draft-ietf-imss-fc-fcsp-mib-00.txt   draft-ietf-imss-fc-fcsp-mib-01.txt 
INTERNET-DRAFT C. DeSanti INTERNET-DRAFT C. DeSanti
F. Maino F. Maino
K. McCloghrie K. McCloghrie
Cisco Systems Cisco Systems
13 August 2007 25 February 2008
MIB for Fibre-Channel Security Protocols (FC-SP) MIB for Fibre-Channel Security Protocols (FC-SP)
draft-ietf-imss-fc-fcsp-mib-00.txt draft-ietf-imss-fc-fcsp-mib-01.txt
Status of this Memo Status of this Memo
By submitting this Internet-Draft, each author represents that any By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79. aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
skipping to change at page 2, line 7 skipping to change at page 2, line 7
Abstract Abstract
This memo defines a portion of the Management Information Base (MIB) This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols in the Internet community. for use with network management protocols in the Internet community.
In particular, it describes managed objects for information related In particular, it describes managed objects for information related
to FC-SP, the Security Protocols defined for Fibre Channel. to FC-SP, the Security Protocols defined for Fibre Channel.
Table of Contents Table of Contents
1 Introduction ................................................. 3 replace with TOC 1
1.1 Change Log ................................................. 3 replace with TOC 2
2 The Internet-Standard Management Framework ................... 7 replace with TOC 3
3 Overview of Fibre Channel .................................... 8 replace with TOC 4
3.1 Introduction ............................................... 8 replace with TOC 5
3.2 Zoning ..................................................... 9 replace with TOC 6
3.3 Virtual Fabrics ............................................ 9 replace with TOC 7
3.4 Security ................................................... 10 replace with TOC 8
3.5 Authentication ............................................. 10 replace with TOC 9
3.6 Security Associations ...................................... 11 replace with TOC 10
3.7 Fabric Security Policies ................................... 12 replace with TOC 11
3.8 Policy Model ............................................... 13 replace with TOC 12
3.9 Policy Objects ............................................. 13 replace with TOC 13
3.10 Three Kinds of Switches ................................... 15 replace with TOC 14
3.11 Security Policy Management ................................ 15 replace with TOC 15
3.12 FC-SP Zoning .............................................. 16 replace with TOC 16
4 Document Overview ............................................ 17 replace with TOC 17
4.1 Fibre Channel management instance .......................... 17 replace with TOC 18
4.2 Entity Name ................................................ 17 replace with TOC 19
4.3 Fabric Index ............................................... 18 replace with TOC 20
4.4 Interface Index ............................................ 18 replace with TOC 21
4.5 Syntax for Policy Object Names ............................. 18 replace with TOC 22
4.6 Certificates, CAs and CRLs ................................. 19
4.7 Traffic Selectors .......................................... 20
4.8 The MIB Modules ............................................ 20
4.9 Rate Control for Notifications ............................. 23
5 Relationship to Other MIB Modules ............................ 24
6 MIB Module Definitions ....................................... 26
6.1 The T11-FC-SP-TC-MIB Module ................................ 26
6.2 The T11-FC-SP-AUTHENTICATION-MIB Module .................... 40
6.3 The T11-FC-SP-ZONING-MIB Module ............................ 61
6.4 The T11-FC-SP-POLICY-MIB Module ............................ 74
6.5 The T11-FC-SP-SA-MIB Module ................................ 173
6.6 The T11-FC-SP-CERTS-MIB Module ............................. 230
7 Acknowledgements ............................................. 235
8 Normative References ......................................... 236
9 Informative References ....................................... 238
10 IANA Considerations ......................................... 239
11 Security Considerations ..................................... 240
12 Authors' Addresses .......................................... 248
1. Introduction 1. Introduction
This memo defines a portion of the Management Information Base (MIB) This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols in the Internet community. for use with network management protocols in the Internet community.
In particular, it describes managed objects for information In particular, it describes managed objects for information
concerning the Fibre Channel Security Protocols (FC-SP), as specified concerning the Fibre Channel Security Protocols (FC-SP), as specified
in [FC-SP]. The FC-SP standard includes the definition of protocols in [FC-SP]. The FC-SP standard includes the definition of protocols
to authenticate Fibre Channel entities, protocols to set up session to authenticate Fibre Channel entities, protocols to set up session
keys, protocols to negotiate the parameters required to ensure frame- keys, protocols to negotiate the parameters required to ensure frame-
by-frame integrity and confidentiality, and protocols to establish by-frame integrity and confidentiality, and protocols to establish
and distribute policies across a Fibre Channel Fabric. and distribute policies across a Fibre Channel Fabric.
This memo was initially developed by the INCITS T11 committee This memo was initially developed by the INCITS T11 committee
(http://www.t11.org), which subsequently approved it for forwarding (http://www.t11.org), which subsequently approved it for forwarding
to the IETF. This latest draft has been accepted as a official WG to the IETF. This version of the draft has been updated to reflect
document by the IETF's IMSS working group, with the intent of comments made during the "WG Last Call" period by the IETF's IMSS
progressing it to become an "Intended status: Proposed" Internet working group, with the intent of forwarding it to the IESG for
Standard. approval as an:
"Intended status: Proposed" Internet Standard.
-- RFC Editor: please remove 2nd sentence of above paragraph.
This memo uses one of the following terms: This memo uses one of the following terms:
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
in this document are to be interpreted as described in BCP 14, RFC in this document are to be interpreted as described in BCP 14, RFC
2119 [RFC2119]. 2119 [RFC2119].
1.1. Change Log 1.1. Change Log
skipping to change at page 7, line 36 skipping to change at page 8, line 5
The following changes were made for the version was submitted to IETF The following changes were made for the version was submitted to IETF
on 13 August 2007 as draft-ietf-imss-fc-fcsp-mib-00.txt : on 13 August 2007 as draft-ietf-imss-fc-fcsp-mib-00.txt :
- The Introduction section was changed to reflect the submission of - The Introduction section was changed to reflect the submission of
this memo to the IETF's IMSS Working Group. this memo to the IETF's IMSS Working Group.
- The References section was updated to reflect two recently - The References section was updated to reflect two recently
published RFCs. published RFCs.
1.1.10. 28 November 2007 version
The following changes were made for the version was submitted to the
IMSS WG's mailing-list on 28 November 2007 as a preliminary version
of draft-ietf-imss-fc-fcsp-mib-01.txt :
- Deleted the definition of T11-FC-SP-CERTS-MIB, and all references
to it.
- Changed section 4.6 to say: a) the management of certificates,
Certification Authorities and Certificate Revocation Lists is the
same in Fibre Channel networks as it is in other networks, and b)
that this document assumes that appropriate MIB objects are defined
elsewhere, e.g., in [IPSP-IPSEC-ACTION] and [IPSP-IKE-ACTION].
- Moved [IPSP-IPSEC-ACTION] and [IPSP-IKE-ACTION] to be Informative
references.
- Updated the References section to reflect the publication of RFC
4983.
- Fixed date in T11-FC-SP-TC-MIB's REVISION clause to be the same as
its LAST-UPDATED.
- Fixed inconsistency in syntax of T11FcSaDirection.
- Inserted ranges on Unsigned32 auxiliary objects.
- Minor rewording in the "Rate Control for Notifications" section.
1.1.11. 21 February 2008 version
The following changes were made for the version was created based on
Working Group Last Call comments on 21 February 2008 as ??? draft-
ietf-imss-fc-fcsp-mib-01.txt :
- Wording change to the ORGANIZATION section of all MIB modules.
- Changed T11FcSpAlphaNumNameOrNull to T11FcSpAlphaNumNameOrAbsent.
- Added REFERENCE clauses to OBJECT-IDENTITYs.
- Deleted the definition of t11FcSpSaTSelPropIndex, with
t11FcSpSaTSelPropPrecedence replacing it in the INDEX clause of the
t11FcSpSaTSelPropTable.
- Moved section 3.5 through 3.12 to be sub-sections of section 3.4.
- Re-ordered the top-level OID assignments in T11-FC-SP-
AUTHENTICATION-MIB.
- Changed the syntax of t11FcSpPoSwMembSwitchName,
t11FcSpPoNoMembNodeName, t11FcSpPoNaSwMembSwitchName,
t11FcSpPoNaNoMembNodeName and t11FcSpPoNaSwConnAllowedName to be
consistent.
- Defined T11FcSpSecurityProtocolId as a new TC, and used it for the
several objects which identify an FC-SP "Security Protocol_Id".
- Added a range sub-clause to exclude zero in the values of
t11FcSpSaPairTransListIndex and t11FcSpSaPairTransIndex.
- Defined new TC's for syntax used multiple times:
T11FcSpLifetimeLeft, T11FcSpLifetimeLeftUnits,
T11FcSpHashCalculationStatus and T11FcSpSecurityProtocolId.
- Added SIZE clause to the syntax of t11FcSpPoSwConnAllowedName.
- Added t11FcSpSaControlMaxNotifs as a new object.
- Added t11FcSpSaTSelPropStorageType and t11FcSpSaTransStorageType as
additional StorageType objects for the two tables in the T11-FC-SP-
SA-MIB which are not INDEX-ed by t11FcSpSaIfFabricIndex, i.e., they
have different granularity, and so can not share usage of
t11FcSpSaIfStorageType.
- Many editorial changes and clarifications.
2. The Internet-Standard Management Framework 2. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of Internet-Standard Management Framework, please refer to section 7 of
RFC 3410 [RFC3410]. RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP). accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in STD 58, module that is compliant to the SMIv2, which is described in STD 58,
RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
[RFC2580]. [RFC2580].
3. Overview of Fibre Channel 3. Overview of Fibre Channel
3.1. Introduction 3.1. Introduction
The Fibre Channel (FC) is logically a bidirectional point-to-point Fibre Channel (FC) is logically a bidirectional point-to-point serial
serial data channel, structured for high performance. Fibre Channel data channel, structured for high performance. Fibre Channel
provides a general transport vehicle for higher level protocols such provides a general transport vehicle for higher level protocols such
as Small Computer System Interface (SCSI) command sets, the High- as Small Computer System Interface (SCSI) command sets, the High-
Performance Parallel Interface (HIPPI) data framing, IP (Internet Performance Parallel Interface (HIPPI) data framing, IP (Internet
Protocol), IEEE 802.2, and others. Protocol), IEEE 802.2, and others.
Physically, Fibre Channel is an interconnection of multiple Physically, Fibre Channel is an interconnection of multiple
communication points, called N_Ports, interconnected either by a communication points, called N_Ports, interconnected either by a
switching network, called a Fabric, or by a point-to-point link. A switching network, called a Fabric, or by a point-to-point link. A
Fibre Channel "Node" consists of one or more N_Ports. A Fabric may Fibre Channel "Node" consists of one or more N_Ports. A Fabric may
consist of multiple Interconnect Elements, some of which are consist of multiple Interconnect Elements, some of which are
skipping to change at page 10, line 19 skipping to change at page 12, line 19
describes the protocols used to implement security in a Fibre Channel describes the protocols used to implement security in a Fibre Channel
Fabric, including the definition of: Fabric, including the definition of:
- protocols to authenticate Fibre Channel entities, - protocols to authenticate Fibre Channel entities,
- protocols to set up session keys, - protocols to set up session keys,
- protocols to negotiate the parameters required to ensure frame- - protocols to negotiate the parameters required to ensure frame-
by-frame integrity and confidentiality, and by-frame integrity and confidentiality, and
- protocols to establish and distribute (security) policies across - protocols to establish and distribute (security) policies across
a Fibre Channel Fabric. a Fibre Channel Fabric.
3.5. Authentication 3.4.1. Authentication
Two entities may negotiate whether authentication is required and Two entities may negotiate whether authentication is required and
which Authentication Protocol is to be used. Authentication can be which Authentication Protocol is to be used. Authentication can be
used in Switch to Switch, Node to Switch, and Node to Node used in Switch to Switch, Node to Switch, and Node to Node
communication. The defined Authentication Protocols are able to communication. The defined Authentication Protocols are able to
perform mutual authentication with optional shared key establishment. perform mutual authentication with optional shared key establishment.
The shared key computed at the end of an Authentication Transaction The shared key computed at the end of an Authentication Transaction
may be used to establish Security Associations. may be used to establish Security Associations.
The Fabric security architecture is defined for several The Fabric security architecture is defined for several
skipping to change at page 11, line 23 skipping to change at page 13, line 23
(FCPAP) [FC-SP]. Security Associations may be set up using the (FCPAP) [FC-SP]. Security Associations may be set up using the
session key computed at the end of the FCPAP transaction. session key computed at the end of the FCPAP transaction.
In addition to DH-CHAP, FCAP and FCPAP, one other Authentication In addition to DH-CHAP, FCAP and FCPAP, one other Authentication
Protocol is defined: IKEv2-AUTH, which refers to the use of an SA Protocol is defined: IKEv2-AUTH, which refers to the use of an SA
Management Transaction of the Security Association Management Management Transaction of the Security Association Management
Protocol (see below) to perform two functions: not only SA management Protocol (see below) to perform two functions: not only SA management
but also authentication. The credentials used in an IKEv2-AUTH but also authentication. The credentials used in an IKEv2-AUTH
transaction are either strong shared secrets or certificates. transaction are either strong shared secrets or certificates.
3.6. Security Associations 3.4.2. Security Associations
A subset of the IKEv2 protocol [RFC4306] suitable for Fibre Channel A subset of the IKEv2 protocol [RFC4306] suitable for Fibre Channel
is defined as the (Fibre Channel) Security Association Management is defined as the (Fibre Channel) Security Association Management
protocol [RFC4595]. This protocol provides the means to establish protocol [RFC4595]. This protocol provides the means to establish
Security Associations (SAs) between Fibre Channel entities. Traffic Security Associations (SAs) between Fibre Channel entities. Traffic
Selectors are defined to specify which type of traffic has to be Selectors are defined to specify which type of traffic has to be
protected by which SA, and what the characteristics of the protection protected by which SA, and what the characteristics of the protection
are. Two mechanisms are available to protect specific classes of are. Two mechanisms are available to protect specific classes of
traffic: ESP_Header is used to protect FC-2 frames (see [FC-FS-2] and traffic: ESP_Header is used to protect FC-2 frames (see [FC-FS-2] and
[RFC4303]), and CT_Authentication is used to protect CT_IUs (Common [RFC4303]), and CT_Authentication is used to protect CT_IUs (Common
skipping to change at page 12, line 19 skipping to change at page 14, line 19
bypassed or discarded; and bypassed or discarded; and
- Traffic Selectors entries identifying FC-2 frames or CT_IUs to be - Traffic Selectors entries identifying FC-2 frames or CT_IUs to be
protected or verified. These entries point to the corresponding SA protected or verified. These entries point to the corresponding SA
entry defining the parameters and the security processing to be entry defining the parameters and the security processing to be
performed. performed.
SAs are unidirectional but they always exist as an SA pair of the SAs are unidirectional but they always exist as an SA pair of the
same type, one in each direction. same type, one in each direction.
3.7. Fabric Security Policies 3.4.3. Fabric Security Policies
Two separate approaches to defining Policies are adopted in FC-SP, Two separate approaches to defining Policies are adopted in FC-SP,
but both approaches follow the same general concept for their Policy but both approaches follow the same general concept for their Policy
model. One is the definition of a Policy Model for Fabric Policies model. One is the definition of a Policy Model for Fabric Policies
which focus on Security. These Security Policies specify the which focus on Security. These Security Policies specify the
membership and connectivity allowed within a Fabric, and also which membership and connectivity allowed within a Fabric, and also which
IP hosts are allowed to manage a Fabric. IP hosts are allowed to manage a Fabric.
The other approach is to define a variant of the Enhanced Zoning The other approach is to define a variant of the Enhanced Zoning
model defined in [FC-SW-4] and [FC-GS-5], such that the variant model defined in [FC-SW-4] and [FC-GS-5], such that the variant
specifies extensions for use in a secure environment. This variant specifies extensions for use in a secure environment. This variant
of Zoning, denoted as "FC-SP Zoning", follows the same general of Zoning, denoted as "FC-SP Zoning", follows the same general
concepts of the Policy model for Security Policies, but keeps Zoning concepts of the Policy model for Security Policies, but keeps Zoning
management and enforcement completely independent from the management management and enforcement completely independent from the management
and enforcement of other policies. and enforcement of other policies.
3.8. Policy Model 3.4.4. Policy Model
Figure 25 of [FC-SP] depicts FC-SP's policy management model like Figure 25 of [FC-SP] depicts FC-SP's policy management model like
this: this:
***** ************************ ***** ************************
* * * Policy * ********************* * * * Policy * *********************
* M * Add, * Configuration * * Policy * * M * Add, * Configuration * * Policy *
* A * Get, * Entity * * Enforcement * * A * Get, * Entity * * Enforcement *
* N * Remove * * * Entity * * N * Remove * * * Entity *
* A * Policy * +----------------+ * * * * A * Policy * +----------------+ * * *
skipping to change at page 13, line 32 skipping to change at page 15, line 32
* E *=====================================>* +-------------+ * * E *=====================================>* +-------------+ *
* N * Deactivate Policy Summary * | Policy | * * N * Deactivate Policy Summary * | Policy | *
* T *=====================================>* | Summary | * * T *=====================================>* | Summary | *
* I * * | Object | * * I * * | Object | *
* T * Get Policy Summary * +-------------+ * * T * Get Policy Summary * +-------------+ *
* Y *<-------------------------------------* * * Y *<-------------------------------------* *
* * Get Policy Objects * * * * Get Policy Objects * *
* *<-------------------------------------* * * *<-------------------------------------* *
***** ********************* ***** *********************
3.9. Policy Objects 3.4.5. Policy Objects
The Policies to be enforced by a Fabric are specified in a set of The Policies to be enforced by a Fabric are specified in a set of
Policy Objects. The various types of Policy Objects are: Policy Objects. The various types of Policy Objects are:
- The Policy Summary Object is a list of pointers to other Policy - The Policy Summary Object is a list of pointers to other Policy
Objects, one pointer per each other active Policy Object. Each Objects, one pointer per each other active Policy Object. Each
pointer in a Policy Summary Object is paired with a cryptographic pointer in a Policy Summary Object is paired with a cryptographic
hash of the referenced Policy Object. hash of the referenced Policy Object.
- The Switch Membership List Object is a Fabric-wide Policy Object - The Switch Membership List Object is a Fabric-wide Policy Object
skipping to change at page 14, line 34 skipping to change at page 16, line 34
- zero or more Switch Connectivity Objects, and - zero or more Switch Connectivity Objects, and
- zero or more Attribute Objects. - zero or more Attribute Objects.
The active Policy Objects specify the Policies currently being The active Policy Objects specify the Policies currently being
enforced. In addition, policies not currently being enforced are enforced. In addition, policies not currently being enforced are
contained in non-active Policy Objects. To change the active Policy contained in non-active Policy Objects. To change the active Policy
Objects, the non-active Policy Objects are edited as necessary and a Objects, the non-active Policy Objects are edited as necessary and a
new Policy Summary Object which includes/references the changed new Policy Summary Object which includes/references the changed
Policy Objects is activated. Policy Objects is activated.
3.9.1. Policy Object Names 3.4.5.1. Policy Object Names
Every Policy Object has a name. In a Fabric's database of Policy Every Policy Object has a name. In a Fabric's database of Policy
Objects, a Policy Object Name is specified as a type/length/value Objects, a Policy Object Name is specified as a type/length/value
(see section 7.2 of [FC-SP]). The possible types are: (see section 7.2 of [FC-SP]). The possible types are:
- Node_Name - Node_Name
- Restricted Node_Name - Restricted Node_Name
- Port_Name - Port_Name
- Restricted Port_Name - Restricted Port_Name
- Wildcard - Wildcard
- Negated Wildcard - Negated Wildcard
- Alphanumeric Name - Alphanumeric Name
- IPv6 Address Range - IPv6 Address Range
- IPv4 Address Range - IPv4 Address Range
3.10. Three Kinds of Switches 3.4.6. Three Kinds of Switches
For a Fabric composed of n Switches and m Nodes, the potential For a Fabric composed of n Switches and m Nodes, the potential
complexity of Switch Connectivity Objects is O(n**2) to describe complexity of Switch Connectivity Objects is O(n**2) to describe
Switch to Switch connections, and O(n*m) for Switch to Node Switch to Switch connections, and O(n*m) for Switch to Node
connections. To provide better scaling, the Switch Connectivity connections. To provide better scaling, the Switch Connectivity
Objects are not Fabric-wide information such that they are Objects are not Fabric-wide information, but are distributed only to
distributed only to where they are needed. To support this, the where they are needed. To support this, the policy model supports
policy model supports three kinds of Switches in a Fabric: three kinds of Switches in a Fabric:
- Server Switches, that maintain the Fabric-wide Policy Objects, all - Server Switches, that maintain the Fabric-wide Policy Objects, all
the Switch Connectivity Objects, and a full copy of the FC-SP the Switch Connectivity Objects, and a full copy of the FC-SP
Zoning Database; Zoning Database;
- Autonomous Switches, that maintain the Fabric-wide Policy Objects, - Autonomous Switches, that maintain the Fabric-wide Policy Objects,
their own Switch Connectivity Object, and a full copy of the FC-SP their own Switch Connectivity Object, and a full copy of the FC-SP
Zoning Database; and Zoning Database; and
- Client Switches, that maintain the Fabric-wide Policy Objects, - Client Switches, that maintain the Fabric-wide Policy Objects,
their own Switch Connectivity Object, and a subset of the FC-SP their own Switch Connectivity Object, and a subset of the FC-SP
Active Zone Set. Active Zone Set (which is the configurations of zones currently
being enforced by a Fabric, see section 10.4.3.3 of [FC-SW-4]).
3.11. Security Policy Management 3.4.7. Security Policy Management
Security Policy can be changed in a server session [FC-GS-5] with a Security Policy can be changed in a server session [FC-GS-5] with a
Security Policy Server. All write access to a Security Policy Server Security Policy Server. All write access to a Security Policy Server
occurs within a server session. While read access to a Security occurs within a server session. While read access to a Security
Policy Server may occur at any time, the consistency of the returned Policy Server may occur at any time, the consistency of the returned
data is guaranteed only inside a server session. data is guaranteed only inside a server session.
The Enhanced Commit Service [FC-SW-4] is used to perform Fabric The Enhanced Commit Service [FC-SW-4] is used to perform Fabric
operations as and when necessary (see table 144 of [FC-SP]). Each operations as and when necessary (see table 144 of [FC-SP]). Each
server session begins and ends, with a SSB request and a SSE request server session begins and ends, with a SSB request and a SSE request
respectively, sent to a Security Policy Server. In the Fabric, the respectively, sent to a Security Policy Server. In the Fabric, the
SSB requests a lock of the Fabric via an EACA SW_ILS, while the SSE SSB requests a lock of the Fabric via an EACA SW_ILS, while the SSE
requests a release of the lock via the ERCA SW_ILS [FC-SW-4]. Active requests a release of the lock via the ERCA SW_ILS [FC-SW-4]. Active
and non-active Policy Objects are persistent in that they survive and non-active Policy Objects are persistent in that they survive
after the end of a server session. after the end of a server session.
3.12. FC-SP Zoning 3.4.8. FC-SP Zoning
To preserve backward compatibility with existing Zoning definitions To preserve backward compatibility with existing Zoning definitions
and implementations, FC-SP Zoning is defined as a variant of the and implementations, FC-SP Zoning is defined as a variant of the
Enhanced Zoning model defined in [FC-SW-4] and [FC-GS-5] that follows Enhanced Zoning model defined in [FC-SW-4] and [FC-GS-5] that follows
the general concepts of the Policy model for Security Policy the general concepts of the Policy model for Security Policy
Management, but keeps Zoning management and enforcement completely Management, but keeps Zoning management and enforcement completely
independent. independent.
FC-SP Zoning allows for some Switches to retain less than a complete FC-SP Zoning allows for some Switches to retain less than a complete
replicated copy of the Zoning Database, as follows: replicated copy of the Zoning Database, as follows:
skipping to change at page 17, line 7 skipping to change at page 19, line 7
through the Security Policy Server. A new Zoning Check Protocol through the Security Policy Server. A new Zoning Check Protocol
replaces the Zone Merge Protocol [FC-SW-4], and new command codes are replaces the Zone Merge Protocol [FC-SW-4], and new command codes are
defined for the SFC SW_ILS to distribute the FC-SP Zoning defined for the SFC SW_ILS to distribute the FC-SP Zoning
configuration on a Fabric. The Zoning definitions are ordered to configuration on a Fabric. The Zoning definitions are ordered to
allow for the computation of a hash of the Active Zone Set and a hash allow for the computation of a hash of the Active Zone Set and a hash
of the Zone Set Database, plus other optional security data (e.g., of the Zone Set Database, plus other optional security data (e.g.,
for integrity protection of Zoning information). for integrity protection of Zoning information).
