Internet DRAFT - draft-ietf-vrrp-unified-mib
draft-ietf-vrrp-unified-mib
Network Working Group Kalyan Tata
Internet Draft Check Point Software
Document: draft-ietf-vrrp-unified-mib-10.txt September 2011
Obsoletes: 2787 (if approved)
Intended Status: Proposed Standard
Expires: March 2012
Definitions of Managed Objects for VRRPv3
<draft-ietf-vrrp-unified-mib-10.txt>
Abstract
This specification defines a portion of the Management Information
Base (MIB) for use with SNMP-based network management. In
particular, it defines objects for configuring, monitoring, and
controlling routers that employ the Virtual Router Redundancy
Protocol Version 3 for both IPv4 and IPv6 as defined in RFC 5798.
This memo obsoletes RFC 2787.
Status of this Memo
This Internet-Draft is submitted to IETF in full conformance with the
provisions of BCP 78 and BCP 79.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
Tata Expires Mar 2012 [Page 1]
Internet Draft VRRP unified MIB Sep 2011
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire in Oct, 2011.
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info)
in effect on the date of publication of this document. Please
review these documents carefully, as they describe your rights and
restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License
text as described in Section 4.e of the Trust Legal Provisions and
are provided without warranty as described in the Simplified BSD
License.
Table of Contents
1. The Internet-Standard Management Framework.....................3
2. Introduction...................................................3
3. Terminology....................................................3
4. Relationship to RFC 2787.......................................3
5. Relation to Interface Group (IF-MIB)...........................3
6. Multi-Stack Implementations....................................3
7. Interpretation of RFC5798......................................4
8. VRRP MIB Structure and Design..................................4
9. VRRP Multistack Scenario.......................................4
10. Definitions...................................................7
11. Security Considerations......................................27
12. IANA Considerations..........................................28
13. Normative References.........................................28
14. Informative References.......................................29
15. Acknowledgments..............................................29
16. Author's Address.............................................29
Tata Expires Oct 2011 [Page 2]
Internet Draft VRRP unified MIB Sep 2011
1. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of
RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in STD 58,
RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
[RFC2580].
2. Introduction
This specification defines a portion of the Management Information
Base (MIB) for use with SNMP-based network management. In
particular, it defines objects for configuring, monitoring, and
controlling routers that employ the Virtual Router Redundancy
Protocol Version 3 for both IPv4 and IPv6 as defined in RFC 5798
[RFC5798].
3. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
RFC 2119 [RFC2119].
4. Relationship to RFC 2787
This document obsoletes RFC2787 [RFC2787]. The major changes in this
document reflect changes in VRRP protocol between RFC 2338 [RFC2338]
and RFC 5798 [RFC5798]. This document is also updated to conform to
current MIB conventions.
5. Relation to Interface Group (IF-MIB)
Since a router can be participating in VRRP on one or more
interfaces, "ifIndex" is used as an index into the tables defined in
the VRRP MIB. This MIB module imports ifIndex from the IF-MIB. At
this time, the latest version of IF-MIB is from RFC2863 [RFC2863].
6. Multi-Stack Implementations
This MIB module is designed to support Multi-Stack implementations
Tata Expires Oct 2011 [Page 3]
Internet Draft VRRP unified MIB Sep 2011
that run VRRP over IPv4 and IPv6. IP version, VRID and ifIndex are
used to uniquely identify rows in a multi stack implementation.
7. Interpretation of RFC5798
During the review of this document, It emerged that there are
different possible interpretations of [RFC5798]. The Authors of that
document and the VRRP working group were unable to reach consensus on
which interpretation is correct. This document makes the following
assumption.
IPv4 and IPv6 virtual routers are treated as two separate logical
entities and represented as two separate entries in the
vrrpv3OperationsTable. This is required due to the undefined behavior
of the protocol in [RFC5798] in a Multi-Stack scenario.
8. VRRP MIB Structure and Design
This MIB module contains three tables:
(1) The vrrpv3OperationsTable, which contains objects that define
the operational characteristics of a VRRP router. Rows in this
table correspond to instances of virtual routers.
(2) The vrrpv3StatisticsTable which contains the operating
statistics for a VRRP router.
(3) The vrrpv3AssociatedIpAddrTable, contains the addresses of the
virtual router(s) that a given VRRP router is backing up.
Tables are indexed on ifIndex, VRID and the IP version to uniquely
identify a VRRP router.
Notifications in this MIB module are controlled using the mechanisms
defined in [RFC3413].
9. VRRP Multistack Scenario
The following section provides examples of how some of the objects in
this MIB are instantiated.
KEY:
----
Tata Expires Oct 2011 [Page 4]
Internet Draft VRRP unified MIB Sep 2011
The labels in the following tables and diagrams correspond to the
actual MIB objects as follows:
if = IfIndex
AddrType= vrrpv3OperationsInetAddrType
VrId = vrrpv3OperationsVrId
State = vrrpv3OperationsStatus
Prior = vrrpOpeartionsPriority
IpAddr = vrrpv3OperationsMasterIpAddr
The following figure shows a hypothetical network with two VRRP
routers VR1 & VR2, configured with two virtual routers. Addresses in
'()' indicate the address of the default gateway for a given host, H1
to H4 are IPv4 hosts and H5 to H8 are IPv6 hosts. A, B and C are IPv4
addresses and X, Y and Z are IPv6 addresses. In the diagram,
"Interface" is used in the context defined in IF-MIB.
