Definitions of Managed Objects for IP Traffic Flow Security
Extracted elements (20)
The MIB exposes only read-only operational and state data (mirroring the RFC 9348 YANG model) so that existing SNMP-based network management systems can monitor IP-TFS without requiring a full YANG/NETCONF deployment. Write configuration is intentionally out of scope.
The MIB reuses the management model defined in RFC 9348 (YANG) as a reference point for managed objects; the structures could also be adapted to existing proprietary MIB implementations where SNMP is used, since no IETF-standardized IPsec MIB previously existed.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, deployment of SNMPv3 with cryptographic security is RECOMMENDED.
Implementations claiming compliance to the SNMPv3 standard MUST include full support for authentication and privacy via the User-based Security Model (USM) with the AES cipher algorithm.
Implementations SHOULD provide the security features described by the SNMPv3 framework (RFC 3410). Implementations MAY also provide support for the Transport Security Model (TSM) combined with SSH or TLS/DTLS.
IP-TRAFFIC-FLOW-SECURITY-MIB is a read-only SNMP MIB module providing operational and configuration state access to IP Traffic Flow Security (IP-TFS) SAs. It is organized into four object groups: iptfsGroup (configuration), ipsecStatsGroup, iptfsInnerStatsGroup, and iptfsOuterStatsGroup.
ipsecStatsTable provides per-SA basic IPsec packet statistics: txPkts, txOctets, txDropPkts, rxPkts, rxOctets, and rxDropPkts, all as Counter64 read-only objects indexed by ipsecSaIndex.
iptfsConfigTable provides per-SA IP-TFS configuration parameters including congestionControl, usePathMtuDiscovery, outerPacketSize, l2FixedRate, l3FixedRate, dontFragment, maxAggregationTime, windowSize, sendImmediately, and lostPacketTimerInterval. All objects are read-only.
iptfsInnerStatsTable provides per-SA IP-TFS inner packet statistics: txInnerPkts, txInnerOctets, rxInnerPkts, rxInnerOctets, and rxIncompleteInnerPkts. The rxIncompleteInnerPkts counter tracks fragments not received, misordering, or errors in outer packets.
iptfsOuterStatsTable provides per-SA IP-TFS outer packet statistics covering padding (txExtraPadPkts, txExtraPadOctets, txAllPadPkts, txAllPadOctets, rxExtraPadPkts, rxExtraPadOctets, rxAllPadPkts, rxAllPadOctets), errors (rxErroredPkts), and sequence-number gaps (rxMissedPkts).
The congestionControl object (TruthValue) enables or disables on-the-wire congestion control data exchange as required by RFC 5348. When false, IP-TFS sends fixed-sized packets at a constant rate with no congestion adaptation.
The dontFragment object (TruthValue) disables fragmentation of inner packets across consecutive IP-TFS tunnel packets on transmission; inner packets too large for a single outer packet are dropped rather than fragmented.
The lostPacketTimerInterval object (NanoSeconds) defines how long an IP-TFS receiver waits for a missing outer packet before declaring it lost. Setting this too low can adversely impact reordering and reassembly.
The maxAggregationTime object (NanoSeconds) limits how long a received inner packet may be held before transmission in the tunnel. Inner packets that would be queued beyond this time are dropped rather than delayed.
The sendImmediately object (TruthValue) controls whether the IP-TFS receiver delivers inner packets as soon as possible without waiting for lost or misordered outer packets. Enabling this reduces inner-packet delay but can amplify out-of-order delivery when aggregation or reordering is present.
The windowSize object (UnsignedShort) specifies the maximum number of out-of-order outer packets an IP-TFS receiver will buffer for reordering. A value of 0 disables reordering entirely.
IANA assigned OBJECT IDENTIFIER value 246 under mib-2 for the IP-TRAFFIC-FLOW-SECURITY-MIB module (name: iptfsMIB), recorded in the 'SMI Network Management MGMT Codes Internet-standard MIB' registry.
Access to iptfsInnerStatsTable and iptfsOuterStatsTable can reveal information that IP-TFS is designed to obscure, such as the true activity of flows. GET and NOTIFY access to these tables should be controlled, and their values should be encrypted in transit via SNMPv3.
Because all MIB objects have MAX-ACCESS of read-only or not-accessible, there is no risk of an intruder altering or creating management objects via SNMP SET operations if the MIB is implemented correctly.
SNMPv3 without per-user access control allows any principal on a secure network to read sensitive MIB objects; operators must configure the SNMP entity to restrict GET/NOTIFY access to legitimate principals only.