-- MIB file created 04-Nov-2009 23:28:00, by
--   SMICng version 2.2.11-beta(PRO)(Solaris), January 20, 2001. Enterprise key cisco.com

DOCS-SEC-MIB DEFINITIONS ::= BEGIN

-- From file: "DOCS-SEC-MIB.my"
-- Compile options "4 7 F H N O W 03 06 0B 0G 0N 0T"

IMPORTS
    TruthValue, MacAddress, RowStatus, DateAndTime
            FROM SNMPv2-TC-v1
    SnmpAdminString
            FROM SNMP-FRAMEWORK-MIB
    SnmpTagList
            FROM SNMP-TARGET-MIB
    InetAddressType, InetAddress, InetAddressPrefixLength, 
    InetPortNumber
            FROM INET-ADDRESS-MIB
    docsIf3CmtsCmRegStatusId
            FROM DOCS-IF3-MIB
    clabProjDocsis
            FROM CLAB-DEF-MIB
    Counter, Gauge
            FROM RFC1155-SMI
    OBJECT-TYPE
            FROM RFC-1212;

docsSecMib OBJECT IDENTIFIER ::= { clabProjDocsis 11 }
-- MODULE-IDENTITY
--  LastUpdated
--    200702230000Z
--  OrgName
--    Cable Television Laboratories, Inc.
--  ContactInfo
--    Postal: Cable Television Laboratories, Inc.
--    858 Coal Creek Circle
--    Louisville, Colorado 80027-9750
--    U.S.A.
--    Phone: +1 303-661-9100
--    Fax:   +1 303-661-9199
--    E-mail: mibs@cablelabs.com
--  Descr
--    This MIB module contains the management objects for 
--    the management of the security requirements in the DOCSIS
--    Security Specification.
--  RevDate
--    200702230000Z
--  RevDescr
--    Revised Version includes ECN OSSIv3.0-N-06.0357-1
--    and published as IO2
--  RevDate
--    200612071700Z
--  RevDescr
--    Initial version, published as part of the CableLabs
--    OSSIv3.0 specification CM-SP-OSSIv3.0-I01-061207
--    Copyright 1999-2006 Cable Television Laboratories, Inc.
--    All rights reserved.

docsSecMibObjects OBJECT IDENTIFIER ::= { docsSecMib 1 }
docsSecCmtsServerCfg OBJECT IDENTIFIER ::= { docsSecMibObjects 1 }
docsSecCmtsEncrypt OBJECT IDENTIFIER ::= { docsSecMibObjects 2 }
docsSecCmtsSavControl OBJECT IDENTIFIER ::= { docsSecMibObjects 4 }
docsSecCmtsCertificate OBJECT IDENTIFIER ::= { docsSecMibObjects 9 }
docsSecCmtsCertRevocationList OBJECT IDENTIFIER ::= { docsSecMibObjects 10 }
docsSecCmtsOnlineCertStatusProtocol OBJECT IDENTIFIER ::= { docsSecMibObjects 11 }
docsSecMibConformance OBJECT IDENTIFIER ::= { docsSecMib 2 }
docsSecMibCompliances OBJECT IDENTIFIER ::= { docsSecMibConformance 1 }
docsSecMibGroups OBJECT IDENTIFIER ::= { docsSecMibConformance 2 }

docsSecCmtsServerCfgTftpOptions OBJECT-TYPE
    SYNTAX OCTET STRING(SIZE(1..2))
        -- BITS are:
        --   hwAddr(0)
        --   netAddr(1)
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute instructs the CMTS to insert the source
        IP address and/or MAC address of received TFTP packets
        into the TFTP option fields before forwarding
        the packets to the Config File server.
        This attribute is only applicable when the TftpProxyEnabled
        attribute of the MdCfg object is 'true'."
    REFERENCE
        "DOCSIS 3.0 Operations Support System Interface
         Specification CM-SP-OSSIv3.0-I01-061207,
         MdCfg Object Section in the Media Access Control (MAC)
         Requirements Annex."
    DEFVAL { '00'h }
    ::= { docsSecCmtsServerCfg 1 }