+------+ +------+
| VR1 | | VR2 |
| | | |
+------+ +------+
| |
Intf = I1 Intf = I2
IP A | IP X IP B | IP Y
IP C | | IP Z
VRID = 1 | VRID=2 VRID=2 | VRID = 1
| |
----+------+------+-+-------+--------+--------++------+--------+---
^ ^ ^ ^ ^ ^ ^ ^
| | | | | | | |
(IP A) (IP A) (IP B) (IP B) (IP X) (IP X) (IP Y) (IP Y)
| | | | | | | |
+----+ +----+ +----+ +----+ +----+ +----+ +----+ +----+
| H1 | | H2 | | H3 | | H4 | | H5 | | H6 | | H7 | | H8 |
+----+ +----+ +----+ +----+ +----+ +----+ +----+ +----+
----- MIB Tables For VRRP Router "VR1": -----
vrrpv3OperationsTable
-------------------
Tata Expires Oct 2011 [Page 5]
Internet Draft VRRP unified MIB Sep 2011
| if | VrId |AddrType| State | Prior |IpAddr| |
+----+------+--------+-------+-------+------+--(..)--+
| I1 | 01 | 1 | M | 255 | A | |
+----+------+--------+-------+-------+------+--(..)--+
| I1 | 01 | 2 | B | 1-254 | Y | |
+----+------+--------+-------+-------+------+--(..)--+
| I1 | 02 | 1 | B | 1-254 | B | |
+----+------+--------+-------+-------+------+--(..)--+
| I1 | 02 | 2 | M | 255 | X | |
+----+------+--------+-------+-------+------+--------+
vrrpv3AssociatedIpAddrTable
-------------------------
| if | VrId | AddrType | IP | RowStat |
+----+------+----------+------+---------+
| I1 | 01 | 1 | A | active |
+----+------+----------+------+---------+
| I1 | 01 | 1 | C | active |
+----+------+----------+------+---------+
| I1 | 01 | 2 | Y | active |
+----+------+----------+------+---------+
| I1 | 01 | 2 | Z | active |
+----+------+----------+------+---------+
| I1 | 02 | 1 | B | active |
+----+------+----------+------+---------+
| I1 | 02 | 2 | X | active |
+----+------+----------+------+---------+
----- MIB Tables For VRRP Router "VR2": -----
vrrpv3OperationsTable
-------------------
| if | VrId |AddrType| State | Prior |IpAddr| |
+----+------+--------+-------+-------+------+--(..)--+
| I2 | 01 | 1 | B | 1-254 | A | |
+----+------+--------+-------+-------|------+--(..)--+
| I2 | 01 | 2 | M | 255 | Y | |
+----+------+--------+-------+-------+------+--(..)--+
| I2 | 02 | 1 | M | 255 | B | |
+----+------+--------+-------+-------+------+--(..)--+
| I2 | 02 | 2 | B | 1-254 | X | |
+----+------+--------+-------+-------+------+--------+
vrrpv3AssociatedIpAddrTable
-------------------------
Tata Expires Oct 2011 [Page 6]
Internet Draft VRRP unified MIB Sep 2011
| if | VrId |AddrType| IP | RowStat |
+----+------+--------+------+---------+
| I2 | 01 | 1 | A | active |
+----+------+--------+------+---------+
| I2 | 01 | 1 | C | active |
+----+------+--------+------+---------+
| I2 | 01 | 2 | Y | active |
+----+------+--------+------+---------+
| I2 | 01 | 2 | Z | active |
+----+------+--------+------+---------+
| I2 | 02 | 1 | B | active |
+----+------+--------+------+---------+
| I2 | 02 | 2 | X | active |
+----+------+--------+------+---------+
NOTES:
1) For "State": M = Master; B = Backup.
In the vrrpv3OperationsTable, a "priority" of 255 indicates that the
respective router owns the IP address, e.g., this IP address is
native to the router (i.e., "the IP Address Owner").
10. Definitions
This MIB module makes reference to the following documents [RFC2578],
[RFC2579], [RFC2580], [RFC2863], and [RFC4001].