4. Document Overview 4. Document Overview
This document defines six MIB modules which together provide the This document defines five MIB modules which together provide the
means for monitoring the operation of, and configuring some means for monitoring the operation of, and configuring some
parameters of, one or more instances of the FC-SP protocols. parameters of, one or more instances of the FC-SP protocols.
4.1. Fibre Channel management instance 4.1. Fibre Channel management instance
A Fibre Channel management instance is defined in [RFC4044] as a A Fibre Channel management instance is defined in [RFC4044] as a
separable managed instance of Fibre Channel functionality. Fibre separable managed instance of Fibre Channel functionality. Fibre
Channel functionality may be grouped into Fibre Channel management Channel functionality may be grouped into Fibre Channel management
instances in whatever way is most convenient for the instances in whatever way is most convenient for the
implementation(s). For example, one such grouping accommodates a implementation(s). For example, one such grouping accommodates a
skipping to change at page 19, line 44 skipping to change at page 21, line 44
certificate of the associated Certification Authority. certificate of the associated Certification Authority.
FCAP requires entities to support at least four Root Certificates FCAP requires entities to support at least four Root Certificates
against which received corresponding certificates can be validated. against which received corresponding certificates can be validated.
Support for certificate chains and verification of certificate chains Support for certificate chains and verification of certificate chains
containing more than one certificate is optional. Entities need to containing more than one certificate is optional. Entities need to
be able to access a Certificate Revocation List (CRL) for each be able to access a Certificate Revocation List (CRL) for each
configured Root Certificate, if one is available from the CA. configured Root Certificate, if one is available from the CA.
Certificates on the CRL are considered invalid. Certificates on the CRL are considered invalid.
Only a few MIB objects are defined in this document to support The management of certificates, Certification Authorities and
certificates, Certification Authorities and Certificate Revocation Certificate Revocation Lists is the same in Fibre Channel networks as
Lists. This is because there is very little about the management of it is in other networks. Therefore, this document does not define
them which is Fibre Channel-specific. Instead, this document any MIB objects for such management. Instead, this document assumes
leverages the MIB tables defined in [IPSP-IPSEC-ACTION} and [IPSP- that appropriate MIB objects are defined elsewhere, e.g., in [IPSP-
IKE-ACTION}. Specifically, the ipsaCredentialTable and the IPSEC-ACTION] and [IPSP-IKE-ACTION].
ipsaCredentialSegmentTable defined in [IPSP-IPSEC-ACTION} provide for
the management of certificates; the ipiaIpsecCredMngServiceTable and -- RFC Editor: at the future time when you edit this document, if
the ipiaCredMngCRLTable defined in [IPSP-IKE-ACTION} provide for the these
management of CAs and CRLs. -- two references are problematic, please delete the "e.g., ..." and
-- remove the references from the Informative References section.
4.7. Traffic Selectors 4.7. Traffic Selectors
When Traffic Selectors are compared against an ingress or egress When Traffic Selectors are compared against an ingress or egress
frame in order to determine the security processing to be applied to frame in order to determine the security processing to be applied to
that frame, there are circumstances in which multiple Traffic that frame, there are circumstances in which multiple Traffic
Selectors, specifying different actions, can match with the frame; Selectors, specifying different actions, can match with the frame.
specifically, when matching against an egress frame to decide which Specifically, when matching against an egress frame to decide which
active Security Association to transmit on, or, against an ingress active Security Association to transmit on, or, against an ingress
frame unprotected by FC-SP, i.e., without an SPI value in it, to frame unprotected by FC-SP, i.e., without an SPI value in it, to
decide which action ('drop' or 'bypass') to apply. For these cases, decide which action ('drop' or 'bypass') to apply. For these cases,
the MIB includes a precedence value for each Traffic Selector such the MIB includes a unique precedence value for each Traffic Selector
that the one with the numerically lowest precedence value is such that the one with the numerically lowest precedence value is
determined to be the one that matches. In contrast, ingress frames determined to be the one that matches. In contrast, ingress frames
on active Security Associations (i.e., protected by FC-SP) are on active Security Associations (i.e., protected by FC-SP) are
compared against the set of traffic selectors negotiated when the compared against the set of traffic selectors negotiated when the
Security Association was setup and identified by the SPI value Security Association was setup and identified by the SPI value
contained in the frame; the action taken depends on whether any contained in the frame; the action taken depends on whether any
Traffic Selector matches, but not on which one. Traffic Selector matches, but not on which one.
This difference between ingress and egress Traffic Selectors on This difference between ingress and egress Traffic Selectors on
active Security Associations is reflected in having separate MIB active Security Associations is reflected in having separate MIB
tables defined for them: the table for Traffic Selectors on egress tables defined for them: the table for Traffic Selectors on egress
skipping to change at page 23, line 25 skipping to change at page 25, line 25
based on its (ingress) SPI value; based on its (ingress) SPI value;
- a table, t11FcSpSaControlTable, of control and other information - a table, t11FcSpSaControlTable, of control and other information
concerning the generation of notifications for events related to concerning the generation of notifications for events related to
FC-SP Security Associations; FC-SP Security Associations;
- one notification, t11FcSpSaNotifyAuthFailure, generated on the - one notification, t11FcSpSaNotifyAuthFailure, generated on the
occurrence of an Authentication failure for a received FC-2 or occurrence of an Authentication failure for a received FC-2 or
CT_IU frame. CT_IU frame.
4.8.6. The T11-FC-SP-CERTS-MIB Module
This MIB module specifies extensions to IPSP MIBs [IPSP-IPSEC-ACTION]
and [IPSP-IKE-ACTION] which are specific to Fibre Channel. In
particular, it specifies one table, t11FcSpCertsTable, with a row per
certificate indicating how that certificate is being used, and
containing the "name" of the certificate. This "name" can be used to
obtain information, which is independent of FC-SP, about the
certificate from the ipsaCredentialTable (and from the
ipsaCredentialSegmentTable if the certificate is longer than 1024
bytes).
4.9. Rate Control for Notifications 4.9. Rate Control for Notifications
All but one of the notifications defined in the six MIB modules in All but one of the notifications defined in the five MIB modules in
this document are notifications which are generated based on events this document are notifications which are generated based on events
occurring in the "control plane", e.g., notifications which are occurring in the "control plane", e.g., notifications which are
generated at the frequency of operator-initiated activities. The one generated at the frequency of operator-initiated activities. The one
exception is t11FcSpSaNotifyAuthFailure, which is generated based on exception is t11FcSpSaNotifyAuthFailure, which is generated based on
an event occurring in the "data plane", and could (in a worst case an event occurring in the "data plane", and could (in a worst case
scenario) occur for every received ingress frame. Therefore, a scenario) occur for every received ingress frame. Therefore, a
method of rate controlling the generation of notifications is needed method of rate controlling the generation of notifications is needed
for t11FcSpSaNotifyAuthFailure, but not for any of the other for t11FcSpSaNotifyAuthFailure, but not for any of the other
notifications. notifications.
For t11FcSpSaNotifyAuthFailure, rate control is achieved by For t11FcSpSaNotifyAuthFailure, rate control is achieved by
specifying that it is generated only for the first occurrence of an specifying that a) after the first occurrence of an Authentication
Authentication failure on a particular Fabric within a time window. failure on any particular Security Association, the SNMP
Subsequent occurrences of an Authentication Failure on the same notifications for second and subsequent failures are suppressed for
Fabric within the same time window are counted but the generation and the duration of a time window, and b) that even the notification for
transmission of SNMP notifications for them is suppressed. the first occurrence is suppressed after it is sent in the same time
window for a configured (in t11FcSpSaControlMaxNotifs) number of
Security Associations within a Fabric. Note that while these
suppressions prevent the the network being flooded with
notifications, the Authentication Failures themselves must still be
detected and counted.
The length of the time window is given by t11FcSpSaControlWindow, a The length of the time window is given by t11FcSpSaControlWindow, a
read-write object in the t11FcSpSaControlTable. If the last read-write object in the t11FcSpSaControlTable. If and when the time
generation of the notification occurred more recently than the value since the last generation of the notification is less than the value
of sysUpTime (i.e., since the last re-initialization of the of sysUpTime (e.g., if one or more notifications have occurred since
management system), then t11FcSpSaControlElapsed and the last re-initialization of the management system), then
t11FcSpSaControlSuppressed contain the elapsed time since the last t11FcSpSaControlElapsed and t11FcSpSaControlSuppressed contain the
notification and the number of notifications suppressed in the window elapsed time since the last notification and the number of
after sending the last one, respectively. Otherwise, notifications suppressed in the window after sending the last one,
t11FcSpSaControlElapsed contains the value of sysUpTime and respectively. Otherwise, t11FcSpSaControlElapsed contains the value
t11FcSpSaControlSuppressed has the value zero. of sysUpTime and t11FcSpSaControlSuppressed has the value zero.
5. Relationship to Other MIB Modules 5. Relationship to Other MIB Modules
The first standardized MIB module for Fibre Channel [RFC2837] was The first standardized MIB module for Fibre Channel [RFC2837] was
focussed on Fibre Channel Switches. It was obsoleted by the more focussed on Fibre Channel Switches. It was obsoleted by the more
generic Fibre Channel Management MIB [RFC4044] which defines basic generic Fibre Channel Management MIB [RFC4044] which defines basic
information for Fibre Channel Nodes and Switches, including information for Fibre Channel Nodes and Switches, including
extensions to the standard IF-MIB [RFC2863] for Fibre Channel extensions to the standard IF-MIB [RFC2863] for Fibre Channel
interfaces. Several other MIB modules have since been defined to interfaces. Several other MIB modules have since been defined to
extend [RFC4044] for various specific Fibre Channel functionality, extend [RFC4044] for various specific Fibre Channel functionality,
(e.g., [RFC4438], [RFC4439], [RFC4625], [RFC4626], [RFC4747], (e.g., [RFC4438], [RFC4439], [RFC4625], [RFC4626], [RFC4747],
[RFC4936], [FC-RSCN-MIB], [RFC4935]). [RFC4936], [RFC4935], [RFC4983]).
The MIB modules defined in this memo further extend [RFC4044] to The MIB modules defined in this memo further extend [RFC4044] to
cover the operation of Fibre Channel Security Protocols, as specified cover the operation of Fibre Channel Security Protocols, as specified
in [FC-SP]. in [FC-SP].
One part of the FC-SP specification is "FC-SP Zoning" which is an One part of the FC-SP specification is "FC-SP Zoning" which is an
extension/variant of the Fibre Channel Zoning defined in [FC-GS-5]. extension/variant of the Fibre Channel Zoning defined in [FC-GS-5].
Management information for the latter is defined in the T11-FC-ZONE- Management information for the latter is defined in the T11-FC-ZONE-
SERVER-MIB module [RFC4936]. Consequently, the T11-FC-SP-ZONING-MIB SERVER-MIB module [RFC4936]. Consequently, the T11-FC-SP-ZONING-MIB
module defined in this document defines the extensions to the T11-FC- module defined in this document defines the extensions to the T11-FC-
ZONE-SERVER-MIB module which are needed to manage FC-SP Zoning. ZONE-SERVER-MIB module which are needed to manage FC-SP Zoning.
The MIB modules in this memo import some common Textual Conventions The MIB modules in this memo import some common Textual Conventions
from T11-TC-MIB defined in [RFC4439] and from INET-ADDRESS-MIB from T11-TC-MIB defined in [RFC4439] and from INET-ADDRESS-MIB
defined in [RFC4001]. defined in [RFC4001].
The T11-FC-SP-CERTS-MIB module leverages [IPSP-IPSEC-ACTION] and
[IPSP-IKE-ACTION] for the management of certificates, CAs and CRLs.
If the RADIUS protocol is used for access to an external server, If the RADIUS protocol is used for access to an external server,
information about RADIUS Servers is likely to be available from the information about RADIUS Servers is likely to be available from the
RADIUS-AUTH-CLIENT-MIB [RFC4668]. RADIUS-AUTH-CLIENT-MIB [RFC4668].
6. MIB Module Definitions 6. MIB Module Definitions
6.1. The T11-FC-SP-TC-MIB Module 6.1. The T11-FC-SP-TC-MIB Module
T11-FC-SP-TC-MIB DEFINITIONS ::= BEGIN T11-FC-SP-TC-MIB DEFINITIONS ::= BEGIN
IMPORTS IMPORTS
MODULE-IDENTITY, OBJECT-IDENTITY, mib-2, MODULE-IDENTITY, OBJECT-IDENTITY, mib-2,
Unsigned32 FROM SNMPv2-SMI -- [RFC2578] Unsigned32 FROM SNMPv2-SMI -- [RFC2578]
TEXTUAL-CONVENTION FROM SNMPv2-TC; -- [RFC2579] TEXTUAL-CONVENTION FROM SNMPv2-TC; -- [RFC2579]
t11FcTcMIB MODULE-IDENTITY t11FcTcMIB MODULE-IDENTITY
LAST-UPDATED "200708130000Z" LAST-UPDATED "200801030000Z"
ORGANIZATION "For the initial versions, T11. ORGANIZATION "This MIB module was developed through the
For later versions, the IETF's IMSS Working Group." coordinated effort of two organizations:
T11 began the development and the IETF's IMSS
Working Group finished it."
CONTACT-INFO CONTACT-INFO
" Claudio DeSanti " Claudio DeSanti
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
EMail: cds@cisco.com EMail: cds@cisco.com
Keith McCloghrie Keith McCloghrie
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
skipping to change at page 26, line 43 skipping to change at page 27, line 45
"This MIB module defines Textual Conventions for use in "This MIB module defines Textual Conventions for use in
the multiple MIB modules which together define the the multiple MIB modules which together define the
instrumentation for an implementation of the Fibre Channel instrumentation for an implementation of the Fibre Channel
Security Protocols (FC-SP) specification. Security Protocols (FC-SP) specification.
This MIB module also defines Object Identities (for use as This MIB module also defines Object Identities (for use as
possible values of MIB objects with syntax AutonomousType), possible values of MIB objects with syntax AutonomousType),
including OIDs for the Cryptographic Algorithms defined including OIDs for the Cryptographic Algorithms defined
in FC-SP. in FC-SP.
Copyright (C) The IETF Trust (2007). This version Copyright (C) The IETF Trust (2008). This version
of this MIB module is part of RFC yyyy; see the RFC of this MIB module is part of RFC yyyy; see the RFC
itself for full legal notices." itself for full legal notices."
-- RFC Editor: replace yyyy with actual RFC number & remove this note -- RFC Editor: replace yyyy with actual RFC number & remove this note
REVISION "200702190000Z" REVISION "200801030000Z"
DESCRIPTION DESCRIPTION
"Initial version of this MIB module, published as RFCyyyy." "Initial version of this MIB module, published as RFCyyyy."
-- RFC-Editor, replace yyyy with actual RFC number & remove this note -- RFC-Editor, replace yyyy with actual RFC number & remove this note
::= { mib-2 nnn } -- to be assigned by IANA ::= { mib-2 nnn } -- to be assigned by IANA
-- RFC Editor: replace nnn with IANA-assigned number & remove this note -- RFC Editor: replace nnn with IANA-assigned number & remove this note
t11FcSpIdentities OBJECT IDENTIFIER ::= { t11FcTcMIB 1 } t11FcSpIdentities OBJECT IDENTIFIER ::= { t11FcTcMIB 1 }
t11FcSpAlgorithms OBJECT IDENTIFIER ::= { t11FcSpIdentities 1 } t11FcSpAlgorithms OBJECT IDENTIFIER ::= { t11FcSpIdentities 1 }
-- --
skipping to change at page 27, line 38 skipping to change at page 28, line 38
The first two cryptographic hash functions are: The first two cryptographic hash functions are:
Hash Type Hash Tag Hash Length (Bytes) Hash Type Hash Tag Hash Length (Bytes)
SHA-1 '00000001'h 20 SHA-1 '00000001'h 20
SHA-256 '00000002'h 32 SHA-256 '00000002'h 32
" "
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 7.1.3.1. 13 June 2006, section 7.1.3.1 and table 106.
- FIPS PUB 180-2." - FIPS PUB 180-2."
SYNTAX OCTET STRING (SIZE (4)) SYNTAX OCTET STRING (SIZE (4))
T11FcSpPolicyHashValue ::= TEXTUAL-CONVENTION T11FcSpPolicyHashValue ::= TEXTUAL-CONVENTION
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Represents the value of the cryptographic hash function "Represents the value of the cryptographic hash function
of an FC-SP Policy Object. of an FC-SP Policy Object.
Each definition of an object with this TC as its syntax Each definition of an object with this TC as its syntax
must be accompanied by a corresponding definition of an must be accompanied by a corresponding definition of an
object with T11FcSpPolicyHashFormat as its syntax. object with T11FcSpPolicyHashFormat as its syntax.
The corresponding object identifies the cryptographic The corresponding object identifies the cryptographic
hash function used to create the hash value." hash function used to create the hash value."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 7.1.3.1." 13 June 2006, section 7.1.3.1 and table 106."
SYNTAX OCTET STRING (SIZE (0..64)) SYNTAX OCTET STRING (SIZE (0..64))
T11FcSpHashCalculationStatus ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"When some kind of 'database' is defined in a set of
read-write MIB objects, it is common that multiple changes
in the data need to be made at the same time. So, if hash
values are maintained for that data, those hash values are
only correct if and when they are re-calculated after every
change. In such circumstances, the use of an object with
this syntax allows the re-calculation of the hash values to
be deferred until all changes have been made and therefore
the calculation need only be done once after all changes,
rather than repeatedly/after each individual change.
The definition of an object defined using this TC is
required to specify which one or more instances of which
MIB objects contain the hash values operated upon (or
whose status is given) by the value of this TC.
When read, the value of an object with this syntax is
either:
correct -- the identified MIB object instance(s)
contain the correct hash values; or
stale -- the identified MIB object instance(s)
contain stale (possibly incorrect) values.
Writing a value of 'calculate' is a request to re-calculate
and update the values of the corresponding instances of the
the identified MIB objects. Writing a value of 'correct' or
'stale' to this object is an error ('wrongValue')."
SYNTAX INTEGER {
calculate(1),
correct(2),
stale(3)
}
T11FcSpAuthRejectReasonCode ::= TEXTUAL-CONVENTION T11FcSpAuthRejectReasonCode ::= TEXTUAL-CONVENTION
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A reason code contained in an AUTH_Reject message, or "A reason code contained in an AUTH_Reject message, or
in an SW_RJT (rejecting an AUTH_ILS), or in an LS_RJT in an SW_RJT (rejecting an AUTH_ILS), or in an LS_RJT
(rejecting an AUTH-ELS)." (rejecting an AUTH-ELS)."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 17, 48, 52." 13 June 2006, Table 17, 48, 52."
skipping to change at page 31, line 36 skipping to change at page 33, line 18
"The format and usage of a companion object having "The format and usage of a companion object having
T11FcSpPolicyName as its syntax. T11FcSpPolicyName as its syntax.
Six of the values indicate the same format, i.e., they Six of the values indicate the same format, i.e., they
differ only in semantics. That common format is a Fibre differ only in semantics. That common format is a Fibre
Channel 'Name_Identifier', i.e., the same syntax as Channel 'Name_Identifier', i.e., the same syntax as
'FcNameIdOrZero (SIZE(8))'. 'FcNameIdOrZero (SIZE(8))'.
These six are three pairs of one restricted and one These six are three pairs of one restricted and one
unrestricted. Each usage of this syntax must specify unrestricted. Each usage of this syntax must specify
whether restricted names are allowed, and if so, how the what the meaning of "restricted" is for that usage, and
usage of restricted names differ from unrestricted names. how the characteristics and behavior of restricted
names differ from unrestricted names.
The six are: The six are:
'nodeName' - a Node_Name, which is the 'nodeName' - a Node_Name, which is the
Name_Identifier associated Name_Identifier associated
with a Fibre Channel Node. with a Fibre Channel Node.
'restrictedNodeName' - a Restricted Node_Name. 'restrictedNodeName' - a Restricted Node_Name.
'portName' - the Name_Identifier associated 'portName' - the Name_Identifier associated
skipping to change at page 34, line 5 skipping to change at page 35, line 20
specified by: specified by:
T11FcSpPolicyNameType = 'alphaNumericName' T11FcSpPolicyNameType = 'alphaNumericName'
" "
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 103." 13 June 2006, Table 103."
SYNTAX OCTET STRING (SIZE (1..64)) SYNTAX OCTET STRING (SIZE (1..64))
T11FcSpAlphaNumNameOrNull ::= TEXTUAL-CONVENTION T11FcSpAlphaNumNameOrAbsent ::= TEXTUAL-CONVENTION
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An extension of the T11FcSpAlphaNumName TC which "An extension of the T11FcSpAlphaNumName TC which
one additional possible value: the zero-length string one additional possible value: the zero-length string
to indicate the absence of a name." to indicate the absence of a name."
SYNTAX OCTET STRING (SIZE (0..64)) SYNTAX OCTET STRING (SIZE (0..64))
T11FcSaDirection ::= TEXTUAL-CONVENTION T11FcSaDirection ::= TEXTUAL-CONVENTION
STATUS current STATUS current
DESCRIPTION DESCRIPTION
skipping to change at page 34, line 35 skipping to change at page 36, line 18
"An SPI (Security Parameter Index) value is carried in the "An SPI (Security Parameter Index) value is carried in the
SPI field of a frame protected by the ESP_Header. An SPI SPI field of a frame protected by the ESP_Header. An SPI
is also carried in the SAID field of a Common Transport is also carried in the SAID field of a Common Transport
Information Unit (CT_IU) protected by CT_Authentication. Information Unit (CT_IU) protected by CT_Authentication.
An SPI value identifies the Security Association on which An SPI value identifies the Security Association on which
the frame is being transmitted." the frame is being transmitted."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 4.7.2 and 4.7.3." 13 June 2006, section 4.7.2 and 4.7.3."
SYNTAX Unsigned32 -- the default range: (0..4294967295) SYNTAX Unsigned32 (0..4294967295) -- the default range!!
T11FcSpPrecedence ::= TEXTUAL-CONVENTION T11FcSpPrecedence ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d" DISPLAY-HINT "d"
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The precedence of a Traffic Selector. If a frame "The precedence of a Traffic Selector. If a frame
matches with two or more Traffic Selectors, then the match matches with two or more Traffic Selectors, then the match
which takes precedence is the one with the Traffic Selector which takes precedence is the one with the Traffic Selector
having the numerically smallest precedence value. Note that having the numerically smallest precedence value. Note that
precedence values are not necessarily contiguous." precedence values are not necessarily contiguous."
SYNTAX Unsigned32 -- the default range: (0..4294967295) SYNTAX Unsigned32 (0..4294967295) -- the default range!!
T11FcRoutingControl ::= TEXTUAL-CONVENTION T11FcRoutingControl ::= TEXTUAL-CONVENTION
DISPLAY-HINT "1x" DISPLAY-HINT "1x"
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A value stored in the R_CTL (Routing Control) 8-bit field "A value stored in the R_CTL (Routing Control) 8-bit field
of an FC-2 frame containing routing and information bits to of an FC-2 frame containing routing and information bits to
categorize the frame function. categorize the frame function.
For FC-2 frames, an R_CTL value typically distinguishes For FC-2 frames, an R_CTL value typically distinguishes
skipping to change at page 37, line 13 skipping to change at page 38, line 14
SYNTAX OCTET STRING (SIZE(2)) SYNTAX OCTET STRING (SIZE(2))
T11FcSpTransforms ::= TEXTUAL-CONVENTION T11FcSpTransforms ::= TEXTUAL-CONVENTION
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A list of the standardized transforms which are defined "A list of the standardized transforms which are defined
by FC-SP for use with ESP_Header, CT_Authentication and/or by FC-SP for use with ESP_Header, CT_Authentication and/or
IKEv2 Support." IKEv2 Support."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
13 June 2006, Appendix A.3.1, tables A.23, A.24, A.25, A.26." Appendix A.3.1, tables A.23, A.24, A.25, A.26."
SYNTAX BITS { SYNTAX BITS {
encrNull(0), encrNull(0),
encrAesCbc(1), encrAesCbc(1),
encrAesCtr(2), encrAesCtr(2),
encrAesGcm(3), encrAesGcm(3),
encr3Des(4), encr3Des(4),
prfHmacMd5(5), prfHmacMd5(5),
prfHmacSha1(6), prfHmacSha1(6),
prfAesCbc(7), prfAesCbc(7),
authHmacMd5L96(8), authHmacMd5L96(8),
authHmacSha1L96(9), authHmacSha1L96(9),
authHmacMd5L128(10), authHmacMd5L128(10),
authHmacSha1L160(11), authHmacSha1L160(11),
encrNullAuthAesGmac(12), encrNullAuthAesGmac(12),
dhGroups1024bit(13), dhGroups1024bit(13),
dhGroups2048bit(14) dhGroups2048bit(14)
} }
T11FcSpSecurityProtocolId ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A Security Protocol identifier to identify
the protocol by which traffic is to be protected,
e.g., ESP_Header or CT_Authentication."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.3.2.2 and table 67."