docsSecCmtsServerCfgConfigFileLearningEnable OBJECT-TYPE
    SYNTAX TruthValue
--    Rsyntax INTEGER {
--        true(1),
--        false(2)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute enables and disables Configuration
        File Learning functionality.
        If this attribute is set to 'true' the CMTS will respond
        with Authentication Failure in the REG-RSP message
        when there is a mismatch between learned config file
        parameters and REG-REQ parameters. If this attribute
        is set to 'false', the CMTS will not execute config
        file learning and mismatch check.
        This attribute is only applicable when the TftpProxyEnabled
        attribute of the MdCfg object is 'true'."
    REFERENCE
        "DOCSIS 3.0 Operations Support System Interface
         Specification CM-SP-OSSIv3.0-I01-061207,
         MdCfg Object Section in the Media Access Control (MAC)
         Requirements Annex.
         DOCSIS 3.0 Security Specification
         CM-SP-SECv3.0-I01-060804, Secure Provisioning Section.
         DOCSIS 3.0 MAC and Upper Layer Protocols Interface
         Specification CM-SP-MULPIv3.0-I01-060804."
    DEFVAL { true }
    ::= { docsSecCmtsServerCfg 2 }

docsSecCmtsEncryptEncryptAlgPriority OBJECT-TYPE
    SYNTAX SnmpTagList
--    Rsyntax OCTET STRING(SIZE(0..255))
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute allows for configuration of a prioritized
        list of encryption algorithms the CMTS will
        use when selecting the primary SAID encryption algorithm
        for a given CM. The CMTS selects the highest priority
        encryption algorithm from this list that the CM
        supports. By default the following encryption algorithms
        are listed from highest to lowest priority (left
        being the highest): 128 bit AES, 56 bit DES, 40 bit
        DES.
        An empty list indicates that the CMTS attempts to use
        the latest and robust encryption algorithm supported
        by the CM. The CMTS will ignore unknown values or unsupported
        algorithms."
    DEFVAL { "aes128CbcMode des56CbcMode des40CbcMode" }
    ::= { docsSecCmtsEncrypt 1 }

docsSecCmtsCmEaeExclusionTable OBJECT-TYPE
    SYNTAX SEQUENCE OF DocsSecCmtsCmEaeExclusionEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This object defines a list of CMs or CM groups to exclude
        from Early Authentication and Encryption (EAE).
        This object allows overrides to the value of EAE Control
        for individual CMs or group of CMs for purposes
        such as debugging. The CMTS supports a minimum of
        30 instances of the CmtsCmEaeExclusion object.
        This object is only applicable when the EarlyAuthEncryptCtrl
        attribute of the MdCfg object is enabled.
        
        This object supports the creation and deletion of multiple
        instances."
    REFERENCE
        "DOCSIS 3.0 Operations Support System Interface
         Specification CM-SP-OSSIv3.0-I01-061207,
         MdCfg Object Section in the Media Access Control (MAC)
         Requirements Annex.
         DOCSIS 3.0 Security Specification
         CM-SP-SECv3.0-I01-060804, Early Authentication And
         Encryption (EAE) Section."
    ::= { docsSecMibObjects 3 }

docsSecCmtsCmEaeExclusionEntry OBJECT-TYPE
    SYNTAX DocsSecCmtsCmEaeExclusionEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "The conceptual row of docsSecCmtsCmEaeExclusion.
        The CMTS persists all instances of CmtsCmEaeExclusion
        across reinitializations."
    INDEX { docsSecCmtsCmEaeExclusionId }
    ::= { docsSecCmtsCmEaeExclusionTable 1 }

DocsSecCmtsCmEaeExclusionEntry ::= SEQUENCE {
    docsSecCmtsCmEaeExclusionId Gauge,
    docsSecCmtsCmEaeExclusionMacAddr MacAddress,
    docsSecCmtsCmEaeExclusionMacAddrMask MacAddress,
    docsSecCmtsCmEaeExclusionRowStatus RowStatus
    }

docsSecCmtsCmEaeExclusionId OBJECT-TYPE
    SYNTAX Gauge(1..4294967295)
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This key uniquely identifies the exclusion MAC address
        rule."
    ::= { docsSecCmtsCmEaeExclusionEntry 1 }