VRRPV3-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
NOTIFICATION-TYPE, Counter32,
Integer32, mib-2, Unsigned32,
Counter64, TimeTicks
FROM SNMPv2-SMI -- RFC2578
TEXTUAL-CONVENTION, RowStatus,
MacAddress, TruthValue, TimeStamp,
TimeInterval
FROM SNMPv2-TC -- RFC2579
MODULE-COMPLIANCE, OBJECT-GROUP,
NOTIFICATION-GROUP
FROM SNMPv2-CONF -- RFC2580
ifIndex
FROM IF-MIB -- RFC2863
InetAddressType, InetAddress
Tata Expires Oct 2011 [Page 7]
Internet Draft VRRP unified MIB Sep 2011
FROM INET-ADDRESS-MIB; -- RFC4001
vrrpv3MIB MODULE-IDENTITY
LAST-UPDATED "201104220000Z" -- Apr 22, 2011
ORGANIZATION "IETF VRRP Working Group"
CONTACT-INFO
"WG E-Mail: vrrp@ietf.org
Editor: Kalyan Tata
Check Point Software
800 Bridge Park Way,
Redwood City, CA 94065
Tata_kalyan@yahoo.com"
DESCRIPTION
"This MIB describes objects used for managing Virtual
Router Redundancy Protocol version 3 (VRRPv3).
Copyright (C) The Internet Society (2011).
This version of MIB module is part of RFC YYYY.
Please see the RFC for full legal notices."
REVISION "201104220000Z" -- Apr 22, 2011
DESCRIPTION "Initial version as published in RFC YYYY."
-- EdNote: Please replace YYYY with actual RFC number for
-- this draft and remove this note.
::= { mib-2 ZZZ }
-- EdNote: Please replace ZZZ with IANA assigned number
-- and remove this note.
-- Textual Conventions
Vrrpv3VrIdTC ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"The value of the virtual router identifier noted as
(VRID) in RFC5798. This along with interface index
(ifIndex) and IP version, serves to uniquely identify a
virtual router on a given VRRP router."
REFERENCE " RFC 5798 (Sections 3 and 5.2.3)"
SYNTAX Integer32 (1..255)
-- VRRPv3 MIB Groups
vrrpv3Notifications OBJECT IDENTIFIER ::= { vrrpv3MIB 0 }
Tata Expires Oct 2011 [Page 8]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3Objects OBJECT IDENTIFIER ::= { vrrpv3MIB 1 }
vrrpv3Conformance OBJECT IDENTIFIER ::= { vrrpv3MIB 2 }
-- VRRPv3 MIB Objects
vrrpv3Operations OBJECT IDENTIFIER ::= { vrrpv3Objects 1 }
vrrpv3Statistics OBJECT IDENTIFIER ::= { vrrpv3Objects 2 }
-- VRRPv3 Operations Table
vrrpv3OperationsTable OBJECT-TYPE
SYNTAX SEQUENCE OF Vrrpv3OperationsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Unified Operations table for a VRRP router which
consists of a sequence (i.e., one or more conceptual
rows) of 'vrrpv3OperationsEntry' items each of which
describe the operational characteristics of a virtual
router."
::= { vrrpv3Operations 1 }
vrrpv3OperationsEntry OBJECT-TYPE
SYNTAX Vrrpv3OperationsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in the vrrpv3OperationsTable containing the
operational characteristics of a virtual router. On a
VRRP router, a given virtual router is identified by a
combination of ifIndex, VRID and the IP version.
ifIndex represents a interface of the router.
A row must be created with vrrpv3OperationsStatus
set to initialize(1) and cannot transition to
backup(2) or master(3) until vrrpv3OperationsRowStatus
is transitioned to active(1).
The information in this table is persistent and when
written the entity SHOULD save the change to non-
volatile storage."
INDEX { ifIndex, vrrpv3OperationsVrId,
vrrpv3OperationsInetAddrType
}
::= { vrrpv3OperationsTable 1 }
Tata Expires Oct 2011 [Page 9]
Internet Draft VRRP unified MIB Sep 2011
Vrrpv3OperationsEntry ::=
SEQUENCE {
vrrpv3OperationsVrId
Vrrpv3VrIdTC,
vrrpv3OperationsInetAddrType
InetAddressType,
vrrpv3OperationsMasterIpAddr
InetAddress,
vrrpv3OperationsPrimaryIpAddr
InetAddress,
vrrpv3OperationsVirtualMacAddr
MacAddress,
vrrpv3OperationsStatus
INTEGER,
vrrpv3OperationsPriority
Unsigned32,
vrrpv3OperationsAddrCount
Integer32,
vrrpv3OperationsAdvInterval
TimeInterval,
vrrpv3OperationsPreemptMode
TruthValue,
vrrpv3OperationsAcceptMode
TruthValue,
vrrpv3OperationsUpTime
TimeTicks,
vrrpv3OperationsRowStatus
RowStatus
}
vrrpv3OperationsVrId OBJECT-TYPE
SYNTAX Vrrpv3VrIdTC
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object contains the Virtual Router Identifier
(VRID)."
REFERENCE "RFC 4001"
::= { vrrpv3OperationsEntry 1 }
vrrpv3OperationsInetAddrType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The IP address type of Vrrpv3OperationsEntry and
Vrrpv3AssociatedIpAddrEntry. This value determines
the type for vrrpv3OperationsMasterIpAddr,
Tata Expires Oct 2011 [Page 10]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3OperationsPrimaryIpAddr and
vrrpv3AssociatedIpAddrAddress.
ipv4(1) and ipv6(2) are the only two values supported
in this MIB module."
