKeyNomTimeout OBJECT-TYPE SYNTAX Unsigned32 (100..30000) UNITS "milliseconds" MAX-ACCESS read-create STATUS current DESCRIPTION " This timeout applies only when the MTA initiated key management. Typically this is the average roundtrip time between the MTA and the CMS." REFERENCE " PacketCable Security Specification" DEFVAL { 500 } ::= { pktcMtaDevCmsEntry 7 } pktcMtaDevCmsUnsolicitedKeyMaxRetries OBJECT-TYPE SYNTAX Unsigned32 (0..1024) MAX-ACCESS read-create STATUS current DESCRIPTION " This is the maximum number of retries before the MTA gives up attempting to establish a security association." REFERENCE " PacketCable Security Specification" DEFVAL { 5 } ::= { pktcMtaDevCmsEntry 8 } pktcMtaDevCmsIpsecCtrl OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION " This value of 'true(1)' indicates that IPSec and IPSec key Management MUST be used to communicate with the CMS. The value of 'fales(2)' indicates that IPSec Signaling Security is disabled for both IPSec Key Management and IPSec protocol (for the specific CMS)." DEFVAL { true } ::= { pktcMtaDevCmsEntry 9 } pktcMtaDevCmsStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create Nechamkin/Mule Expires - November 2003 [Page 30] PacketCable/IPCablecom MTA MIB May 2003 STATUS current DESCRIPTION " This object contains the Row Status associated with the pktcMtaDevCmsTable. An entry in this table is not qualified for activation until instances of all corresponding columns have been initialized, either through default values, or through Set operations. The pktcMtaDevCmsFqdn and pktcMtaDevKerbRealmName objects must be explicitly set. Until that time, the value of the pktcMtaDevCmsStatus must be 'notReady'. There is no restriction on setting columns in this table when the value of pktcMtaDevCmsStatus is active(1). The RowStatus TC [RFC2579] requires that this DESCRIPTION clause states under which circumstances other objects in this row can be modified: The value of this object has no effect on whether other objects in this conceptual row can be modified." ::= { pktcMtaDevCmsEntry 10 } pktcMtaDevResetKrbTickets OBJECT-TYPE SYNTAX BITS { invalidateProvOnReboot (0), invalidateAllCmsOnReboot (1) } MAX-ACCESS read-write STATUS current DESCRIPTION " The object defines a Kerberos Ticket Control Mask that instructs an MTA to invalidate the specific application server Kerberos Tickets which are locally persisted in MTA's NVRAM. If an MTA does not persist the Kerberos Tickets, it MUST ignore setting of this object, and MUST report value 0 when the object is read. The object value is encoded as follows: - setting invalidateProvOnReboot (0) bit to 1 means that an MTA MUST invalidate a Kerberos Application Ticket for the Provisioning Application at the next MTA reboot, - setting invalidateAllCmsOnReboot (1) bit to 1 means that an that an MTA MUST invalidate a Kerberos Application Tickets for all CMS(s) currently assigned To the end- points." REFERENCE "PacketCable Security Specification" DEFVAL { { } } ::= { pktcMtaDevSecurity 9 } Nechamkin/Mule Expires - November 2003 [Page 31] PacketCable/IPCablecom MTA MIB May 2003 -- -- notification group is for future extension. -- pktcMtaNotificationPrefix OBJECT IDENTIFIER ::= { pktcMtaMib 2 } pktcMtaNotification OBJECT IDENTIFIER ::= { pktcMtaNotificationPrefix 0 } pktcMtaConformance OBJECT IDENTIFIER ::= { pktcMtaMib 3 } pktcMtaCompliances OBJECT IDENTIFIER ::= { pktcMtaConformance 1 } pktcMtaGroups OBJECT IDENTIFIER ::= { pktcMtaConformance 2 } pktcMtaDevProvisioningEnrollment NOTIFICATION-TYPE OBJECTS { sysDescr, pktcMtaDevSwCurrentVers, pktcMtaDevTypeIdentifier, ifPhysAddress, pktcMtaDevCorrelationId } STATUS current DESCRIPTION " This inform is issued to initiate the PacketCable process provisioning. MAC Address of the MTA is contained in the MTA's ifTable, ifPhysAddress column corresponding to the ifIndex=1" REFERENCE " Inform as defined in RFC 1902" ::= { pktcMtaNotification 1 } pktcMtaDevProvisioningStatus