SYNTAX INTEGER { espHeader(1), ctAuth(2) }
T11FcSpLifetimeLeft ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"This TC is used for one object of an associated pair
of objects. The object with this syntax specifies a
remaining lifetime of something, e.g., of an SA, where
the lifetime is given in the units specified by the other
object of the pair which has T11FcSpLifetimeLeftUnits
as its syntax."
SYNTAX Unsigned32
T11FcSpLifetimeLeftUnits ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"An object, defined using T11FcSpLifetimeLeft TC as
its syntax, is required to be one of an associated
pair of objects such that the other object of the pair
is defined with this T11FcSpLifetimeLeftUnits TC as
its syntax and with its value specifying the
units of the remaining lifetime given by the
value of the T11FcSpLifetimeLeft object."
SYNTAX INTEGER {
seconds(1), -- seconds
kiloBytes(2), -- 10^^3 bytes
megaBytes(3), -- 10^^6 bytes
gigaBytes(4), -- 10^^9 bytes
teraBytes(5), -- 10^^12 bytes
petaBytes(6), -- 10^^15 bytes
exaBytes(7), -- 10^^18 bytes
zettaBytes(8), -- 10^^21 bytes
yottaBytes(9) -- 10^^24 bytes
}
-- --
-- Object Identities to identify the Cryptographic Algorithms -- Object Identities to identify the Cryptographic Algorithms
-- listed in FC-SP. -- listed in FC-SP.
-- --
t11FcSpEncryptAlgorithms t11FcSpEncryptAlgorithms
OBJECT IDENTIFIER ::= { t11FcSpAlgorithms 1 } OBJECT IDENTIFIER ::= { t11FcSpAlgorithms 1 }
t11FcSpEncrNull OBJECT-IDENTITY t11FcSpEncrNull OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The ENCR_NULL algorithm." DESCRIPTION "The ENCR_NULL algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 70."
::= { t11FcSpEncryptAlgorithms 1 } ::= { t11FcSpEncryptAlgorithms 1 }
t11FcSpEncrAesCbc OBJECT-IDENTITY t11FcSpEncrAesCbc OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The ENCR_AES_CBC algorithm." DESCRIPTION "The ENCR_AES_CBC algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 70."
::= { t11FcSpEncryptAlgorithms 2 } ::= { t11FcSpEncryptAlgorithms 2 }
t11FcSpEncrAesCtr OBJECT-IDENTITY t11FcSpEncrAesCtr OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The ENCR_AES_CTR algorithm." DESCRIPTION "The ENCR_AES_CTR algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 70."
::= { t11FcSpEncryptAlgorithms 3 } ::= { t11FcSpEncryptAlgorithms 3 }
t11FcSpEncrAesGcm OBJECT-IDENTITY t11FcSpEncrAesGcm OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The ENCR_AES_GCM algorithm." DESCRIPTION "The ENCR_AES_GCM algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 70."
::= { t11FcSpEncryptAlgorithms 4 } ::= { t11FcSpEncryptAlgorithms 4 }
t11FcSpEncr3Des OBJECT-IDENTITY t11FcSpEncr3Des OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The ENCR_3DES algorithm." DESCRIPTION "The ENCR_3DES algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 70."
::= { t11FcSpEncryptAlgorithms 5 } ::= { t11FcSpEncryptAlgorithms 5 }
t11FcSpAuthAlgorithms t11FcSpAuthAlgorithms
OBJECT IDENTIFIER ::= { t11FcSpAlgorithms 2 } OBJECT IDENTIFIER ::= { t11FcSpAlgorithms 2 }
t11FcSpAuthNull OBJECT-IDENTITY t11FcSpAuthNull OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The AUTH_NONE algorithm." DESCRIPTION "The AUTH_NONE algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 72."
::= { t11FcSpAuthAlgorithms 1 } ::= { t11FcSpAuthAlgorithms 1 }
t11FcSpAuthHmacMd5L96 OBJECT-IDENTITY t11FcSpAuthHmacMd5L96 OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The AUTH_HMAC_MD5_96 algorithm." DESCRIPTION "The AUTH_HMAC_MD5_96 algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 72."
::= { t11FcSpAuthAlgorithms 2 } ::= { t11FcSpAuthAlgorithms 2 }
t11FcSpAuthHmacSha1L96 OBJECT-IDENTITY t11FcSpAuthHmacSha1L96 OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The AUTH_HMAC_SHA1_96 algorithm." DESCRIPTION "The AUTH_HMAC_SHA1_96 algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 72."
::= { t11FcSpAuthAlgorithms 3 } ::= { t11FcSpAuthAlgorithms 3 }
t11FcSpAuthHmacMd5L128 OBJECT-IDENTITY t11FcSpAuthHmacMd5L128 OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The AUTH_HMAC_MD5_128 algorithm." DESCRIPTION "The AUTH_HMAC_MD5_128 algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 72."
::= { t11FcSpAuthAlgorithms 4 } ::= { t11FcSpAuthAlgorithms 4 }
t11FcSpAuthHmacSha1L160 OBJECT-IDENTITY t11FcSpAuthHmacSha1L160 OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The AUTH_HMAC_SHA1_160 algorithm." DESCRIPTION "The AUTH_HMAC_SHA1_160 algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 72."
::= { t11FcSpAuthAlgorithms 5 } ::= { t11FcSpAuthAlgorithms 5 }
t11FcSpEncrNullAuthAesGmac OBJECT-IDENTITY t11FcSpEncrNullAuthAesGmac OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The ENCR_NULL_AUTH_AES_GMAC algorithm." DESCRIPTION "The ENCR_NULL_AUTH_AES_GMAC algorithm."
REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, Table 70."
::= { t11FcSpEncryptAlgorithms 6 } ::= { t11FcSpEncryptAlgorithms 6 }
END END
6.2. The T11-FC-SP-AUTHENTICATION-MIB Module 6.2. The T11-FC-SP-AUTHENTICATION-MIB Module
--******************************************************************** --********************************************************************
-- FC-SP Authentication Protocols -- FC-SP Authentication Protocols
-- --
skipping to change at page 40, line 32 skipping to change at page 43, line 32
TruthValue, TimeStamp FROM SNMPv2-TC -- [RFC2579] TruthValue, TimeStamp FROM SNMPv2-TC -- [RFC2579]
InterfaceIndex FROM IF-MIB -- [RFC2863] InterfaceIndex FROM IF-MIB -- [RFC2863]
fcmInstanceIndex, fcmInstanceIndex,
FcNameIdOrZero FROM FC-MGMT-MIB -- [RFC4044] FcNameIdOrZero FROM FC-MGMT-MIB -- [RFC4044]
t11FamLocalSwitchWwn t11FamLocalSwitchWwn
FROM T11-FC-FABRIC-ADDR-MGR-MIB -- [RFC4439] FROM T11-FC-FABRIC-ADDR-MGR-MIB -- [RFC4439]
T11FabricIndex FROM T11-TC-MIB -- [RFC4439] T11FabricIndex FROM T11-TC-MIB -- [RFC4439]
T11FcSpDhGroups, T11FcSpDhGroups,
T11FcSpHashFunctions, T11FcSpHashFunctions,
T11FcSpSignFunctions, T11FcSpSignFunctions,
T11FcSpLifetimeLeft,
T11FcSpLifetimeLeftUnits,
T11FcSpAuthRejectReasonCode, T11FcSpAuthRejectReasonCode,
T11FcSpAuthRejReasonCodeExp FROM T11-FC-SP-TC-MIB; T11FcSpAuthRejReasonCodeExp FROM T11-FC-SP-TC-MIB;
t11FcSpAuthenticationMIB MODULE-IDENTITY t11FcSpAuthenticationMIB MODULE-IDENTITY
LAST-UPDATED "200702190000Z" LAST-UPDATED "200801030000Z"
ORGANIZATION "T11" ORGANIZATION "This MIB module was developed through the
coordinated effort of two organizations:
T11 began the development and the IETF's IMSS
Working Group finished it."
CONTACT-INFO CONTACT-INFO
" Claudio DeSanti " Claudio DeSanti
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
EMail: cds@cisco.com EMail: cds@cisco.com
Keith McCloghrie Keith McCloghrie
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
Email: kzm@cisco.com" Email: kzm@cisco.com"
DESCRIPTION DESCRIPTION
"This MIB module specifies the management information "This MIB module specifies the management information
required to manage the Authentication Protocols defined by required to manage the Authentication Protocols defined by
Fibre Channel's FC-SP specification. Fibre Channel's FC-SP specification.
skipping to change at page 41, line 24 skipping to change at page 44, line 28
Authentication Protocols. Authentication Protocols.
- t11FcSpAuIfStatTable is a table with one row for each - t11FcSpAuIfStatTable is a table with one row for each
mapping of an Authentication entity onto an interface, mapping of an Authentication entity onto an interface,
containing statistics information. containing statistics information.
- t11FcSpAuRejectTable is a table of volatile information - t11FcSpAuRejectTable is a table of volatile information
about FC-SP Authentication Protocol transactions about FC-SP Authentication Protocol transactions
which were most recently rejected. which were most recently rejected.
Copyright (C) The IETF Trust (2007). This version Copyright (C) The IETF Trust (2008). This version
of this MIB module is part of RFC yyyy; see the RFC of this MIB module is part of RFC yyyy; see the RFC
itself for full legal notices." itself for full legal notices."
-- RFC Editor: replace yyyy with actual RFC number & remove this note -- RFC Editor: replace yyyy with actual RFC number & remove this note
REVISION "200702190000Z" REVISION "200801030000Z"
DESCRIPTION DESCRIPTION
"Initial version of this MIB module, published as RFCyyyy." "Initial version of this MIB module, published as RFCyyyy."
-- RFC-Editor, replace yyyy with actual RFC number & remove this note -- RFC-Editor, replace yyyy with actual RFC number & remove this note
::= { mib-2 nnn } -- to be assigned by IANA ::= { mib-2 nnn } -- to be assigned by IANA
-- RFC Editor: replace nnn with IANA-assigned number & remove this note -- RFC Editor: replace nnn with IANA-assigned number & remove this note
t11FcSpAuMIBIdentities t11FcSpAuMIBNotifications
OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 1 } OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 0 }
t11FcSpAuMIBObjects t11FcSpAuMIBObjects
OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 2 } OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 1 }
t11FcSpAuMIBConformance t11FcSpAuMIBConformance
OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 2 }
t11FcSpAuMIBIdentities
OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 3 } OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 3 }
t11FcSpAuMIBNotifications
OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 0 }
-- --
-- OIDs defined for use as values of t11FcSpAuServerProtocol -- OIDs defined for use as values of t11FcSpAuServerProtocol
-- --
t11FcSpAuServerProtocolRadius OBJECT-IDENTITY t11FcSpAuServerProtocolRadius OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This OID identifies RADIUS as the protocol used "This OID identifies RADIUS as the protocol used
to communicate with an External Server as part of to communicate with an External Server as part of
skipping to change at page 44, line 29 skipping to change at page 47, line 29
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name used to identify the FC-SP entity. "The name used to identify the FC-SP entity.
For entities which are Fibre Channel Switches, this value For entities which are Fibre Channel Switches, this value
corresponds to the Switch's value of fcmSwitchWWN. For corresponds to the Switch's value of fcmSwitchWWN. For
entities other than Fibre Channel Switches, this value entities other than Fibre Channel Switches, this value
corresponds to the value of fcmInstanceWwn for the corresponds to the value of fcmInstanceWwn for the
corresponding Fibre Channel management instance." corresponding Fibre Channel management instance."
REFERENCE REFERENCE
"fcmInstanceWwn & fcmSwitchWWN, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 5.3.3.
fcmInstanceWwn & fcmSwitchWWN,
'Fibre Channel Management MIB', RFC 4044, May 2005." 'Fibre Channel Management MIB', RFC 4044, May 2005."
::= { t11FcSpAuEntityEntry 1 } ::= { t11FcSpAuEntityEntry 1 }
t11FcSpAuFabricIndex OBJECT-TYPE t11FcSpAuFabricIndex OBJECT-TYPE
SYNTAX T11FabricIndex SYNTAX T11FabricIndex
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which uniquely identifies a "An index value which uniquely identifies a
particular Fabric to which the entity is attached." particular Fabric to which the entity is attached."
skipping to change at page 46, line 19 skipping to change at page 49, line 22
t11FcSpAuRejectReceivedNotify notifications on the receipt t11FcSpAuRejectReceivedNotify notifications on the receipt
of AUTH_Reject/SW_RJT/LS_RJT messages. of AUTH_Reject/SW_RJT/LS_RJT messages.
If the value of the object is 'true', then this type of If the value of the object is 'true', then this type of
notification is generated. If the value is 'false', notification is generated. If the value is 'false',
this type of notification is not generated." this type of notification is not generated."
DEFVAL { false } DEFVAL { false }
::= { t11FcSpAuEntityEntry 6 } ::= { t11FcSpAuEntityEntry 6 }
t11FcSpAuDefaultLifetime OBJECT-TYPE t11FcSpAuDefaultLifetime OBJECT-TYPE
SYNTAX Unsigned32 (0..4294967295) SYNTAX T11FcSpLifetimeLeft
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"When the value of this object is non-zero, it specifies the "When the value of this object is non-zero, it specifies the
default value of a lifetime, specified in units given by default value of a lifetime, specified in units given by
the corresponding instance of t11FcSpAuDefaultLifetimeUnits. the corresponding instance of t11FcSpAuDefaultLifetimeUnits.
This default lifetime is to be used for any Security This default lifetime is to be used for any Security
Association which has no explicitly-specified value for its Association which has no explicitly-specified value for its
lifetime. lifetime.
An SA's lifetime is either the time interval or the number An SA's lifetime is either the time interval or the number
of passed bytes, after which the SA has to be terminated and of passed bytes, after which the SA has to be terminated and
(if necessary) replaced with a new SA. (if necessary) replaced with a new SA.
If this object is zero, then there is no default value for If this object is zero, then there is no default value for
lifetime." lifetime."
DEFVAL { 28800 } -- 8 hours (in units of seconds) DEFVAL { 28800 } -- 8 hours (in units of seconds)
::= { t11FcSpAuEntityEntry 7 } ::= { t11FcSpAuEntityEntry 7 }
t11FcSpAuDefaultLifetimeUnits OBJECT-TYPE t11FcSpAuDefaultLifetimeUnits OBJECT-TYPE
SYNTAX INTEGER { SYNTAX T11FcSpLifetimeLeftUnits
seconds(1), -- seconds
kiloBytes(2), -- 10^^3 bytes
megaBytes(3), -- 10^^6 bytes
gigaBytes(4), -- 10^^9 bytes
teraBytes(5), -- 10^^12 bytes
petaBytes(6), -- 10^^15 bytes
exaBytes(7), -- 10^^18 bytes
zettaBytes(8), -- 10^^21 bytes
yottaBytes(9) -- 10^^24 bytes
}
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The units in which the value of the corresponding "The units in which the value of the corresponding
instance of t11FcSpAuDefaultLifetime specifies a instance of t11FcSpAuDefaultLifetime specifies a
default lifetime for a Security Association which has default lifetime for a Security Association which has
no explicitly-specified value for its lifetime." no explicitly-specified value for its lifetime."
DEFVAL { seconds } DEFVAL { seconds }
::= { t11FcSpAuEntityEntry 8 } ::= { t11FcSpAuEntityEntry 8 }
skipping to change at page 61, line 28 skipping to change at page 64, line 28
TruthValue FROM SNMPv2-TC -- [RFC2579] TruthValue FROM SNMPv2-TC -- [RFC2579]
MODULE-COMPLIANCE, OBJECT-GROUP, MODULE-COMPLIANCE, OBJECT-GROUP,
NOTIFICATION-GROUP NOTIFICATION-GROUP
FROM SNMPv2-CONF -- [RFC2580] FROM SNMPv2-CONF -- [RFC2580]
ifIndex FROM IF-MIB -- [RFC2863] ifIndex FROM IF-MIB -- [RFC2863]
t11ZsServerEntry, t11ZsServerEntry,
t11ZsStatsEntry, t11ZsStatsEntry,
t11ZsNotifyControlEntry, t11ZsNotifyControlEntry,
t11ZsFabricIndex FROM T11-FC-ZONE-SERVER-MIB -- [RFC4936] t11ZsFabricIndex FROM T11-FC-ZONE-SERVER-MIB -- [RFC4936]
T11FcSpPolicyHashValue, T11FcSpPolicyHashValue,
T11FcSpPolicyHashFormat T11FcSpPolicyHashFormat,
T11FcSpHashCalculationStatus
FROM T11-FC-SP-TC-MIB; FROM T11-FC-SP-TC-MIB;
t11FcSpZoningMIB MODULE-IDENTITY t11FcSpZoningMIB MODULE-IDENTITY
LAST-UPDATED "200702190000Z" LAST-UPDATED "200801030000Z"
ORGANIZATION "T11" ORGANIZATION "This MIB module was developed through the
coordinated effort of two organizations:
T11 began the development and the IETF's IMSS
Working Group finished it."
CONTACT-INFO CONTACT-INFO
" Claudio DeSanti " Claudio DeSanti
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
EMail: cds@cisco.com EMail: cds@cisco.com
Keith McCloghrie Keith McCloghrie
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
skipping to change at page 62, line 13 skipping to change at page 65, line 17
T11-FC-ZONE-SERVER-MIB module which are necessary for the T11-FC-ZONE-SERVER-MIB module which are necessary for the
management of Fibre Channel's FC-SP Zoning Servers, as management of Fibre Channel's FC-SP Zoning Servers, as
defined in the FC-SP specification. defined in the FC-SP specification.
The persistence of values written to these MIB objects is The persistence of values written to these MIB objects is
the same as the persistence of the objects they extend, the same as the persistence of the objects they extend,
i.e., it is given by the value of the relevant instance of i.e., it is given by the value of the relevant instance of
t11ZsServerDatabaseStorageType (defined in the t11ZsServerDatabaseStorageType (defined in the
T11-FC-ZONE-SERVER-MIB module). T11-FC-ZONE-SERVER-MIB module).
Copyright (C) The IETF Trust (2007). This version Copyright (C) The IETF Trust (2008). This version
of this MIB module is part of RFC yyyy; see the RFC of this MIB module is part of RFC yyyy; see the RFC
itself for full legal notices." itself for full legal notices."
-- RFC Editor: replace yyyy with actual RFC number & remove this note -- RFC Editor: replace yyyy with actual RFC number & remove this note
REVISION "200702190000Z" REVISION "200801030000Z"
DESCRIPTION DESCRIPTION
"Initial version of this MIB module, published as RFCyyyy." "Initial version of this MIB module, published as RFCyyyy."
-- RFC-Editor, replace yyyy with actual RFC number & remove this note -- RFC-Editor, replace yyyy with actual RFC number & remove this note
::= { mib-2 nnn } -- to be assigned by IANA ::= { mib-2 nnn } -- to be assigned by IANA
-- RFC Editor: replace nnn with IANA-assigned number & remove this note -- RFC Editor: replace nnn with IANA-assigned number & remove this note
t11FcSpZsMIBNotifications OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 0 }
t11FcSpZsMIBObjects OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 1 } t11FcSpZsMIBObjects OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 1 }
t11FcSpZsMIBConformance OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 2 } t11FcSpZsMIBConformance OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 2 }
t11FcSpZsMIBNotifications OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 0 }
t11FcSpZsConfiguration OBJECT IDENTIFIER ::= { t11FcSpZsMIBObjects 1 } t11FcSpZsConfiguration OBJECT IDENTIFIER ::= { t11FcSpZsMIBObjects 1 }
t11FcSpZsStatistics OBJECT IDENTIFIER ::= { t11FcSpZsMIBObjects 2 } t11FcSpZsStatistics OBJECT IDENTIFIER ::= { t11FcSpZsMIBObjects 2 }
-- --
-- Augmenting the table of Zone Servers -- Augmenting the table of Zone Servers
-- --
t11FcSpZsServerTable OBJECT-TYPE t11FcSpZsServerTable OBJECT-TYPE
SYNTAX SEQUENCE OF T11FcSpZsServerEntry SYNTAX SEQUENCE OF T11FcSpZsServerEntry
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
skipping to change at page 63, line 33 skipping to change at page 66, line 33
"Each entry contains information relevant to FC-SP "Each entry contains information relevant to FC-SP
for a particular Zone Server for a particular Fabric for a particular Zone Server for a particular Fabric
on a particular Switch. The Fabric and Switch are on a particular Switch. The Fabric and Switch are
identified in the same manner as in t11ZsServerEntry." identified in the same manner as in t11ZsServerEntry."
AUGMENTS { t11ZsServerEntry } AUGMENTS { t11ZsServerEntry }
::= { t11FcSpZsServerTable 1 } ::= { t11FcSpZsServerTable 1 }
T11FcSpZsServerEntry ::= SEQUENCE { T11FcSpZsServerEntry ::= SEQUENCE {
t11FcSpZsServerCapabilityObject BITS, t11FcSpZsServerCapabilityObject BITS,
t11FcSpZsServerEnabled TruthValue, t11FcSpZsServerEnabled TruthValue,
t11FcSpZoneSetHashStatus INTEGER, t11FcSpZoneSetHashStatus T11FcSpHashCalculationStatus,
t11FcSpActiveZoneSetHashType T11FcSpPolicyHashFormat, t11FcSpActiveZoneSetHashType T11FcSpPolicyHashFormat,
t11FcSpActiveZoneSetHash T11FcSpPolicyHashValue, t11FcSpActiveZoneSetHash T11FcSpPolicyHashValue,
t11FcSpZoneSetDatabaseHashType T11FcSpPolicyHashFormat, t11FcSpZoneSetDatabaseHashType T11FcSpPolicyHashFormat,
t11FcSpZoneSetDatabaseHash T11FcSpPolicyHashValue t11FcSpZoneSetDatabaseHash T11FcSpPolicyHashValue
} }
t11FcSpZsServerCapabilityObject OBJECT-TYPE t11FcSpZsServerCapabilityObject OBJECT-TYPE
SYNTAX BITS { SYNTAX BITS {
fcSpZoning(0) fcSpZoning(0)
} }
skipping to change at page 64, line 27 skipping to change at page 67, line 27
DESCRIPTION DESCRIPTION
"This object indicates whether the Zone Server for the "This object indicates whether the Zone Server for the
particular Fabric on the particular Switch, is operating in particular Fabric on the particular Switch, is operating in
FC-SP Zoning mode." FC-SP Zoning mode."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, Fibre Channel "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, Fibre Channel
- Security Protocols (FC-SP), 13 June 2006, Table 185." - Security Protocols (FC-SP), 13 June 2006, Table 185."
::= { t11FcSpZsServerEntry 2 } ::= { t11FcSpZsServerEntry 2 }
t11FcSpZoneSetHashStatus OBJECT-TYPE t11FcSpZoneSetHashStatus OBJECT-TYPE
SYNTAX INTEGER { SYNTAX T11FcSpHashCalculationStatus
calculate(1),
correct(2),
stale(3)
}
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"When read, the value of this object is either: "When read, the value of this object is either:
correct -- the corresponding instances of both correct -- the corresponding instances of both
t11FcSpActiveZoneSetHash and t11FcSpActiveZoneSetHash and
t11FcSpZoneSetDatabaseHash contain t11FcSpZoneSetDatabaseHash contain
the correct hash values; or the correct hash values; or
stale -- the corresponding instances of stale -- the corresponding instances of
skipping to change at page 65, line 11 skipping to change at page 68, line 7
and update the values of the corresponding instances of both and update the values of the corresponding instances of both
t11FcSpActiveZoneSetHash and t11FcSpZoneSetDatabaseHash. t11FcSpActiveZoneSetHash and t11FcSpZoneSetDatabaseHash.
Writing a value of 'correct' or 'stale' to this object Writing a value of 'correct' or 'stale' to this object
is an error ('wrongValue'). is an error ('wrongValue').
When the Active Zone Set and/or the Zone Set Database are When the Active Zone Set and/or the Zone Set Database are
updated, it is common that multiple changes need to be made updated, it is common that multiple changes need to be made
at the same time. In such circumstances, the use of this at the same time. In such circumstances, the use of this
object allows the hash values to be updated only once after object allows the hash values to be updated only once after
all changes, rather than repeatedly/after each individual all changes, rather than repeatedly/after each individual
change." change.
If and when the corresponding instance of
t11ZsServerDatabaseStorageType has the value 'permanent(4)',
then if write access is supported to any instance of a
read-write object in any row of any table governed by the
'permanent' value of t11ZsServerDatabaseStorageType, then
write access to the corresponding instance of this object
must also be supported."