docsSecCmtsCmEaeExclusionMacAddr OBJECT-TYPE
    SYNTAX MacAddress
--    Rsyntax OCTET STRING(SIZE(6))
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute identifies the CM MAC address. A match
        is made when a CM MAC address bitwise ANDed with the
        MacAddrMask attribute equals the value of this attribute."
    DEFVAL { '000000000000'H }
    ::= { docsSecCmtsCmEaeExclusionEntry 2 }

docsSecCmtsCmEaeExclusionMacAddrMask OBJECT-TYPE
    SYNTAX MacAddress
--    Rsyntax OCTET STRING(SIZE(6))
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute identifies the CM MAC address mask
        and is used with the MacAddr attribute."
    DEFVAL { 'FFFFFFFFFFFF'H }
    ::= { docsSecCmtsCmEaeExclusionEntry 3 }

docsSecCmtsCmEaeExclusionRowStatus OBJECT-TYPE
    SYNTAX RowStatus
--    Rsyntax INTEGER {
--        active(1),
--        notInService(2),
--        notReady(3),
--        createAndGo(4),
--        createAndWait(5),
--        destroy(6)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "Controls and reflects the status of rows in this
        table. There is no restriction on changing values in
        a row of this table while the row is active."
    ::= { docsSecCmtsCmEaeExclusionEntry 4 }

docsSecCmtsSavControlCmAuthEnable OBJECT-TYPE
    SYNTAX TruthValue
--    Rsyntax INTEGER {
--        true(1),
--        false(2)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute enables or disables Source Address
        Verification (SAV) for CM configured policies in the
        SavCmAuth object. If this attribute is set to 'false',
        the CM configured policies in the SavCmAuth object
        are ignored.
        This attribute is only applicable when the
        SrcAddrVerificationEnabled attribute of the MdCfg object is
        'true'."
    REFERENCE
        "DOCSIS 3.0 Operations Support System Interface
         Specification CM-SP-OSSIv3.0-I01-061207,
         MdCfg Object Section in the Media Access Control (MAC)
         Requirements Annex."
    DEFVAL { true }
    ::= { docsSecCmtsSavControl 1 }

docsSecSavCmAuthTable OBJECT-TYPE
    SYNTAX SEQUENCE OF DocsSecSavCmAuthEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This object defines a read-only set of SAV policies
        associated with a CM that the CMTS will use in addition
        to the CMTS verification of an operator assigned IP
        Address being associated with a CM. When the CMTS has
        not resolved a source address of a CM CPE, the CMTS verifies
        if the CM CPE is authorized to pass traffic based
        on this object. These object policies include a list
        of subnet prefixes (defined in the SavStaticList
        object) or a SAV Group Name that could reference a CMTS
        configured list of subnet prefixes (defined in SavCfgList
        object) or vendor-specific policies. The CMTS
        populates the attributes of this object for a CM from
        that CM's config file.
        This object is only applicable when the
        SrcAddrVerificationEnabled attribute of the MdCfg object is
        'true' and the CmAuthEnable attribute of the CmtsSavCtrl
        object is 'true'.
        The CMTS is not required to persist instances of this
        object across reinitializations."
    REFERENCE
        "DOCSIS 3.0 Operations Support System Interface
         Specification CM-SP-OSSIv3.0-I01-061207,
         MdCfg Object Section in the Media Access Control (MAC)
         Requirements Annex.
         DOCSIS 3.0 Security Specification
         CM-SP-SECv3.0-I01-060804, Secure Provisioning Section.
         DOCSIS 3.0 MAC and Upper Layer Protocols Interface
         Specification CM-SP-MULPIv3.0-I01-060804,
         Common Radio Frequency Interface Encodings Annex."
    ::= { docsSecMibObjects 5 }

docsSecSavCmAuthEntry OBJECT-TYPE
    SYNTAX DocsSecSavCmAuthEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "The conceptual row of docsSecSavCmAuth."
    INDEX { docsIf3CmtsCmRegStatusId }
    ::= { docsSecSavCmAuthTable 1 }

