-- MIB file created 20-Jun-2007 17:13:15, by -- SMICng version 2.2.11-beta(PRO)(Solaris), January 20, 2001. Enterprise key cisco.com CISCO-LWAPP-IDS-MIB DEFINITIONS ::= BEGIN -- From file: "CISCO-LWAPP-IDS-MIB.my" -- Compile options "4 7 F H N O W 03 06 0B 0G 0N 0T" IMPORTS TruthValue, TimeInterval, RowStatus FROM SNMPv2-TC-v1 SnmpAdminString FROM SNMP-FRAMEWORK-MIB InetAddressType, InetAddress FROM INET-ADDRESS-MIB ciscoMgmt FROM CISCO-SMI Gauge FROM RFC1155-SMI OBJECT-TYPE FROM RFC-1212 TRAP-TYPE FROM RFC-1215; ciscoLwappIdsMIB OBJECT IDENTIFIER ::= { ciscoMgmt 519 } -- MODULE-IDENTITY -- LastUpdated -- 200604100000Z -- OrgName -- Cisco Systems Inc. -- ContactInfo -- Cisco Systems, -- Customer Service -- Postal: 170 West Tasman Drive -- San Jose, CA 95134 -- USA -- Tel: +1 800 553-NETS -- -- Email: cs-wnbu-snmp@cisco.com -- Descr -- This MIB is intended to be implemented on all those -- devices operating as Central Controllers (CC) that -- terminate the Light Weight Access Point Protocol -- tunnel from Light-weight LWAPP Access Points. -- -- This MIB provides the information used to integrate -- the LWAPP controller with external IDS/IPS -- applications. LWAPP controllers interact with -- these applications to protect the network against -- various threats that would compromise the overall -- security of the network. -- -- The arrangement of the IDS / IPS applications, -- controller (referred to as CC in the diagram) and the -- LWAPP APs appear as follows. -- -- +.......+ +.......+ -- + + + + -- + IDS + + IDS + -- + IPS + + IPS + -- +.......+ +.......+ -- . . -- . . . . -- . . . . -- . . . . -- +......+ +......+ +......+ +......+ -- + + + + + + + + -- + CC + + CC + + CC + + CC + -- + + + + + + + + -- +......+ +......+ +......+ +......+ -- .. . . . -- .. . . . -- . . . . . -- . . . . . -- . . . . . -- . . . . . -- +......+ +......+ +......+ +......+ +......+ -- + + + + + + + + + + -- + AP + + AP + + AP + + AP + + AP + -- + + + + + + + + + + -- +......+ +......+ +......+ +......+ +......+ -- . . . . -- . . . . . -- . . . . . -- . . . . . -- . . . . . -- +......+ +......+ +......+ +......+ +......+ -- + + + + + + + + + + -- + MN + + MN + + MN + + MN + + MN + -- + + + + + + + + + + -- +......+ +......+ +......+ +......+ +......+ -- -- -- The LWAPP tunnel exists between the controller and -- the APs. The MNs communicate with the APs through -- the protocol defined by the 802.11 standard. The -- controllers and the IDS systems exchange information -- through Cisco proprietary event exchange mechanisms. -- -- LWAPP APs, upon bootup, discover and join one of the -- controllers and the controller pushes the configuration, -- that includes the WLAN parameters, to the LWAPP APs. -- The APs then encapsulate all the 802.11 frames from -- wireless clients inside LWAPP frames and forward -- the LWAPP frames to the controller. -- -- One or more controllers hold logical connections to -- an IDS / IPS and interact with it to enforce security -- on the network. -- -- GLOSSARY -- -- Access Point ( AP ) -- -- An entity that contains an 802.11 medium access -- control ( MAC ) and physical layer ( PHY ) interface -- and provides access to the distribution services via -- the wireless medium for associated clients. -- -- LWAPP APs encapsulate all the 802.11 frames in -- LWAPP frames and sends them to the controller to which -- it is logically connected. -- -- Central Controller ( CC ) -- -- The central entity that terminates the LWAPP protocol -- tunnel from the LWAPP APs. Throughout this MIB, -- this entity is also referred to as 'controller'. -- -- HyperText Transfer Protocol Over Secure Socket Layer -- (HTTPS) -- -- HTTPS is a Web based protocol that encrypts and -- decrypts user page requests as well as the pages -- that are returned by the Web server. HTTPS uses -- port 443 instead of HTTP port 80 in its -- interactions with the lower layer, TCP/IP. SSL -- uses a 40-bit key for the RC4 stream encryption -- algorithm, which is considered an adequate degree -- of encryption for commercial exchange. -- -- Intrusion Detection System ( IDS ) -- -- An IDS performs activities like enforcing security -- related policies, identifying and reporting attacks -- on the network etc., thereby helping