-- MIB file created 28-Oct-2004 10:04:04, by
--   SMICng version 2.2.11-beta(PRO)(Solaris), January 20, 2001. Enterprise key cisco.com

CISCO-IKE-FLOW-MIB DEFINITIONS ::= BEGIN

-- From file: "CISCO-IKE-FLOW-MIB.my"
-- Compile options "4 7 F H N O W 03 06 0B 0G 0N 0T"

IMPORTS
    TruthValue
            FROM SNMPv2-TC-v1
    cisgIpsSgProtocol, cisgIpsSgTunIndex, cisgIpsSgTunHistIndex, 
    cisgIpsSgFailLocalAddress, cisgIpsSgFailRemoteAddress
            FROM CISCO-IPSEC-SIGNALING-MIB
    CIPsecIkeNegoMode, CIPsecDiffHellmanGrp
            FROM CISCO-IPSEC-TC
    ciscoMgmt
            FROM CISCO-SMI
    Counter, Gauge
            FROM RFC1155-SMI
    OBJECT-TYPE
            FROM RFC-1212
    TRAP-TYPE
            FROM RFC-1215;

ciscoIkeFlowMIB OBJECT IDENTIFIER ::= { ciscoMgmt 429 }
-- MODULE-IDENTITY
--  LastUpdated
--    200409140000Z
--  OrgName
--    Cisco Systems
--  ContactInfo
--           Cisco Systems
--            Customer Service
--    
--    Postal: 170 W Tasman Drive
--            San Jose, CA  95134
--            USA
--    
--       Tel: +1 800 553-NETS
--    E-mail: cs-ipsecmib@external.cisco.com
--  Descr
--    This is a MIB module for monitoring the structures
--     and status of IPsec control flows based on Internet
--     Key Exchange protocol. The MIB models standard 
--     aspects of the IKE protocol.
--    
--     Synopsis
--    
--     This MIB module models status, performance and 
--     failures of the IKEv1- and IKEv2-based signaling in
--     IPsec, FC-SP(and similar) protocols. In practice, 
--     the security protocols such as IPsec, FC-SP and 
--     CTS use a signaling protocol such as IKE, KINK, 
--     or some such. A number of characteristics of these
--     signaling protocols are generic.
--     The generic attributes and status of signaling 
--     activity has been modeled in 
--     CISCO-IPSEC-SIGNALING-MIB. This MIB module augments
--     CISCO-IPSEC-SIGNALING-MIB with IKE-specific
--     MIB objects.
--     (Signaling protocols are also referred to this 
--     document as 'Control Protocols', since they perform
--     session control.)
--    
--     History of the MIB
--     A precursor to this MIB was written by Tivoli and
--     implemented in IBM Nways routers in 1999. That 
--     MIB instrumented both IKE(v1) and IPsec in a 
--     single module. During late 1999, Cisco adopted 
--     the MIB and together with Tivoli published the 
--     IPsec Flow Monitor MIB in IETF IPsec WG in 
--     draft-ietf-ipsec-flow-monitoring-mib-00.txt. 
--     In 2000, the MIB was Cisco-ized and implemented
--     this draft as CISCO-IPSEC-FLOW-MONITOR-MIB in 
--     IOS and VPN3000 platforms.
--    
--     With the evolution of IKEv2, the MIB was modified
--     and presented to the IPsec WG again in May 2003 
--     in draft-ietf-ipsec-flow-monitoring-mib-02.txt.
--    
--     This version of the draft is a Cisco-ized version
--     that culls out the IKE-specific aspects of the
--     IPsec Flow Monitor MIB. 
--    
--     Overview of MIB
--     The MIB contains five major groups of objects which 
--     are used to manage the IKE protocol activity. These 
--     groups include the global statistics, IKE tunnel 
--     table, IKE History Group and a notification Group.
--    
--     The tunnel table and the history table have a 
--     sparse-table relationship with the corresponding
--     tables in the CISCO-IPSEC-SIGNALING-MIB 
--     (details in the DESCRIPTION of the respective 
--     tables). 
--    
--     Acronyms
--     The following acronyms are used in this document:     
--    
--     Flow, Tunnel:
--         An ISAKMP SA can be regarded as representing
--         a flow of ISAKMP/IKE traffic. Hence an ISAKMP
--         is referred to as a 'Phase 1 Tunnel' in this
--         document. 
--      
--     IPsec: 
--         Secure IP Protocol 
--    
--     ISAKMP:
--         Internet Security Association and Key
--         Management Protocol
--    
--     IKE:
--         Internet Key Exchange Protocol
--    
--     MM:
--         Main Mode - the process of setting up
--         a Phase 1 SA to secure the exchanges
--         required to setup Phase 2 SAs
--    
--     Phase 2 Tunnel:
--         AN instance of a non-ISAKMP SA  bundle in 
--         which all the SA share the same proxy 
--         identifiers (IDii,IDir) protect the same 
--         stream of application traffic.
--         Such an SA bundle is termed a 'Phase 2 Tunnel'.
--         Note that a Phase 2 tunnel may comprise 
--         different SA bundles and different number of 
--         SA bundles at different 
--         times (due to key refresh).
--    
--     QM:         
--         Quick Mode - the process of setting up
--         Phase 2 Security Associations using a 
--         Phase 1 SA.
--    
--     SA: 
--         Security Association (ref: rfc2408).
--    
--     VPN:
--         Virtual Private Network. 
--  RevDate
--    200409140000Z
--  RevDescr
--    Initial version.