DocsSecSavCmAuthEntry ::= SEQUENCE {
    docsSecSavCmAuthGrpName SnmpAdminString,
    docsSecSavCmAuthStaticPrefixListId Gauge
    }

docsSecSavCmAuthGrpName OBJECT-TYPE
    SYNTAX SnmpAdminString
--    Rsyntax OCTET STRING(SIZE(0..255))
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "This attribute references the Name attribute of the
        SavCfgList object of a CM. If the CM signaled group
        name is not configured in the CMTS, the CMTS ignores this
        attribute value for the purpose of Source Address
        Verification. The CMTS must allow the modification
        of the GrpName object and use the updated SAV rules for
        newly discovered CPEs from CMs. When a source IP address
        is claimed by two CMs (e.g., detected as duplicated),
        the CMTS must use the current SAV rules defined
        for both CMs in case the SAV GrpName rules may have been
        updated. In the case of a persisting conflict, it is
        up to vendor-implementation to decide what CM should
        hold the SAV authorization.
        The zero-length string indicates that no SAV Group was
        signaled by the CM. The zero-length value or a non-existing
        reference in the SavCfgList object means the
        SavCfgListName is ignored for the purpose of SAV."
    REFERENCE
        "DOCSIS 3.0 MAC and Upper Layer Protocols Interface
         Specification CM-SP-MULPIv3.0-I01-060804,
         Common Radio Frequency Interface Encodings Annex."
    ::= { docsSecSavCmAuthEntry 1 }

docsSecSavCmAuthStaticPrefixListId OBJECT-TYPE
    SYNTAX Gauge
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "This attribute identifies the reference to a CMTS
        created subnet prefix list based on the CM signaled static
        prefix list TLV elements. The CMTS may reuse this
        attribute value to reference more than one CM when
        those CMs have signaled the same subnet prefix list to
        the CMTS.
        The value zero indicates that no SAV static prefix encodings
        were signaled by the CM."
    ::= { docsSecSavCmAuthEntry 2 }

docsSecSavCfgListTable OBJECT-TYPE
    SYNTAX SEQUENCE OF DocsSecSavCfgListEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This object defines the CMTS configured subnet prefix
        extension to the SavCmAuth object.
        This object supports the creation and deletion of multiple
        instances.
        Creation of a new instance of this object requires the
        PrefixAddrType and PrefixAddr attributes to be set."
    ::= { docsSecMibObjects 6 }

docsSecSavCfgListEntry OBJECT-TYPE
    SYNTAX DocsSecSavCfgListEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "The conceptual row of docsSecSavCfgList.
        The CMTS persists all instances of SavCfgList
        across reinitializations."
    INDEX { docsSecSavCfgListName, docsSecSavCfgListRuleId }
    ::= { docsSecSavCfgListTable 1 }

DocsSecSavCfgListEntry ::= SEQUENCE {
    docsSecSavCfgListName SnmpAdminString,
    docsSecSavCfgListRuleId Gauge,
    docsSecSavCfgListPrefixAddrType InetAddressType,
    docsSecSavCfgListPrefixAddr InetAddress,
    docsSecSavCfgListPrefixLen InetAddressPrefixLength,
    docsSecSavCfgListRowStatus RowStatus
    }

docsSecSavCfgListName OBJECT-TYPE
    SYNTAX SnmpAdminString(SIZE(1..16))
--    Rsyntax OCTET STRING(SIZE(1..16))
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This attribute is the key that identifies the instance
        of the SavCmAuth object to which this object extension
        belongs."
    ::= { docsSecSavCfgListEntry 1 }

docsSecSavCfgListRuleId OBJECT-TYPE
    SYNTAX Gauge(1..4294967295)
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This attribute is the key that identifies a particular
        subnet prefix rule of an instance of this object."
    ::= { docsSecSavCfgListEntry 2 }

docsSecSavCfgListPrefixAddrType OBJECT-TYPE
    SYNTAX InetAddressType
--    Rsyntax INTEGER {
--        ?? enum value of zero may cause problems
--        unknown(0),
--        ipv4(1),
--        ipv6(2),
--        ipv4z(3),
--        ipv6z(4),
--        dns(16)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute identifies the IP address type of this
        subnet prefix rule."
    ::= { docsSecSavCfgListEntry 3 }

docsSecSavCfgListPrefixAddr OBJECT-TYPE
    SYNTAX InetAddress
--    Rsyntax OCTET STRING(SIZE(0..255))
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute corresponds to the IP address of this
        subnet prefix rule in accordance to the PrefixAddrType
        attribute."
    ::= { docsSecSavCfgListEntry 4 }