to improve -- the overall security of the enterprise network. -- -- Intrusion Prevention System ( IPS ) -- -- An IPS offers significant protection to the network -- against viruses, worms, signature attacks etc. This -- system detects L3 - L7 attacks. This system can also -- instruct other IPS clients through standards based -- protocols to allow/block network access for specific -- network entities. -- -- Light Weight Access Point Protocol ( LWAPP ) -- -- This is a generic protocol that defines the -- communication between the Access Points and the -- controller. -- -- Mobile Node ( MN ) -- -- A roaming 802.11 wireless device in a wireless -- network associated with an access point. -- -- Network Management System ( NMS ) -- -- The station from which the administrator manages the -- wired and wireless networks. -- -- Secure Hash Algorithm ( SHA ) -- -- The SHA, developed by NIST for use with the Digital -- Signature Standard (DSS) is specified within the -- Secure Hash Standard (SHS). SHA is a cryptographic -- message digest algorithm similar to the MD4 family -- of hash functions developed by Rivest. It differs -- from the MD4 hash functions in that it adds an -- additional expansion operation, an extra round and -- the whole transformation was designed to -- accomodate the DSS block size for efficiency. -- -- REFERENCE -- -- [1] Wireless LAN Medium Access Control ( MAC ) and -- Physical Layer ( PHY ) Specifications. -- -- [2] Draft-obara-capwap-lwapp-00.txt, IETF Light -- Weight Access Point Protocol -- RevDate -- 200604100000Z -- RevDescr -- Initial version of this MIB module. ciscoLwappIdsMIBNotifs OBJECT IDENTIFIER ::= { ciscoLwappIdsMIB 0 } ciscoLwappIdsMIBObjects OBJECT IDENTIFIER ::= { ciscoLwappIdsMIB 1 } ciscoLwappIdsMIBConform OBJECT IDENTIFIER ::= { ciscoLwappIdsMIB 2 } ciscoLwappIdsConfig OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBObjects 1 } ciscoLwappIdsStatus OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBObjects 2 } ciscoLwappIdsMIBCompliances OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBConform 1 } ciscoLwappIdsMIBGroups OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBConform 2 } cLIdsIpsSensorConfigTable OBJECT-TYPE SYNTAX SEQUENCE OF CLIdsIpsSensorConfigEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table facilitates the configuration of a group of IPS sensors to which the LWAPP controller would subscribe to retrieve the IDS events from the respective sensors. IPS sensors are used to protect the network by helping to detect and report threats like worms, viruses etc. By subscribing to such a sensor, the LWAPP controller, through appropriate interfaces, can retrieve the events detected by the sensor and report the same to the NMS. The controller can accept the request, to block the packets from an IP address, from each Sensor configured through this table and block the data traffic originating from that particular source. Rows are added or deleted to the table by explicit management actions initiated by the user from a network management station. Information about each IPS sensor is uniquely identified by the network address of the respective sensor. " ::= { ciscoLwappIdsConfig 1 } cLIdsIpsSensorConfigEntry OBJECT-TYPE SYNTAX CLIdsIpsSensorConfigEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "There is an entry in this table for each IPS sensor identified by cLIdsIpsSensorAddressType and cLIdsIpsSensorAddress from which the controller can accept requests to block certain clients. " INDEX { cLIdsIpsSensorAddressType, cLIdsIpsSensorAddress } ::= { cLIdsIpsSensorConfigTable 1 } CLIdsIpsSensorConfigEntry ::= SEQUENCE { cLIdsIpsSensorAddressType InetAddressType, cLIdsIpsSensorAddress InetAddress, cLIdsIpsSensorUserName SnmpAdminString, cLIdsIpsSensorPassword SnmpAdminString, cLIdsIpsSensorQueryInterval TimeInterval, cLIdsIpsSensorEnabled TruthValue, cLIdsIpsSensorFingerPrintHex OCTET STRING, cLIdsIpsSensorPort Gauge, cLIdsIpsSensorRowStatus RowStatus } cLIdsIpsSensorAddressType OBJECT-TYPE SYNTAX InetAddressType -- Rsyntax INTEGER { -- ?? enum value of zero may cause problems -- unknown(0), -- ipv4(1), -- ipv6(2), -- ipv4z(3), -- ipv6z(4), -- dns(16) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object