ciscoIkeFlowMIBNotifs OBJECT IDENTIFIER ::= { ciscoIkeFlowMIB 0 }
ciscoIkeFlowMIBObjects OBJECT IDENTIFIER ::= { ciscoIkeFlowMIB 1 }
ciscoIkeFlowMIBConform OBJECT IDENTIFIER ::= { ciscoIkeFlowMIB 2 }
cifIkeCurrentActivity OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBObjects 1 }
cifIkeHistory   OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBObjects 2 }
cifIkeNotifControl OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBObjects 3 }
ciscoIkeFlowMIBCompliances OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBConform 1 }
ciscoIkeFlowMIBGroups OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBConform 2 }

cifIkeGlobalStatsTable OBJECT-TYPE
    SYNTAX SEQUENCE OF CifIkeGlobalStatsEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "
        The Phase-1 IKE Global Statistics Table.
        There is one entry in this table for each Phase-1 IKE,
        protocol('cpIkev1' and 'cpIkev2') implemented by the 
        managed entity.
        
        For all the counter objects in the table below, initially when
        the IKE Tunnel becomes active and appears in this 
        table, they would contain a value of zero."
    ::= { cifIkeCurrentActivity 1 }

cifIkeGlobalStatsEntry OBJECT-TYPE
    SYNTAX CifIkeGlobalStatsEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "
        Each entry contains the global statistics pertaining
        to the specific IKE protocol."
    INDEX { cisgIpsSgProtocol }
    ::= { cifIkeGlobalStatsTable 1 }

CifIkeGlobalStatsEntry ::= SEQUENCE {
    cifIkeGlobalInP2Exchgs Counter,
    cifIkeGlobalInP2ExchgInvalids Counter,
    cifIkeGlobalInP2ExchgRejects Counter,
    cifIkeGlobalOutP2Exchgs Counter,
    cifIkeGlobalOutP2ExchgInvalids Counter,
    cifIkeGlobalOutP2ExchgRejects Counter,
    cifIkeGlobalInXauths Counter,
    cifIkeGlobalInXauthFailures Counter,
    cifIkeGlobalOutXauthFailures Counter,
    cifIkeGlobalInNewGrpReqs Counter,
    cifIkeGlobalOutNewGrpReqs Counter,
    cifIkeGlobalInNewGrpRejectReqs Counter,
    cifIkeGlobalOutNewGrpRejectReqs Counter
    }