REFERENCE "RFC 4001"
::= { vrrpv3OperationsEntry 2 }
vrrpv3OperationsMasterIpAddr OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The master router's real IP address. Master router
would set this address to vrrpv3OperationsPrimaryIpAddr
while transitioning to master state. For backup
routers, this is the IP address listed as the source in
VRRP advertisement last received by this virtual
router."
REFERENCE " RFC 5798"
::= { vrrpv3OperationsEntry 3 }
vrrpv3OperationsPrimaryIpAddr OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"In the case where there is more than one IP
Address (associated IP addresses) for a given
`ifIndex', this object is used to specify the IP
address that will become the
vrrpv3OperationsMasterIpAddr', should the virtual
router transition from backup state to master."
::= { vrrpv3OperationsEntry 4 }
vrrpv3OperationsVirtualMacAddr OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The virtual MAC address of the virtual router.
Although this object can be derived from the
'vrrpv3OperationsVrId' object, it is defined so that it
is easily obtainable by a management application and
can be included in VRRP-related SNMP notifications."
::= { vrrpv3OperationsEntry 5 }
vrrpv3OperationsStatus OBJECT-TYPE
Tata Expires Oct 2011 [Page 11]
Internet Draft VRRP unified MIB Sep 2011
SYNTAX INTEGER {
initialize(1),
backup(2),
master(3)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current state of the virtual router. This object
has three defined values:
- `initialize', which indicates that the
virtual router is waiting for a startup event.
- `backup', which indicates the virtual router is
monitoring the availability of the master router.
- `master', which indicates that the virtual router
is forwarding packets for IP addresses that are
associated with this router."
REFERENCE " RFC 5798"
::= { vrrpv3OperationsEntry 6 }
vrrpv3OperationsPriority OBJECT-TYPE
SYNTAX Unsigned32 (0..255)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object specifies the priority to be used for the
virtual router master election process. Higher values
imply higher priority.
A priority of '0', although not settable, is sent by
the master router to indicate that this router has
ceased to participate in VRRP and a backup virtual
router should transition to become a new master.
A priority of 255 is used for the router that owns the
associated IP address(es) for VRRP over IPv4 and hence
not settable.
A 'badValue(3)' should be returned when a user tries to
set 0 or 255 for this object. "
REFERENCE " RFC 5798 section 6.1"
DEFVAL { 100 }
::= { vrrpv3OperationsEntry 7 }
vrrpv3OperationsAddrCount OBJECT-TYPE
Tata Expires Oct 2011 [Page 12]
Internet Draft VRRP unified MIB Sep 2011
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of IP addresses that are associated with
this virtual router. This number is equal to the
number of rows in the vrrpv3AssociatedAddrTable that
correspond to a given ifIndex/VRID/IP version."
REFERENCE "RFC 5798 Section 6.1"
::= { vrrpv3OperationsEntry 8 }
vrrpv3OperationsAdvInterval OBJECT-TYPE
SYNTAX TimeInterval (1..4095)
UNITS "centiseconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The time interval, in centiseconds, between sending
advertisement messages. Only the master router sends
VRRP advertisements."
REFERENCE " RFC 5798 section 6.1"
DEFVAL { 100}
::= { vrrpv3OperationsEntry 9 }
vrrpv3OperationsPreemptMode OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Controls whether a higher priority virtual router will
preempt a lower priority master."
REFERENCE " RFC 5798 section 6.1"
DEFVAL { true }
::= { vrrpv3OperationsEntry 10 }
vrrpv3OperationsAcceptMode OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Controls whether a virtual router in Master state
will accept packets addressed to the address owner's
IPv6 address as its own if it is not the IPv6 address
owner. Default is false(2).
This object is not relevant for rows representing VRRP
over IPv4 and should be set to false(2)."
DEFVAL { false }
::= { vrrpv3OperationsEntry 11 }
Tata Expires Oct 2011 [Page 13]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3OperationsUpTime OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This value represents the amount of time, in
TimeTicks (hundredth of a second), since this virtual
router (i.e., the ` vrrpv3OperationsStatus')
transitioned out of `initialize'."
REFERENCE " RFC 5798 section 6.1"
::= { vrrpv3OperationsEntry 12 }
vrrpv3OperationsRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The RowStatus variable should be used in accordance to
installation and removal conventions for conceptual
rows.
To create a row in this table, a manager sets this
object to either createAndGo(4) or createAndWait(5).
Until instances of all corresponding columns are
appropriately configured, the value of the
Corresponding instance of the
`vrrpv3OperationsRowStatus' column will be read as
notReady(3).
In particular, a newly created row cannot be made
active(1) until (minimally) the corresponding instance
of vrrpv3OperationsInetAddrType, vrrpv3OperationsVrId
and vrrpv3OperationsPrimaryIpAddr has been set and
there is at least one active row in the
`vrrpv3AssociatedIpAddrTable' defining an associated
IP address.
notInService(2) should be used to administratively
bring the row down.
A typical order of operation to add a row is:
1. Create a row in vrrpv3OperationsTable with
createAndWait(5).
2. Create one or more corresponding rows in
vrrpv3AssociatedIpAddrTable.
