The GDOI MIB Support for GET VPN feature provides a command that you use on the KS (or primary KS) to check whether all the devices in the network are running versions that support the GDOI MIB. For more information, see the “Ensuring that GMs Are Running Software Versions That Support the GDOI MIB” section.

The GDOI MIB objects are organized into the following GDOI MIB tables. Following is the relationship (hierarchy) among the tables:

Figure 1. GDOI MIB Table Hierarchy

Following is a list of the MIB table objects (listed per group).

Group table objects:

• Group ID type—Specifies whether the group ID is an IP address, group number, hostname, and so on.

• Group ID length—Number of octets in the group ID value.

• Group ID value—Group number, IP address, or hostname.

• Group name—String value.

• Group member count -- Specifies the number of registered KSs to this group.

• Group active peer KS count -- Specifies the number of active KSs to this group.

• Group last rekey retransmits -- Specifies the cumulative count of number of rekey messages and retransmit messages sent as a part of last rekey operation.

• Group last rekey time taken -- Specifies the time taken by the KS to complete the last rekey operation.

KS table objects:

• KS ID type

• KS ID length

• KS ID value

• Active KEK—SPI of the key encryption key (KEK) that is currently used by the KS to encrypt the rekey message.

• Last rekey sequence number—Last rekey number that was sent by the KS to the group.

• KS Role -- Primary or secondary.

• Number of registered GMs -- count of GMs registered to this KS.

COOP table objects:

• COOP peer ID type

• COOP peer ID length

• COOP peer ID value

• COOP peer ID role -- Primary or secondary

• COOP peer status -- Alive, dead or unknown

• Number of registered GMs -- count of GMs registered to the COOP peer

GM table:

• GM ID type

• GM ID length

• GM ID value

• Registered KS ID type—ID type of the KS to which the GM is registered.

• Registered KS ID length

• Registered KS ID value

• Active KEK—SPI of the KEK currently used by the GM to decrypt rekey messages.

• Last rekey seq number—Last rekey number received by the GM.

• Count of active TEKs -- number of active TEKs used by the GM to encrypt/decrypt/authenticate dataplane traffic.

KS KEK table:

• KEK index

• KEK SPI

• KEK source ID information—Source ID type, ID length, and ID value.

• KEK source ID port—Port associated with the source ID.

• KEK destination ID information—Destination ID type, ID length, and ID value.

• KEK destination ID port—Port associated with the destination ID.

• IP protocol ID—UDP or TCP.

• Key management algorithm (unused).

• Encryption algorithm and key length (bits)

• SIG payload hash algorithm, SIG payload signature algorithm, and SIG payload key length (bits).

• Hash algorithm (will be reused from the IPsec MIB)

• Diffie-Hellman group

• KEK original lifetime (seconds)—Maximum time for which a KEK is valid.

• KEK remaining lifetime (seconds)

KS TEK selector table (corresponds to the ACLs that are configured as part of the IPsec SA in the GDOI group configuration on the KS):

• TEK selector index—An integer index for traffic encryption keys (TEK).

• TEK source ID information—Source ID type, ID length, and ID value.

• TEK source ID port—Port associated with the source ID.

• TEK destination ID information—Destination ID type, ID length, and ID value.

• TEK destination ID port—Port associated with the destination ID.

• TEK Security protocol—GDOI_PROTO_IPSEC_ESP protocol ID value in the SA TEK payload (see RFC 6407).

KS TEK policy table:

• TEK policy index—An integer index.

• TEK SPI—Four octets

• Encapsulation mode—Tunnel or transport.

• Encryption algorithm and key length (bits)

• Integrity and authentication algorithm and key length (bits)

• TBAR window size (seconds)

• TEK original lifetime (seconds)—Maximum time for which a TEK is valid.

• TEK remaining lifetime (seconds)

• TEK Status—Inbound, outbound, or not in use.