cifIkeGlobalInP2Exchgs OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges 
        received by all currently and previously 
        active Phase-1 Tunnels."
    ::= { cifIkeGlobalStatsEntry 1 }

cifIkeGlobalInP2ExchgInvalids OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges which were
        received and found to be invalid by all currently and
        previously active Phase-1 Tunnels."
    ::= { cifIkeGlobalStatsEntry 2 }

cifIkeGlobalInP2ExchgRejects OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges 
        which were received and rejected by all 
        currently and previously active Phase-1 Tunnels."
    ::= { cifIkeGlobalStatsEntry 3 }

cifIkeGlobalOutP2Exchgs OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges which were
        sent by all currently and previously active IPsec 
        Phase-1 Tunnels."
    ::= { cifIkeGlobalStatsEntry 4 }

cifIkeGlobalOutP2ExchgInvalids OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges which were
        sent and found to be invalid by all currently and 
        previously active Phase-1 Tunnels."
    ::= { cifIkeGlobalStatsEntry 5 }

cifIkeGlobalOutP2ExchgRejects OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges 
        which were sent and rejected by all currently and
        previously active Phase-1 IKE Tunnels."
    ::= { cifIkeGlobalStatsEntry 6 }

cifIkeGlobalInXauths OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    Failures
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The number of times the extended authentication
        requests was received by the managed entity
        from a peer."
    ::= { cifIkeGlobalStatsEntry 7 }

cifIkeGlobalInXauthFailures OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    Failures
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The number of times the extended authentication
        information supplied by an IKE peer was found
        to be invalid by the local entity."
    ::= { cifIkeGlobalStatsEntry 8 }

cifIkeGlobalOutXauthFailures OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    Failures
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The number of times the extended authentication
        information supplied by the managed entity to an
        IKE peer was found to be invalid by the remote peer."
    ::= { cifIkeGlobalStatsEntry 9 }

cifIkeGlobalInNewGrpReqs OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        remotely."
    ::= { cifIkeGlobalStatsEntry 10 }

cifIkeGlobalOutNewGrpReqs OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        locally."
    ::= { cifIkeGlobalStatsEntry 11 }

cifIkeGlobalInNewGrpRejectReqs OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        remotely that ended in reject."
    ::= { cifIkeGlobalStatsEntry 12 }

cifIkeGlobalOutNewGrpRejectReqs OBJECT-TYPE
    SYNTAX --?? syntax is not convertable to SMIv1
           Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        locally that ended in reject."
    ::= { cifIkeGlobalStatsEntry 13 }

cifIkeTunnelTable OBJECT-TYPE
    SYNTAX SEQUENCE OF CifIkeTunnelEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "
        The Phase-1 Internet Key Exchange Tunnel Table.
        There is one entry in this table for each active IPsec
        Phase-1 IKE Tunnel."
    ::= { cifIkeCurrentActivity 3 }

cifIkeTunnelEntry OBJECT-TYPE
    SYNTAX CifIkeTunnelEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "
        Each entry contains the attributes associated with
        an active Phase-1 IKE Tunnel.
        
        The rows in this table correspond 1-to-1 with a subset of
        the rows in cisgIpsSgTunnelTable, specifically the subset 
        which represent Phase-1 IKE Tunnels.
         
        Hence, the value of the index 'cisgIpsSgProtocol'
        in this table is always 'cpIkev1' or 'cpIkev2'.
         