3. Populate the vrrpv3OperationsEntry.
4. set vrrpv3OperationsRowStatus to active(1).
A typical order of operation to delete an entry is:
Tata Expires Oct 2011 [Page 14]
Internet Draft VRRP unified MIB Sep 2011
1. Set vrrpv3OperationsRowStatus to notInService(2).
2. Set the corresponding rows in
vrrpv3AssociatedIpAddrTable to destroy(6) to delete the
entry.
3. set vrrpv3OperationsRowStatus to destroy(6) to
delete the entry."
::= { vrrpv3OperationsEntry 13 }
-- VRRP Associated Address Table
vrrpv3AssociatedIpAddrTable OBJECT-TYPE
SYNTAX SEQUENCE OF Vrrpv3AssociatedIpAddrEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The table of addresses associated with each virtual
router."
::= { vrrpv3Operations 2 }
vrrpv3AssociatedIpAddrEntry OBJECT-TYPE
SYNTAX Vrrpv3AssociatedIpAddrEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in the table contains an IP address that is
associated with a virtual router. The number of rows
for a given IP version, VrID and ifIndex will equal the
number of IP addresses associated (e.g., backed up) by
the virtual router (equivalent to
'vrrpv3OperationsIpAddrCount').
Rows in the table cannot be modified unless the value
of `vrrpv3OperationsStatus' for the corresponding entry
in the vrrpv3OperationsTable has transitioned to
initialize(1).
The information in this table is persistent and when
written the entity SHOULD save the change to non-
volatile storage."
INDEX { ifIndex, vrrpv3OperationsVrId,
vrrpv3OperationsInetAddrType,
vrrpv3AssociatedIpAddrAddress }
::= { vrrpv3AssociatedIpAddrTable 1 }
Vrrpv3AssociatedIpAddrEntry ::=
SEQUENCE {
vrrpv3AssociatedIpAddrAddress
Tata Expires Oct 2011 [Page 15]
Internet Draft VRRP unified MIB Sep 2011
InetAddress,
vrrpv3AssociatedIpAddrRowStatus
RowStatus
}
vrrpv3AssociatedIpAddrAddress OBJECT-TYPE
SYNTAX InetAddress (SIZE (0|4|16))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The assigned IP addresses that a virtual router is
responsible for backing up.
The IP address type is determined by the value of
vrrpv3OperationsInetAddrType in the index of this
row"
REFERENCE " RFC 5798 "
::= { vrrpv3AssociatedIpAddrEntry 1 }
vrrpv3AssociatedIpAddrRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The row status variable, used according to
installation and removal conventions for conceptual
rows. To create a row in this table, a manager sets
this object to either createAndGo(4) or
createAndWait(5). Setting this object to active(1)
results in the addition of an associated address for a
virtual router. Setting this object to notInService(2)
results in administratively bringing down the row.
Destroying the entry or setting it to destroy(6)
removes the associated address from the virtual router.
The use of other values is implementation-dependent.
Implementations should not allow deletion of the last
row corresponding to an active row in
vrrpv3OperationsTable.
Refer to description of vrrpv3OperationsRowStatus for a
typical row creation and deletion scenarios."
::= { vrrpv3AssociatedIpAddrEntry 2 }
-- VRRP Router Statistics
vrrpv3RouterChecksumErrors OBJECT-TYPE
Tata Expires Oct 2011 [Page 16]
Internet Draft VRRP unified MIB Sep 2011
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP packets received with an
invalid VRRP checksum value.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3GlobalStatisticsDiscontinuityTime."
REFERENCE " RFC 5798 Section 5.2.8"
::= { vrrpv3Statistics 1 }
vrrpv3RouterVersionErrors OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP packets received with an
unknown or unsupported version number.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3GlobalStatisticsDiscontinuityTime."
REFERENCE " RFC 5798 Section 5.2.1"
::= { vrrpv3Statistics 2 }
vrrpv3RouterVrIdErrors OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP packets received with a
VRID that is not valid for any virtual router on this
router.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3GlobalStatisticsDiscontinuityTime."
REFERENCE " RFC 5798 Section 5.2.3"
::= { vrrpv3Statistics 3 }
vrrpv3GlobalStatisticsDiscontinuityTime OBJECT-TYPE
Tata Expires Oct 2011 [Page 17]
Internet Draft VRRP unified MIB Sep 2011
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime on the most recent occasion at
which one of vrrpv3RouterChecksumErrors,
vrrpv3RouterVersionErrors and vrrpv3RouterVrIdErrors
suffered a discontinuity.
If no such discontinuities have occurred since the last
re-initialization of the local management subsystem,
then this object contains a zero value."
::= { vrrpv3Statistics 4 }
-- VRRP Router Statistics Table
vrrpv3StatisticsTable OBJECT-TYPE
SYNTAX SEQUENCE OF Vrrpv3StatisticsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table of virtual router statistics."
::= { vrrpv3Statistics 5 }
vrrpv3StatisticsEntry OBJECT-TYPE
SYNTAX Vrrpv3StatisticsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in the table, containing statistics
information about a given virtual router."
