The Differentiated Services Configuration MIB
Extracted elements (21)
The DIFFSERV-CONFIG-MIB is positioned as a conceptual layer between the Policy-based Management MIB and the instance-specific Differentiated Services MIB. Changes to this MIB do not directly alter external traffic behavior; instead, configurations are instantiated into the DIFFSERV-MIB only when activated via policy or SNMP operations.
The diffServConfigId index is constrained to 1–116 octets to remain within the SMI limit of 128 sub-identifiers in an object identifier, ensuring valid OID construction when the string is used as an index.
The diffServConfigTable is semantically different from diffServDataPathTable in that it is not associated with any specific interface or direction. This allows a single configuration template to be reused across multiple interfaces.
To avoid duplication of managed objects, the actual functional datapath templates are defined in the Differentiated Services MIB (RFC 3289) tables rather than in the DIFFSERV-CONFIG-MIB. The DIFFSERV-CONFIG-MIB only provides a starting pointer (diffServConfigStart) into those pre-existing tables.
Use of the DIFFSERV-CONFIG-MIB does not require the Policy-based Management MIB (PMMIBDR). Without it, a management application must emulate the policy activation behavior using equivalent low-level SNMP SET/GET operations directly.
Vendors may include additional managed objects in vendor-specific MIB modules for configuring DiffServ parameters. If a vendor uses the DIFFSERV-CONFIG-MIB objects, they should extend them in the same approach as defined for the Differentiated Services MIB module.
For the full compliance level, diffServConfigStatus MUST support only createAndGo(4) and destroy(6) write values; support for createAndWait and notInService is not required.
Full compliance with DIFFSERV-CONFIG-MIB requires that 'diffServMIBFullCompliance' (from RFC 3289) also be met, since DIFFSERV-CONFIG-MIB depends on the Differentiated Services MIB to provide the configuration entries.
If a configuration template is activated via SNMP SET requests, an accurate error response value MUST be returned. On systems where activation may take a long time, extra mechanisms must be provided to detect errors after an early response.
It is RECOMMENDED that all entries comprising the configuration started by diffServConfigStart follow the same StorageType as the diffServConfigEntry row. Mismatched storage types can cause configuration divergence after agent reboots, and the management application should verify the correct configuration after a reboot.
RowPointer objects MUST point to the first accessible columnar object in the conceptual row, not to the index value itself. For example, diffServCountActOctets.1 is correct; diffServCountActId.1 is not.
When a configuration template is activated on an interface, it MUST be cloned so that the original template remains available for reuse. The cloning process must generate new indices for each element and update all NEXT RowPointers accordingly; the original pointers must not be reused.
diffServConfigEntry contains: diffServConfigId (SnmpAdminString index, 1–116 octets), diffServConfigDescr (human-readable description), diffServConfigOwner (creator identity), diffServConfigLastChange (DateAndTime, read-only), diffServConfigStart (RowPointer), diffServConfigStorage (StorageType), and diffServConfigStatus (RowStatus).
diffServConfigStart is a RowPointer that references the first element of a functional datapath in the DIFFSERV-MIB, pointing to one of: diffServClfrEntry, diffServMeterEntry, diffServActionEntry, diffServAlgDropEntry, or diffServQEntry. A value of zeroDotZero indicates no further DiffServ treatment; a non-existent row is treated equivalently to zeroDotZero.
The diffServConfigTable is the sole table in the DIFFSERV-CONFIG-MIB module. Each entry registers a per-hop-behavior (PHB) traffic treatment configuration template, identified by diffServConfigId, with a starting pointer into the DIFFSERV-MIB functional datapath via diffServConfigStart.
The DIFFSERV-CONFIG-MIB module is registered at OID mib-2 108 (1.3.6.1.2.1.108). Sub-nodes are: diffServConfigMIBObjects (1) and diffServConfigMIBConformance (2).
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, deployment of SNMPv3 with full cryptographic mechanisms for authentication and privacy is RECOMMENDED to protect read-write and read-create objects in this MIB from unauthorized access.
Read access to the DIFFSERV-CONFIG-MIB is generally not sensitive since it only reveals that templates exist; the operational managed objects are in the DIFFSERV-MIB. However, diffServConfigDescr and diffServConfigOwner may warrant access control in sensitive environments.
Unauthorized change of diffServConfigStart could cause a different functional datapath configuration to be applied, resulting in unintended traffic treatment on the DiffServ-capable device.
Unauthorized change of diffServConfigStorage could cause unknown device behavior after an SNMP agent reboot, either by not saving configuration changes or by making configurations unavailable.
Template cloning proceeds: (1) retrieve diffServConfigStart for the template; (2) logically lock the current entry; (3) clone the entry with a new index and updated NEXT pointer; (4) advance to the next element and repeat from step 2; (5) after processing all elements, unlock all locked entries. This serializes modifications during instantiation.