        For all the counter objects in the table below, initially when
        the Phase-1 IKE Tunnel becomes active and appears in this 
        table, they would contain a value of zero. "
    INDEX { cisgIpsSgProtocol, cisgIpsSgTunIndex }
    ::= { cifIkeTunnelTable 1 }

CifIkeTunnelEntry ::= SEQUENCE {
    cifIkeTunNegoMode CIPsecIkeNegoMode,
    cifIkeTunDHGrp CIPsecDiffHellmanGrp,
    cifIkeTunSaRefreshThreshold Gauge,
    cifIkeTunTotalRefreshes Counter,
    cifIkeTunInP2Exchgs Counter,
    cifIkeTunInP2ExchgInvalids Counter,
    cifIkeTunInP2ExchgRejects Counter,
    cifIkeTunInP2SaDelRequests Counter,
    cifIkeTunOutP2Exchgs Counter,
    cifIkeTunOutP2ExchgInvalids Counter,
    cifIkeTunOutP2ExchgRejects Counter,
    cifIkeTunInNewGrpReqs Counter,
    cifIkeTunOutNewGrpReqs Counter,
    cifIkeTunInNewGrpRejectedReqs Counter,
    cifIkeTunOutNewGrpRejectedReqs Counter,
    cifIkeTunInConfigs Counter,
    cifIkeTunOutConfigs Counter,
    cifIkeTunInConfigRejects Counter,
    cifIkeTunOutConfigRejects Counter
    }

cifIkeTunNegoMode OBJECT-TYPE
    SYNTAX CIPsecIkeNegoMode
--    Rsyntax INTEGER {
--        mainMode(1),
--        aggressiveMode(2)
--        }
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The negotiation mode of the Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelEntry 1 }

cifIkeTunDHGrp OBJECT-TYPE
    SYNTAX CIPsecDiffHellmanGrp
--    Rsyntax INTEGER {
--        other(1),
--        notDH(2),
--        modp768(3),
--        modp1024(4),
--        ec2nGP155(5),
--        ec2nGP185(6),
--        modp1536(7),
--        ec2nGF163(8),
--        ec2nGF283(9),
--        ec2nGF409(10),
--        ec2nGF571(11),
--        modp2048(12)
--        }
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The Diffie Hellman Group used in Phase-1 IKE
        negotiations."
    ::= { cifIkeTunnelEntry 2 }

cifIkeTunSaRefreshThreshold OBJECT-TYPE
    SYNTAX Gauge(0..2147483647)
--  Units
--    seconds
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The security association refresh threshold in seconds.
        If the tunnel does not refresh its security associations,
        the value of this MIB object is zero."
    ::= { cifIkeTunnelEntry 3 }

cifIkeTunTotalRefreshes OBJECT-TYPE
    SYNTAX Counter
--  Units
--    QM Exchanges
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of security associations refreshes 
        performed. If the tunnel does not refresh its security 
        associations, the value of this MIB object is never 
        incremented."
    ::= { cifIkeTunnelEntry 4 }

cifIkeTunInP2Exchgs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges received by
        this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelEntry 5 }

cifIkeTunInP2ExchgInvalids OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges received and
        found to be invalid by this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelEntry 6 }

cifIkeTunInP2ExchgRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges received and
        rejected by this Phase-1 Tunnel."
    ::= { cifIkeTunnelEntry 7 }

cifIkeTunInP2SaDelRequests OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Notification Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 security association
        delete requests received by this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelEntry 8 }

cifIkeTunOutP2Exchgs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges sent by
        this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelEntry 9 }

cifIkeTunOutP2ExchgInvalids OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges sent and
        found to be invalid by this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelEntry 10 }

cifIkeTunOutP2ExchgRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges sent and
        rejected by this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelEntry 11 }

cifIkeTunInNewGrpReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        remotely using this IKE tunnel."
    ::= { cifIkeTunnelEntry 12 }

cifIkeTunOutNewGrpReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        locally using this IKE tunnel."
    ::= { cifIkeTunnelEntry 13 }

cifIkeTunInNewGrpRejectedReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        remotely using this IKE tunnel that ended in reject. "
    ::= { cifIkeTunnelEntry 14 }

cifIkeTunOutNewGrpRejectedReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        locally using this IKE tunnel that ended in reject."
    ::= { cifIkeTunnelEntry 15 }