REFERENCE
"t11ZsServerDatabaseStorageType in
'Fibre Channel Zone Server MIB', RFC 4936, August 2007."
DEFVAL { stale } DEFVAL { stale }
::= { t11FcSpZsServerEntry 3 } ::= { t11FcSpZsServerEntry 3 }
t11FcSpActiveZoneSetHashType OBJECT-TYPE t11FcSpActiveZoneSetHashType OBJECT-TYPE
SYNTAX T11FcSpPolicyHashFormat SYNTAX T11FcSpPolicyHashFormat
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The format used for the hash value contained in the "The format used for the hash value contained in the
corresponding instance of t11FcSpActiveZoneSetHash." corresponding instance of t11FcSpActiveZoneSetHash."
skipping to change at page 74, line 23 skipping to change at page 77, line 23
IMPORTS IMPORTS
MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, mib-2, MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, mib-2,
Counter32, Unsigned32 Counter32, Unsigned32
FROM SNMPv2-SMI -- [RFC2578] FROM SNMPv2-SMI -- [RFC2578]
RowStatus, StorageType, TimeStamp, RowStatus, StorageType, TimeStamp,
TruthValue FROM SNMPv2-TC -- [RFC2579] TruthValue FROM SNMPv2-TC -- [RFC2579]
MODULE-COMPLIANCE, OBJECT-GROUP, MODULE-COMPLIANCE, OBJECT-GROUP,
NOTIFICATION-GROUP NOTIFICATION-GROUP
FROM SNMPv2-CONF -- [RFC2580] FROM SNMPv2-CONF -- [RFC2580]
SnmpAdminString FROM SNMP-FRAMEWORK-MIB -- [RFC3411] SnmpAdminString FROM SNMP-FRAMEWORK-MIB -- [RFC3411]
InetAddress, InetAddress, InetPortNumber,
InetAddressType FROM INET-ADDRESS-MIB -- [RFC4001] InetAddressType FROM INET-ADDRESS-MIB -- [RFC4001]
fcmInstanceIndex, fcmInstanceIndex,
FcNameIdOrZero, FcNameIdOrZero,
FcDomainIdOrZero FROM FC-MGMT-MIB -- [RFC4044] FcDomainIdOrZero FROM FC-MGMT-MIB -- [RFC4044]
T11NsGs4RejectReasonCode T11NsGs4RejectReasonCode
FROM T11-FC-NAME-SERVER-MIB -- [RFC4438] FROM T11-FC-NAME-SERVER-MIB -- [RFC4438]
T11FabricIndex FROM T11-TC-MIB -- [RFC4439] T11FabricIndex FROM T11-TC-MIB -- [RFC4439]
T11FcSpAlphaNumName, T11FcSpAlphaNumName,
T11FcSpAlphaNumNameOrNull, T11FcSpAlphaNumNameOrAbsent,
T11FcSpPolicyName, T11FcSpPolicyName,
T11FcSpPolicyNameType, T11FcSpPolicyNameType,
T11FcSpPolicyObjectType, T11FcSpPolicyObjectType,
T11FcSpPolicyHashFormat, T11FcSpPolicyHashFormat,
T11FcSpPolicyHashValue FROM T11-FC-SP-TC-MIB; T11FcSpPolicyHashValue,
T11FcSpHashCalculationStatus FROM T11-FC-SP-TC-MIB;
t11FcSpPolicyMIB MODULE-IDENTITY t11FcSpPolicyMIB MODULE-IDENTITY
LAST-UPDATED "200702190000Z" LAST-UPDATED "200801030000Z"
ORGANIZATION "T11" ORGANIZATION "This MIB module was developed through the
coordinated effort of two organizations:
T11 began the development and the IETF's IMSS
Working Group finished it."
CONTACT-INFO CONTACT-INFO
" Claudio DeSanti " Claudio DeSanti
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
EMail: cds@cisco.com EMail: cds@cisco.com
Keith McCloghrie Keith McCloghrie
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
Email: kzm@cisco.com" Email: kzm@cisco.com"
DESCRIPTION DESCRIPTION
"This MIB module specifies the management information "This MIB module specifies the management information
required to manage Fabric Policies as defined by Fibre required to manage Fabric Policies as defined by Fibre
Channel's FC-SP specification. Channel's FC-SP specification.
skipping to change at page 76, line 24 skipping to change at page 79, line 29
- read-create MIB objects to allow the creation of - read-create MIB objects to allow the creation of
non-active Policy Summary Objects (which reference non-active Policy Summary Objects (which reference
non-active Policy Objects), and non-active Policy Objects), and
- read-create MIB objects representing non-active - read-create MIB objects representing non-active
Policy Objects. Policy Objects.
4) Statistics 4) Statistics
5) Control information and Notifications 5) Control information and Notifications
Copyright (C) The IETF Trust (2007). This version Copyright (C) The IETF Trust (2008). This version
of this MIB module is part of RFC yyyy; see the RFC of this MIB module is part of RFC yyyy; see the RFC
itself for full legal notices." itself for full legal notices."
-- RFC Editor: replace yyyy with actual RFC number & remove this note -- RFC Editor: replace yyyy with actual RFC number & remove this note
REVISION "200702190000Z" REVISION "200801030000Z"
DESCRIPTION DESCRIPTION
"Initial version of this MIB module, published as RFCyyyy." "Initial version of this MIB module, published as RFCyyyy."
-- RFC-Editor, replace yyyy with actual RFC number & remove this note -- RFC-Editor, replace yyyy with actual RFC number & remove this note
::= { mib-2 nnn } -- to be assigned by IANA ::= { mib-2 nnn } -- to be assigned by IANA
-- RFC Editor: replace nnn with IANA-assigned number & remove this note -- RFC Editor: replace nnn with IANA-assigned number & remove this note
t11FcSpPoMIBNotifications OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 0 }
t11FcSpPoMIBObjects OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 1 } t11FcSpPoMIBObjects OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 1 }
t11FcSpPoMIBConformance OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 2 } t11FcSpPoMIBConformance OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 2 }
t11FcSpPoMIBNotifications OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 0 }
t11FcSpPoActive OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 1 } t11FcSpPoActive OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 1 }
t11FcSpPoOperations OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 2 } t11FcSpPoOperations OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 2 }
t11FcSpPoNonActive OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 3 } t11FcSpPoNonActive OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 3 }
t11FcSpPoStatistics OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 4 } t11FcSpPoStatistics OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 4 }
t11FcSpPoControl OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 5 } t11FcSpPoControl OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 5 }
-- --
-- Part 1 - Active Policy Objects -- Part 1 - Active Policy Objects
-- --
skipping to change at page 82, line 47 skipping to change at page 85, line 47
t11FcSpPoSwMembSwitchNameType, t11FcSpPoSwMembSwitchName } t11FcSpPoSwMembSwitchNameType, t11FcSpPoSwMembSwitchName }
::= { t11FcSpPoSwMembTable 1 } ::= { t11FcSpPoSwMembTable 1 }
T11FcSpPoSwMembEntry ::= SEQUENCE { T11FcSpPoSwMembEntry ::= SEQUENCE {
t11FcSpPoSwMembSwitchNameType T11FcSpPolicyNameType, t11FcSpPoSwMembSwitchNameType T11FcSpPolicyNameType,
t11FcSpPoSwMembSwitchName FcNameIdOrZero, t11FcSpPoSwMembSwitchName FcNameIdOrZero,
t11FcSpPoSwMembSwitchFlags BITS, t11FcSpPoSwMembSwitchFlags BITS,
t11FcSpPoSwMembDomainID FcDomainIdOrZero, t11FcSpPoSwMembDomainID FcDomainIdOrZero,
t11FcSpPoSwMembPolicyDataRole INTEGER, t11FcSpPoSwMembPolicyDataRole INTEGER,
t11FcSpPoSwMembAuthBehaviour BITS, t11FcSpPoSwMembAuthBehaviour BITS,
t11FcSpPoSwMembAttribute T11FcSpAlphaNumNameOrNull t11FcSpPoSwMembAttribute T11FcSpAlphaNumNameOrAbsent
} }
t11FcSpPoSwMembSwitchNameType OBJECT-TYPE t11FcSpPoSwMembSwitchNameType OBJECT-TYPE
SYNTAX T11FcSpPolicyNameType { SYNTAX T11FcSpPolicyNameType {
nodeName(1), nodeName(1),
restrictedNodeName(2), restrictedNodeName(2),
wildcard(5), wildcard(5),
restrictedWildcard(6) restrictedWildcard(6)
} }
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
skipping to change at page 87, line 11 skipping to change at page 90, line 11
'rejectIsFailure' - if this bit is set, the rejection of 'rejectIsFailure' - if this bit is set, the rejection of
an AUTH_Negotiate message must be considered as an an AUTH_Negotiate message must be considered as an
authentication failure by this Switch." authentication failure by this Switch."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 7.1.4.1 and table 114." 13 June 2006, section 7.1.4.1 and table 114."
::= { t11FcSpPoSwMembEntry 6 } ::= { t11FcSpPoSwMembEntry 6 }
t11FcSpPoSwMembAttribute OBJECT-TYPE t11FcSpPoSwMembAttribute OBJECT-TYPE
SYNTAX T11FcSpAlphaNumNameOrNull SYNTAX T11FcSpAlphaNumNameOrAbsent
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of an active Attribute Policy Object which is "The name of an active Attribute Policy Object which is
defined for this Switch, or the zero-length string. The defined for this Switch, or the zero-length string. The
zero-length string indicates that no Attribute Policy zero-length string indicates that no Attribute Policy
Object is defined for this Switch." Object is defined for this Switch."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
skipping to change at page 88, line 17 skipping to change at page 91, line 17
by fcmInstanceIndex." by fcmInstanceIndex."
INDEX { fcmInstanceIndex, t11FcSpPoFabricIndex, INDEX { fcmInstanceIndex, t11FcSpPoFabricIndex,
t11FcSpPoNoMembNodeNameType, t11FcSpPoNoMembNodeName } t11FcSpPoNoMembNodeNameType, t11FcSpPoNoMembNodeName }
::= { t11FcSpPoNoMembTable 1 } ::= { t11FcSpPoNoMembTable 1 }
T11FcSpPoNoMembEntry ::= SEQUENCE { T11FcSpPoNoMembEntry ::= SEQUENCE {
t11FcSpPoNoMembNodeNameType T11FcSpPolicyNameType, t11FcSpPoNoMembNodeNameType T11FcSpPolicyNameType,
t11FcSpPoNoMembNodeName FcNameIdOrZero, t11FcSpPoNoMembNodeName FcNameIdOrZero,
t11FcSpPoNoMembFlags BITS, t11FcSpPoNoMembFlags BITS,
t11FcSpPoNoMembCtAccessIndex Unsigned32, t11FcSpPoNoMembCtAccessIndex Unsigned32,
t11FcSpPoNoMembAttribute T11FcSpAlphaNumNameOrNull t11FcSpPoNoMembAttribute T11FcSpAlphaNumNameOrAbsent
} }
t11FcSpPoNoMembNodeNameType OBJECT-TYPE t11FcSpPoNoMembNodeNameType OBJECT-TYPE
SYNTAX T11FcSpPolicyNameType { SYNTAX T11FcSpPolicyNameType {
nodeName(1), nodeName(1),
restrictedNodeName(2), restrictedNodeName(2),
portName(3), portName(3),
restrictedPortName(4), restrictedPortName(4),
wildcard(5), wildcard(5),
restrictedWildcard(6) restrictedWildcard(6)
skipping to change at page 90, line 27 skipping to change at page 93, line 27
the t11FcSpPoCtDescrTable for the same Fabric and for which the t11FcSpPoCtDescrTable for the same Fabric and for which
the value of t11FcSpPoCtDescrSpecifierIndex is the same as the value of t11FcSpPoCtDescrSpecifierIndex is the same as
the value of this object." the value of this object."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.4.1 and tables 118/119/120/121." section 7.1.4.1 and tables 118/119/120/121."
::= { t11FcSpPoNoMembEntry 4 } ::= { t11FcSpPoNoMembEntry 4 }
t11FcSpPoNoMembAttribute OBJECT-TYPE t11FcSpPoNoMembAttribute OBJECT-TYPE
SYNTAX T11FcSpAlphaNumNameOrNull SYNTAX T11FcSpAlphaNumNameOrAbsent
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of an active Attribute Policy Object which is "The name of an active Attribute Policy Object which is
defined for this Node, or the zero-length string. The defined for this Node, or the zero-length string. The
zero-length string indicates that no Attribute Policy zero-length string indicates that no Attribute Policy
Object is defined for this Node." Object is defined for this Node."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
skipping to change at page 96, line 47 skipping to change at page 99, line 47
- a Node (if t11FcSpPoSwConnAllowedType = 'node') - a Node (if t11FcSpPoSwConnAllowedType = 'node')
to which connectivity is: to which connectivity is:
- allowed by 'nodeName' and 'portname', - allowed by 'nodeName' and 'portname',
- not allowed by 'restrictedNodeName' and - not allowed by 'restrictedNodeName' and
'restrictedPortName'." 'restrictedPortName'."
::= { t11FcSpPoSwConnEntry 5 } ::= { t11FcSpPoSwConnEntry 5 }
t11FcSpPoSwConnAllowedName OBJECT-TYPE t11FcSpPoSwConnAllowedName OBJECT-TYPE
SYNTAX T11FcSpPolicyName SYNTAX T11FcSpPolicyName (SIZE (8))
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"If the value of t11FcSpPoSwConnAllowedNameType is "If the value of t11FcSpPoSwConnAllowedNameType is
'wildcard' or 'restrictedWildcard', this object has the 'wildcard' or 'restrictedWildcard', this object has the
value '0000000000000000'h. value '0000000000000000'h.
Otherwise, the combination of t11FcSpPoSwConnAllowedNameType Otherwise, the combination of t11FcSpPoSwConnAllowedNameType
and t11FcSpPoSwConnAllowedName specify the name of: and t11FcSpPoSwConnAllowedName specify the name of:
skipping to change at page 98, line 37 skipping to change at page 101, line 37
t11FcSpPoIpMgmtEntryNameType, t11FcSpPoIpMgmtEntryNameType,
t11FcSpPoIpMgmtEntryNameLow, t11FcSpPoIpMgmtEntryNameLow,
t11FcSpPoIpMgmtEntryNameHigh } t11FcSpPoIpMgmtEntryNameHigh }
::= { t11FcSpPoIpMgmtTable 1 } ::= { t11FcSpPoIpMgmtTable 1 }
T11FcSpPoIpMgmtEntry ::= SEQUENCE { T11FcSpPoIpMgmtEntry ::= SEQUENCE {
t11FcSpPoIpMgmtEntryNameType InetAddressType, t11FcSpPoIpMgmtEntryNameType InetAddressType,
t11FcSpPoIpMgmtEntryNameLow InetAddress, t11FcSpPoIpMgmtEntryNameLow InetAddress,
t11FcSpPoIpMgmtEntryNameHigh InetAddress, t11FcSpPoIpMgmtEntryNameHigh InetAddress,
t11FcSpPoIpMgmtWkpIndex Unsigned32, t11FcSpPoIpMgmtWkpIndex Unsigned32,
t11FcSpPoIpMgmtAttribute T11FcSpAlphaNumNameOrNull t11FcSpPoIpMgmtAttribute T11FcSpAlphaNumNameOrAbsent
} }
t11FcSpPoIpMgmtEntryNameType OBJECT-TYPE t11FcSpPoIpMgmtEntryNameType OBJECT-TYPE
SYNTAX InetAddressType SYNTAX InetAddressType
-- INTEGER { ipv4(1), ipv6(2) }
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The combination of t11FcSpPoIpMgmtNameType, "The combination of t11FcSpPoIpMgmtNameType,
t11FcSpPoIpMgmtNameLow and t11FcSpPoIpMgmtNameHigh t11FcSpPoIpMgmtNameLow and t11FcSpPoIpMgmtNameHigh
specify the IP Address range of this IP Management specify the IP Address range of this IP Management
Entry in the IP Management List Object. Entry in the IP Management List Object.
The FC-SP specification does not allow the use of a The FC-SP specification does not allow the use of a
DNS domain name to specify the address at the lower end DNS domain name to specify the address at the lower end
skipping to change at page 100, line 28 skipping to change at page 103, line 30
same as the value of this object. A value of zero indicates same as the value of this object. A value of zero indicates
that this IP Management Entry does not identify a Well Known that this IP Management Entry does not identify a Well Known
Protocols Access Specifier." Protocols Access Specifier."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.7.1 and tables 127/129." section 7.1.7.1 and tables 127/129."
::= { t11FcSpPoIpMgmtEntry 4 } ::= { t11FcSpPoIpMgmtEntry 4 }
t11FcSpPoIpMgmtAttribute OBJECT-TYPE t11FcSpPoIpMgmtAttribute OBJECT-TYPE
SYNTAX T11FcSpAlphaNumNameOrNull SYNTAX T11FcSpAlphaNumNameOrAbsent
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of an active Attribute Policy Object which is "The name of an active Attribute Policy Object which is
defined for this IP Management entry, or the zero-length defined for this IP Management entry, or the zero-length
string. The zero-length string indicates that no Attribute string. The zero-length string indicates that no Attribute
Policy Object is defined for this IP Management entry." Policy Object is defined for this IP Management entry."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
skipping to change at page 101, line 47 skipping to change at page 104, line 47
management instance identified by fcmInstanceIndex." management instance identified by fcmInstanceIndex."
INDEX { fcmInstanceIndex, t11FcSpPoFabricIndex, INDEX { fcmInstanceIndex, t11FcSpPoFabricIndex,
t11FcSpPoWkpDescrSpecifierIndex, t11FcSpPoWkpDescrIndex } t11FcSpPoWkpDescrSpecifierIndex, t11FcSpPoWkpDescrIndex }
::= { t11FcSpPoWkpDescrTable 1 } ::= { t11FcSpPoWkpDescrTable 1 }
T11FcSpPoWkpDescrEntry ::= SEQUENCE { T11FcSpPoWkpDescrEntry ::= SEQUENCE {
t11FcSpPoWkpDescrSpecifierIndex Unsigned32, t11FcSpPoWkpDescrSpecifierIndex Unsigned32,
t11FcSpPoWkpDescrIndex Unsigned32, t11FcSpPoWkpDescrIndex Unsigned32,
t11FcSpPoWkpDescrFlags BITS, t11FcSpPoWkpDescrFlags BITS,
t11FcSpPoWkpDescrWkpNumber Unsigned32, t11FcSpPoWkpDescrWkpNumber Unsigned32,
t11FcSpPoWkpDescrDestPort Unsigned32 t11FcSpPoWkpDescrDestPort InetPortNumber
} }
t11FcSpPoWkpDescrSpecifierIndex OBJECT-TYPE t11FcSpPoWkpDescrSpecifierIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295) SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which uniquely identifies a particular "An index value which uniquely identifies a particular
Well-Known Protocol Access Specifier within a Fabric." Well-Known Protocol Access Specifier within a Fabric."
::= { t11FcSpPoWkpDescrEntry 1 } ::= { t11FcSpPoWkpDescrEntry 1 }
skipping to change at page 103, line 29 skipping to change at page 106, line 29
instance of t11FcSpPoWkpDescrFlags, this object specifies instance of t11FcSpPoWkpDescrFlags, this object specifies
the IP protocol number of the Well-Known Protocol." the IP protocol number of the Well-Known Protocol."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.7.1 and table 131. section 7.1.7.1 and table 131.
- http://www.iana.org/assignments/protocol-numbers." - http://www.iana.org/assignments/protocol-numbers."
::= { t11FcSpPoWkpDescrEntry 4 } ::= { t11FcSpPoWkpDescrEntry 4 }
t11FcSpPoWkpDescrDestPort OBJECT-TYPE t11FcSpPoWkpDescrDestPort OBJECT-TYPE
SYNTAX Unsigned32 (0..65535) SYNTAX InetPortNumber
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"When the 'destPortWildcard' bit is set in the corresponding "When the 'destPortWildcard' bit is set in the corresponding
instance of t11FcSpPoWkpDescrFlags, this object specifies instance of t11FcSpPoWkpDescrFlags, this object specifies
the Destination (TCP/UDP) Port number of the Well-Known the Destination (TCP/UDP) Port number of the Well-Known
Protocol." Protocol. When the 'destPortWildcard' bit is reset, this
object is ignored (and can have the value zero)."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.7.1 and table 131. section 7.1.7.1 and table 131.
- http://www.iana.org/assignments/port-numbers." - http://www.iana.org/assignments/port-numbers."
::= { t11FcSpPoWkpDescrEntry 5 } ::= { t11FcSpPoWkpDescrEntry 5 }
-- --
-- Attribute Entries in Active Attribute Policy Objects -- Attribute Entries in Active Attribute Policy Objects
-- --
skipping to change at page 107, line 38 skipping to change at page 110, line 38
zeroDotZero. zeroDotZero.
In particular, when the value of t11FcSpPoAttribType In particular, when the value of t11FcSpPoAttribType
indicates 'AUTH_Negotiate Message Payload', one or more indicates 'AUTH_Negotiate Message Payload', one or more
Authentication Protocol Identifiers and their associated Authentication Protocol Identifiers and their associated
Authentication Protocol Parameters are embedded within the Authentication Protocol Parameters are embedded within the
value of the corresponding instance of t11FcSpPoAttribValue; value of the corresponding instance of t11FcSpPoAttribValue;
MIB objects to contain these individual values are defined MIB objects to contain these individual values are defined
in the t11FcSpPoAuthProtTable. Thus, for an 'AUTH_Negotiate in the t11FcSpPoAuthProtTable. Thus, for an 'AUTH_Negotiate
Message Payload' Attribute, the value of this object Message Payload' Attribute, the value of this object
contains the OID of t11FcSpPoAuthProtTable." contains an OID within the t11FcSpPoAuthProtTable, e.g.,
of the whole table, of an individual row, or of an individual
instance within the table."
::= { t11FcSpPoAttribEntry 6 } ::= { t11FcSpPoAttribEntry 6 }
-- --
-- Auth. Protocol Parameters in Active Attribute Policy Objects -- Auth. Protocol Parameters in Active Attribute Policy Objects
-- --
t11FcSpPoAuthProtTable OBJECT-TYPE t11FcSpPoAuthProtTable OBJECT-TYPE
SYNTAX SEQUENCE OF T11FcSpPoAuthProtEntry SYNTAX SEQUENCE OF T11FcSpPoAuthProtEntry
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
skipping to change at page 109, line 15 skipping to change at page 112, line 15
t11FcSpPoAuthProtPartIndex } t11FcSpPoAuthProtPartIndex }
::= { t11FcSpPoAuthProtTable 1 } ::= { t11FcSpPoAuthProtTable 1 }
T11FcSpPoAuthProtEntry ::= SEQUENCE { T11FcSpPoAuthProtEntry ::= SEQUENCE {
t11FcSpPoAuthProtIdentifier Unsigned32, t11FcSpPoAuthProtIdentifier Unsigned32,
t11FcSpPoAuthProtPartIndex Unsigned32, t11FcSpPoAuthProtPartIndex Unsigned32,
t11FcSpPoAuthProtParams OCTET STRING t11FcSpPoAuthProtParams OCTET STRING
} }
t11FcSpPoAuthProtIdentifier OBJECT-TYPE t11FcSpPoAuthProtIdentifier OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (0..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The Authentication Protocol Identifier: "The Authentication Protocol Identifier:
1 = DH-CHAP 1 = DH-CHAP
2 = FCAP 2 = FCAP
3 = FCPAP 3 = FCPAP
4 = IKEv2 4 = IKEv2
5 = IKEv2-AUTH 5 = IKEv2-AUTH
skipping to change at page 112, line 43 skipping to change at page 115, line 43
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 7.3.6.2" 13 June 2006, section 7.3.6.2"
::= { t11FcSpPoOperEntry 1 } ::= { t11FcSpPoOperEntry 1 }
t11FcSpPoOperDeActivate OBJECT-TYPE t11FcSpPoOperDeActivate OBJECT-TYPE
SYNTAX T11FcSpAlphaNumName SYNTAX T11FcSpAlphaNumName
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"Writing the current value of i11FcSpPoPolicySummaryObjName "Writing the current value of t11FcSpPoPolicySummaryObjName
into this object (for a particular Fabric) is a request into this object (for a particular Fabric) is a request
to deactivate that Fabric's current policy configuration. to deactivate that Fabric's current policy configuration.
Writing any other value into this object is a Writing any other value into this object is a
('wrongValue') error. ('wrongValue') error.
