rfc-7856

Softwire Mesh Management Information Base (MIB)

Y. Cui, J. Dong, P. Wu, M. Xu, A. Yla-Jaaski
date2016-05 streamIETF areaint wgsoftwire statusPROPOSED STANDARD pages18 canonicalhttps://www.rfc-editor.org/rfc/rfc7856 doi10.17487/RFC7856
This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it defines objects for managing a softwire mesh.

Extracted elements (22)

design-rationale §4.1

Detailed encapsulation parameters (e.g., L2TPv3 Session ID, GRE Key) are intentionally not managed in the Softwire Mesh MIB; the MIB focuses on the NLRI-NH mapping and BGP neighbor relationships, leaving lower-level tunnel parameters to other MIBs or management mechanisms.

snmp, vpn

design-rationale §4.2

The swmEncapsTable entry count is used as an indirect indicator of the number of active softwire mesh tunnels maintained by an AFBR, since each E-IP-to-I-IP mapping corresponds to one active tunnel destination.

snmp, vpn, measurement

interoperability-note §5.1

For IPv4-over-IPv6 tunnels, ifInUcastPkts counts IPv6 packets delivered to the virtual interface for decapsulation; ifOutUcastPkts counts IPv6 packets generated by encapsulation, with post-fragmentation counting when fragmentation occurs.

snmp, ip, vpn

interoperability-note §5.1

ifOperStatus in the IF-MIB reflects the softwire mesh function state: 'up' if softwire mesh capability was negotiated during BGP OPEN, 'down' otherwise. This links BGP control-plane negotiation to the SNMP interface state.

snmp, bgp, vpn

interoperability-note §5

The Softwire Mesh MIB requires implementation of the IP Tunnel MIB (RFC 4087); the softwire mesh interface must also have an entry in the IF-MIB (RFC 2863), indexed by ifIndex, as tunnels are represented as logical interfaces.

snmp, vpn

interoperability-note §5.2

tunnelIfAddressType in the IP Tunnel MIB is identical to swmEncapsIIPDstType in the Softwire Mesh MIB. When swmEncapsEIPDstType is IPv6 and swmEncapsIIPDstType is IPv4, the tunnel is IPv6-over-IPv4; when reversed, it is IPv4-over-IPv6.

snmp, vpn, ip

normative-requirement §7 MUST

Implementations claiming compliance to SNMPv3 MUST include full support for authentication and privacy via the User-based Security Model (USM) with the AES cipher algorithm.

snmp, security, crypto

normative-requirement §7 MAY

Implementations MAY provide support for the Transport Security Model (TSM) in combination with a secure transport such as SSH or TLS/DTLS for SNMP access to this MIB.

snmp, security, tls

normative-requirement §7 SHOULD

Implementations SHOULD provide SNMPv3 security features, and deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED; SNMPv3 with cryptographic security is RECOMMENDED instead.

snmp, security

normative-requirement §5.2 MUST

The tunnelIfEncapsMethod in the IP Tunnel MIB tunnelIfEntry MUST be set to softwireMesh(16) for all softwire mesh tunnel interfaces, with a corresponding entry present in the Softwire Mesh MIB.

snmp, vpn

normative-requirement §5.2 MUST

The tunnelIfRemoteInetAddress MUST be set to '0.0.0.0' for IPv4 or '::' for IPv6 in the IP Tunnel MIB, because the softwire mesh uses a point-to-multipoint tunnel model where the actual per-destination address is stored in swmEncapsIIPDst.

snmp, vpn, ip

protocol-element §6

swmBGPNeighborTunnelType (IANAtunnelType, read-only) represents the tunnel type an AFBR selects for transmitting traffic to a specific BGP neighbor/AFBR peer.

snmp, bgp

protocol-element §6

swmEncapsEIPDstType (InetAddressType) specifies the address family of the E-IP destination prefix: IPv6(2) for IPv6-over-IPv4 tunneling, IPv4(1) for IPv4-over-IPv6 tunneling. This field differs from tunnelIfAddressType in the IP Tunnel MIB.

snmp, ip

protocol-element §6

swmEncapsIIPDst (InetAddress, read-only) is the I-IP destination address used as the outer-header encapsulation destination for packets matching the corresponding E-IP prefix. Since tunnelIfRemoteInetAddress is set to 0.0.0.0 or ::, this object carries the actual per-tunnel destination.

snmp, ip, vpn

protocol-element §4.3

The swmBGPNeighborTable provides softwire mesh BGP neighbor information for an AFBR, including the neighbor's address (swmBGPNeighborInetAddress) and the tunnel type selected to communicate with that neighbor (swmBGPNeighborTunnelType). It is indexed by ifIndex, swmBGPNeighborInetAddressType, and swmBGPNeighborInetAddress.

snmp, bgp, vpn

protocol-element §4.2

The swmEncapsTable maintains the softwire mesh NLRI-NH mapping between External-IP (E-IP) destination prefixes and Internal-IP (I-IP) encapsulation destination addresses. It is indexed by ifIndex, swmEncapsEIPDstType, swmEncapsEIPDst, and swmEncapsEIPPrefixLength, and the number of entries reflects the number of active softwire mesh tunnels on the AFBR.

snmp, ip, vpn

protocol-element §6

The swmMIB MODULE-IDENTITY is assigned OID { mib-2 239 } and defines the top-level structure with swmObjects (swmMIB 1) and swmConformance (swmMIB 2) subtrees.

snmp, registry

protocol-element §4.1

The swmSupportedTunnelTable provides information about what tunnel types an AFBR supports for softwire mesh scenarios, indexed by swmSupportedTunnelType (IANAtunnelType). Supported types include L2TPv3 over IP, GRE, Transmit tunnel endpoint, IPsec in Tunnel-mode, IP in IP with IPsec Transport Mode, MPLS-in-IP with IPsec Transport Mode, and IP in IP.

snmp, vpn, ipsec, mpls

registry §8

IANA allocated OID { mib-2 239 } with descriptor 'swmMIB' in the 'SMI Network Management MGMT Codes Internet-standard MIB' subregistry under the mib-2 branch.

snmp, registry

registry §8

IANA recorded IANAtunnelType value softwireMesh(16) in the IANAifType-MIB Textual Convention to identify softwire mesh tunnels.

snmp, registry, vpn

security-consideration §7

No objects in this MIB have MAX-ACCESS of read-write or read-create, so there is no risk of an intruder altering or creating management objects via SNMP SET operations if the MIB is implemented correctly.

snmp, security

security-consideration §7

The readable objects swmSupportedTunnelType, swmEncapsIIPDstType, swmEncapsIIPDst, and swmBGPNeighborTunnelType can expose tunnel types and internal network topology, so GET and NOTIFY access should be controlled and values encrypted when transmitted via SNMP.

snmp, security, privacy