NOTIFICATION-TYPE OBJECTS { ifPhysAddress, pktcMtaDevCorrelationId, pktcMtaDevProvisioningState } STATUS current DESCRIPTION " This inform is issued to confirm completion of the PacketCable provisioning process, and indicate the completion state." REFERENCE " Inform as defined in RFC 1902" ::= { pktcMtaNotification 2 } -- -- compliance statements -- Nechamkin/Mule Expires - November 2003 [Page 32] PacketCable/IPCablecom MTA MIB May 2003 pktcMtaBasicCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION " The compliance statement for devices that implement PacketCable/IPCablecom MTA. It is left to manufacturers to determine whether to support both PacketCable and IPCablecom objects in the same MTA." MODULE MANDATORY-GROUPS { pktcMtaGroup } OBJECT pktcMtaDevSnmpEntity MIN-ACCESS read-only DESCRIPTION " The behavior of the SNMP Agent when the object is set is currently undefined. Object should be implemented as read-only." OBJECT pktcMtaDevRealmName MIN-ACCESS read-only DESCRIPTION " The behavior of the SNMP Agent when the object is set is currently undefined. Object should be implemented as read-only after the conceptual row is created." OBJECT pktcMtaDevRealmOrgName MIN-ACCESS read-only DESCRIPTION " The behavior of the SNMP Agent when the object is set is currently undefined. Object should be implemented as read-only after the conceptual row is created." OBJECT pktcMtaDevCmsFqdn MIN-ACCESS read-only DESCRIPTION " The behavior of the SNMP Agent when the object is set is currently undefined. Object should be implemented as read-only after the conceptual row is created." OBJECT pktcMtaDevCmsKerbRealmName MIN-ACCESS read-only DESCRIPTION " The behavior of the SNMP Agent when the object is set is currently undefined. Object should be Nechamkin/Mule Expires - November 2003 [Page 33] PacketCable/IPCablecom MTA MIB May 2003 implemented as read-only after the conceptual row is created." ::= { pktcMtaCompliances 1 } pktcMtaGroup OBJECT-GROUP OBJECTS { pktcMtaDevResetNow, pktcMtaDevSerialNumber, pktcMtaDevSwCurrentVers, pktcMtaDevFQDN, pktcMtaDevEndPntCount, pktcMtaDevEnabled, pktcMtaDevErrorOid, pktcMtaDevErrorValue, pktcMtaDevErrorReason, pktcMtaDevTypeIdentifier, pktcMtaDevProvisioningState, pktcMtaDevHttpAccess, pktcMtaDevCertificate, pktcMtaDevCorrelationId, pktcMtaDevManufacturerCertificate, pktcMtaDevServerAddressType, pktcMtaDevServerDhcp1, pktcMtaDevServerDhcp2, pktcMtaDevServerDns1, pktcMtaDevServerDns2, pktcMtaDevTimeServer, pktcMtaDevConfigFile, pktcMtaDevSnmpEntity, pktcMtaDevRealmPkinitGracePeriod, pktcMtaDevRealmTgsGracePeriod, pktcMtaDevRealmAvailSlot, pktcMtaDevRealmName, pktcMtaDevRealmOrgName, pktcMtaDevRealmUnsolicitedKeyMaxTimeout, pktcMtaDevRealmUnsolicitedKeyNomTimeout, pktcMtaDevRealmUnsolicitedKeyMaxRetries, pktcMtaDevRealmStatus, pktcMtaDevCmsAvailSlot, pktcMtaDevCmsFqdn, pktcMtaDevCmsKerbRealmName, pktcMtaDevCmsUnsolicitedKeyMaxTimeout, pktcMtaDevCmsUnsolicitedKeyNomTimeout, pktcMtaDevCmsUnsolicitedKeyMaxRetries, pktcMtaDevCmsSolicitedKeyTimeout, pktcMtaDevCmsMaxClockSkew, pktcMtaDevCmsIpsecCtrl, Nechamkin/Mule Expires - November 2003 [Page 34] PacketCable/IPCablecom MTA MIB May 2003 pktcMtaDevCmsStatus, pktcMtaDevResetKrbTickets, pktcMtaDevProvUnsolicitedKeyMaxTimeout, pktcMtaDevProvUnsolicitedKeyNomTimeout, pktcMtaDevProvUnsolicitedKeyMaxRetries, pktcMtaDevProvKerbRealmName, pktcMtaDevProvSolicitedKeyTimeout, pktcMtaDevProvConfigHash, pktcMtaDevProvConfigKey, pktcMtaDevProvState, pktcMtaDevProvisioningTimer, pktcMtaDevTelephonyRootCertificate } STATUS current DESCRIPTION " Group of objects for PacketCable MTA MIB." ::= { pktcMtaGroups 1 } pktcMtaNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { pktcMtaDevProvisioningStatus, pktcMtaDevProvisioningEnrollment } STATUS current DESCRIPTION " These notifications deal with change in status of MTA Device." ::= { pktcMtaGroups 2 } END 5. Acknowledgments This document is a production of the PacketCable