When read, the value of this object is always the zero- When read, the value of this object is always the zero-
length string." length string."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
skipping to change at page 116, line 41 skipping to change at page 119, line 41
t11FcSpPoNaSummaryName, t11FcSpPoNaSummaryPolicyType, t11FcSpPoNaSummaryName, t11FcSpPoNaSummaryPolicyType,
t11FcSpPoNaSummaryPolicyIndex } t11FcSpPoNaSummaryPolicyIndex }
::= { t11FcSpPoNaSummaryTable 1 } ::= { t11FcSpPoNaSummaryTable 1 }
T11FcSpPoNaSummaryEntry ::= SEQUENCE { T11FcSpPoNaSummaryEntry ::= SEQUENCE {
t11FcSpPoNaSummaryName T11FcSpAlphaNumName, t11FcSpPoNaSummaryName T11FcSpAlphaNumName,
t11FcSpPoNaSummaryPolicyType T11FcSpPolicyObjectType, t11FcSpPoNaSummaryPolicyType T11FcSpPolicyObjectType,
t11FcSpPoNaSummaryPolicyIndex Unsigned32, t11FcSpPoNaSummaryPolicyIndex Unsigned32,
t11FcSpPoNaSummaryPolicyNameType T11FcSpPolicyNameType, t11FcSpPoNaSummaryPolicyNameType T11FcSpPolicyNameType,
t11FcSpPoNaSummaryPolicyName T11FcSpPolicyName, t11FcSpPoNaSummaryPolicyName T11FcSpPolicyName,
t11FcSpPoNaSummaryHashStatus INTEGER, t11FcSpPoNaSummaryHashStatus T11FcSpHashCalculationStatus,
t11FcSpPoNaSummaryHashFormat T11FcSpPolicyHashFormat, t11FcSpPoNaSummaryHashFormat T11FcSpPolicyHashFormat,
t11FcSpPoNaSummaryHashValue T11FcSpPolicyHashValue, t11FcSpPoNaSummaryHashValue T11FcSpPolicyHashValue,
t11FcSpPoNaSummaryRowStatus RowStatus t11FcSpPoNaSummaryRowStatus RowStatus
} }
t11FcSpPoNaSummaryName OBJECT-TYPE t11FcSpPoNaSummaryName OBJECT-TYPE
SYNTAX T11FcSpAlphaNumName SYNTAX T11FcSpAlphaNumName
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of the non-active Policy Summary Object which "The name of the non-active Policy Summary Object which
contains this Policy Object." contains this Policy Object."
::= { t11FcSpPoNaSummaryEntry 1 } ::= { t11FcSpPoNaSummaryEntry 1 }
t11FcSpPoNaSummaryPolicyType OBJECT-TYPE t11FcSpPoNaSummaryPolicyType OBJECT-TYPE
SYNTAX T11FcSpPolicyObjectType SYNTAX T11FcSpPolicyObjectType
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The 'Identifier' which specifies the type of this Policy "The 'Identifier' (i.e., the type) of this Policy Object."
Object."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 7.1.3.1 and table 104." 13 June 2006, section 7.1.3.1 and table 104."
::= { t11FcSpPoNaSummaryEntry 2 } ::= { t11FcSpPoNaSummaryEntry 2 }
t11FcSpPoNaSummaryPolicyIndex OBJECT-TYPE t11FcSpPoNaSummaryPolicyIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295) SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
skipping to change at page 118, line 17 skipping to change at page 121, line 16
SYNTAX T11FcSpPolicyName SYNTAX T11FcSpPolicyName
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The combination of t11FcSpPoNaSummaryPolicyNameType and "The combination of t11FcSpPoNaSummaryPolicyNameType and
t11FcSpPoNaSummaryPolicyName specify the name of the t11FcSpPoNaSummaryPolicyName specify the name of the
non-active Policy Object identified by this row." non-active Policy Object identified by this row."
::= { t11FcSpPoNaSummaryEntry 5 } ::= { t11FcSpPoNaSummaryEntry 5 }
t11FcSpPoNaSummaryHashStatus OBJECT-TYPE t11FcSpPoNaSummaryHashStatus OBJECT-TYPE
SYNTAX INTEGER { SYNTAX T11FcSpHashCalculationStatus
calculate(1),
correct(2),
stale(3)
}
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"When read, the value of this object is either: "When read, the value of this object is either:
correct -- the corresponding instance of correct -- the corresponding instance of
t11FcSpPoNaSummaryHashValue contains t11FcSpPoNaSummaryHashValue contains
the correct value; or the correct value; or
stale -- the corresponding instance of stale -- the corresponding instance of
t11FcSpPoNaSummaryHashValue contains t11FcSpPoNaSummaryHashValue contains
skipping to change at page 123, line 13 skipping to change at page 126, line 13
t11FcSpPoNaSwMembSwitchName } t11FcSpPoNaSwMembSwitchName }
::= { t11FcSpPoNaSwMembTable 1 } ::= { t11FcSpPoNaSwMembTable 1 }
T11FcSpPoNaSwMembEntry ::= SEQUENCE { T11FcSpPoNaSwMembEntry ::= SEQUENCE {
t11FcSpPoNaSwMembSwitchNameType T11FcSpPolicyNameType, t11FcSpPoNaSwMembSwitchNameType T11FcSpPolicyNameType,
t11FcSpPoNaSwMembSwitchName FcNameIdOrZero, t11FcSpPoNaSwMembSwitchName FcNameIdOrZero,
t11FcSpPoNaSwMembFlags BITS, t11FcSpPoNaSwMembFlags BITS,
t11FcSpPoNaSwMembDomainID FcDomainIdOrZero, t11FcSpPoNaSwMembDomainID FcDomainIdOrZero,
t11FcSpPoNaSwMembPolicyDataRole INTEGER, t11FcSpPoNaSwMembPolicyDataRole INTEGER,
t11FcSpPoNaSwMembAuthBehaviour BITS, t11FcSpPoNaSwMembAuthBehaviour BITS,
t11FcSpPoNaSwMembAttribute T11FcSpAlphaNumNameOrNull, t11FcSpPoNaSwMembAttribute T11FcSpAlphaNumNameOrAbsent,
t11FcSpPoNaSwMembRowStatus RowStatus t11FcSpPoNaSwMembRowStatus RowStatus
} }
t11FcSpPoNaSwMembSwitchNameType OBJECT-TYPE t11FcSpPoNaSwMembSwitchNameType OBJECT-TYPE
SYNTAX T11FcSpPolicyNameType { SYNTAX T11FcSpPolicyNameType {
nodeName(1), nodeName(1),
restrictedNodeName(2), restrictedNodeName(2),
wildcard(5), wildcard(5),
restrictedWildcard(6) restrictedWildcard(6)
} }
skipping to change at page 127, line 4 skipping to change at page 130, line 4
'rejectIsFailure' - if this bit is set, the rejection of 'rejectIsFailure' - if this bit is set, the rejection of
an AUTH_Negotiate message must be considered as an an AUTH_Negotiate message must be considered as an
authentication failure by this Switch." authentication failure by this Switch."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 7.1.4.1 and table 114." 13 June 2006, section 7.1.4.1 and table 114."
::= { t11FcSpPoNaSwMembEntry 6 } ::= { t11FcSpPoNaSwMembEntry 6 }
t11FcSpPoNaSwMembAttribute OBJECT-TYPE t11FcSpPoNaSwMembAttribute OBJECT-TYPE
SYNTAX T11FcSpAlphaNumNameOrNull SYNTAX T11FcSpAlphaNumNameOrAbsent
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of a non-active Attribute Policy Object which "The name of a non-active Attribute Policy Object which
is defined for this Switch. The zero-length string is defined for this Switch. The zero-length string
indicates that no non-active Attribute Policy Object is indicates that no non-active Attribute Policy Object is
defined for this Switch. defined for this Switch.
The effect of having no rows in the t11FcSpPoNaAttribTable The effect of having no rows in the t11FcSpPoNaAttribTable
for which the value of t11FcSpPoNaAttribName is the for which the value of t11FcSpPoNaAttribName is the
skipping to change at page 128, line 48 skipping to change at page 131, line 48
t11FcSpPoNaNoMembNodeNameType, t11FcSpPoNaNoMembNodeNameType,
t11FcSpPoNaNoMembNodeName } t11FcSpPoNaNoMembNodeName }
::= { t11FcSpPoNaNoMembTable 1 } ::= { t11FcSpPoNaNoMembTable 1 }
T11FcSpPoNaNoMembEntry ::= SEQUENCE { T11FcSpPoNaNoMembEntry ::= SEQUENCE {
t11FcSpPoNaNoMembListName T11FcSpAlphaNumName, t11FcSpPoNaNoMembListName T11FcSpAlphaNumName,
t11FcSpPoNaNoMembNodeNameType T11FcSpPolicyNameType, t11FcSpPoNaNoMembNodeNameType T11FcSpPolicyNameType,
t11FcSpPoNaNoMembNodeName FcNameIdOrZero, t11FcSpPoNaNoMembNodeName FcNameIdOrZero,
t11FcSpPoNaNoMembFlags BITS, t11FcSpPoNaNoMembFlags BITS,
t11FcSpPoNaNoMembCtAccessIndex Unsigned32, t11FcSpPoNaNoMembCtAccessIndex Unsigned32,
t11FcSpPoNaNoMembAttribute T11FcSpAlphaNumNameOrNull, t11FcSpPoNaNoMembAttribute T11FcSpAlphaNumNameOrAbsent,
t11FcSpPoNaNoMembRowStatus RowStatus t11FcSpPoNaNoMembRowStatus RowStatus
} }
t11FcSpPoNaNoMembListName OBJECT-TYPE t11FcSpPoNaNoMembListName OBJECT-TYPE
SYNTAX T11FcSpAlphaNumName SYNTAX T11FcSpAlphaNumName
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of the non-active Node Membership List Object." "The name of the non-active Node Membership List Object."
skipping to change at page 131, line 27 skipping to change at page 134, line 27
t11FcSpPoNaCtDescrSpecifierIndex is the same as the value t11FcSpPoNaCtDescrSpecifierIndex is the same as the value
of this object. No such rows in t11FcSpPoNaCtDescrTable of this object. No such rows in t11FcSpPoNaCtDescrTable
has the same effect as this object's value being zero." has the same effect as this object's value being zero."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.4.1 and tables 118/119/120/121." section 7.1.4.1 and tables 118/119/120/121."
::= { t11FcSpPoNaNoMembEntry 5 } ::= { t11FcSpPoNaNoMembEntry 5 }
t11FcSpPoNaNoMembAttribute OBJECT-TYPE t11FcSpPoNaNoMembAttribute OBJECT-TYPE
SYNTAX T11FcSpAlphaNumNameOrNull SYNTAX T11FcSpAlphaNumNameOrAbsent
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of a non-active Attribute Policy Object which "The name of a non-active Attribute Policy Object which
is defined for this Node. The zero-length string indicates is defined for this Node. The zero-length string indicates
that no non-active Attribute Policy Object is defined for that no non-active Attribute Policy Object is defined for
this Node. this Node.
The effect of having no rows in the t11FcSpPoNaAttribTable The effect of having no rows in the t11FcSpPoNaAttribTable
for which the value of t11FcSpPoNaAttribName is the for which the value of t11FcSpPoNaAttribName is the
skipping to change at page 140, line 45 skipping to change at page 143, line 45
t11FcSpPoNaIpMgmtEntryNameLow, t11FcSpPoNaIpMgmtEntryNameLow,
t11FcSpPoNaIpMgmtEntryNameHigh } t11FcSpPoNaIpMgmtEntryNameHigh }
::= { t11FcSpPoNaIpMgmtTable 1 } ::= { t11FcSpPoNaIpMgmtTable 1 }
T11FcSpPoNaIpMgmtEntry ::= SEQUENCE { T11FcSpPoNaIpMgmtEntry ::= SEQUENCE {
t11FcSpPoNaIpMgmtListName T11FcSpAlphaNumName, t11FcSpPoNaIpMgmtListName T11FcSpAlphaNumName,
t11FcSpPoNaIpMgmtEntryNameType InetAddressType, t11FcSpPoNaIpMgmtEntryNameType InetAddressType,
t11FcSpPoNaIpMgmtEntryNameLow InetAddress, t11FcSpPoNaIpMgmtEntryNameLow InetAddress,
t11FcSpPoNaIpMgmtEntryNameHigh InetAddress, t11FcSpPoNaIpMgmtEntryNameHigh InetAddress,
t11FcSpPoNaIpMgmtWkpIndex Unsigned32, t11FcSpPoNaIpMgmtWkpIndex Unsigned32,
t11FcSpPoNaIpMgmtAttribute T11FcSpAlphaNumNameOrNull, t11FcSpPoNaIpMgmtAttribute T11FcSpAlphaNumNameOrAbsent,
t11FcSpPoNaIpMgmtRowStatus RowStatus t11FcSpPoNaIpMgmtRowStatus RowStatus
} }
t11FcSpPoNaIpMgmtListName OBJECT-TYPE t11FcSpPoNaIpMgmtListName OBJECT-TYPE
SYNTAX T11FcSpAlphaNumName SYNTAX T11FcSpAlphaNumName
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of a non-active Node Membership List Object." "The name of a non-active Node Membership List Object."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 7.1.7.1 and table 125." 13 June 2006, section 7.1.7.1 and table 125."
::= { t11FcSpPoNaIpMgmtEntry 1 } ::= { t11FcSpPoNaIpMgmtEntry 1 }
t11FcSpPoNaIpMgmtEntryNameType OBJECT-TYPE t11FcSpPoNaIpMgmtEntryNameType OBJECT-TYPE
SYNTAX InetAddressType SYNTAX InetAddressType { ipv4(1), ipv6(2) }
-- INTEGER { ipv4(1), ipv6(2) }
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The combination of t11FcSpPoNaIpMgmtEntryNameType, "The combination of t11FcSpPoNaIpMgmtEntryNameType,
t11FcSpPoNaIpMgmtNameLow and t11FcSpPoNaIpMgmtNameHigh t11FcSpPoNaIpMgmtNameLow and t11FcSpPoNaIpMgmtNameHigh
specify the IP Address range of this IP Management specify the IP Address range of this IP Management
Entry in the IP Management List Object. Entry in the IP Management List Object.
The FC-SP specification does not allow this address to The FC-SP specification does not allow this address to
be specified using a DNS domain name, nor does it allow be specified using a DNS domain name, nor does it allow
skipping to change at page 143, line 7 skipping to change at page 146, line 6
of this object. If there are no such rows or if the value of this object. If there are no such rows or if the value
of this object is zero, then this IP Management Entry does of this object is zero, then this IP Management Entry does
not identify any Well Known Protocols Access restrictions." not identify any Well Known Protocols Access restrictions."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.7.1 and tables 127/129." section 7.1.7.1 and tables 127/129."
::= { t11FcSpPoNaIpMgmtEntry 5 } ::= { t11FcSpPoNaIpMgmtEntry 5 }
t11FcSpPoNaIpMgmtAttribute OBJECT-TYPE t11FcSpPoNaIpMgmtAttribute OBJECT-TYPE
SYNTAX T11FcSpAlphaNumNameOrNull SYNTAX T11FcSpAlphaNumNameOrAbsent
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The name of a non-active Attribute Policy Object which "The name of a non-active Attribute Policy Object which
is defined for this IP Management entry. The zero-length is defined for this IP Management entry. The zero-length
string indicates that no non-active Attribute Policy Object string indicates that no non-active Attribute Policy Object
is defined for it. is defined for it.
The effect of having no rows in the t11FcSpPoNaAttribTable The effect of having no rows in the t11FcSpPoNaAttribTable
for which the value of t11FcSpPoNaAttribName is the same for which the value of t11FcSpPoNaAttribName is the same
skipping to change at page 145, line 6 skipping to change at page 148, line 6
INDEX { fcmInstanceIndex, t11FcSpPoFabricIndex, INDEX { fcmInstanceIndex, t11FcSpPoFabricIndex,
t11FcSpPoNaWkpDescrSpecifierIndx, t11FcSpPoNaWkpDescrSpecifierIndx,
t11FcSpPoNaWkpDescrIndex } t11FcSpPoNaWkpDescrIndex }
::= { t11FcSpPoNaWkpDescrTable 1 } ::= { t11FcSpPoNaWkpDescrTable 1 }
T11FcSpPoNaWkpDescrEntry ::= SEQUENCE { T11FcSpPoNaWkpDescrEntry ::= SEQUENCE {
t11FcSpPoNaWkpDescrSpecifierIndx Unsigned32, t11FcSpPoNaWkpDescrSpecifierIndx Unsigned32,
t11FcSpPoNaWkpDescrIndex Unsigned32, t11FcSpPoNaWkpDescrIndex Unsigned32,
t11FcSpPoNaWkpDescrFlags BITS, t11FcSpPoNaWkpDescrFlags BITS,
t11FcSpPoNaWkpDescrWkpNumber Unsigned32, t11FcSpPoNaWkpDescrWkpNumber Unsigned32,
t11FcSpPoNaWkpDescrDestPort Unsigned32, t11FcSpPoNaWkpDescrDestPort InetPortNumber,
t11FcSpPoNaWkpDescrRowStatus RowStatus t11FcSpPoNaWkpDescrRowStatus RowStatus
} }
t11FcSpPoNaWkpDescrSpecifierIndx OBJECT-TYPE t11FcSpPoNaWkpDescrSpecifierIndx OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295) SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which uniquely identifies a particular "An index value which uniquely identifies a particular
non-active Well-Known Protocol Access Specifier within non-active Well-Known Protocol Access Specifier within
skipping to change at page 146, line 35 skipping to change at page 149, line 35
instance of t11FcSpPoNaWkpDescrFlags, this object specifies instance of t11FcSpPoNaWkpDescrFlags, this object specifies
the IP protocol number of the Well-Known Protocol." the IP protocol number of the Well-Known Protocol."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.7.1 and table 131. section 7.1.7.1 and table 131.
- http://www.iana.org/assignments/protocol-numbers." - http://www.iana.org/assignments/protocol-numbers."
::= { t11FcSpPoNaWkpDescrEntry 4 } ::= { t11FcSpPoNaWkpDescrEntry 4 }
t11FcSpPoNaWkpDescrDestPort OBJECT-TYPE t11FcSpPoNaWkpDescrDestPort OBJECT-TYPE
SYNTAX Unsigned32 (0..65535) SYNTAX InetPortNumber
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"When the 'destPortWildcard' bit is set in the corresponding "When the 'destPortWildcard' bit is set in the corresponding
instance of t11FcSpPoNaWkpDescrFlags, this object specifies instance of t11FcSpPoNaWkpDescrFlags, this object specifies
the Destination (TCP/UDP) Port number of the Well-Known the Destination (TCP/UDP) Port number of the Well-Known
Protocol." Protocol. When the 'destPortWildcard' bit is reset, this
object is ignored (and can have the value zero)."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), 13 June 2006, Fibre Channel - Security Protocols (FC-SP), 13 June 2006,
section 7.1.7.1 and table 131. section 7.1.7.1 and table 131.
- http://www.iana.org/assignments/port-numbers." - http://www.iana.org/assignments/port-numbers."
::= { t11FcSpPoNaWkpDescrEntry 5 } ::= { t11FcSpPoNaWkpDescrEntry 5 }
t11FcSpPoNaWkpDescrRowStatus OBJECT-TYPE t11FcSpPoNaWkpDescrRowStatus OBJECT-TYPE
SYNTAX RowStatus SYNTAX RowStatus
MAX-ACCESS read-create MAX-ACCESS read-create
skipping to change at page 153, line 24 skipping to change at page 156, line 24
::= { t11FcSpPoNaAuthProtTable 1 } ::= { t11FcSpPoNaAuthProtTable 1 }
T11FcSpPoNaAuthProtEntry ::= SEQUENCE { T11FcSpPoNaAuthProtEntry ::= SEQUENCE {
t11FcSpPoNaAuthProtIdentifier Unsigned32, t11FcSpPoNaAuthProtIdentifier Unsigned32,
t11FcSpPoNaAuthProtPartIndex Unsigned32, t11FcSpPoNaAuthProtPartIndex Unsigned32,
t11FcSpPoNaAuthProtParams OCTET STRING, t11FcSpPoNaAuthProtParams OCTET STRING,
t11FcSpPoNaAuthProtRowStatus RowStatus t11FcSpPoNaAuthProtRowStatus RowStatus
} }
t11FcSpPoNaAuthProtIdentifier OBJECT-TYPE t11FcSpPoNaAuthProtIdentifier OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (0..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The Authentication Protocol Identifier: "The Authentication Protocol Identifier:
1 = DH-CHAP 1 = DH-CHAP
3 = FCPAP 3 = FCPAP
4 = IKEv2 4 = IKEv2
5 = IKEv2-AUTH 5 = IKEv2-AUTH
240 thru 255 = Vendor Specific Protocols 240 thru 255 = Vendor Specific Protocols
skipping to change at page 173, line 29 skipping to change at page 176, line 29
MODULE-COMPLIANCE, OBJECT-GROUP, MODULE-COMPLIANCE, OBJECT-GROUP,
NOTIFICATION-GROUP NOTIFICATION-GROUP
FROM SNMPv2-CONF -- [RFC2580] FROM SNMPv2-CONF -- [RFC2580]
InterfaceIndex, InterfaceIndex,
InterfaceIndexOrZero FROM IF-MIB -- [RFC2863] InterfaceIndexOrZero FROM IF-MIB -- [RFC2863]
fcmInstanceIndex, fcmInstanceIndex,
FcAddressIdOrZero FROM FC-MGMT-MIB -- [RFC4044] FcAddressIdOrZero FROM FC-MGMT-MIB -- [RFC4044]
T11FabricIndex FROM T11-TC-MIB -- [RFC4439] T11FabricIndex FROM T11-TC-MIB -- [RFC4439]
T11FcSpType, T11FcSpType,
T11FcSpiIndex, T11FcSpiIndex,
T11FcSpLifetimeLeft,
T11FcSpLifetimeLeftUnits,
T11FcSpSecurityProtocolId,
T11FcRoutingControl, T11FcRoutingControl,
T11FcSaDirection, T11FcSaDirection,
T11FcSpPrecedence, T11FcSpPrecedence,
T11FcSpTransforms FROM T11-FC-SP-TC-MIB; T11FcSpTransforms FROM T11-FC-SP-TC-MIB;
t11FcSpSaMIB MODULE-IDENTITY t11FcSpSaMIB MODULE-IDENTITY
LAST-UPDATED "200702190000Z" LAST-UPDATED "200801030000Z"
ORGANIZATION "T11" ORGANIZATION "This MIB module was developed through the
coordinated effort of two organizations:
T11 began the development and the IETF's IMSS
Working Group finished it."
CONTACT-INFO CONTACT-INFO
" Claudio DeSanti " Claudio DeSanti
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
EMail: cds@cisco.com EMail: cds@cisco.com
Keith McCloghrie Keith McCloghrie
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
Email: kzm@cisco.com" Email: kzm@cisco.com"
DESCRIPTION DESCRIPTION
"This MIB module specifies the management information "This MIB module specifies the management information
required to manage Security Associations established via required to manage Security Associations established via
Fibre Channel's FC-SP specification. Fibre Channel's FC-SP specification.
skipping to change at page 174, line 44 skipping to change at page 178, line 4
t11FcSpSaTSelNegOutTable and t11FcSpSaTSelSpiTable, t11FcSpSaTSelNegOutTable and t11FcSpSaTSelSpiTable,
containing information about active bidirectional pairs of containing information about active bidirectional pairs of
Security Associations; in particular, t11FcSpSaPairTable Security Associations; in particular, t11FcSpSaPairTable
has one row per active bidirectional SA pair, has one row per active bidirectional SA pair,
t11FcSpSaTSelNegInTable and t11FcSpSaTSelNegOutTable t11FcSpSaTSelNegInTable and t11FcSpSaTSelNegOutTable
contain information on the Traffic Selectors negotiated on contain information on the Traffic Selectors negotiated on
the SAs, and the t11FcSpSaTSelSpiTable is an alternate the SAs, and the t11FcSpSaTSelSpiTable is an alternate
lookup table such that the Traffic Selector(s) in use on a lookup table such that the Traffic Selector(s) in use on a
particular Security Association can be quickly determined particular Security Association can be quickly determined
based on the (ingress) SPI value; based on the (ingress) SPI value;
- a table, t11FcSpSaControlTable, of control and other - a table, t11FcSpSaControlTable, of control and other
information concerning the generation of notifications for information concerning the generation of notifications for
events related to FC-SP Security Associations; events related to FC-SP Security Associations;
- one notification, t11FcSpSaNotifyAuthFailure, generated on - one notification, t11FcSpSaNotifyAuthFailure, generated on
the occurrence of an Authentication failure for a received the occurrence of an Authentication failure for a received
FC-2 or CT_IU frame. FC-2 or CT_IU frame.
Copyright (C) The IETF Trust (2007). This version Copyright (C) The IETF Trust (2008). This version
of this MIB module is part of RFC yyyy; see the RFC of this MIB module is part of RFC yyyy; see the RFC
itself for full legal notices." itself for full legal notices."
