Definitions of Managed Objects for the Resource Public Key Infrastructure (RPKI) to Router Protocol
Extracted elements (22)
The compliance statement is named 'RFC6945ReadOnlyCompliance' because all objects are read-only; the Errors group (rpkiRtrCacheServerErrorsGroup) is optional rather than mandatory because it is intended for debugging rather than baseline monitoring.
For read-only compliance with RFC 6945, the rpkiRtrCacheServerRemoteAddressType and LocalAddressType objects require support for IPv4(1), IPv6(2), and DNS(16) InetAddressTypes, while rpkiRtrPrefixOriginAddressType requires only IPv4 and IPv6.
If the rpkiRtrCacheServerRemoteAddress object exceeds 114 octets, or rpkiRtrPrefixOriginAddress exceeds 111 octets, the SNMP OID index will exceed the 128 sub-identifier limit and the row cannot be accessed using SNMPv1, SNMPv2c, or SNMPv3.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED; instead, SNMPv3 with cryptographic security SHOULD be deployed, and operators are responsible for configuring access control appropriately.
Implementations MAY also support the Transport Security Model (TSM) in combination with a secure transport such as SSH or TLS/DTLS for SNMP access to this MIB.
Implementations MUST provide the security features described by the SNMPv3 framework, including full support for authentication and privacy via the User-based Security Model (USM) with the AES cipher algorithm.
The management agent MUST throttle consecutive rpkiRtrCacheServerConnectionStateChange notifications so that there is at least a 5-second gap between them; if multiple events occur within that window, only the most recent is sent and the others are discarded.
The SNMP agent MUST throttle consecutive rpkiRtrCacheServerConnectionToGoStale notifications so that there is at least a 5-second gap between them.
The RPKI-ROUTER-MIB module (OID mib-2 218) defines three tables and two notifications for monitoring the RPKI-Router Protocol: the Cache Server Connection Table, the Cache Server Errors Table, and the Prefix Origin Table.
The rpkiRtrCacheServerConnectionStateChange notification carries rpkiRtrCacheServerConnectionStatus, LatestSerial, and SessionID, and is sent whenever a cache server connection changes between up(1) and down(2).
The rpkiRtrCacheServerConnectionToGoStale notification carries V4/V6 active record counts, LatestSerial, SessionID, RefreshTimer, and TimeToRefresh; it is suggested to fire when TimeToRefresh drops below 60 seconds, alerting an NMS that cached RPKI data may soon be stale.
The rpkiRtrCacheServerErrorsTable augments the connection table with eight Counter32 objects counting specific RFC 6810 error codes received per connection: CorruptData, InternalError, NoData, InvalidRequest, UnsupportedVersion, UnsupportedPdu, WithdrawalUnknown, and DuplicateAnnounce.
The rpkiRtrCacheServerId object (Unsigned32 1..4294967295) is a unique per-connection identifier within the cache server table; it serves as the foreign key linking rows in rpkiRtrPrefixOriginTable back to the connection that supplied the announcement.
The rpkiRtrCacheServerPreference object (Unsigned32, default 4294967295) expresses the router's relative preference for a cache server: lower value means more preferred. If no ordering is configured or the configured value exceeds Unsigned32 max, the maximum value is returned.
The rpkiRtrCacheServerRefreshTimer object has a range of 60–7200 seconds and holds the configured refresh interval for Serial Query cycles to the cache server. rpkiRtrCacheServerTimeToRefresh is an Integer32 that counts down to zero and can go negative if a refresh is overdue.
The rpkiRtrCacheServerTable is indexed by (RemoteAddressType, RemoteAddress, RemotePort) and tracks per-connection state including connection type, status, message counters, IPv4/IPv6 announcement/withdrawal/active-record gauges, latest serial, session ID, refresh timer, and a unique cache server ID.
The RpkiRtrConnectionType textual convention enumerates the transport security options for router-to-cache-server connections: ssh(1), tls(2), tcpMD5(3), tcpAO(4), tcp(5), ipsec(6), and other(7), as defined in RFC 6810 Section 7.
The rpkiRtrDiscontinuityTimer scalar (TimeStamp) records the sysUpTime value at which any Counter32 in the MIB module last experienced a discontinuity, allowing managers to determine which counter samples are comparable to one another.
The rpkiRtrPrefixOriginTable is indexed by (AddressType, Address, MinLength, MaxLength, ASN, CacheServerId) and records the collective set of IP prefixes with their minimum/maximum prefix lengths and authorized origin AS numbers received from all connected RPKI cache servers.
IANA assigned the OBJECT IDENTIFIER { mib-2 218 } to the rpkiRtrMIB module within the SMI Numbers registry.
All objects in this MIB module are read-only (no MAX-ACCESS read-write or read-create), so there is no risk that an intruder can alter or create management objects via SNMP SET operations.
Readable objects in this MIB (connection addresses, ports, serial numbers, session IDs, prefix/origin data) are sensitive because an attacker who observes them can learn the RPKI topology and potentially plan attacks against routers or cache servers; GET and NOTIFY access should be controlled and values encrypted in transit.