Working Group. The current editors wish to express their gratitude to: Angela Lyda Arris Interactive Sumanth Channabasappa Alopa Networks, Matt A. Osman CableLabs Klaus Hermanns Cisco Systems Rick Vetter, Sasha Medvinsky Motorola Roy Spitzer Telogy Networks, Inc. Itay Sherman, Satish Kumar Texas Instruments, Nechamkin/Mule Expires - November 2003 [Page 35] PacketCable/IPCablecom MTA MIB May 2003 6. Normative References [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [RFC3289] Baker, F., Chan, K., Smith, A., "Management Information Base for the Differentiated Services Architecture", RFC 3289, May 2002. [RFC2131] R. Droms, "Dynamic Host Configuration Protocol", March 1997. [RFC2132] S. Alexander, R. Droms, "DHCP Options and BOOTP Vendor Extensions", March 1997. [RFC1034] P. Mockapetris, "DOMAIN NAMES - CONCEPTS AND FACILITIES", November 1987. [RFC1035] P. Mockapetris, "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION", November 1987. [RFC3291] Daniele, M., Haberman, B., Routhier, S., Schoenwaelder, J., "Textual Conventions for Internet Network Addresses", RFC 3291, May 2002. [RFC3495] B. Beser, P. Duffy, Ed., "Dynamic Host Configuration Protocol (DHCP) Option for CableLabs Client Configuration.", RFC-3495, March 2003. [PKT-SP-PROV-IO6-030415] Packetcable MTA Device Provisioning Specification PKT-SP-PROV-IO6-030415. [PKT-SP-SEC-I08-030415] PacketCable Security Specification, Issued, PKT-SP-SEC-I08-030415. [ITU-T-J112] Transmission Systems for Interactive Cable Television Services, Annex B, J.112, ITU-T, March, 1998. Nechamkin/Mule Expires - November 2003 [Page 36] PacketCable/IPCablecom MTA MIB May 2003 7. Informative References [RFC2026] Bradner, S., "The Internet Standards Process, Revision 3", RFC 2026, October 1996. [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction and Applicability Statements for Internet- Standard Management Framework", RFC 3410, December 2002. [PKT-SP-MIB-MTA-I06-030415] Packetcable MTA MIB Specification PKT- SP-MIB-MTA-I06-030415. [ETSI TS 101 909-4] ETSI TS 101 909-4:"Access and Terminals (AT); Digital Broadband Cable Access to the Public Telecommunications Network; IP Multimedia Time Critical Services; Part 4: Network Call Signaling Protocol". [ETSI TS 101 909-9] ETSI TS 101 909-9:"Access and Terminals (AT); Digital Broadband Cable Access to the Public Telecommunications Network; IP Multimedia Time Critical Services; Part 9: IPCablecom Network Call Signalling (NCS) MIB Requirements". [EN 300 001] EN 300 001 V1.5.1 (1998-10):"European Standard (Telecommunications series) Attachments to Public Switched Telephone Network (PSTN); General technical requirements for equipment connected to an analogue subscriber interface in the PSTN; Chapter 3: Ringing signal characteristics (national deviations are in Table 3.1.1)". [EN 300 659-1] EN 300 659-1: ôPublic Switched Telephone Network (PSTN); Subscriber line protocol over the local loop for display (and related) services; Part 1: On hook data transmissionö. 8. Security Considerations There are a number of management objects defined in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. Improper manipulation of the objects defined in this MIB may result in random behavior of MTA devices and may result in service disruption. These are the tables and objects and their sensitivity/vulnerability: Nechamkin/Mule Expires - November 2003 [Page 37] PacketCable/IPCablecom MTA MIB May 2003 - The following objects, if SET maliciously would cause the MTA device to reset and/or stop its service: pktcMtaDevResetNow, pktcMtaDevEnabled. - All writable objects in the pktcMtaDevServer and pktcMtaDevRealmTable groups share the potential, if SET maliciously, to prevent an MTA from provisioning properly, hence there are considered very sensitive for service delivery, in particular: pktcMtaDevProvisioningTimer, pktcMtaDevServerAddressType, pktcMtaDevServerDns1, pktcMtaDevServerDns2 - these two objects, if SET