represents the type of the network address made available through cLIdsIpsSensorAddress. " ::= { cLIdsIpsSensorConfigEntry 1 } cLIdsIpsSensorAddress OBJECT-TYPE SYNTAX InetAddress -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS not-accessible STATUS mandatory DESCRIPTION "This object represents the network address of the IPS sensor. The type of the network address represented by this object is determined by the value of cLIdsIpsSensorAddressType. " ::= { cLIdsIpsSensorConfigEntry 2 } cLIdsIpsSensorUserName OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-write STATUS mandatory DESCRIPTION "This object represents the user name in use by the LWAPP controller to get authenticated with the IPS sensor. " ::= { cLIdsIpsSensorConfigEntry 3 } cLIdsIpsSensorPassword OBJECT-TYPE SYNTAX SnmpAdminString -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS read-write STATUS mandatory DESCRIPTION "This object represents the password following the username used by the LWAPP controller to get authenticated with the IPS sensor. Note that the read operation on this object returns a string in the pattern '****' for security reasons. " ::= { cLIdsIpsSensorConfigEntry 4 } cLIdsIpsSensorQueryInterval OBJECT-TYPE SYNTAX TimeInterval(1000..360000) -- Rsyntax INTEGER(1000..360000) -- Units -- Hundredths-seconds ACCESS read-write STATUS mandatory DESCRIPTION "This object represents the time interval at which the controller would query this particular IPS sensor for IDS events. " DEFVAL { 3000 } ::= { cLIdsIpsSensorConfigEntry 5 } cLIdsIpsSensorEnabled OBJECT-TYPE SYNTAX TruthValue -- Rsyntax INTEGER { -- true(1), -- false(2) -- } ACCESS read-write STATUS mandatory DESCRIPTION "This object represents the status of this IPS sensor as seen by controller for its interaction with the sensor. A value of 'true' indicates the controller shall query the sensor for events and respond to the requests from the sensor. A value of 'false' indicates the controller's communication with the sensor is disabled. " DEFVAL { false } ::= { cLIdsIpsSensorConfigEntry 6 } cLIdsIpsSensorFingerPrintHex OBJECT-TYPE SYNTAX OCTET STRING(SIZE(40)) ACCESS read-write STATUS mandatory DESCRIPTION "This object represents the SHA1 hash done on the sensor certificate and configured as a series of 40 hexadecimal digits. This hash value is needed to verify the validity of the certificate to prevent security attacks. Note that the read operation on this object returns a string in the pattern '****' for security reasons. " ::= { cLIdsIpsSensorConfigEntry 7 } cLIdsIpsSensorPort OBJECT-TYPE SYNTAX Gauge(1..65535) ACCESS read-write STATUS mandatory DESCRIPTION "This object represents the HTTPS port on the sensor on which the controller polls the sensor. " ::= { cLIdsIpsSensorConfigEntry 8 } cLIdsIpsSensorRowStatus OBJECT-TYPE SYNTAX RowStatus -- Rsyntax INTEGER { -- active(1), -- notInService(2), -- notReady(3), -- createAndGo(4), -- createAndWait(5), -- destroy(6) -- } ACCESS read-write STATUS mandatory DESCRIPTION "This is the status column for this row and used to create and delete specific instances of rows in this table. " ::= { cLIdsIpsSensorConfigEntry 9 } cLIdsClientExclTable OBJECT-TYPE SYNTAX SEQUENCE OF CLIdsClientExclEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "This table lists those clients whose data packets are to be blocked as requested by the IPS sensor due to the detection of attacks at layer 3 to layer 7 involving the particular client. This table has an expansion dependent relationship with cLIdsIpsSensorConfigTable. There may exist one or more rows corresponding to the row for each sensor configured through cLIdsIpsSensorConfigTable. An entry is added to this row by the agent when the controller receives the block request from one of the IPS sensors configured through cLIdsIpsSensorConfigTable. The controller sends the ciscoLwappIdsShunClientUpdate notification to indicate that the controller shall be blocking the particular client for a period equal to cLIdsClientTimeRemaining. The entry corresponding to a particular client is removed when one of the following happens. (i) When the configuration about the particular IPS sensor is removed from the controller, either through an explicit