docsSecSavCfgListPrefixLen OBJECT-TYPE
    SYNTAX InetAddressPrefixLength
--    Rsyntax Gauge(0..2040)
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute defines the length of the subnet prefix
        to be matched by this rule."
    ::= { docsSecSavCfgListEntry 5 }

docsSecSavCfgListRowStatus OBJECT-TYPE
    SYNTAX RowStatus
--    Rsyntax INTEGER {
--        active(1),
--        notInService(2),
--        notReady(3),
--        createAndGo(4),
--        createAndWait(5),
--        destroy(6)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "The row creation control of this conceptual row.
        An entry in this table can be set to active
        only when the following attributes are correctly
        assigned:
           PrefixAddrType
           PrefixAddress
        There are no restrictions to modify or delete
        entries in this table."
    ::= { docsSecSavCfgListEntry 6 }

docsSecSavStaticListTable OBJECT-TYPE
    SYNTAX SEQUENCE OF DocsSecSavStaticListEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This object defines a subnet prefix extension to the
        SavCmAuth object based on CM statically signaled
        subnet prefixes to the CMTS.
        When a CM signals to the CMTS static subnet prefixes,
        the CMTS must create a List Id to be referenced by the CM
        in the SavCmAuth StaticPrefixListId attribute, or
        the CMTS may reference an existing List Id associated
        to previously registered CMs in case of those subnet
        prefixes associated with the List Id match the ones
        signaled by the CM."
    REFERENCE
        "DOCSIS 3.0 MAC and Upper Layer Protocols Interface
        Specification CM-SP-MULPIv3.0-I01-060804,
        Common Radio Frequency Interface Encodings Annex."
    ::= { docsSecMibObjects 7 }

docsSecSavStaticListEntry OBJECT-TYPE
    SYNTAX DocsSecSavStaticListEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "The conceptual row of docsSecSavStaticList.
        The CMTS may persist instances of this object
        across reinitializations."
    INDEX { docsSecSavStaticListId, docsSecSavStaticListRuleId }
    ::= { docsSecSavStaticListTable 1 }

DocsSecSavStaticListEntry ::= SEQUENCE {
    docsSecSavStaticListId Gauge,
    docsSecSavStaticListRuleId Gauge,
    docsSecSavStaticListPrefixAddrType InetAddressType,
    docsSecSavStaticListPrefixAddr InetAddress,
    docsSecSavStaticListPrefixLen InetAddressPrefixLength
    }

docsSecSavStaticListId OBJECT-TYPE
    SYNTAX Gauge(1..4294967295)
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This key uniquely identifies the index that groups
        multiple subnet prefix rules. The CMTS assigns this
        value per CM or may reuse it among multiple CMs that share
        the same list of subnet prefixes."
    ::= { docsSecSavStaticListEntry 1 }

docsSecSavStaticListRuleId OBJECT-TYPE
    SYNTAX Gauge(1..4294967295)
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This key identifies a particular static subnet prefix
        rule of an instance of this object."
    ::= { docsSecSavStaticListEntry 2 }

docsSecSavStaticListPrefixAddrType OBJECT-TYPE
    SYNTAX InetAddressType
--    Rsyntax INTEGER {
--        ?? enum value of zero may cause problems
--        unknown(0),
--        ipv4(1),
--        ipv6(2),
--        ipv4z(3),
--        ipv6z(4),
--        dns(16)
--        }
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "This attribute identifies the IP address type of this
        subnet prefix rule."
    ::= { docsSecSavStaticListEntry 3 }

docsSecSavStaticListPrefixAddr OBJECT-TYPE
    SYNTAX InetAddress
--    Rsyntax OCTET STRING(SIZE(0..255))
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "This attribute corresponds to the IP address of this
        subnet prefix rule in accordance to the PrefixAddrType
        attribute."
    ::= { docsSecSavStaticListEntry 4 }

docsSecSavStaticListPrefixLen OBJECT-TYPE
    SYNTAX InetAddressPrefixLength
--    Rsyntax Gauge(0..2040)
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "This attribute defines the length of the subnet prefix
        to be matched by this rule."
    ::= { docsSecSavStaticListEntry 5 }