maliciously, will prevent the MTA from being authenticated and consequently from getting the telephony services. pktcMtaDevSnmpEntity, pktcMtaDevProvConfigHash, pktcMtaDevProvConfigKey, pktcMtaDevProvSolicitedKeyTimeout, pktcMtaDevRealmName, pktcMtaDevRealmOrgName, pktcMtaDevRealmStatus - this object, if SET maliciously, would cause the whole row of the table to be deleted which will deny the prevent the MTA from getting the telephony services. - All writable objects in the pktcMtaDevCmsTable table share the potentional, if SET maliciously, to disrupt the telephony service by altering which Call Management Server the MTA must send signaling registration to, in particular: pktcMtaDevCmsFqdn, pktcMtaDevCmsKerbRealmName, pktcMtaDevCmsMaxClockSkew, pktcMtaDevCmsSolicitedKeyTimeout, pktcMtaDevCmsUnsolicitedKeyMaxTimeout, pktcMtaDevCmsUnsolicitedKeyNomTimeout, pktcMtaDevRealmUnsolicitedKeyMaxRetries - this object, if set to a zero value '0', may prevent an MTA from retry its attempt to establish a security association with the CMS, pktcMtaDevCmsStatus. - The following objects, if SET maliciously will not have an immediate effect on service but they may impact the service performace and may cause avalanche attacks on provisioning servers including Kerberos KDC servers on massive device reboots: pktcMtaDevResetKrbTickets - if set to true, will cause an MTA to request a new Kerberos ticket at reboot. pktcMtaDevRealmPkinitGracePeriod - if set to short periods, will cause MTA to renew its tickets more frequently, pktcMtaDevRealmTgsGracePeriod (same as above), Nechamkin/Mule Expires - November 2003 [Page 38] PacketCable/IPCablecom MTA MIB May 2003 pktcMtaDevRealmUnsolicitedKeyMaxTimeout, pktcMtaDevRealmUnsolicitedKeyNomTimeout. Some of the readable objects in this MIB module may be considered sensitive or vulnerable in some network environments. Some of these objects may contain information that may be sensitive from a business or customer perspective. It is thus important to control even GET and/or NOTIFY access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP. These are the tables and objects and their sensitivity/vulnerability: - pktcMtaDevFQDN - "man-in-the-middle" type of security thread can be posed by allowing an authorized access to the object, - pktcMtaDevEndPntCount - object value may be used by attackers to guess the endpoint names and maliciously ring any or all phones attached to an MTA, - pktcMtaDevHttpAccess - object value may be used by attackers to block HTTP traffic, hence prevent configuration file download, - pktcMtaDevServerDhcp1, - pktcMtaDevServerDhcp2 - Values of these objects may be used by attackers to launch Denial-of-Service attacks on the Telephony Service Provider DHCP servers, - pktcMtaDevProvKerbRealmName, - pktcMtaDevManufacturerCertificate, - pktcMtaDevCertificate, - pktcMtaDevTelephonyRootCertificate - Values of these objects may be used by attackers to launch Denial-of-Service attacks against Kerberos servers. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them. Nechamkin/Mule Expires - November 2003 [Page 39] PacketCable/IPCablecom MTA MIB May 2003 9. Intellectual Property The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director. 10. Authors' Addresses Eugene Nechamkin Broadcom Corporation, 200 - 13711 International Place Richmond, BC, V6V 2Z8 CANADA Phone: +1 604 233 8500 E-mail: enechamkin@broadcom.com Jean-Francois Mule Cable Television Laboratories, Inc. 400 Centennial Parkway Louisville Colorado 80027-1266 U.S.A. Phone: +1 303-661-9100 E-mail: jfm@cablelabs.com 11. Full Copyright Statement The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the Nechamkin/Mule Expires - November 2003 [Page 40] PacketCable/IPCablecom MTA MIB May 2003 IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director. Copyright (C) The Internet Society (2003). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Nechamkin/Mule Expires - November 2003 [Page 41]