Definitions of Managed Objects for Internet Small Computer System Interface (iSCSI)
obsoleted by
- rfc-7147 — Definitions of Managed Objects for the Internet Small Computer System Interface (iSCSI)
Extracted elements (26)
Digest method attributes use OID values (from iscsiDescriptors subtree) rather than enumerated integers, because implementations may need to add proprietary digest methods. Vendors define corresponding OBJECT-IDENTITY entries in their enterprise MIBs and return those OIDs.
Each iSCSI MIB object exports a separate attributes table and one or more statistics tables that augment it, rather than combining them. This design allows attributes and statistics to be added independently as iSCSI evolves, keeping the schema cleaner.
The 3-in-10 notification throttle was chosen because one notification every three seconds is frequent enough for operational awareness, but allowing a short burst of two or three simultaneous notifications avoids suppressing distinct concurrent events. Three in ten seconds is the identified happy medium.
The connection state in iscsiConnectionAttributesTable is intentionally a simplified, higher-level definition rather than a direct mapping to the iSCSI specification's state tables, because simplified states provide more useful information to a user or network manager.
The iSCSI instance layer allows a single physical device to be partitioned into multiple virtual iSCSI entities (analogous to virtual routers in IP routing products), and also allows a single SNMP agent to proxy for multiple stackable subsystems each with their own instances.
iscsiNodeTransportType is a RowPointer that links each iSCSI node to its corresponding transport entry in the SCSI MIB, enabling management station navigation between MIB modules. For implementations without a SCSI layer (e.g., iSCSI proxies), it may point to an implementation-specific table or be left as 0.0.
The iSCSI MIB is normally layered between the SCSI MIB (RFC 4455) and the TCP MIB (RFC 4022), and uses the IPS Identity Authentication MIB (RFC 4545) for initiator and target authorization entries. Cross-MIB navigation is enabled via RowPointer attributes in each direction.
An SNMP agent implementing the iSCSI MIB module SHOULD NOT send more than three iSCSI notifications in any 10-second period, to prevent inundating the network or notification host during error bursts.
Index values (iscsiInstIndex, iscsiPortalIndex, iscsiNodeIndex, iscsiTgtAuthIndex) must not be modified or reused by an agent unless a reboot has occurred. Agents should attempt to keep these values persistent across reboots.
Individual objects within a row in the iscsiPortalAttributesTable may not be modified while the row is active. For example, changing a portal's IP address requires deleting the existing row and creating a new one.
When a row in iscsiPortalAttributesTable is deleted, all connections associated with that portal are terminated — either immediately or via clean shutdown per RFC 3720. An outbound connection matches if iscsiCxnLocalAddr matches iscsiPortalAddr; an inbound connection also requires iscsiCxnLocalPort to match iscsiTargetPortalPort.
When adding a row to iscsiPortalAttributesTable or iscsiTgtAuthAttributesTable, all non-Index/RowStatus objects must be set. When the RowStatus is 'active', the values of other objects cannot be changed.
The iscsiConnectionAttributesTable lists active TCP connections within each session. It contains InetAddressType/InetAddress and port for both local and remote sides, and a simplified connection state. No statistics are kept per connection; statistics are maintained at the session level.
The iscsiDescriptors subtree defines extensible OID-based identifiers for header and data integrity types (iscsiHdrIntegrityNone, iscsiHdrIntegrityCrc32c, iscsiDataIntegrityNone, iscsiDataIntegrityCrc32c). Attributes referencing digest methods carry OID values rather than enumerated integers, allowing enterprise MIB extensions.
The IscsiDigestMethod textual convention defines four values: none(1) — secondary placeholder, other(2), noDigest(3) — no digest support, crc32c(4) — CRC32C required. It is used for both header and data digest preference negotiation.
The iscsiInstanceAttributesTable is the root table of the iSCSI MIB; every other table entry is owned by exactly one iSCSI instance indexed by iscsiInstIndex. It carries vendor ID, supported version range (iscsiInstVersionMin/Max), portal/node/session counts, and session failure tracking (iscsiInstSsnFailures, iscsiInstLastSsnFailureType, iscsiInstLastSsnRmtNodeName).
The iscsiInstanceSsnErrorStatsTable (augments iscsiInstanceAttributesTable) counts session failures by cause: iscsiInstSsnDigestErrors (header/data digest failures), iscsiInstSsnCxnTimeoutErrors (sequence timeout), and iscsiInstSsnFormatErrors (PDU format errors).
The IscsiName textual convention is defined as OCTET STRING (SIZE(0 | 16..223)) with DISPLAY-HINT '223t'. A zero-length string indicates the absence of an iSCSI name; valid names are 16–223 bytes, encoded per RFC 3720 Section 3.2.6.
The iscsiNodeAttributesTable contains per-node login negotiation preferences including InitialR2T, ImmediateData, MaxOutstandingR2T (1–65535 R2Ts, default 1), FirstBurstLength (default 65536 bytes), MaxBurstLength (default 262144 bytes), MaxConnections (default 1), DataSequenceInOrder, DataPDUInOrder, DefaultTime2Wait (default 2s), DefaultTime2Retain (default 20s), and ErrorRecoveryLevel (0–2, default 0).
The iscsiPortalAttributesTable represents iSCSI transport endpoints. Each row has an InetAddressType/InetAddress pair, a transport protocol (default TCP=6), iscsiPortalRoles bits (targetTypePortal, initiatorTypePortal), MaxRecvDataSegmentLength (512–16777215 bytes, default 8192), primary and secondary header/data digest preferences, and a marker request flag.
The iscsiSessionAttributesTable tracks active iSCSI sessions per node. Each session has a type (normal SCSI or SendTargets discovery) and a direction (Inbound from an outside initiator to a local target, or Outbound from a local initiator to an outside target). Negotiated attributes such as authentication and integrity schemes are stored as OIDs rather than enumerated types.
The iscsiTgtAuthAttributesTable lists initiator identities authorized to access each target. Each entry contains iscsiTgtAuthIdentity, a RowPointer into the IPS-AUTH MIB (RFC 4545) that holds the name, address, and credential information for the permitted initiator.
The iscsiTgtPortalAttributesTable holds target-specific portal attributes: iscsiTgtPortalPort (TCP listen port, 1–65535) and iscsiTgtPortalTag (portal group aggregation tag, 1–65535). Portals sharing the same tag may aggregate connections within a single multi-connection iSCSI session.
Three NOTIFICATION-TYPEs are defined: iscsiIntrLoginFailure (critical login failure detected by an initiator), iscsiTgtLoginFailure (critical login failure detected by a target), and iscsiInstSessionFailure (session terminated due to abnormal connection or digest failure). Critical failures include authentication, authorization, and negotiation failures.
The ISCSI-MIB module is assigned OID { mib-2 142 } by IANA. This registers the top-level iSCSI Protocol MIB module under the standard mib-2 arc.
Critical login failures — defined as those due to authentication, authorization, or negotiation problems — are designated as security events that may require immediate action. The iscsiTgtLoginAuthenticateFails and iscsiTgtLoginAuthorizeFails counters each specify that an iscsiTgtLoginFailure notification SHOULD be generated when they are incremented.