AUGMENTS { vrrpv3OperationsEntry }
::= { vrrpv3StatisticsTable 1 }
Vrrpv3StatisticsEntry ::=
SEQUENCE {
vrrpv3StatisticsMasterTransitions
Counter32,
vrrpv3StatisticsNewMasterReason
INTEGER,
vrrpv3StatisticsRcvdAdvertisements
Counter64,
vrrpv3StatisticsAdvIntervalErrors
Counter64,
vrrpv3StatisticsIpTtlErrors
Counter64,
vrrpv3StatisticsProtoErrReason
INTEGER,
Tata Expires Oct 2011 [Page 18]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3StatisticsRcvdPriZeroPackets
Counter64,
vrrpv3StatisticsSentPriZeroPackets
Counter64,
vrrpv3StatisticsRcvdInvalidTypePackets
Counter64,
vrrpv3StatisticsAddressListErrors
Counter64,
vrrpv3StatisticsPacketLengthErrors
Counter64,
vrrpv3StatisticsRowDiscontinuityTime
TimeStamp,
vrrpv3StatisticsRefreshRate
Unsigned32
}
vrrpv3StatisticsMasterTransitions OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of times that this virtual router's
state has transitioned to MASTER.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
::= { vrrpv3StatisticsEntry 1 }
vrrpv3StatisticsNewMasterReason OBJECT-TYPE
SYNTAX INTEGER {
notMaster (0),
priority (1),
preempted (2),
masterNoResponse (3)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This indicates the reason for the virtual router to
transition to MASTER state. If the virtual router never
transitioned to master state, this SHOULD be set to
notmaster(0). Otherwise this indicates the reason this
virtual router transitioned to master state the last
time. Used by vrrpv3NewMaster notification."
::= { vrrpv3StatisticsEntry 2 }
Tata Expires Oct 2011 [Page 19]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3StatisticsRcvdAdvertisements OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP advertisements received by
this virtual router.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
::= { vrrpv3StatisticsEntry 3 }
vrrpv3StatisticsAdvIntervalErrors OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP advertisement packets
received for which the advertisement interval is
different from the vrrpv3OperationsAdvInterval
configured on this virtual router.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
::= { vrrpv3StatisticsEntry 4 }
vrrpv3StatisticsIpTtlErrors OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP packets received by the
Virtual router with IPv4 TTL (for VRRP over IPv4) or
IPv6 Hop Limit (for VRRP over IPv6) not equal to 255.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
REFERENCE "RFC 5798 Section 5.1.1.3"
Tata Expires Oct 2011 [Page 20]
Internet Draft VRRP unified MIB Sep 2011
::= { vrrpv3StatisticsEntry 5 }
vrrpv3StatisticsProtoErrReason OBJECT-TYPE
SYNTAX INTEGER {
noError (0),
ipTtlError (1),
versionError (2),
checksumError (3),
vrIdError(4)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This indicates the reason for the last protocol error.
This SHOULD be set to noError(0) when no protocol
errors are encountered. Used by vrrpv3ProtoError
notification."
::= { vrrpv3StatisticsEntry 6 }
vrrpv3StatisticsRcvdPriZeroPackets OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP packets received by the
virtual router with a priority of '0'.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
REFERENCE "RFC 5798 Section 5.2.4"
::= { vrrpv3StatisticsEntry 7 }
vrrpv3StatisticsSentPriZeroPackets OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of VRRP packets sent by the virtual
router with a priority of '0'.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
REFERENCE "RFC 5798 Section 5.3.4"
::= { vrrpv3StatisticsEntry 8 }
Tata Expires Oct 2011 [Page 21]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3StatisticsRcvdInvalidTypePackets OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of VRRP packets received by the virtual
router with an invalid value in the 'type' field.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
::= { vrrpv3StatisticsEntry 9 }
vrrpv3StatisticsAddressListErrors OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received for which the
address list does not match the locally configured list
for the virtual router.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
::= { vrrpv3StatisticsEntry 10 }
vrrpv3StatisticsPacketLengthErrors OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received with a packet
length less than the length of the VRRP header.
Discontinuities in the value of this counter can occur
at re-initialization of the management system, and at
other times as indicated by the value of
vrrpv3StatisticsRowDiscontinuityTime."
::= { vrrpv3StatisticsEntry 11 }
vrrpv3StatisticsRowDiscontinuityTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
Tata Expires Oct 2011 [Page 22]
Internet Draft VRRP unified MIB Sep 2011
STATUS current
DESCRIPTION
"The value of sysUpTime on the most recent occasion at
which any one or more of this entry's counters suffered
a discontinuity.
If no such discontinuities have occurred since the last
re-initialization of the local management subsystem,
then this object contains a zero value."
::= { vrrpv3StatisticsEntry 12 }
vrrpv3StatisticsRefreshRate OBJECT-TYPE
SYNTAX Unsigned32
UNITS "milli-seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The minimum reasonable polling interval for this entry.
This object provides an indication of the minimum
Amount of time required to update the counters in this
entry."