-- RFC Editor: replace yyyy with actual RFC number & remove this note -- RFC Editor: replace yyyy with actual RFC number & remove this note
REVISION "200702190000Z" REVISION "200801030000Z"
DESCRIPTION DESCRIPTION
"Initial version of this MIB module, published as RFCyyyy." "Initial version of this MIB module, published as RFCyyyy."
-- RFC-Editor, replace yyyy with actual RFC number & remove this note -- RFC-Editor, replace yyyy with actual RFC number & remove this note
::= { mib-2 nnn } -- to be assigned by IANA ::= { mib-2 nnn } -- to be assigned by IANA
-- RFC Editor: replace nnn with IANA-assigned number & remove this note -- RFC Editor: replace nnn with IANA-assigned number & remove this note
t11FcSpSaMIBNotifications OBJECT IDENTIFIER ::= { t11FcSpSaMIB 0 } t11FcSpSaMIBNotifications OBJECT IDENTIFIER ::= { t11FcSpSaMIB 0 }
t11FcSpSaMIBObjects OBJECT IDENTIFIER ::= { t11FcSpSaMIB 1 } t11FcSpSaMIBObjects OBJECT IDENTIFIER ::= { t11FcSpSaMIB 1 }
t11FcSpSaMIBConformance OBJECT IDENTIFIER ::= { t11FcSpSaMIB 2 } t11FcSpSaMIBConformance OBJECT IDENTIFIER ::= { t11FcSpSaMIB 2 }
t11FcSpSaBase OBJECT IDENTIFIER ::= { t11FcSpSaMIBObjects 1 } t11FcSpSaBase OBJECT IDENTIFIER ::= { t11FcSpSaMIBObjects 1 }
skipping to change at page 178, line 43 skipping to change at page 182, line 19
SYNTAX StorageType SYNTAX StorageType
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This object specifies the memory realization of "This object specifies the memory realization of
information related to FC-SP Security Associations information related to FC-SP Security Associations
for interface(s) to a particular Fabric; specifically, for interface(s) to a particular Fabric; specifically,
for rows created and/or modified in these tables: for rows created and/or modified in these tables:
t11FcSpSaPropTable t11FcSpSaPropTable
t11FcSpSaTSelPropTable
t11FcSpSaTransTable
t11FcSpSaTSelDrByTable t11FcSpSaTSelDrByTable
t11FcSpSaControlTable t11FcSpSaControlTable
and, for modified information contained in the same and, for modified information contained in the same
row as an instance of this object. row as an instance of this object.
Even if an instance of this object has the value Even if an instance of this object has the value
'permanent(4)', none of the information defined in 'permanent(4)', none of the information defined in
this MIB module for interface(s) to the given Fabric this MIB module for interface(s) to the given Fabric
need to be writable." need to be writable."
skipping to change at page 184, line 24 skipping to change at page 187, line 46
the instance of t11FcSpSaIfStorageType which is INDEX-ed the instance of t11FcSpSaIfStorageType which is INDEX-ed
by the same values of fcmInstanceIndex, t11FcSpSaIfIndex by the same values of fcmInstanceIndex, t11FcSpSaIfIndex
and t11FcSpSaIfFabricIndex." and t11FcSpSaIfFabricIndex."
INDEX { fcmInstanceIndex, t11FcSpSaIfIndex, INDEX { fcmInstanceIndex, t11FcSpSaIfIndex,
t11FcSpSaIfFabricIndex, t11FcSpSaIfFabricIndex,
t11FcSpSaPropIndex } t11FcSpSaPropIndex }
::= { t11FcSpSaPropTable 1 } ::= { t11FcSpSaPropTable 1 }
T11FcSpSaPropEntry ::= SEQUENCE { T11FcSpSaPropEntry ::= SEQUENCE {
t11FcSpSaPropIndex Unsigned32, t11FcSpSaPropIndex Unsigned32,
t11FcSpSaPropSecurityProt INTEGER, t11FcSpSaPropSecurityProt T11FcSpSecurityProtocolId,
t11FcSpSaPropTSelListIndex Unsigned32, t11FcSpSaPropTSelListIndex Unsigned32,
t11FcSpSaPropTransListIndex Unsigned32, t11FcSpSaPropTransListIndex Unsigned32,
t11FcSpSaPropAcceptAlgorithm INTEGER, t11FcSpSaPropAcceptAlgorithm INTEGER,
t11FcSpSaPropOutMatchSucceeds Counter64, t11FcSpSaPropOutMatchSucceeds Counter64,
t11FcSpSaPropRowStatus RowStatus t11FcSpSaPropRowStatus RowStatus
} }
t11FcSpSaPropIndex OBJECT-TYPE t11FcSpSaPropIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which uniquely identifies a particular "An index value which uniquely identifies a particular
proposal for use on one or more interfaces to a Fabric." proposal for use on one or more interfaces to a Fabric."
::= { t11FcSpSaPropEntry 1 } ::= { t11FcSpSaPropEntry 1 }
t11FcSpSaPropSecurityProt OBJECT-TYPE t11FcSpSaPropSecurityProt OBJECT-TYPE
SYNTAX INTEGER { espHeader(1), ctAuth(2) } SYNTAX T11FcSpSecurityProtocolId
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The Security Protocol identifier for this proposal, i.e., "The Security Protocol identifier for this proposal, i.e.,
whether the proposal is for traffic to be protected using whether the proposal is for traffic to be protected using
ESP_Header or CT_Authentication." ESP_Header or CT_Authentication."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.3.2.2 and table 67." 13 June 2006, section 6.3.2.2 and table 67."
::= { t11FcSpSaPropEntry 2 } ::= { t11FcSpSaPropEntry 2 }
t11FcSpSaPropTSelListIndex OBJECT-TYPE t11FcSpSaPropTSelListIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A pointer to the proposal's list of Traffic Selectors. "When the value of this object is non-zero, it points
to the proposal's list of Traffic Selectors. The value
must be non-zero in an active row of this table.
The identified list is represented by all rows in the The identified list is represented by all rows in the
t11FcSpSaTSelPropTable for which t11FcSpSaTSelPropListIndex t11FcSpSaTSelPropTable for which t11FcSpSaTSelPropListIndex
has the same value as this object (and with corresponding has the same value as this object (and with corresponding
values of t11FcSpSaIfIndex and fcmInstanceIndex)." values of t11FcSpSaIfIndex and fcmInstanceIndex)."
::= { t11FcSpSaPropEntry 3 } ::= { t11FcSpSaPropEntry 3 }
t11FcSpSaPropTransListIndex OBJECT-TYPE t11FcSpSaPropTransListIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A pointer to the proposal's list of Transforms. "When the value of this objct is non-zero, it points to
the proposal's list of Transforms. The value must be
non-zero in an active row of this table.
The identified list is represented by all rows in the The identified list is represented by all rows in the
t11FcSpSaTransTable for which t11FcSpSaTransListIndex t11FcSpSaTransTable for which t11FcSpSaTransListIndex
has the same value as this object (and with corresponding has the same value as this object (and with corresponding
values of t11FcSpSaIfIndex and fcmInstanceIndex)." values of t11FcSpSaIfIndex and fcmInstanceIndex)."
::= { t11FcSpSaPropEntry 4 } ::= { t11FcSpSaPropEntry 4 }
t11FcSpSaPropAcceptAlgorithm OBJECT-TYPE t11FcSpSaPropAcceptAlgorithm OBJECT-TYPE
SYNTAX INTEGER { SYNTAX INTEGER {
intersection(1), intersection(1),
skipping to change at page 188, line 6 skipping to change at page 191, line 48
for corresponding values of t11FcSpSaIfIndex and for corresponding values of t11FcSpSaIfIndex and
fcmInstanceIndex. Further, the proposing and accepting fcmInstanceIndex. Further, the proposing and accepting
of Traffic Selectors is only done as a part of a proposal of Traffic Selectors is only done as a part of a proposal
specified by a row of the t11FcSpSaPropTable, i.e., specified by a row of the t11FcSpSaPropTable, i.e.,
in combination with the proposing and accepting of security in combination with the proposing and accepting of security
transforms as specified by the combination of transforms as specified by the combination of
t11FcSpSaPropTSelListIndex and t11FcSpSaPropTransListIndex t11FcSpSaPropTSelListIndex and t11FcSpSaPropTransListIndex
in one row of the t11FcSpSaPropTable. in one row of the t11FcSpSaPropTable.
The StorageType of a row in this table is specified by The StorageType of a row in this table is specified by
the instance of t11FcSpSaIfStorageType which is INDEX-ed the instance of t11FcSpSaTSelPropStorageType in that row."
by the same values of fcmInstanceIndex, t11FcSpSaIfIndex
and t11FcSpSaIfFabricIndex."
INDEX { fcmInstanceIndex, t11FcSpSaIfIndex, INDEX { fcmInstanceIndex, t11FcSpSaIfIndex,
t11FcSpSaTSelPropListIndex, t11FcSpSaTSelPropIndex } t11FcSpSaTSelPropListIndex, t11FcSpSaTSelPropPrecedence }
::= { t11FcSpSaTSelPropTable 1 } ::= { t11FcSpSaTSelPropTable 1 }
T11FcSpSaTSelPropEntry ::= SEQUENCE { T11FcSpSaTSelPropEntry ::= SEQUENCE {
t11FcSpSaTSelPropListIndex Unsigned32, t11FcSpSaTSelPropListIndex Unsigned32,
t11FcSpSaTSelPropIndex Unsigned32,
t11FcSpSaTSelPropDirection T11FcSaDirection,
t11FcSpSaTSelPropPrecedence T11FcSpPrecedence, t11FcSpSaTSelPropPrecedence T11FcSpPrecedence,
t11FcSpSaTSelPropDirection T11FcSaDirection,
t11FcSpSaTSelPropStartSrcAddr FcAddressIdOrZero, t11FcSpSaTSelPropStartSrcAddr FcAddressIdOrZero,
t11FcSpSaTSelPropEndSrcAddr FcAddressIdOrZero, t11FcSpSaTSelPropEndSrcAddr FcAddressIdOrZero,
t11FcSpSaTSelPropStartDstAddr FcAddressIdOrZero, t11FcSpSaTSelPropStartDstAddr FcAddressIdOrZero,
t11FcSpSaTSelPropEndDstAddr FcAddressIdOrZero, t11FcSpSaTSelPropEndDstAddr FcAddressIdOrZero,
t11FcSpSaTSelPropStartRCtl T11FcRoutingControl, t11FcSpSaTSelPropStartRCtl T11FcRoutingControl,
t11FcSpSaTSelPropEndRCtl T11FcRoutingControl, t11FcSpSaTSelPropEndRCtl T11FcRoutingControl,
t11FcSpSaTSelPropStartType T11FcSpType, t11FcSpSaTSelPropStartType T11FcSpType,
t11FcSpSaTSelPropEndType T11FcSpType, t11FcSpSaTSelPropEndType T11FcSpType,
t11FcSpSaTSelPropStorageType StorageType,
t11FcSpSaTSelPropRowStatus RowStatus t11FcSpSaTSelPropRowStatus RowStatus
} }
t11FcSpSaTSelPropListIndex OBJECT-TYPE t11FcSpSaTSelPropListIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which identifies a particular list of "An index value which identifies a particular list of
Traffic Selectors." Traffic Selectors."
::= { t11FcSpSaTSelPropEntry 1 } ::= { t11FcSpSaTSelPropEntry 1 }
t11FcSpSaTSelPropIndex OBJECT-TYPE t11FcSpSaTSelPropPrecedence OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX T11FcSpPrecedence
MAX-ACCESS not-accessible MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which identifies one Traffic Selector "The precedence of this Traffic Selector. Each
within of a list of Traffic Selectors." Traffic Selector within a particular list of
Traffic Selectors must have a different precedence.
If an egress frame matches multiple Traffic Selectors,
it should be transmitted on the SA associated with the
Traffic Selector having the numerically smallest
precedence value."
::= { t11FcSpSaTSelPropEntry 2 } ::= { t11FcSpSaTSelPropEntry 2 }
t11FcSpSaTSelPropDirection OBJECT-TYPE t11FcSpSaTSelPropDirection OBJECT-TYPE
SYNTAX T11FcSaDirection SYNTAX T11FcSaDirection
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An indication of whether this Traffic Selector is "An indication of whether this Traffic Selector is
to be proposed for ingress or egress traffic." to be proposed for ingress or egress traffic."
DEFVAL { egress } DEFVAL { egress }
::= { t11FcSpSaTSelPropEntry 3 } ::= { t11FcSpSaTSelPropEntry 3 }
t11FcSpSaTSelPropPrecedence OBJECT-TYPE
SYNTAX T11FcSpPrecedence
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The precedence of this Traffic Selector.
If an egress frame matches multiple Traffic Selectors,
it should be transmitted on the SA associated with the
Traffic Selector having the numerically smallest
precedence value."
::= { t11FcSpSaTSelPropEntry 4 }
t11FcSpSaTSelPropStartSrcAddr OBJECT-TYPE t11FcSpSaTSelPropStartSrcAddr OBJECT-TYPE
SYNTAX FcAddressIdOrZero (SIZE (3)) SYNTAX FcAddressIdOrZero (SIZE (3))
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically smallest 24-bit value of a source address "The numerically smallest 24-bit value of a source address
(S_ID) of a frame which will match with this Traffic (S_ID) of a frame which will match with this Traffic
Selector." Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { '000000'h } DEFVAL { '000000'h }
::= { t11FcSpSaTSelPropEntry 5 } ::= { t11FcSpSaTSelPropEntry 4 }
t11FcSpSaTSelPropEndSrcAddr OBJECT-TYPE t11FcSpSaTSelPropEndSrcAddr OBJECT-TYPE
SYNTAX FcAddressIdOrZero (SIZE (3)) SYNTAX FcAddressIdOrZero (SIZE (3))
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically largest 24-bit value of a source address "The numerically largest 24-bit value of a source address
(S_ID) of a frame which will match with this Traffic (S_ID) of a frame which will match with this Traffic
Selector." Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { 'FFFFFF'h } DEFVAL { 'FFFFFF'h }
::= { t11FcSpSaTSelPropEntry 6 } ::= { t11FcSpSaTSelPropEntry 5 }
t11FcSpSaTSelPropStartDstAddr OBJECT-TYPE t11FcSpSaTSelPropStartDstAddr OBJECT-TYPE
SYNTAX FcAddressIdOrZero (SIZE (3)) SYNTAX FcAddressIdOrZero (SIZE (3))
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically smallest 24-bit value of a destination "The numerically smallest 24-bit value of a destination
address (D_ID) of a frame which will match with this address (D_ID) of a frame which will match with this
Traffic Selector." Traffic Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { '000000'h } DEFVAL { '000000'h }
::= { t11FcSpSaTSelPropEntry 7 } ::= { t11FcSpSaTSelPropEntry 6 }
t11FcSpSaTSelPropEndDstAddr OBJECT-TYPE t11FcSpSaTSelPropEndDstAddr OBJECT-TYPE
SYNTAX FcAddressIdOrZero (SIZE (3)) SYNTAX FcAddressIdOrZero (SIZE (3))
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically largest 24-bit value of a destination "The numerically largest 24-bit value of a destination
address (D_ID) of a frame which will match with this address (D_ID) of a frame which will match with this
Traffic Selector." Traffic Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { 'FFFFFF'h } DEFVAL { 'FFFFFF'h }
::= { t11FcSpSaTSelPropEntry 8 } ::= { t11FcSpSaTSelPropEntry 7 }
t11FcSpSaTSelPropStartRCtl OBJECT-TYPE t11FcSpSaTSelPropStartRCtl OBJECT-TYPE
SYNTAX T11FcRoutingControl SYNTAX T11FcRoutingControl
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically smallest 8-bit value contained within a "The numerically smallest 8-bit value contained within a
Routing Control (R_CTL) field of a frame which will match Routing Control (R_CTL) field of a frame which will match
with this Traffic Selector." with this Traffic Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { '00'h } DEFVAL { '00'h }
::= { t11FcSpSaTSelPropEntry 9 } ::= { t11FcSpSaTSelPropEntry 8 }
t11FcSpSaTSelPropEndRCtl OBJECT-TYPE t11FcSpSaTSelPropEndRCtl OBJECT-TYPE
SYNTAX T11FcRoutingControl SYNTAX T11FcRoutingControl
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically largest 8-bit value contained within a "The numerically largest 8-bit value contained within a
Routing Control (R_CTL) field of a frame which will match Routing Control (R_CTL) field of a frame which will match
with this Traffic Selector." with this Traffic Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { 'FF'h } DEFVAL { 'FF'h }
::= { t11FcSpSaTSelPropEntry 10 } ::= { t11FcSpSaTSelPropEntry 9 }
t11FcSpSaTSelPropStartType OBJECT-TYPE t11FcSpSaTSelPropStartType OBJECT-TYPE
SYNTAX T11FcSpType SYNTAX T11FcSpType
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically smallest of a range of possible 'type' "The numerically smallest of a range of possible 'type'
values of frames which will match with this Traffic values of frames which will match with this Traffic
Selector." Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { '0000'h } DEFVAL { '0000'h }
::= { t11FcSpSaTSelPropEntry 11 } ::= { t11FcSpSaTSelPropEntry 10 }
t11FcSpSaTSelPropEndType OBJECT-TYPE t11FcSpSaTSelPropEndType OBJECT-TYPE
SYNTAX T11FcSpType SYNTAX T11FcSpType
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The numerically largest of a range of possible 'type' "The numerically largest of a range of possible 'type'
values of frames which will match with this Traffic values of frames which will match with this Traffic
Selector." Selector."
REFERENCE REFERENCE
"- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "- INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.4.5." 13 June 2006, section 6.4.5."
DEFVAL { 'FFFF'h } DEFVAL { 'FFFF'h }
::= { t11FcSpSaTSelPropEntry 11 }
t11FcSpSaTSelPropStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object specifies the memory realization of
the information in this row.
Even if an instance of this object has the value
'permanent(4)', none of the information in its row
needs to be writable."
::= { t11FcSpSaTSelPropEntry 12 } ::= { t11FcSpSaTSelPropEntry 12 }
t11FcSpSaTSelPropRowStatus OBJECT-TYPE t11FcSpSaTSelPropRowStatus OBJECT-TYPE
SYNTAX RowStatus SYNTAX RowStatus
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The status of this row. Values of object instances "The status of this row. Values of object instances
within the row can be modified at any time." within the row can be modified at any time."
::= { t11FcSpSaTSelPropEntry 13 } ::= { t11FcSpSaTSelPropEntry 13 }
skipping to change at page 193, line 16 skipping to change at page 197, line 16
t11FcSpSaPropTable, i.e., in combination with the proposing t11FcSpSaPropTable, i.e., in combination with the proposing
and accepting of Traffic Selectors as specified by the and accepting of Traffic Selectors as specified by the
combination of t11FcSpSaPropTSelListIndex and combination of t11FcSpSaPropTSelListIndex and
t11FcSpSaPropTransListIndex in one row of the t11FcSpSaPropTransListIndex in one row of the
t11FcSpSaPropTable. t11FcSpSaPropTable.
The security (encryption and integrity) transform in use on The security (encryption and integrity) transform in use on
an SA pair is indicated by having the pair's values of an SA pair is indicated by having the pair's values of
t11FcSpSaPairTransListIndex and t11FcSpSaPairTransIndex t11FcSpSaPairTransListIndex and t11FcSpSaPairTransIndex
contain the values of t11FcSpSaTransListIndex and contain the values of t11FcSpSaTransListIndex and
t11FcSpSaTransListIndex for the transform's row in this t11FcSpSaTransIndex for the transform's row in this table.
table.
The StorageType of a row in this table is specified by The StorageType of a row in this table is specified by
the instance of t11FcSpSaIfStorageType which is INDEX-ed the instance of t11FcSpSaTransStorageType in that row."
by the same values of fcmInstanceIndex, t11FcSpSaIfIndex
and t11FcSpSaIfFabricIndex."
INDEX { fcmInstanceIndex, t11FcSpSaIfIndex, INDEX { fcmInstanceIndex, t11FcSpSaIfIndex,
t11FcSpSaTransListIndex, t11FcSpSaTransIndex } t11FcSpSaTransListIndex, t11FcSpSaTransIndex }
::= { t11FcSpSaTransTable 1 } ::= { t11FcSpSaTransTable 1 }
T11FcSpSaTransEntry ::= SEQUENCE { T11FcSpSaTransEntry ::= SEQUENCE {
t11FcSpSaTransListIndex Unsigned32, t11FcSpSaTransListIndex Unsigned32,
t11FcSpSaTransIndex Unsigned32, t11FcSpSaTransIndex Unsigned32,
t11FcSpSaTransSecurityProt INTEGER, t11FcSpSaTransSecurityProt T11FcSpSecurityProtocolId,
t11FcSpSaTransEncryptAlg AutonomousType, t11FcSpSaTransEncryptAlg AutonomousType,
t11FcSpSaTransEncryptKeyLen Unsigned32, t11FcSpSaTransEncryptKeyLen Unsigned32,
t11FcSpSaTransIntegrityAlg AutonomousType, t11FcSpSaTransIntegrityAlg AutonomousType,
t11FcSpSaTransStorageType StorageType,
t11FcSpSaTransRowStatus RowStatus t11FcSpSaTransRowStatus RowStatus
} }
t11FcSpSaTransListIndex OBJECT-TYPE t11FcSpSaTransListIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which uniquely identifies a particular "An index value which uniquely identifies a particular
list of security transforms to be proposed, to be accepted, list of security transforms to be proposed, to be accepted,
or already agreed upon." or already agreed upon."
::= { t11FcSpSaTransEntry 1 } ::= { t11FcSpSaTransEntry 1 }
t11FcSpSaTransIndex OBJECT-TYPE t11FcSpSaTransIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which uniquely identifies one security "An index value which uniquely identifies one security
transform within a list identified by transform within a list identified by
t11FcSpSaTransListIndex." t11FcSpSaTransListIndex."
::= { t11FcSpSaTransEntry 2 } ::= { t11FcSpSaTransEntry 2 }
t11FcSpSaTransSecurityProt OBJECT-TYPE t11FcSpSaTransSecurityProt OBJECT-TYPE
SYNTAX INTEGER { espHeader(1), ctAuth(2) } SYNTAX T11FcSpSecurityProtocolId
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The Security Protocol identifier which indicates "The Security Protocol identifier which indicates
whether this transform is for traffic to be protected whether this transform is for traffic to be protected
using ESP_Header or using CT_Authentication." using ESP_Header or using CT_Authentication."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.3.2.2 and table 67." 13 June 2006, section 6.3.2.2 and table 67."
skipping to change at page 195, line 21 skipping to change at page 199, line 19
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The Integrity Algorithm for this transform." "The Integrity Algorithm for this transform."
REFERENCE REFERENCE
"INCITS xxx/200x, T11/Project 1570-D/Rev 1.8, "INCITS xxx/200x, T11/Project 1570-D/Rev 1.8,
Fibre Channel - Security Protocols (FC-SP), Fibre Channel - Security Protocols (FC-SP),
13 June 2006, section 6.3.2.3 and tables 69 & 72." 13 June 2006, section 6.3.2.3 and tables 69 & 72."
::= { t11FcSpSaTransEntry 6 } ::= { t11FcSpSaTransEntry 6 }
t11FcSpSaTransStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object specifies the memory realization of
the information in this row.
Even if an instance of this object has the value
'permanent(4)', none of the information in its row
needs to be writable."
::= { t11FcSpSaTransEntry 7 }
t11FcSpSaTransRowStatus OBJECT-TYPE t11FcSpSaTransRowStatus OBJECT-TYPE
SYNTAX RowStatus SYNTAX RowStatus
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The status of this row. "The status of this row.
When an instance of t11FcSpSaPairTransListIndex points to When an instance of t11FcSpSaPairTransListIndex points to
a row in this table, values of object instances in the row a row in this table, values of object instances in the row
cannot be modified nor can the row be deleted. Otherwise, cannot be modified nor can the row be deleted. Otherwise,
a row can be modified or deleted at any time." a row can be modified or deleted at any time."
::= { t11FcSpSaTransEntry 7 } ::= { t11FcSpSaTransEntry 8 }
-- --
-- Traffic Selectors for Drop & Bypass -- Traffic Selectors for Drop & Bypass
-- --
t11FcSpSaTSelDrByTable OBJECT-TYPE t11FcSpSaTSelDrByTable OBJECT-TYPE
SYNTAX SEQUENCE OF T11FcSpSaTSelDrByEntry SYNTAX SEQUENCE OF T11FcSpSaTSelDrByEntry
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
skipping to change at page 201, line 10 skipping to change at page 205, line 10
t11FcSpSaIfFabricIndex), managed as part of the Fibre t11FcSpSaIfFabricIndex), managed as part of the Fibre
Channel management instance identified by Channel management instance identified by
fcmInstanceIndex." fcmInstanceIndex."