cifIkeTunInConfigs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        received (either CFG_REPLY or CFG_SET payloads)
        by the local entity on the ISAKMP SA represented by
        this IKE tunnel."
    ::= { cifIkeTunnelEntry 16 }

cifIkeTunOutConfigs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        dispatched (either CFG_REPLY or CFG_SET payloads)
        by the local entity on the ISAKMP SA represented by
        this IKE tunnel."
    ::= { cifIkeTunnelEntry 17 }

cifIkeTunInConfigRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        which were received (either CFG_REPLY or CFG_SET
        payloads) and rejected by this entity using the ISAKMP
        SA represented by this IKE tunnel."
    ::= { cifIkeTunnelEntry 18 }

cifIkeTunOutConfigRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        which were dispatched (either CFG_REPLY or CFG_SET
        payloads) by this entity and were rejected by the
        peer (client) using the ISAKMP SA represented by
        this IKE tunnel."
    ::= { cifIkeTunnelEntry 19 }

cifIkeTunnelHistTable OBJECT-TYPE
    SYNTAX SEQUENCE OF CifIkeTunnelHistEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "
        The Phase-1 Internet Key Exchange Tunnel
        history table.  
        
        This table is conceptually a sliding window in 
        which only the last 'N' entries are maintained,
        where 'N' is the value of the object 
        'cisgIpsSgHistTableSize' (defined in
        defined in CISCO-IPSEC-SIGNALING-MIB).
        
        If the value of 'cisgIpsSgHistTableSize' is 0,
        then this table will be empty.
        
        For all the counter objects in the table below, initially
        when the Tunnel entry appears in this table, they would 
        contain a value of zero. "
    ::= { cifIkeHistory 1 }

cifIkeTunnelHistEntry OBJECT-TYPE
    SYNTAX CifIkeTunnelHistEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "
        Each entry contains the attributes associated with 
        a previously active Phase-1 IKE Tunnel.
        
        This table has a sparse table relationship with the
        generic Phase-1 Tunnel history table
        'cisgIpsSgTunnelHistTable' defined in
        CISCO-IPSEC-SIGNALING-MIB. However, the value of the
        index column in this table will always be either
        'cpIkev1' or 'cpIkev2'."
    INDEX { cisgIpsSgProtocol, cisgIpsSgTunHistIndex }
    ::= { cifIkeTunnelHistTable 1 }

CifIkeTunnelHistEntry ::= SEQUENCE {
    cifIkeTunHistNegoMode CIPsecIkeNegoMode,
    cifIkeTunHistDHGrp CIPsecDiffHellmanGrp,
    cifIkeTunHistTotalRefreshes Counter,
    cifIkeTunHistTotalSas Counter,
    cifIkeTunHistInP2Exchgs Counter,
    cifIkeTunHistInP2ExchgInvalids Counter,
    cifIkeTunHistInP2ExchgRejects Counter,
    cifIkeTunHistOutP2Exchgs Counter,
    cifIkeTunHistOutP2ExchgInvalids Counter,
    cifIkeTunHistOutP2ExchgRejects Counter,
    cifIkeTunHistInNewGrpReqs Counter,
    cifIkeTunHistOutNewGrpReqs Counter,
    cifIkeTunHistInNewGrpRejectReqs Counter,
    cifIkeTunHistOutNewGrpRejectReqs Counter,
    cifIkeTunHistInConfigs Counter,
    cifIkeTunHistOutConfigs Counter,
    cifIkeTunHistInConfigsRejects Counter,
    cifIkeTunHistOutConfigsRejects Counter
    }

cifIkeTunHistNegoMode OBJECT-TYPE
    SYNTAX CIPsecIkeNegoMode
--    Rsyntax INTEGER {
--        mainMode(1),
--        aggressiveMode(2)
--        }
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The negotiation mode of the Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelHistEntry 1 }