docsSecCmtsCmSavStatsTable OBJECT-TYPE
    SYNTAX SEQUENCE OF DocsSecCmtsCmSavStatsEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "This object provides a read-only list of SAV counters
        for different service theft indications."
    ::= { docsSecMibObjects 8 }

docsSecCmtsCmSavStatsEntry OBJECT-TYPE
    SYNTAX DocsSecCmtsCmSavStatsEntry
    ACCESS not-accessible
    STATUS mandatory
    DESCRIPTION
        "The conceptual row of docsSecCmtsCmSavStats."
    INDEX { docsIf3CmtsCmRegStatusId }
-- Augments docsIf3CmtsCmRegStatusEntry FROM DOCS-IF3-MIB
    ::= { docsSecCmtsCmSavStatsTable 1 }

DocsSecCmtsCmSavStatsEntry ::= SEQUENCE {
    docsSecCmtsCmSavStatsSavDiscards Counter
    }

docsSecCmtsCmSavStatsSavDiscards OBJECT-TYPE
    SYNTAX Counter
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "This attribute provides the information about number
        of dropped upstream packets due to SAV failure."
    ::= { docsSecCmtsCmSavStatsEntry 1 }

docsSecCmtsCertificateCertRevocationMethod OBJECT-TYPE
    SYNTAX INTEGER {
        none(1),
        crl(2),
        ocsp(3),
        crlAndOcsp(4)
        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute identifies which certificate revocation
        method is to be used by the CMTS to verify the cable
        modem certificate validity. The certificate revocation
        methods include Certification Revocation
        List (CRL) and Online Certificate Status Protocol
        (OCSP).
        The following options are available:
        The option 'none' indicates that the CMTS does not attempt
        to determine the revocation status of a certificate.
        
        The option 'crl' indicates the CMTS uses a Certificate
        Revocation List (CRL) as defined by the Url attribute
        of the CmtsCertRevocationList object. When the
        value of this attribute is changed to 'crl', it triggers
        the CMTS to retrieve the CRL from the URL specified
        by the Url attribute. If the value of this attribute
        is 'crl' when the CMTS starts up, it triggers the CMTS
        to retrieve the CRL from the URL specified by the Url attribute.
        
        The option 'ocsp' indicates the CMTS uses the Online
        Certificate Status Protocol (OCSP) as defined by the
        Url attribute of the CmtsOnlineCertStatusProtocol
        object.
        
        The option 'crlAndOcsp' indicates the CMTS uses both
        the CRL as defined by the Url attribute in the
        CmtsCertRevocationList object and OCSP as defined by the Url
        attribute in the CmtsOnlineCertStatusProtocol
        object.
        The CMTS persists the values of the CertRevocationMethod
        attribute across reinitializations."
    DEFVAL { none }
    ::= { docsSecCmtsCertificate 1 }

docsSecCmtsCertRevocationListUrl OBJECT-TYPE
    SYNTAX SnmpAdminString
--    Rsyntax OCTET STRING(SIZE(0..255))
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute contains the URL from where the CMTS
        will retrieve the CRL. When this attribute is set to
        a URL value different from the current value, it triggers
        the CMTS to retrieve the CRL from that URL. If the
        value of this attribute is a zero-length string, the
        CMTS does not attempt to retrieve the CRL.
        The CMTS persists the value of Url across
        reinitializations."
    REFERENCE
        "DOCSIS 3.0 Security Specification
         CM-SP-SECv3.0-I01-060804, BPI+ X.509 Certificate Profile
         and Management Section."
    DEFVAL { "" }
    ::= { docsSecCmtsCertRevocationList 1 }

docsSecCmtsCertRevocationListRefreshInterval OBJECT-TYPE
    SYNTAX Gauge(1..524160)
--  Units
--    minutes
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute contains the refresh interval for
        the CMTS to retrieve the CRL (referred to in the Url attribute)
        with the purpose of updating its Certificate
        Revocation List. This attribute is meaningful if
        the tbsCertList.nextUpdate attribute does not exist
        in the last retrieved CRL, otherwise the value 0 is
        returned.
        The CMTS persists the value of RefreshInterval across
        reinitializations."
    REFERENCE
        "DOCSIS 3.0 Security Specification
         CM-SP-SECv3.0-I01-060804, BPI+ X.509 Certificate Profile
         and Management Section."
    DEFVAL { 10080 }
    ::= { docsSecCmtsCertRevocationList 2 }