INDEX { fcmInstanceIndex, t11FcSpSaPairIfIndex, INDEX { fcmInstanceIndex, t11FcSpSaPairIfIndex,
t11FcSpSaIfFabricIndex, t11FcSpSaPairInboundSpi } t11FcSpSaIfFabricIndex, t11FcSpSaPairInboundSpi }
::= { t11FcSpSaPairTable 1 } ::= { t11FcSpSaPairTable 1 }
T11FcSpSaPairEntry ::= SEQUENCE { T11FcSpSaPairEntry ::= SEQUENCE {
t11FcSpSaPairIfIndex InterfaceIndex, t11FcSpSaPairIfIndex InterfaceIndex,
t11FcSpSaPairInboundSpi T11FcSpiIndex, t11FcSpSaPairInboundSpi T11FcSpiIndex,
t11FcSpSaPairSecurityProt INTEGER, t11FcSpSaPairSecurityProt T11FcSpSecurityProtocolId,
t11FcSpSaPairTransListIndex Unsigned32, t11FcSpSaPairTransListIndex Unsigned32,
t11FcSpSaPairTransIndex Unsigned32, t11FcSpSaPairTransIndex Unsigned32,
t11FcSpSaPairLifetimeLeft Unsigned32, t11FcSpSaPairLifetimeLeft Unsigned32,
t11FcSpSaPairLifetimeLeftUnits INTEGER, t11FcSpSaPairLifetimeLeftUnits INTEGER,
t11FcSpSaPairTerminate INTEGER, t11FcSpSaPairTerminate INTEGER,
t11FcSpSaPairInProtUnMatchs Counter64, t11FcSpSaPairInProtUnMatchs Counter64,
t11FcSpSaPairInDetReplays Counter64, t11FcSpSaPairInDetReplays Counter64,
t11FcSpSaPairInBadXforms Counter64, t11FcSpSaPairInBadXforms Counter64,
t11FcSpSaPairInGoodXforms Counter64 t11FcSpSaPairInGoodXforms Counter64
} }
skipping to change at page 201, line 41 skipping to change at page 205, line 41
t11FcSpSaPairInboundSpi OBJECT-TYPE t11FcSpSaPairInboundSpi OBJECT-TYPE
SYNTAX T11FcSpiIndex SYNTAX T11FcSpiIndex
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The SPI value which is used to indicate that an incoming "The SPI value which is used to indicate that an incoming
frame was received on the ingress SA of this SA pair." frame was received on the ingress SA of this SA pair."
::= { t11FcSpSaPairEntry 2 } ::= { t11FcSpSaPairEntry 2 }
t11FcSpSaPairSecurityProt OBJECT-TYPE t11FcSpSaPairSecurityProt OBJECT-TYPE
SYNTAX INTEGER { espHeader(1), ctAuth(2) } SYNTAX T11FcSpSecurityProtocolId
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The object indicates whether this SA uses ESP_Header to "The object indicates whether this SA uses ESP_Header to
protect FC-2 frames, or CT_Authentication to protect Common protect FC-2 frames, or CT_Authentication to protect Common
Transport Information Units (CT_IUs)." Transport Information Units (CT_IUs)."
::= { t11FcSpSaPairEntry 3 } ::= { t11FcSpSaPairEntry 3 }
t11FcSpSaPairTransListIndex OBJECT-TYPE t11FcSpSaPairTransListIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The combination of this value and the value of the "The combination of this value and the value of the
corresponding instance of t11FcSpSaPairTransIndex corresponding instance of t11FcSpSaPairTransIndex
identify the row in the t11FcSpSaTransTable which identify the row in the t11FcSpSaTransTable which
contains the transforms which are in use on this SA pair." contains the transforms which are in use on this SA pair."
::= { t11FcSpSaPairEntry 4 } ::= { t11FcSpSaPairEntry 4 }
t11FcSpSaPairTransIndex OBJECT-TYPE t11FcSpSaPairTransIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The combination of this value and the value of the "The combination of this value and the value of the
corresponding instance of t11FcSpSaPairTransListIndex corresponding instance of t11FcSpSaPairTransListIndex
identify the row in the t11FcSpSaTransTable which identify the row in the t11FcSpSaTransTable which
contains the transforms which are in use on this SA pair." contains the transforms which are in use on this SA pair."
::= { t11FcSpSaPairEntry 5 } ::= { t11FcSpSaPairEntry 5 }
t11FcSpSaPairLifetimeLeft OBJECT-TYPE t11FcSpSaPairLifetimeLeft OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX T11FcSpLifetimeLeft
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The remaining lifetime of this SA pair, given in the "The remaining lifetime of this SA pair, given in the
units specified by the value of the corresponding units specified by the value of the corresponding
instance of t11FcSpSaPairLifetimeLeft." instance of t11FcSpSaPairLifetimeLeft."
::= { t11FcSpSaPairEntry 6 } ::= { t11FcSpSaPairEntry 6 }
t11FcSpSaPairLifetimeLeftUnits OBJECT-TYPE t11FcSpSaPairLifetimeLeftUnits OBJECT-TYPE
SYNTAX INTEGER { SYNTAX T11FcSpLifetimeLeftUnits
seconds(1), -- seconds
kiloBytes(2), -- 10^^3 bytes
megaBytes(3), -- 10^^6 bytes
gigaBytes(4), -- 10^^9 bytes
teraBytes(5), -- 10^^12 bytes
petaBytes(6), -- 10^^15 bytes
exaBytes(7), -- 10^^18 bytes
zettaBytes(8), -- 10^^21 bytes
yottaBytes(9) -- 10^^24 bytes
}
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The units in which the value of the corresponding "The units in which the value of the corresponding
instance of t11FcSpSaPairLifetimeLeft specifies the instance of t11FcSpSaPairLifetimeLeft specifies the
remaining lifetime of this SA pair." remaining lifetime of this SA pair."
::= { t11FcSpSaPairEntry 7 } ::= { t11FcSpSaPairEntry 7 }
t11FcSpSaPairTerminate OBJECT-TYPE t11FcSpSaPairTerminate OBJECT-TYPE
SYNTAX INTEGER { noop(1), terminate(2) } SYNTAX INTEGER { noop(1), terminate(2) }
skipping to change at page 206, line 9 skipping to change at page 209, line 27
t11FcSpSaTSelNegInStartDstAddr FcAddressIdOrZero, t11FcSpSaTSelNegInStartDstAddr FcAddressIdOrZero,
t11FcSpSaTSelNegInEndDstAddr FcAddressIdOrZero, t11FcSpSaTSelNegInEndDstAddr FcAddressIdOrZero,
t11FcSpSaTSelNegInStartRCtl T11FcRoutingControl, t11FcSpSaTSelNegInStartRCtl T11FcRoutingControl,
t11FcSpSaTSelNegInEndRCtl T11FcRoutingControl, t11FcSpSaTSelNegInEndRCtl T11FcRoutingControl,
t11FcSpSaTSelNegInStartType T11FcSpType, t11FcSpSaTSelNegInStartType T11FcSpType,
t11FcSpSaTSelNegInEndType T11FcSpType, t11FcSpSaTSelNegInEndType T11FcSpType,
t11FcSpSaTSelNegInUnpMtchDrops Counter64 t11FcSpSaTSelNegInUnpMtchDrops Counter64
} }
t11FcSpSaTSelNegInIndex OBJECT-TYPE t11FcSpSaTSelNegInIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value to distinguish an ingress Traffic Selector "An index value to distinguish an ingress Traffic Selector
from all others currently in use by Security Associations from all others currently in use by Security Associations
on the same interface to a particular Fabric." on the same interface to a particular Fabric."
::= { t11FcSpSaTSelNegInEntry 1 } ::= { t11FcSpSaTSelNegInEntry 1 }
t11FcSpSaTSelNegInInboundSpi OBJECT-TYPE t11FcSpSaTSelNegInInboundSpi OBJECT-TYPE
SYNTAX T11FcSpiIndex SYNTAX T11FcSpiIndex
skipping to change at page 213, line 9 skipping to change at page 216, line 13
t11FcSpSaIfFabricIndex), and managed as part of the Fibre t11FcSpSaIfFabricIndex), and managed as part of the Fibre
Channel management instance identified by fcmInstanceIndex." Channel management instance identified by fcmInstanceIndex."
INDEX { fcmInstanceIndex, t11FcSpSaPairIfIndex, INDEX { fcmInstanceIndex, t11FcSpSaPairIfIndex,
t11FcSpSaIfFabricIndex, t11FcSpSaIfFabricIndex,
t11FcSpSaTSelSpiInboundSpi, t11FcSpSaTSelSpiTrafSelIndex } t11FcSpSaTSelSpiInboundSpi, t11FcSpSaTSelSpiTrafSelIndex }
::= { t11FcSpSaTSelSpiTable 1 } ::= { t11FcSpSaTSelSpiTable 1 }
T11FcSpSaTSelSpiEntry ::= SEQUENCE { T11FcSpSaTSelSpiEntry ::= SEQUENCE {
t11FcSpSaTSelSpiInboundSpi T11FcSpiIndex, t11FcSpSaTSelSpiInboundSpi T11FcSpiIndex,
t11FcSpSaTSelSpiTrafSelIndex Unsigned32, t11FcSpSaTSelSpiTrafSelIndex Unsigned32,
t11FcSpSaTSelSpiDirection INTEGER, t11FcSpSaTSelSpiDirection T11FcSaDirection,
t11FcSpSaTSelSpiTrafSelPtr Unsigned32 t11FcSpSaTSelSpiTrafSelPtr Unsigned32
} }
t11FcSpSaTSelSpiInboundSpi OBJECT-TYPE t11FcSpSaTSelSpiInboundSpi OBJECT-TYPE
SYNTAX T11FcSpiIndex SYNTAX T11FcSpiIndex
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An SPI value which identifies the ingress Security "An SPI value which identifies the ingress Security
Association of a particular SA pair." Association of a particular SA pair."
::= { t11FcSpSaTSelSpiEntry 1 } ::= { t11FcSpSaTSelSpiEntry 1 }
t11FcSpSaTSelSpiTrafSelIndex OBJECT-TYPE t11FcSpSaTSelSpiTrafSelIndex OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An index value which distinguishes between the "An index value which distinguishes between the
(potentially multiple) Traffic Selectors in use on (potentially multiple) Traffic Selectors in use on
this Security Association pair." this Security Association pair."
::= { t11FcSpSaTSelSpiEntry 2 } ::= { t11FcSpSaTSelSpiEntry 2 }
t11FcSpSaTSelSpiDirection OBJECT-TYPE t11FcSpSaTSelSpiDirection OBJECT-TYPE
SYNTAX T11FcSaDirection SYNTAX T11FcSaDirection
skipping to change at page 215, line 47 skipping to change at page 218, line 47
T11FcSpSaControlEntry ::= SEQUENCE { T11FcSpSaControlEntry ::= SEQUENCE {
t11FcSpSaControlAuthFailEnable TruthValue, t11FcSpSaControlAuthFailEnable TruthValue,
t11FcSpSaControlInboundSpi T11FcSpiIndex, t11FcSpSaControlInboundSpi T11FcSpiIndex,
t11FcSpSaControlSource FcAddressIdOrZero, t11FcSpSaControlSource FcAddressIdOrZero,
t11FcSpSaControlDestination FcAddressIdOrZero, t11FcSpSaControlDestination FcAddressIdOrZero,
t11FcSpSaControlFrame OCTET STRING, t11FcSpSaControlFrame OCTET STRING,
t11FcSpSaControlElapsed TimeTicks, t11FcSpSaControlElapsed TimeTicks,
t11FcSpSaControlSuppressed Gauge32, t11FcSpSaControlSuppressed Gauge32,
t11FcSpSaControlWindow Unsigned32, t11FcSpSaControlWindow Unsigned32,
t11FcSpSaControlMaxNotifs Unsigned32,
t11FcSpSaControlLifeExcdEnable TruthValue, t11FcSpSaControlLifeExcdEnable TruthValue,
t11FcSpSaControlLifeExcdSpi T11FcSpiIndex, t11FcSpSaControlLifeExcdSpi T11FcSpiIndex,
t11FcSpSaControlLifeExcdDir T11FcSaDirection, t11FcSpSaControlLifeExcdDir T11FcSaDirection,
t11FcSpSaControlLifeExcdTime TimeStamp t11FcSpSaControlLifeExcdTime TimeStamp
} }
t11FcSpSaControlAuthFailEnable OBJECT-TYPE t11FcSpSaControlAuthFailEnable OBJECT-TYPE
SYNTAX TruthValue SYNTAX TruthValue
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
skipping to change at page 218, line 17 skipping to change at page 221, line 18
The value of this object is reset to zero on a restart The value of this object is reset to zero on a restart
of the network management subsystem, and whenever a of the network management subsystem, and whenever a
t11FcSpSaNotifyAuthFailure notification is generated. t11FcSpSaNotifyAuthFailure notification is generated.
In the event that the value of this object reaches its In the event that the value of this object reaches its
maximum value, it remains at that value until it is maximum value, it remains at that value until it is
reset on the generation of the next reset on the generation of the next
t11FcSpSaNotifyAuthFailure notification." t11FcSpSaNotifyAuthFailure notification."
::= { t11FcSpSaControlEntry 7 } ::= { t11FcSpSaControlEntry 7 }
t11FcSpSaControlWindow OBJECT-TYPE t11FcSpSaControlWindow OBJECT-TYPE
SYNTAX Unsigned32 SYNTAX Unsigned32 (1..4294967295)
UNITS "seconds" UNITS "seconds"
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The length of a time window which begins when a "The length of a time window which begins when a
t11FcSpSaNotifyAuthFailure notification is generated. t11FcSpSaNotifyAuthFailure notification is generated for
Subsequent Authentication failures occurring on the any Security Association on a particular Fabric. For the
same Fabric in the same time window are counted but no duration of the time window, further Authentication failures
t11FcSpSaNotifyAuthFailure notification is generated. occurring for the same Security Association are counted but
no t11FcSpSaNotifyAuthFailure notification is generated.
When this object is modified before the end of a time When this object is modified before the end of a time
window, that time window is immediately terminated, i.e., window, that time window is immediately terminated, i.e.,
the next Authentication failure on the relevant Fabric the next Authentication failure on the relevant Fabric
after the modification will cause a new time window to after the modification will cause a new time window to
begin with the new length." begin with the new length."
DEFVAL { 300 } DEFVAL { 300 }
::= { t11FcSpSaControlEntry 8 } ::= { t11FcSpSaControlEntry 8 }
t11FcSpSaControlMaxNotifs OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of t11FcSpSaNotifyAuthFailure
notifications to be generated per Fabric within a
t11FcSpSaControlWindow time window. Subsequent
Authentication failures occurring on the same Fabric
in the same time window are counted but no
t11FcSpSaNotifyAuthFailure notification is generated.
When this object is modified before the end of a time
window, that time window is immediately terminated, i.e.,
the next Authentication failure on the relevant Fabric
after the modification will cause a new time window to
begin with the new length."
DEFVAL { 16 }
::= { t11FcSpSaControlEntry 9 }
t11FcSpSaControlLifeExcdEnable OBJECT-TYPE t11FcSpSaControlLifeExcdEnable OBJECT-TYPE
SYNTAX TruthValue SYNTAX TruthValue
MAX-ACCESS read-write MAX-ACCESS read-write
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This object specifies whether t11FcSpSaNotifyLifeExceeded "This object specifies whether t11FcSpSaNotifyLifeExceeded
notifications should be generated for this Fabric." notifications should be generated for this Fabric."
DEFVAL { true } DEFVAL { true }
::= { t11FcSpSaControlEntry 9 } ::= { t11FcSpSaControlEntry 10 }
t11FcSpSaControlLifeExcdSpi OBJECT-TYPE t11FcSpSaControlLifeExcdSpi OBJECT-TYPE
SYNTAX T11FcSpiIndex SYNTAX T11FcSpiIndex
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The SPI of the SA which was most recently terminated "The SPI of the SA which was most recently terminated
because its lifetime (in seconds or in passed bytes) because its lifetime (in seconds or in passed bytes)
was exceeded. Such terminations include those due to was exceeded. Such terminations include those due to
a failed attempt to renew an SA after its lifetime was a failed attempt to renew an SA after its lifetime was
exceeded." exceeded."
::= { t11FcSpSaControlEntry 10 } ::= { t11FcSpSaControlEntry 11 }
t11FcSpSaControlLifeExcdDir OBJECT-TYPE t11FcSpSaControlLifeExcdDir OBJECT-TYPE
SYNTAX T11FcSaDirection SYNTAX T11FcSaDirection
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The direction of frame transmission on the SA which was "The direction of frame transmission on the SA which was
most recently terminated because its lifetime (in seconds most recently terminated because its lifetime (in seconds
or in passed bytes) was exceeded." or in passed bytes) was exceeded."
::= { t11FcSpSaControlEntry 11 } ::= { t11FcSpSaControlEntry 12 }
t11FcSpSaControlLifeExcdTime OBJECT-TYPE t11FcSpSaControlLifeExcdTime OBJECT-TYPE
SYNTAX TimeStamp SYNTAX TimeStamp
MAX-ACCESS read-only MAX-ACCESS read-only
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The time of the most recent termination of an SA "The time of the most recent termination of an SA
due to its lifetime (in seconds or in passed bytes) due to its lifetime (in seconds or in passed bytes)
being exceeded. Such terminations include those being exceeded. Such terminations include those
due to a failed attempt to renew an SA after its due to a failed attempt to renew an SA after its
lifetime was exceeded." lifetime was exceeded."
::= { t11FcSpSaControlEntry 12 } ::= { t11FcSpSaControlEntry 13 }
-- --
-- Notification definitions -- Notification definitions
-- --
t11FcSpSaNotifyAuthFailure NOTIFICATION-TYPE t11FcSpSaNotifyAuthFailure NOTIFICATION-TYPE
OBJECTS { t11FcSpSaControlInboundSpi, OBJECTS { t11FcSpSaControlInboundSpi,
t11FcSpSaControlSource, t11FcSpSaControlSource,
t11FcSpSaControlDestination, t11FcSpSaControlDestination,
t11FcSpSaControlFrame, t11FcSpSaControlFrame,
skipping to change at page 221, line 41 skipping to change at page 225, line 4
t11FcSpSaNotificationGroup t11FcSpSaNotificationGroup
} }
-- The following is an auxiliary (listed in an INDEX clause) -- The following is an auxiliary (listed in an INDEX clause)
-- object for which the SMIv2 does not allow an OBJECT clause -- object for which the SMIv2 does not allow an OBJECT clause
-- to be specified, but for which this MIB has the following -- to be specified, but for which this MIB has the following
-- compliance requirement: -- compliance requirement:
-- OBJECT t11FcSpSaIfIndex -- OBJECT t11FcSpSaIfIndex
-- DESCRIPTION -- DESCRIPTION
-- Compliance requires support for either one of: -- Compliance requires support for either one of:
-- - individual interfaces using ifIndex values, or -- - individual interfaces using ifIndex values, or
-- - the use of the zero value. -- - the use of the zero value.
-- Write access is not required for any objects in this MIB module: -- Write access is not required for any objects in this MIB module:
OBJECT t11FcSpSaIfStorageType OBJECT t11FcSpSaIfStorageType
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTSelPropStorageType
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTransStorageType
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaIfReplayPrevention OBJECT t11FcSpSaIfReplayPrevention
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaIfReplayWindowSize OBJECT t11FcSpSaIfReplayWindowSize
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaIfTerminateAllSas OBJECT t11FcSpSaIfTerminateAllSas
MIN-ACCESS read-only MIN-ACCESS read-only
skipping to change at page 222, line 33 skipping to change at page 226, line 4
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaPropTransListIndex OBJECT t11FcSpSaPropTransListIndex
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaPropAcceptAlgorithm OBJECT t11FcSpSaPropAcceptAlgorithm
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaPropRowStatus OBJECT t11FcSpSaPropRowStatus
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTSelPropDirection OBJECT t11FcSpSaTSelPropDirection
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTSelPropPrecedence
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTSelPropStartSrcAddr OBJECT t11FcSpSaTSelPropStartSrcAddr
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTSelPropEndSrcAddr OBJECT t11FcSpSaTSelPropEndSrcAddr
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTSelPropStartDstAddr OBJECT t11FcSpSaTSelPropStartDstAddr
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaTSelPropEndDstAddr OBJECT t11FcSpSaTSelPropEndDstAddr
MIN-ACCESS read-only MIN-ACCESS read-only
skipping to change at page 225, line 18 skipping to change at page 228, line 30
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaControlAuthFailEnable OBJECT t11FcSpSaControlAuthFailEnable
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaControlWindow OBJECT t11FcSpSaControlWindow
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaControlMaxNotifs
MIN-ACCESS read-only
DESCRIPTION "Write access is not required."
OBJECT t11FcSpSaControlLifeExcdEnable OBJECT t11FcSpSaControlLifeExcdEnable
MIN-ACCESS read-only MIN-ACCESS read-only
DESCRIPTION "Write access is not required." DESCRIPTION "Write access is not required."
::= { t11FcSpSaMIBCompliances 1 } ::= { t11FcSpSaMIBCompliances 1 }
-- Units of Conformance -- Units of Conformance
t11FcSpSaCapabilityGroup OBJECT-GROUP t11FcSpSaCapabilityGroup OBJECT-GROUP
OBJECTS { t11FcSpSaIfEspHeaderCapab, OBJECTS { t11FcSpSaIfEspHeaderCapab,
skipping to change at page 226, line 32 skipping to change at page 229, line 48
::= { t11FcSpSaMIBGroups 3 } ::= { t11FcSpSaMIBGroups 3 }
t11FcSpSaProposalGroup OBJECT-GROUP t11FcSpSaProposalGroup OBJECT-GROUP
OBJECTS { t11FcSpSaPropSecurityProt, OBJECTS { t11FcSpSaPropSecurityProt,
t11FcSpSaPropTSelListIndex, t11FcSpSaPropTSelListIndex,
t11FcSpSaPropTransListIndex, t11FcSpSaPropTransListIndex,
t11FcSpSaPropAcceptAlgorithm, t11FcSpSaPropAcceptAlgorithm,
t11FcSpSaPropOutMatchSucceeds, t11FcSpSaPropOutMatchSucceeds,
t11FcSpSaPropRowStatus, t11FcSpSaPropRowStatus,
t11FcSpSaTSelPropDirection, t11FcSpSaTSelPropDirection,
t11FcSpSaTSelPropPrecedence,
t11FcSpSaTSelPropStartSrcAddr, t11FcSpSaTSelPropStartSrcAddr,
t11FcSpSaTSelPropEndSrcAddr, t11FcSpSaTSelPropEndSrcAddr,
t11FcSpSaTSelPropStartDstAddr, t11FcSpSaTSelPropStartDstAddr,
t11FcSpSaTSelPropEndDstAddr, t11FcSpSaTSelPropEndDstAddr,
t11FcSpSaTSelPropStartRCtl, t11FcSpSaTSelPropStartRCtl,
t11FcSpSaTSelPropEndRCtl, t11FcSpSaTSelPropEndRCtl,
t11FcSpSaTSelPropStartType, t11FcSpSaTSelPropStartType,
t11FcSpSaTSelPropEndType, t11FcSpSaTSelPropEndType,
t11FcSpSaTSelPropStorageType,
t11FcSpSaTSelPropRowStatus t11FcSpSaTSelPropRowStatus
} }
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A collection of objects containing information "A collection of objects containing information
related to making and accepting proposals for related to making and accepting proposals for
FC-SP Security Associations." FC-SP Security Associations."