cifIkeTunHistDHGrp OBJECT-TYPE
    SYNTAX CIPsecDiffHellmanGrp
--    Rsyntax INTEGER {
--        other(1),
--        notDH(2),
--        modp768(3),
--        modp1024(4),
--        ec2nGP155(5),
--        ec2nGP185(6),
--        modp1536(7),
--        ec2nGF163(8),
--        ec2nGF283(9),
--        ec2nGF409(10),
--        ec2nGF571(11),
--        modp2048(12)
--        }
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The Diffie Hellman Group used in Phase-1 IKE
        negotiations."
    ::= { cifIkeTunnelHistEntry 2 }

cifIkeTunHistTotalRefreshes OBJECT-TYPE
    SYNTAX Counter
--  Units
--    QM Exchanges
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of security associations
        refreshes performed."
    ::= { cifIkeTunnelHistEntry 3 }

cifIkeTunHistTotalSas OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SAs
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of security associations used 
        during the life of the Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelHistEntry 4 }

cifIkeTunHistInP2Exchgs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges received
        by this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelHistEntry 5 }

cifIkeTunHistInP2ExchgInvalids OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges
        received on this tunnel that were found to
        contain references to unrecognized security
        parameters."
    ::= { cifIkeTunnelHistEntry 6 }

cifIkeTunHistInP2ExchgRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges
        received on this tunnel that were validated but were
        rejected by the local policy."
    ::= { cifIkeTunnelHistEntry 7 }

cifIkeTunHistOutP2Exchgs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Notification Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 security association
        delete requests received by this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelHistEntry 8 }

cifIkeTunHistOutP2ExchgInvalids OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges sent by
        this Phase-1 IKE Tunnel."
    ::= { cifIkeTunnelHistEntry 9 }

cifIkeTunHistOutP2ExchgRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    SA Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Phase-2 exchanges
        sent on this tunnel that were rejected by the 
        peer, because it contained references to security
        parameters not recognized by the peer."
    ::= { cifIkeTunnelHistEntry 10 }

cifIkeTunHistInNewGrpReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        remotely using this IKE tunnel during its lifetime."
    ::= { cifIkeTunnelHistEntry 11 }

cifIkeTunHistOutNewGrpReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        locally using this IKE tunnel during its lifetime."
    ::= { cifIkeTunnelHistEntry 12 }

cifIkeTunHistInNewGrpRejectReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        remotely using this IKE tunnel during its lifetime
        that ended in reject."
    ::= { cifIkeTunnelHistEntry 13 }

cifIkeTunHistOutNewGrpRejectReqs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Negotiations
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of New Group exchanges initiated
        locally using this IKE tunnel during its lifetime
        that ended in reject."
    ::= { cifIkeTunnelHistEntry 14 }

cifIkeTunHistInConfigs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        received (either CFG_REPLY or CFG_SET payloads)
        by the local entity on the ISAKMP SA represented by this
        IKE tunnel."
    ::= { cifIkeTunnelHistEntry 15 }

cifIkeTunHistOutConfigs OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        dispatched (either CFG_REPLY or CFG_SET payloads)
        by the local entity on the ISAKMP SA represented by this
        IKE tunnel."
    ::= { cifIkeTunnelHistEntry 16 }

cifIkeTunHistInConfigsRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        which were received (either CFG_REPLY or CFG_SET
        payloads) and rejected by this entity using the ISAKMP
        SA represented by this IKE tunnel."
    ::= { cifIkeTunnelHistEntry 17 }

cifIkeTunHistOutConfigsRejects OBJECT-TYPE
    SYNTAX Counter
--  Units
--    Mode Configuration Setting Payloads
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "
        The total number of Mode Configuration settings
        which were dispatched (either CFG_REPLY or CFG_SET
        payloads) by this entity and were rejected by the
        peer (client) using the ISAKMP SA represented by this
        IKE tunnel."
    ::= { cifIkeTunnelHistEntry 18 }