GM KEK table:

• KEK index—An integer index.

• KEK SPI

• KEK source ID information—Source ID type, ID length , and ID value.

• KEK source ID port—Port associated with the source ID.

• KEK destination ID information—Destination ID type, ID length, and ID value.

• KEK destination ID port—Port associated with the destination ID.

• IP protocol ID—UDP or TCP.

• Key management algorithm (unused)

• Encryption algorithm and key length (bits)

• SIG payload hash algorithm, SIG payload signature algorithm, and SIG payload key length (bits)

• Hash algorithm

• Diffie-Hellman group

• KEK original lifetime (seconds)—Maximum time for which a KEK is valid.

• KEK remaining lifetime (seconds)

GM TEK selector table (corresponds to the ACLs that are downloaded to the GM as part of the TEK policy from the KS):

• TEK selector index—An integer index.

• TEK source ID information—Source ID type, ID length, and ID value.

• TEK source ID port—Port associated with the source ID.

• TEK destination ID information—Destination ID type, ID length , and ID value.

• TEK destination ID port—Port associated with the destination ID.

• TEK Security protocol—GDOI_PROTO_IPSEC_ESP protocol ID value in the SA TEK payload (see RFC 6407).

GM TEK policy table:

• TEK policy index—An integer index.

• TEK SPI —Four octets.

• Encapsulation mode—Tunnel or transport.

• Encryption algorithm and key length (bits)

• Integrity and authentication algorithm and key length (bits)

• TBAR window size (seconds)

• TEK original lifetime (seconds)—Maximum time for which a TEK is valid.

• TEK remaining lifetime (seconds)

• TEK Status—Inbound, outbound, or not in use.

The GDOI MIB supports the Simple Network Management Protocol (SNMP) notifications in the following table. The GDOI MIB contains two kinds of notifications: those generated by the KS and those generated by each GM. You can enable any combination of notifications (or all notifications).

For more information, see the “Enabling GDOI MIB Notifications” section.

The GDOI MIB contains only objects that are listed in RFC 6407 and does not contain objects for functionality specific to the Cisco implementation of GDOI. This functionality includes:

• Cooperative key servers

• GM ACLs

• Receive-only SAs

• Fail-close/fail-open

• Crypto map objects

• Other Cisco GET VPN-specific features

1.    enable


2.    show crypto gdoi feature gdoi-mib


3.    show crypto gdoi feature gdoi-mib | include No

Device> enable

Device# show crypto gdoi feature gdoi-mib

Device# show crypto gdoi feature gdoi-mib | include No

1.    enable


2.    configure terminal


3.    snmp-server community community-string [view view-name] [ro | rw] [ipv6 nacl] [access-list-number | extended-access-list-number | access-list-name]


4.    end

Device> enable

Device# configure terminal

Device(config)# snmp-server community mycommunity

Device(config)# end

For more information about specifying a community access string, refer to the “Configuring SNMP Support” module in the SNMP Configuration Guide. For more information about the snmp-server community command (including syntax and usage guidelines), refer to the Cisco IOS SNMP Support Command Reference.

1.    enable


2.    configure terminal


3.    snmp-server host {hostname | ip-address} version {1 | 2c | 3} community-string


4.    end

Device> enable

Device# configure terminal

Device(config)# snmp-server host 209.165.200.225 version 2c mycommunity

Device(config)# end

For more information about enabling communication with the SNMP manager, refer to the “Configuring SNMP Support” module in the SNMP Configuration Guide. For more information about the snmp-server host command (including syntax and usage guidelines), refer to the Cisco IOS SNMP Support Command Reference.

1.    enable


2.    configure terminal


3.    snmp-server enable traps gdoi [notification-type]


4.    end

Device> enable

Device# configure terminal

Device(config)# snmp-server enable traps gdoi gm-registration-complete gm-rekey-rcvd ks-new-registration ks-reg-complete

Device(config)# end