::= { t11FcSpSaMIBGroups 4 } ::= { t11FcSpSaMIBGroups 4 }
t11FcSpSaDropBypassGroup OBJECT-GROUP t11FcSpSaDropBypassGroup OBJECT-GROUP
skipping to change at page 227, line 40 skipping to change at page 231, line 11
t11FcSpSaPairLifetimeLeftUnits, t11FcSpSaPairLifetimeLeftUnits,
t11FcSpSaPairTerminate, t11FcSpSaPairTerminate,
t11FcSpSaPairInProtUnMatchs, t11FcSpSaPairInProtUnMatchs,
t11FcSpSaPairInDetReplays, t11FcSpSaPairInDetReplays,
t11FcSpSaPairInBadXforms, t11FcSpSaPairInBadXforms,
t11FcSpSaPairInGoodXforms, t11FcSpSaPairInGoodXforms,
t11FcSpSaTransSecurityProt, t11FcSpSaTransSecurityProt,
t11FcSpSaTransEncryptAlg, t11FcSpSaTransEncryptAlg,
t11FcSpSaTransEncryptKeyLen, t11FcSpSaTransEncryptKeyLen,
t11FcSpSaTransIntegrityAlg, t11FcSpSaTransIntegrityAlg,
t11FcSpSaTransStorageType,
t11FcSpSaTransRowStatus, t11FcSpSaTransRowStatus,
t11FcSpSaTSelNegInInboundSpi, t11FcSpSaTSelNegInInboundSpi,
t11FcSpSaTSelNegInStartSrcAddr, t11FcSpSaTSelNegInStartSrcAddr,
t11FcSpSaTSelNegInEndSrcAddr, t11FcSpSaTSelNegInEndSrcAddr,
t11FcSpSaTSelNegInStartDstAddr, t11FcSpSaTSelNegInStartDstAddr,
t11FcSpSaTSelNegInEndDstAddr, t11FcSpSaTSelNegInEndDstAddr,
t11FcSpSaTSelNegInStartRCtl, t11FcSpSaTSelNegInStartRCtl,
t11FcSpSaTSelNegInEndRCtl, t11FcSpSaTSelNegInEndRCtl,
t11FcSpSaTSelNegInStartType, t11FcSpSaTSelNegInStartType,
t11FcSpSaTSelNegInEndType, t11FcSpSaTSelNegInEndType,
skipping to change at page 228, line 32 skipping to change at page 232, line 5
t11FcSpSaNotifInfoGroup OBJECT-GROUP t11FcSpSaNotifInfoGroup OBJECT-GROUP
OBJECTS { t11FcSpSaControlAuthFailEnable, OBJECTS { t11FcSpSaControlAuthFailEnable,
t11FcSpSaControlInboundSpi, t11FcSpSaControlInboundSpi,
t11FcSpSaControlSource, t11FcSpSaControlSource,
t11FcSpSaControlDestination, t11FcSpSaControlDestination,
t11FcSpSaControlFrame, t11FcSpSaControlFrame,
t11FcSpSaControlElapsed, t11FcSpSaControlElapsed,
t11FcSpSaControlSuppressed, t11FcSpSaControlSuppressed,
t11FcSpSaControlWindow, t11FcSpSaControlWindow,
t11FcSpSaControlMaxNotifs,
t11FcSpSaControlLifeExcdEnable, t11FcSpSaControlLifeExcdEnable,
t11FcSpSaControlLifeExcdSpi, t11FcSpSaControlLifeExcdSpi,
t11FcSpSaControlLifeExcdDir, t11FcSpSaControlLifeExcdDir,
t11FcSpSaControlLifeExcdTime t11FcSpSaControlLifeExcdTime
} }
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A collection of objects containing information "A collection of objects containing information
related to notifications of events concerning related to notifications of events concerning
FC-SP Security Associations." FC-SP Security Associations."
skipping to change at page 230, line 5 skipping to change at page 232, line 30
t11FcSpSaNotifyLifeExceeded t11FcSpSaNotifyLifeExceeded
} }
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"A collection of notifications of events concerning "A collection of notifications of events concerning
FC-SP Security Associations." FC-SP Security Associations."
::= { t11FcSpSaMIBGroups 8 } ::= { t11FcSpSaMIBGroups 8 }
END END
6.6. The T11-FC-SP-CERTS-MIB Module
T11-FC-SP-CERTS-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
mib-2, Unsigned32
FROM SNMPv2-SMI -- [RFC2578]
MODULE-COMPLIANCE,
OBJECT-GROUP FROM SNMPv2-CONF -- [RFC2580]
SnmpAdminString FROM SNMP-FRAMEWORK-MIB -- [RFC3411]
fcmInstanceIndex FROM FC-MGMT-MIB -- [RFC4044]
T11FabricIndex FROM T11-TC-MIB -- [RFC4439]
t11FcSpAuEntityName FROM T11-FC-SP-AUTHENTICATION-MIB;
t11FcSpCertsMIB MODULE-IDENTITY
LAST-UPDATED "200702190000Z"
ORGANIZATION "T11"
CONTACT-INFO
" Claudio DeSanti
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134 USA
EMail: cds@cisco.com
Keith McCloghrie
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134 USA
Email: kzm@cisco.com"
DESCRIPTION
"This MIB module defines management information specific to
the use of certificates in conjunction with Fibre Channel's
FC-SP specification.
Since FC-SP leverages a subset of IPsec and IKEv2 (see RFC
4595), a subset of the management information defined for
the use of certificates with IPsec/IKEv2 is also applicable
to FC-SP. Thus, this MIB module leverages RFC wwww and
RFC xxxx for the management of certificates, CAs and CRLs.
Specifically, the information defined in this MIB module
consists of a pointer into the IPsec/IKEv2 MIB modules,
plus minimal additional item(s) of information which are
considered to be important in a Fibre Channel environment.
Copyright (C) The IETF Trust (2007). This version
of this MIB module is part of RFC yyyy; see the RFC
itself for full legal notices."
REVISION "200702190000Z"
DESCRIPTION
"Initial version of this MIB module, published as RFCyyyy."
::= { mib-2 nnn } -- to be assigned by IANA
t11FcSpCertsMIBObjects OBJECT IDENTIFIER ::= { t11FcSpCertsMIB 1 }
t11FcSpCertsMIBConformance OBJECT IDENTIFIER ::= { t11FcSpCertsMIB 2 }
t11FcSpCertsTable OBJECT-TYPE
SYNTAX SEQUENCE OF T11FcSpCertsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing information on the use of certificates
in FC-SP, including (but not limited to) the use of
certificates with the Fibre Channel Certificate
Authentication Protocol (FCAP) defined by FC-SP, or with
FC-SP's use of IKEv2."
::= { t11FcSpCertsMIBObjects 1 }
t11FcSpCertsEntry OBJECT-TYPE
SYNTAX T11FcSpCertsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains information related to one certificate
for use by the FC-SP Authentication entity identified by
t11FcSpAuEntityName, on a particular Fabric, which is managed
as part of the Fibre Channel management instance identified
by fcmInstanceIndex."
INDEX { fcmInstanceIndex, t11FcSpAuEntityName,
t11FcSpCertFabricIndex, t11FcSpCertIndex }
::= { t11FcSpCertsTable 1 }
T11FcSpCertsEntry ::= SEQUENCE {
t11FcSpCertFabricIndex T11FabricIndex,
t11FcSpCertIndex Unsigned32,
t11FcSpCertPointer SnmpAdminString,
t11FcSpCertUsage INTEGER
}
t11FcSpCertFabricIndex OBJECT-TYPE
SYNTAX T11FabricIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An index value which uniquely identifies a particular
Fabric where the certificate is available for use."
::= { t11FcSpCertsEntry 1 }
t11FcSpCertIndex OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object distinguishes between the multiple certificates
available for use with FC-SP on a particular Fabric."
::= { t11FcSpCertsEntry 2 }
t11FcSpCertPointer OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(0..32))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This object contains the 'name' of a row in the
ipsaCredentialTable, i.e., it points to the certificate which
is represented by the row of the ipsaCredentialTable for
which the value of ipsaCredName has the same value as the
value of this object. Further information about the
certificate is available in that row.
If and when there is no row in the psaCredentialTable for
this certificate, the value of this object is the zero-length
string."
::= { t11FcSpCertsEntry 3 }
t11FcSpCertUsage OBJECT-TYPE
SYNTAX INTEGER {
other(1),
ownDefaultCert(2),
ownCert(3),
rootCert(4)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This object identifies how this certificate can be used:
other -- none of the below;
ownDefaultCert -- the certificate which the local entity
uses as its default certificate; the local entity
has at most one default certificate;
ownCert -- a certificate which the local entity can use
for itself, but which is not its default
certificate;
rootCert -- a root certificate.
"
::= { t11FcSpCertsEntry 4 }
t11FcSpCertMIBCompliances
OBJECT IDENTIFIER ::= { t11FcSpCertsMIBConformance 1 }
t11FcSpCertMIBGroups
OBJECT IDENTIFIER ::= { t11FcSpCertsMIBConformance 2 }
t11FcSpCertMIBCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for entities which use
certificates with FC-SP."
MODULE -- this module
MANDATORY-GROUPS
{ t11FcSpCertInfoGroup }
::= { t11FcSpCertMIBCompliances 1 }
t11FcSpCertInfoGroup OBJECT-GROUP
OBJECTS {
t11FcSpCertPointer,
t11FcSpCertUsage
}
STATUS current
DESCRIPTION
"A collection of objects containing information
related to certificates available for use with FC-SP."
::= { t11FcSpCertMIBGroups 1 }
END
7. Acknowledgements 7. Acknowledgements
This document is initially being developed by the INCITS Task Group This document was initially developed and approved by the INCITS Task
T11.5 (http://www.t11.org) as the SM-FSM project. We wish to Group T11.5 (http://www.t11.org) as the SM-FSM project. We wish to
acknowledge the contributions and comments from the INCITS Technical acknowledge the contributions and comments from the INCITS Technical
Committee T11, including the following: Committee T11, including the following:
T11 Chair: Robert Snively, Brocade T11 Chair: Robert Snively, Brocade
T11 Vice Chair: Claudio DeSanti, Cisco Systems T11 Vice Chair: Claudio DeSanti, Cisco Systems
T11.5 Chair: Roger Cummings, Symantec T11.5 Chair: Roger Cummings, Symantec
T11.5 members: T11.5 members:
David Black, EMC David Black, EMC
Don Fraser, HP Don Fraser, HP
Larry Hofer, Brocade Larry Hofer, Brocade
Scott Kipp, Brocade Scott Kipp, Brocade
Ralph Weber, ENDL Ralph Weber, ENDL
After approval by T11, the document is expected to become a work item The document was subsequently a work item of the IETF's IMSS Working
of by the IETF's IMSS Working Group, chaired by David Black (EMC Group, chaired by David Black (EMC Corporation). Bert Wijnen
Corporation). We expect that we will also wish to acknowledge the (Alcatel-Lucent) deserves many thanks for his thorough review of all
IETF MIB Doctor (name to be supplied) as and when he/she reviews this five MIB modules in this (large!) document. We also wish to
document. acknowledge Dan Romascanu (Avaya), the IETF Area Director, for his
comments and assistance.
8. Normative References 8. Normative References
[RFC2578] [RFC2578]
McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M.
and S. Waldbusser, "Structure of Management Information Version 2 and S. Waldbusser, "Structure of Management Information Version 2
(SMIv2)", STD 58, RFC 2578, April 1999. (SMIv2)", STD 58, RFC 2578, April 1999.
[RFC2579] [RFC2579]
McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M.
skipping to change at page 237, line 28 skipping to change at page 234, line 21
H.K., McCloghrie, K., and S. Gai, RFC 4438, April 2006. H.K., McCloghrie, K., and S. Gai, RFC 4438, April 2006.
[RFC4439] [RFC4439]
DeSanti, C., Gaonkar, V., McCloghrie, K., and S. Gai, "Fibre DeSanti, C., Gaonkar, V., McCloghrie, K., and S. Gai, "Fibre
Channel Fabric Address Manager MIB", RFC 4439, March 2006. Channel Fabric Address Manager MIB", RFC 4439, March 2006.
[RFC4936] [RFC4936]
DeSanti, C., Vivek, H.K., McCloghrie, K., and S. Gai, "Fibre DeSanti, C., Vivek, H.K., McCloghrie, K., and S. Gai, "Fibre
Channel Zone Server MIB", RFC 4936, August 2007. Channel Zone Server MIB", RFC 4936, August 2007.
[IPSP-IKE-ACTION]
Baer, M., Charlet, R., Hardaker, W., Story, R., and C. Wang, "IPsec
Security Policy IKE Action MIB", draft-ietf-ipsp-ikeaction-mib-
nn.txt, work-in-progress, 19 October 2006.
[IPSP-IPSEC-ACTION]
Baer, M., Charlet, R., Hardaker, W., Story, R., and C. Wang, "IPsec
Security Policy IPsec Action MIB", draft-ietf-ipsp-ipsecaction-mib-
nn.txt, work-in-progress, 19 October 2006.
[FC-FS-2] [FC-FS-2]
"Fibre Channel - Framing and Signaling-2 (FC-FS-2)", ANSI INCITS "Fibre Channel - Framing and Signaling-2 (FC-FS-2)", ANSI INCITS
424:2007, http://www.t11.org/t11/stat.nsf/upnum/1619-d, August 424:2007, http://www.t11.org/t11/stat.nsf/upnum/1619-d, August
2006. 2006.
[FC-GS-5] [FC-GS-5]
"Fibre Channel - Generic Services - 5 (FC-GS-5)", ANSI INCITS "Fibre Channel - Generic Services - 5 (FC-GS-5)", ANSI INCITS
427-2006, http://www.t11.org/t11/stat.nsf/upnum/1677-d, December 427-2006, http://www.t11.org/t11/stat.nsf/upnum/1677-d, December
2006. 2006.
skipping to change at page 239, line 22 skipping to change at page 236, line 9
4626, August 2006. 4626, August 2006.
[RFC4668] [RFC4668]
D. Nelson, "RADIUS Authentication Client MIB for IPv6", RFC 4668, D. Nelson, "RADIUS Authentication Client MIB for IPv6", RFC 4668,
August 2006. August 2006.
[RFC4747] [RFC4747]
Kipp, S., Ramkumar, G., and K. McCloghrie, "The Virtual Fabrics Kipp, S., Ramkumar, G., and K. McCloghrie, "The Virtual Fabrics
MIB", RFC 4747, November 2006. MIB", RFC 4747, November 2006.
[FC-RSCN-MIB]
DeSanti, C., Vivek, H.K., McCloghrie, K., and S. Gai, "Fibre
Channel Registered State Change Notification (RSCN) MIB", draft-
ietf-imss-fc-rscn-mib-nn.txt, work-in-progress, November 2006.
[RFC4935] [RFC4935]
DeSanti, C., Vivek, H.K., McCloghrie, K., and S. Gai, "Fibre DeSanti, C., Vivek, H.K., McCloghrie, K., and S. Gai, "Fibre
Channel Fabric Configuration Server MIB", RFC 4935, August 2007. Channel Fabric Configuration Server MIB", RFC 4935, August 2007.
[RFC4983]
DeSanti, C., Vivek, H.K., McCloghrie, K., and S. Gai, "Fibre
Channel Registered State Change Notification (RSCN) MIB", RFC 4983,
August 2007.
[IPSP-IKE-ACTION]
Baer, M., Charlet, R., Hardaker, W., Story, R., and C. Wang, "IPsec
Security Policy IKE Action MIB", draft-ietf-ipsp-ikeaction-mib-
nn.txt, work-in-progress, October 2006.
[IPSP-IPSEC-ACTION]
Baer, M., Charlet, R., Hardaker, W., Story, R., and C. Wang, "IPsec
Security Policy IPsec Action MIB", draft-ietf-ipsp-ipsecaction-mib-
nn.txt, work-in-progress, October 2006.
10. IANA Considerations 10. IANA Considerations
IANA is requested to make one MIB OID assignment, under the IANA is requested to make one MIB OID assignment, under the
appropriate subtree, for each of the six MIB modules defined in this appropriate subtree, for each of the five MIB modules defined in this
document. document.
11. Security Considerations 11. Security Considerations
In this section, the first sub-section states some Security In this section, the first sub-section states some Security
Considerations due to which information was excluded from this Considerations due to which information was excluded from this
document. This is followed by one sub-section for each of the MIB document. This is followed by one sub-section for each of the MIB
modules defined in section 6, listing their individual Security modules defined in section 6, listing their individual Security
Considerations. The section concludes with Security Considerations Considerations. The section concludes with Security Considerations
common to all of these MIB modules. common to all of these MIB modules.
skipping to change at page 245, line 16 skipping to change at page 242, line 16
There are several management objects defined in this MIB module with There are several management objects defined in this MIB module with
a MAX-ACCESS clause of read-write and/or read-create. Such objects a MAX-ACCESS clause of read-write and/or read-create. Such objects
may be considered sensitive or vulnerable in some network may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on environment without proper protection can have a negative effect on
network operations. These objects and their network operations. These objects and their
sensitivity/vulnerability are: sensitivity/vulnerability are:
t11FcSpSaIfStorageType t11FcSpSaIfStorageType
t11FcSpSaTSelPropStorageType
t11FcSpSaTransStorageType
- could cause changes in configuration information related to - could cause changes in configuration information related to
FC-SP Security Associations to be retained or not retained FC-SP Security Associations to be retained or not retained
over restarts, against the wishes of management. over restarts, against the wishes of management.
t11FcSpSaIfReplayPrevention t11FcSpSaIfReplayPrevention
t11FcSpSaIfReplayWindowSize t11FcSpSaIfReplayWindowSize
- could cause changes in the operation of anti-replay - could cause changes in the operation of anti-replay
protection, thereby permitting an attacker to conduct replay protection, thereby permitting an attacker to conduct replay
attacks, or requiring FC-SP implementations to engage in attacks, or requiring FC-SP implementations to engage in
unnecessary protection against replay. unnecessary protection against replay.
skipping to change at page 246, line 8 skipping to change at page 243, line 10
establishing the Security Association. establishing the Security Association.
t11FcSpSaControlWindow t11FcSpSaControlWindow
- could cause the suppression of second and subsequent SNMP - could cause the suppression of second and subsequent SNMP
notifications on the occurrence of Authentication failures notifications on the occurrence of Authentication failures
for received FC-2 or CT_IU frames, thereby masking repeated for received FC-2 or CT_IU frames, thereby masking repeated
attempts to subvert security measures, or cause the attempts to subvert security measures, or cause the
disruption of network operations due to the generation of disruption of network operations due to the generation of
unwanted notifications. unwanted notifications.
t11FcSpSaControlMaxNotifs
- could cause the suppression of all SNMP notifications on the
occurrence of Authentication failures for received FC-2 or
CT_IU frames, thereby masking attempts to subvert security
measures, or cause the disruption of network operations due
to the generation of unwanted notifications.
t11FcSpSaPropTable t11FcSpSaPropTable
t11FcSpSaTSelPropTable t11FcSpSaTSelPropTable
t11FcSpSaTransTable t11FcSpSaTransTable
- could cause an FC-SP entity to propose the setup of Security - could cause an FC-SP entity to propose the setup of Security
Associations which apply to a different selection of traffic Associations which apply to a different selection of traffic
and/or using different security transforms, such that some and/or using different security transforms, such that some
traffic has a reduced level of security which might improve traffic has a reduced level of security which might improve
an attacker's chance of subverting security, or an increased an attacker's chance of subverting security, or an increased
level of security which would involve unnecessary security level of security which would involve unnecessary security
processing, or cause the negotiation of Security Associations processing, or cause the negotiation of Security Associations
skipping to change at page 247, line 20 skipping to change at page 244, line 29
will drop before sending/after receiving. will drop before sending/after receiving.
t11FcSpSaPairTable t11FcSpSaPairTable
t11FcSpSaTSelNegInTable t11FcSpSaTSelNegInTable
t11FcSpSaTSelNegOutTable t11FcSpSaTSelNegOutTable
t11FcSpSaTSelSpiTable t11FcSpSaTSelSpiTable
- information on which Security Associations are currently - information on which Security Associations are currently
active, what subsets of traffic they are carrying, and what active, what subsets of traffic they are carrying, and what
security protection is being given to them. security protection is being given to them.
11.7. The T11-FC-SP-CERTS-MIB Module 11.7. Recommendations common to all MIB Modules
There are no objects defined in this MIB module with a MAX-ACCESS
clause of read-write and/or read-create.
Some of the readable objects in this MIB module (i.e., objects with a
MAX-ACCESS other than not-accessible) may be considered sensitive or
vulnerable in some network environments. It is thus important to
control even GET and/or NOTIFY access to these objects and possibly
to even encrypt the values of these objects when sending them over
the network via SNMP. These are the tables and objects and their
sensitivity/vulnerability:
t11FcSpCertPointer
- a pointer to information about certificates being used by an
FC-SP entity.
t11FcSpCertUsage
- information about how certificates are being used by an FC-SP
entity.
11.8. Recommendations common to all MIB Modules
SNMP versions prior to SNMPv3 did not include adequate security. SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPsec), Even if the network itself is secure (for example by using IPsec),
even then, there is no control as to who on the secure network is even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the objects allowed to access and GET/SET (read/change/create/delete) the objects
in this MIB module. in this MIB module.
It is RECOMMENDED that implementors consider the security features as It is RECOMMENDED that implementors consider the security features as
provided by the SNMPv3 framework (see [RFC3410], section 8), provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for including full support for the SNMPv3 cryptographic mechanisms (for
skipping to change at page 249, line 7 skipping to change at page 245, line 30
Keith McCloghrie Keith McCloghrie
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA USA 95134 San Jose, CA USA 95134
Phone: +1 408-526-5260 Phone: +1 408-526-5260
Email: kzm@cisco.com Email: kzm@cisco.com
Full Copyright Statement Full Copyright Statement
Copyright (C) The IETF Trust (2007). This document is subject to the Copyright (C) The IETF Trust (2008). This document is subject to the
rights, licenses and restrictions contained in BCP 78, and except as rights, licenses and restrictions contained in BCP 78, and except as
set forth therein, the authors retain all their rights. set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
skipping to change at line 10498 skipping to change at page 247, line 4
The IETF invites any interested party to bring to its attention any The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at this standard. Please address the information to the IETF at
ietf-ipr@ietf.org. ietf-ipr@ietf.org.
Acknowledgment Acknowledgment
Funding for the RFC Editor function is currently provided by the Funding for the RFC Editor function is currently provided by the
Internet Society. Internet Society.
Table of Contents
1 Introduction ................................................. 3
1.1 Change Log ................................................. 3
1.1.1 Initial version .......................................... 3
1.1.2 September 2006 version ................................... 3
1.1.3 December 2006 version .................................... 4
1.1.4 2 February 2007 version .................................. 5
1.1.5 26 February 2007 version ................................. 5
1.1.6 11 April 2007 version .................................... 7
1.1.7 3 May 2007 version ....................................... 7
1.1.8 12 June 2007 version ..................................... 7
1.1.9 13 August 2007 version ................................... 7
1.1.10 28 November 2007 version ................................ 8
1.1.11 21 February 2008 version ................................ 8
2 The Internet-Standard Management Framework ................... 9
3 Overview of Fibre Channel .................................... 10
3.1 Introduction ............................................... 10
3.2 Zoning ..................................................... 11
3.3 Virtual Fabrics ............................................ 11
3.4 Security ................................................... 12
3.4.1 Authentication ........................................... 12
3.4.2 Security Associations .................................... 13
3.4.3 Fabric Security Policies ................................. 14
3.4.4 Policy Model ............................................. 15
3.4.5 Policy Objects ........................................... 15
3.4.5.1 Policy Object Names .................................... 16
3.4.6 Three Kinds of Switches .................................. 17
3.4.7 Security Policy Management ............................... 17
3.4.8 FC-SP Zoning ............................................. 18
4 Document Overview ............................................ 19
4.1 Fibre Channel management instance .......................... 19
4.2 Entity Name ................................................ 19
4.3 Fabric Index ............................................... 20
4.4 Interface Index ............................................ 20
4.5 Syntax for Policy Object Names ............................. 20
4.6 Certificates, CAs and CRLs ................................. 21
4.7 Traffic Selectors .......................................... 22
4.8 The MIB Modules ............................................ 22
4.8.1 The T11-FC-SP-TC-MIB Module .............................. 22
4.8.2 The T11-FC-SP-AUTHENTICATION-MIB Module .................. 23
4.8.3 The T11-FC-SP-ZONING-MIB Module .......................... 23
4.8.4 The T11-FC-SP-POLICY-MIB Module .......................... 23
4.8.5 The T11-FC-SP-SA-MIB Module .............................. 24
4.9 Rate Control for Notifications ............................. 25
5 Relationship to Other MIB Modules ............................ 26
6 MIB Module Definitions ....................................... 27
6.1 The T11-FC-SP-TC-MIB Module ................................ 27
6.2 The T11-FC-SP-AUTHENTICATION-MIB Module .................... 43
6.3 The T11-FC-SP-ZONING-MIB Module ............................ 64
6.4 The T11-FC-SP-POLICY-MIB Module ............................ 77
6.5 The T11-FC-SP-SA-MIB Module ................................ 176
7 Acknowledgements ............................................. 232
8 Normative References ......................................... 233
9 Informative References ....................................... 235
10 IANA Considerations ......................................... 236
11 Security Considerations ..................................... 237
11.1 Information not defined in this document .................. 237
11.2 The T11-FC-SP-TC-MIB Module ............................... 237
11.3 The T11-FC-SP-AUTHENTICATION-MIB Module ................... 237
11.4 The T11-FC-SP-ZONING-MIB Module ........................... 239
11.5 The T11-FC-SP-POLICY-MIB Module ........................... 240
11.6 The T11-FC-SP-SA-MIB Module ............................... 242
11.7 Recommendations common to all MIB Modules ................. 244
12 Authors' Addresses .......................................... 245
 End of changes. 197 change blocks. 
518 lines changed or deleted 575 lines changed or added

This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/