cifIkeNotifCntlInNewGrpRejected OBJECT-TYPE
    SYNTAX TruthValue
--    Rsyntax INTEGER {
--        true(1),
--        false(2)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "
        The generation of the 'ciscoIkeFlowInNewGrpRejected'
        notification is enabled if and only if this object has the
        value 'true'."
    DEFVAL { false }
    ::= { cifIkeNotifControl 1 }

cifIkeNotifCntlOutNewGrpRejected OBJECT-TYPE
    SYNTAX TruthValue
--    Rsyntax INTEGER {
--        true(1),
--        false(2)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "
        The generation of the 'ciscoIkeFlowOutNewGrpRejected'
        notification is enabled if and only if this object has the
        value 'true'."
    DEFVAL { false }
    ::= { cifIkeNotifControl 2 }

ciscoIkeFlowInNewGrpRejected TRAP-TYPE
-- Reverse mappable trap
    ENTERPRISE ciscoIkeFlowMIB
    VARIABLES {
        cisgIpsSgFailLocalAddress, cisgIpsSgFailRemoteAddress }
--  Status
--    mandatory
    DESCRIPTION
        "
        This notification is generated when the managed 
        entity receives and rejects an incoming new group 
        proposal from an IKE peer identified by
        'cisgIpsSgFailRemoteAddress'. 
        'cisgIpsSgFailLocalAddress' identifies the address of
        the local peer.  
        The ISAKMP context of the exchange can be obtained 
        from the IKE tunnel index which is contained in the 
        index of the varbind objects of this trap."
    ::= 1

ciscoIkeFlowOutNewGrpRejected TRAP-TYPE
-- Reverse mappable trap
    ENTERPRISE ciscoIkeFlowMIB
    VARIABLES {
        cisgIpsSgFailLocalAddress, cisgIpsSgFailRemoteAddress }
--  Status
--    mandatory
    DESCRIPTION
        "
        This notification is generated when the managed entity
        issues a new group proposal to the remote peer identified 
        by 'cisgIpsSgFailRemoteAddress' and the peer rejects the 
        proposal. 'cisgIpsSgFailLocalAddress' identifies the
        address of the local peer.
        The ISAKMP context of the exchange can be 
        obtained from the IKE tunnel index which is contained 
        in the index of the varbind objects of this trap."
    ::= 2

ciscoIkeFlowActivityGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 1 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group consists of objects that track the 
--    current IKE protocol activity:
--    1) IKE Global Objects
--    2) IKE Tunnel table.
--  Refer
--    
--    rfc2408, rfc2407; rfc2409 section 5.1, 5.2, 5.3
--    and 5.4.
--  objects
--    cifIkeGlobalInP2Exchgs, cifIkeGlobalInP2ExchgInvalids, 
--    cifIkeGlobalInP2ExchgRejects, cifIkeGlobalOutP2Exchgs, 
--    cifIkeGlobalOutP2ExchgInvalids, cifIkeGlobalOutP2ExchgRejects, 
--    cifIkeTunNegoMode, cifIkeTunDHGrp, 
--    cifIkeTunSaRefreshThreshold, cifIkeTunTotalRefreshes, 
--    cifIkeTunInP2Exchgs, cifIkeTunInP2ExchgInvalids, 
--    cifIkeTunInP2ExchgRejects, cifIkeTunInP2SaDelRequests, 
--    cifIkeTunOutP2Exchgs, cifIkeTunOutP2ExchgInvalids, 
--    cifIkeTunOutP2ExchgRejects

cifIkeFlowNewGroupGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 2 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group consists of:
--     1) Global metrics about new group negotiations
--     2) IKE Tunnel-wise new group metrics
--  Refer
--    
--    rfc2408, rfc2407; rfc2409 section 5.6.
--  objects
--    cifIkeGlobalInNewGrpReqs, cifIkeGlobalOutNewGrpReqs, 
--    cifIkeGlobalInNewGrpRejectReqs, 
--    cifIkeGlobalOutNewGrpRejectReqs, cifIkeTunInNewGrpReqs, 
--    cifIkeTunOutNewGrpReqs, cifIkeTunInNewGrpRejectedReqs, 
--    cifIkeTunOutNewGrpRejectedReqs

cifIkeFlowXauthGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 3 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group consists of metrics pertaining to
--    IKE extended authentication. Devices that do
--    not support Xauth need not implement this group.
--  objects
--    cifIkeGlobalInXauths, cifIkeGlobalInXauthFailures, 
--    cifIkeGlobalOutXauthFailures

cifIkeFlowModeConfigGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 4 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group consists of metrics pertaining to
--    IKE extended authentication. Devices that do
--    not support Xauth need not implement this group.
--  objects
--    cifIkeTunInConfigs, cifIkeTunOutConfigs, 
--    cifIkeTunInConfigRejects, cifIkeTunOutConfigRejects

cifIkeFlowHistoryGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 5 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group consists of the core (mandatory) 
--    objects pertaining to maintaining history of 
--    Internet Key Exchange protocol activity.
--  objects
--    cifIkeTunHistNegoMode, cifIkeTunHistDHGrp, 
--    cifIkeTunHistTotalRefreshes, cifIkeTunHistTotalSas, 
--    cifIkeTunHistInP2Exchgs, cifIkeTunHistInP2ExchgInvalids, 
--    cifIkeTunHistInP2ExchgRejects, cifIkeTunHistOutP2Exchgs, 
--    cifIkeTunHistOutP2ExchgInvalids, 
--    cifIkeTunHistOutP2ExchgRejects

cifIkeFlowNewGroupHistoryGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 6 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group consists of archive of new group
--    activity pertaining to expired IKE Phase-1 
--    tunnels.
--  objects
--    cifIkeTunHistInNewGrpReqs, cifIkeTunHistOutNewGrpReqs, 
--    cifIkeTunHistInNewGrpRejectReqs, 
--    cifIkeTunHistOutNewGrpRejectReqs

cifIkeFlowModeConfigHistoryGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 7 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group consists of archive of mode
--    config activity pertaining to expired IKE 
--    Phase-1 Tunnels.
--  objects
--    cifIkeTunHistInConfigs, cifIkeTunHistOutConfigs, 
--    cifIkeTunHistInConfigsRejects, cifIkeTunHistOutConfigsRejects

cifIkeFlowNotifCntlGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 8 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group of objects controls the sending 
--    of notifications pertaining to Phase-1 IKE
--    operations.
--  objects
--    cifIkeNotifCntlInNewGrpRejected, 
--    cifIkeNotifCntlOutNewGrpRejected

cifIkeFlowNotificationGroup OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBGroups 9 }
-- NOTIFICATION-GROUP
--  Status
--    mandatory
--  Descr
--    
--    This group contains the notifications pertaining
--    to Phase-1 IKE operations.
--  Refer
--    
--    rfc2408, rfc2407; rfc2409 section 5.1, 5.2, 5.3
--    and 5.4.
--  notifications
--    ciscoIkeFlowInNewGrpRejected, ciscoIkeFlowOutNewGrpRejected

ciscoIkeFlowMIBCompliance OBJECT IDENTIFIER ::= { ciscoIkeFlowMIBCompliances 1 }
-- MODULE-COMPLIANCE
--  Status
--    mandatory
--  Descr
--    The compliance statement for SNMP entities
--     implementing this MIB.
--  Module
--    >>current<<
--   MandGroup
--    ciscoIkeFlowActivityGroup
--   OptGroup
--    cifIkeFlowNewGroupGroup
--   OptGroup
--    cifIkeFlowXauthGroup
--   OptGroup
--    cifIkeFlowModeConfigGroup
--   OptGroup
--    cifIkeFlowHistoryGroup
--   OptGroup
--    cifIkeFlowNewGroupHistoryGroup
--   OptGroup
--    cifIkeFlowModeConfigHistoryGroup
--   OptGroup
--    cifIkeFlowNotificationGroup
--   OptGroup
--    cifIkeFlowNotifCntlGroup


END