::= { vrrpv3StatisticsEntry 13 }
-- Notification Definitions
-- Notifications may be controlled using SNMP-NOTIFICATION-MIB
vrrpv3NewMaster NOTIFICATION-TYPE
OBJECTS {
vrrpv3OperationsMasterIpAddr,
vrrpv3StatisticsNewMasterReason
}
STATUS current
DESCRIPTION
"The newMaster notification indicates that the sending
agent has transitioned to 'Master' state."
::= { vrrpv3Notifications 1 }
vrrpv3ProtoError NOTIFICATION-TYPE
OBJECTS {
vrrpv3StatisticsProtoErrReason
}
STATUS current
DESCRIPTION
"The notification indicates that the sending agent has
encountered the protocol error indicated by
vrrpv3StatisticsProtoErrReason."
::= { vrrpv3Notifications 2 }
Tata Expires Oct 2011 [Page 23]
Internet Draft VRRP unified MIB Sep 2011
-- Conformance Information
vrrpv3Compliances OBJECT IDENTIFIER ::= { vrrpv3Conformance 1 }
vrrpv3Groups OBJECT IDENTIFIER ::= { vrrpv3Conformance 2 }
-- Compliance Statements
vrrpv3FullCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement"
MODULE -- this module
MANDATORY-GROUPS {
vrrpv3OperationsGroup,
vrrpv3StatisticsGroup,
vrrpv3InfoGroup,
vrrpv3NotificationsGroup
}
OBJECT vrrpv3OperationsPriority
WRITE-SYNTAX Unsigned32 (1..254)
DESCRIPTION "Setable values are from 1 to 254."
::= { vrrpv3Compliances 1 }
vrrpv3ReadOnlyCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"When this MIB module is implemented without support for
read-create (i.e. in read-only mode), then such an
implementation can claim read-only compliance. Such a
device can then be monitored but can not be configured
with this MIB."
MODULE -- this module
MANDATORY-GROUPS {
vrrpv3OperationsGroup,
vrrpv3StatisticsGroup,
vrrpv3StatisticsDiscontinuityGroup,
vrrpv3InfoGroup,
vrrpv3NotificationsGroup
}
OBJECT vrrpv3OperationsPriority
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT vrrpv3OperationsPrimaryIpAddr
Tata Expires Oct 2011 [Page 24]
Internet Draft VRRP unified MIB Sep 2011
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT vrrpv3OperationsAdvInterval
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT vrrpv3OperationsPreemptMode
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT vrrpv3OperationsAcceptMode
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT vrrpv3OperationsRowStatus
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT vrrpv3AssociatedIpAddrRowStatus
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
::= { vrrpv3Compliances 2 }
-- Conformance Groups
vrrpv3OperationsGroup OBJECT-GROUP
OBJECTS {
vrrpv3OperationsVirtualMacAddr,
vrrpv3OperationsStatus,
vrrpv3OperationsPriority,
vrrpv3OperationsMasterIpAddr,
vrrpv3OperationsAdvInterval,
vrrpv3OperationsPreemptMode,
vrrpv3OperationsAcceptMode,
vrrpv3OperationsUpTime,
vrrpv3OperationsRowStatus,
vrrpv3OperationsAddrCount,
vrrpv3OperationsPrimaryIpAddr,
vrrpv3AssociatedIpAddrRowStatus
}
STATUS current
DESCRIPTION
"Conformance group for VRRPv3 operations."
::= { vrrpv3Groups 1 }
Tata Expires Oct 2011 [Page 25]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3StatisticsGroup OBJECT-GROUP
OBJECTS {
vrrpv3RouterChecksumErrors,
vrrpv3RouterVersionErrors,
vrrpv3RouterVrIdErrors,
vrrpv3StatisticsMasterTransitions,
vrrpv3StatisticsNewMasterReason,
vrrpv3StatisticsRcvdAdvertisements,
vrrpv3StatisticsAdvIntervalErrors,
vrrpv3StatisticsRcvdPriZeroPackets,
vrrpv3StatisticsSentPriZeroPackets,
vrrpv3StatisticsRcvdInvalidTypePackets,
vrrpv3StatisticsIpTtlErrors,
vrrpv3StatisticsProtoErrReason,
vrrpv3StatisticsAddressListErrors,
vrrpv3StatisticsPacketLengthErrors,
vrrpv3StatisticsRowDiscontinuityTime,
vrrpv3StatisticsRefreshRate
}
STATUS current
DESCRIPTION
"Conformance group for VRRPv3 statistics."
::= { vrrpv3Groups 2 }
vrrpv3StatisticsDiscontinuityGroup OBJECT-GROUP
OBJECTS {
vrrpv3GlobalStatisticsDiscontinuityTime
}
STATUS current
DESCRIPTION
"Objects providing information statistics counter
discontinuities."
::= { vrrpv3Groups 3 }
vrrpv3InfoGroup OBJECT-GROUP
OBJECTS {
vrrpv3StatisticsProtoErrReason,
vrrpv3StatisticsNewMasterReason
}
STATUS current
DESCRIPTION
"Conformance group for objects contained in VRRPv3
notifications."