management action initiated through the NMS or when the controller reboots. (ii) When the remaining time period for which the client will be blocked as indicated by cLIdsClientTimeRemaining, expires. (iii) When the IPS sensor explicitly requests the controller to stop blocking the client's data packets. The controller sends the ciscoLwappIdsShunClientUpdate notification with cLIdsClientTimeRemaining equal to 0 to indicate that the client won't be blocked any further, on one of the three conditions for entry removal mentioned above. " ::= { ciscoLwappIdsStatus 1 } cLIdsClientExclEntry OBJECT-TYPE SYNTAX CLIdsClientExclEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Each entry in this table represents the information about a wireless client whose data packets are requested to be blocked by the controller. The request is made by the IPS sensor identified by cLIdsIpsSensorAddress. " INDEX { cLIdsIpsSensorAddressType, cLIdsIpsSensorAddress, cLIdsClientAddressType, cLIdsClientAddress } ::= { cLIdsClientExclTable 1 } CLIdsClientExclEntry ::= SEQUENCE { cLIdsClientAddressType InetAddressType, cLIdsClientAddress InetAddress, cLIdsClientTimeRemaining TimeInterval } cLIdsClientAddressType OBJECT-TYPE SYNTAX InetAddressType -- Rsyntax INTEGER { -- ?? enum value of zero may cause problems -- unknown(0), -- ipv4(1), -- ipv6(2), -- ipv4z(3), -- ipv6z(4), -- dns(16) -- } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object identifies the type of the network address being populated by cLIdsClientAddress. " ::= { cLIdsClientExclEntry 1 } cLIdsClientAddress OBJECT-TYPE SYNTAX InetAddress -- Rsyntax OCTET STRING(SIZE(0..255)) ACCESS not-accessible STATUS mandatory DESCRIPTION "This object identifies the network address of the wireless client whose data packets have been requested to be blocked by the controller. The type of the network address represented by this object is determined by the value of cLIdsClientAddressType. " ::= { cLIdsClientExclEntry 2 } cLIdsClientTimeRemaining OBJECT-TYPE SYNTAX TimeInterval -- Rsyntax INTEGER(0..2147483647) -- Units -- hundredths-seconds ACCESS read-only STATUS mandatory DESCRIPTION "This object indicates the remaining time for which the client's data packets are going to be blocked by the controller. " ::= { cLIdsClientExclEntry 3 } ciscoLwappIdsShunClientUpdate TRAP-TYPE -- Reverse mappable trap ENTERPRISE ciscoLwappIdsMIB VARIABLES { cLIdsClientTimeRemaining } -- Status -- mandatory DESCRIPTION "This notification is sent by the agent with cLIdsClientTimeRemaining indicating a value greater than 0, whenever it adds a row to cLIdsClientExclTable. The agent also sends this notification with cLIdsClientTimeRemaining equal to 0, when it removes a row from cLIdsClientExclTable. " ::= 1 ciscoLwappIdsConfigGroup OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBGroups 1 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This collection of objects provides the -- information used to integrate a controller with -- external IDS/IPS applications. -- objects -- cLIdsIpsSensorUserName, cLIdsIpsSensorPassword, -- cLIdsIpsSensorQueryInterval, cLIdsIpsSensorEnabled, -- cLIdsIpsSensorFingerPrintHex, cLIdsIpsSensorPort, -- cLIdsIpsSensorRowStatus ciscoLwappIdsStatusGroup OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBGroups 2 } -- OBJECT-GROUP -- Status -- mandatory -- Descr -- This collection of objects provides the status -- of the various operations the controller performs -- together with external IDS/IPS applications. -- objects -- cLIdsClientTimeRemaining ciscoLwappIdsNotifsGroup OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBGroups 3 } -- NOTIFICATION-GROUP -- Status -- mandatory -- Descr -- This collection of objects provides the information -- about the notifications sent by the agent related -- to IDS. -- notifications -- ciscoLwappIdsShunClientUpdate ciscoLwappIdsMIBCompliance OBJECT IDENTIFIER ::= { ciscoLwappIdsMIBCompliances 1 } -- MODULE-COMPLIANCE -- Status -- mandatory -- Descr -- The compliance statement for the SNMP entities that -- implement the ciscoLwappIdsMIB module. -- Module -- >>current<< -- MandGroup -- ciscoLwappIdsConfigGroup -- MandGroup -- ciscoLwappIdsStatusGroup -- MandGroup -- ciscoLwappIdsNotifsGroup END