docsSecCmtsCertRevocationListLastUpdate OBJECT-TYPE
    SYNTAX DateAndTime
--    Rsyntax OCTET STRING(SIZE(8|11))
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "This attribute contains the last date and time when
        the CRL was retrieved by the CMTS. This attribute returns
        the initial EPOC time if the CRL has not being updated.
        The CMTS persists the value of LastUpdate across
        reinitializations."
    ::= { docsSecCmtsCertRevocationList 3 }

docsSecCmtsOnlineCertStatusProtocolUrl OBJECT-TYPE
    SYNTAX SnmpAdminString
--    Rsyntax OCTET STRING(SIZE(0..255))
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute contains the URL string to retrieve
        OCSP information. If the value of this attribute is
        a zero-length string, the CMTS does not attempt to request
        the status of a CM certificate.
        The CMTS persists the value of Url across
        reinitializations."
    REFERENCE
        "DOCSIS 3.0 Security Specification
         CM-SP-SECv3.0-I01-060804, BPI+ X.509 Certificate Profile
         and Management Section.
         RFC 2560."
    DEFVAL { "" }
    ::= { docsSecCmtsOnlineCertStatusProtocol 1 }

docsSecCmtsOnlineCertStatusProtocolSignatureBypass OBJECT-TYPE
    SYNTAX TruthValue
--    Rsyntax INTEGER {
--        true(1),
--        false(2)
--        }
    ACCESS read-write
    STATUS mandatory
    DESCRIPTION
        "This attribute enables or disables signature checking
        on OCSP response messages.
        The CMTS persists the value of SignatureBypass across
        reinitializations."
    REFERENCE
        "DOCSIS 3.0 Security Specification
         CM-SP-SECv3.0-I01-060804, BPI+ X.509 Certificate Profile
         and Management Section.
         RFC 2560."
    DEFVAL { false }
    ::= { docsSecCmtsOnlineCertStatusProtocol 2 }

docsSecGroup OBJECT IDENTIFIER ::= { docsSecMibGroups 1 }
-- OBJECT-GROUP
--  Status
--    mandatory
--  Descr
--    Group of objects implemented in the CMTS.
--  objects
--    docsSecCmtsCertRevocationListUrl, 
--    docsSecCmtsCertRevocationListRefreshInterval, 
--    docsSecCmtsCertRevocationListLastUpdate, 
--    docsSecCmtsOnlineCertStatusProtocolUrl, 
--    docsSecCmtsOnlineCertStatusProtocolSignatureBypass, 
--    docsSecCmtsServerCfgTftpOptions, 
--    docsSecCmtsServerCfgConfigFileLearningEnable, 
--    docsSecCmtsEncryptEncryptAlgPriority, 
--    docsSecCmtsSavControlCmAuthEnable, 
--    docsSecCmtsCmEaeExclusionMacAddr, 
--    docsSecCmtsCmEaeExclusionMacAddrMask, 
--    docsSecCmtsCmEaeExclusionRowStatus, docsSecSavCmAuthGrpName, 
--    docsSecSavCmAuthStaticPrefixListId, 
--    docsSecSavCfgListPrefixAddrType, docsSecSavCfgListPrefixAddr, 
--    docsSecSavCfgListPrefixLen, docsSecSavCfgListRowStatus, 
--    docsSecSavStaticListPrefixAddrType, 
--    docsSecSavStaticListPrefixAddr, docsSecSavStaticListPrefixLen, 
--    docsSecCmtsCmSavStatsSavDiscards, 
--    docsSecCmtsCertificateCertRevocationMethod

docsSecCompliance OBJECT IDENTIFIER ::= { docsSecMibCompliances 1 }
-- MODULE-COMPLIANCE
--  Status
--    mandatory
--  Descr
--    The compliance statement for devices that implement the DOCSIS
--    Security MIB.
--  Module
--    >>current<<
--   MandGroup
--    docsSecGroup


END