::= { vrrpv3Groups 4 }
vrrpv3NotificationsGroup NOTIFICATION-GROUP
NOTIFICATIONS {
vrrpv3NewMaster,
Tata Expires Oct 2011 [Page 26]
Internet Draft VRRP unified MIB Sep 2011
vrrpv3ProtoError
}
STATUS current
DESCRIPTION
"The VRRP MIB Notification Group."
::= { vrrpv3Groups 5 }
END
11. Security Considerations
There are a number of management objects defined in this MIB module
with a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations. These are the tables and objects and their
sensitivity/vulnerability:
The objects vrrpv3OperationsPriority, vrrpv3OperationsPrimaryIpAddr,
vrrpv3OperationsAdvInterval, vrrpv3OperationsPreemptMode,
vrrpv3OperationsAcceptMode, vrrpv3OperationsRowStatus and
vrrpv3AssociatedIpAddrRowStatus possess the read-create attribute.
Manipulation of these objects is capable of affecting the operation
of a virtual router.
Specific examples of this include, but are not limited to:
o The vrrpv3OperationsRowStatus object which could be used to disable
a virtual router. While there are other columns that, if changed,
could disrupt operations, they can not be changed without first
changing the RowStatus object.
SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPSec),
even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the
objects in this MIB module.
It is RECOMMENDED that implementers consider the security features
as provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for
authentication and privacy).
Further, deployment of SNMP versions prior to SNMPv3 is NOT
RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to
enable cryptographic security. It is then a customer/operator
Tata Expires Oct 2011 [Page 27]
Internet Draft VRRP unified MIB Sep 2011
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module is properly configured to give access to
the objects only to those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
12. IANA Considerations
The MIB module in this document uses the following IANA-assigned
OBJECT IDENTIFIER values recorded in the SMI Numbers registry:
Descriptor OBJECT IDENTIFIER value
---------- -----------------------
vrrpv3MIB { mib-2 ZZZ }
[Editor's Note (to be removed prior to publication): The IANA is
requested to assign a value for "ZZZ" under the 'mib-2' subtree
and to record the assignment in the SMI Numbers registry. When
the assignment has been made, the RFC Editor is asked to replace
"ZZZ" (here and in the MIB module) with the assigned value.
This document obsoletes RFC 2787 and the IANA is requested to
deprecate the value 68 under 'mib-2' assigned to VRRP-MIB.]
13. Normative References
[RFC2119] Bradner S., "Key words for use in RFCs to Indicate
Requirement Levels", RFC 2119, March 1997.
[RFC2578] McCloghrie, K., D. Perkins, J. Schoenwaelder, J. Case, M.
Rose, S. Waldbusser, "Structure of Management Information
Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., D. Perkins, J. Schoenwaelder, J. Case, M.
Rose, S. Waldbusser, "Textual Conventions for SMIv2", STD
58, RFC 2579, April 1999.
[RFC2580] McCloghrie, K., D. Perkins, J. Schoenwaelder, J. Case, M.
Rose, S. Waldbusser, "Conformance Statements for SMIv2",
STD 58, RFC 2580, April 1999.
[RFC5798] S. Nadas, Ed., "Virtual Router Redundancy Protocol
Version 3 for IPv4 and IPv6 ", RFC 5798, Mar 2010.
[RFC2787] Jewell, B., D. Chuang, "Definitions of Managed Objects for
the Virtual Router Redundancy Protocol", RFC 2787, March
2000.
[RFC2863] McCloghrie, K., Kastenholz, F., "The Interfaces Group
MIB" RFC2863, June 2000.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J.
Schoenwaelder, "Textual Conventions for Internet
Network Addresses", RFC 4001, February 2005.
Tata Expires Oct 2011 [Page 28]
Internet Draft VRRP Unified MIB Aug 2009
[RFC3413] Levi, D., Meyer, P., Stewart, B., "SNMP Applications",
RFC 3413, December 2002.
14. Informative References
[RFC3410] Case, J., R. Mundy, D. Partain, B. Stewart, "Introduction
and Applicability Statements for Internet-Standard
Management Framework", RFC 3410, December 2002.
[RFC2338] S.Knight, D.Weaver, D.Whipple, R.Hinden, D.Mitzel, P.Hunt,
P.Higginson, M.Shand, A.Lindem, "Virtual Router Redundancy
Protocol", RFC 2338, April 1998.
15. Acknowledgments
Kripakaran Karlekar and Brain Jewell helped in design and initial
drafts of this specification. This specification is based on RFC
2787. The authors of RFC2787 are Brian Jewell and David Chuang. The
author would also like to thank Bert Wijnen, Dave Thaler, Joan
Cucchiara, Mukesh Gupta, Steve Bates, Adrian Farrel, Ben Campbell and
Joel M. Halpern for taking time to review the document and provide
valuable guidance.
16. Author's Address
Srinivas Kalyan Tata
Check Point Software
800 Bridge Parkway
Redwood City, CA 94065
Phone: +1-408-505-0542
EMail: tata_kalyan@yahoo.com
Tata Expires Oct 2011 [Page 29]
