From owner-ipcdn@terayon.com Fri Mar 17 16:15:33 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04664 for ; Fri, 17 Mar 2000 16:15:27 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id NAA02310; Fri, 17 Mar 2000 13:12:23 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 17 Mar 2000 21:12:22 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id NAA00646; Fri, 17 Mar 2000 13:12:22 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id NAA12734 for ipcdn-outgoing; Fri, 17 Mar 2000 13:07:54 -0800 (PST) Message-Id: <4.1.20000317155529.00cedd90@cliffie.ne.arris-i.com> X-Sender: wsawyer@cliffie.ne.arris-i.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 Date: Fri, 17 Mar 2000 16:05:18 -0500 To: ipcdn@terayon.com, docsis-oss@cablelabs.com From: Wilson Sawyer Subject: subscriber management MIB Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=====================_32567202==_" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com --=====================_32567202==_ Content-Type: text/plain; charset="us-ascii" Here is a revised draft of the DOCSIS subscriber management MIB. I missed the window for IETF submissions, so it won't be posted to the IETF site until after the 27th. Please direct comments to the ipcdn mailing list. I thank Minnie Lu for her recent comments; I tried to correct a number of the deficiencies she noted, but may have missed a few. Respectfully, --=====================_32567202==_ Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: attachment; filename="draft-ietf-ipcdn-subscriber-mib-01.txt" Content-Transfer-Encoding: quoted-printable =0AINTERNET-DRAFT DOCSIS Subscriber Management MIB March= 2000=0A=0A Management Information Base=0A = for DOCSIS Cable Modem Termination Systems=0A for= Subscriber Management=0A = draft-ietf-ipcdn-subscriber-mib-01.txt=0A=0A Thu Mar 9= 17:00:00 EST 2000=0A=0A=0A Wilson Sawyer=0A = Arris Interactive=0A = wsawyer@ieee.org=0A=0A Michael StJohns=0A = @Home Network=0A = stjohns@corp.home.net=0A=0AStatus of this Memo=0A=0A This document is an= Internet-Draft and is in full conformance with=0A all provisions of= Section 10 of RFC2026. Internet-Drafts are working=0A documents of the= Internet Engineering Task Force (IETF), its areas,=0A and its working= groups. Note that other groups may also distribute=0A working documents= as Internet-Drafts.=0A=0A Internet-Drafts are draft documents valid for a= maximum of six months=0A and may be updated, replaced, or obsoleted by= other documents at any=0A time. It is inappropriate to use= Internet-Drafts as reference=0A material or to cite them other than as= "work in progress."=0A=0A The list of current Internet-Drafts can be= accessed at:=0A http://www.ietf.org/ietf/1id-abstracts.txt=0A=0A The= list of Internet-Draft Shadow Directories can be accessed at:=0A = http://www.ietf.org/shadow.html.=0A=0AAbstract=0A=0A This memo defines an= experimental portion of the Management=0A Information Base (MIB) for use= with network management protocols in=0A the Internet community. In= particular, it defines a set of managed=0A objects for SNMP-based= management of DOCSIS-compliant[16] Cable Modem=0A Termination Systems.= These managed objects facilitate protection of=0A the cable network from= misuse by subscribers.=0A=0A This memo specifies a MIB module in a manner= that is compliant to the=0A SNMP SMIv2 [5][6][7]. The set of objects are= consistent with the=0A SNMP framework and existing SNMP standards.=0A=0A = This memo is a product of the IPCDN working group within the Internet=0A = Engineering Task Force. Comments are solicited and should be=0A = addressed to the working group's mailing list at ipcdn@terayon.com=0A = and/or the authors.=0A=0AExpires September 2000 = [Page 1]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber= Management MIB March 2000=0A=0ATable of Contents=0A=0A1. The SNMP= Network Management Framework..............................2=0A2.= Overview...........................................................3=0A2.1.= Structure of the MIB.............................................3=0A2.2.= Management requirements..........................................4=0A2.2.1.= Interaction with DOCSIS provisioning for CPE address control...4=0A2.2.2.= Interaction with DOCSIS provisioning for filtering.............5=0A2.2.3.= Distinguishing Modem from Subscriber Traffic...................5=0A2.2.4.= Row Existence of docsSubMgtTcpUdpFilterTable...................6=0A2.2.5.= Notes on Table Bounds..........................................6=0A3.= Definitions........................................................6=0A4.= Acknowledgments...................................................21=0A5.= References........................................................21=0A6.= Security Considerations...........................................22=0A7.= Author's Addresses................................................23=0A=0A1= . The SNMP Network Management Framework=0A=0A The SNMP Management= Framework presently consists of five major=0A components:=0A=0A o An= overall architecture, described in RFC 2571 [1].=0A=0A o Mechanisms for= describing and naming objects and events for the=0A purpose of= management. The first version of this Structure of=0A Management= Information (SMI) is called SMIv1 and described in STD=0A 16, RFC= 1155 [2], STD 16, RFC 1212 [3] and RFC 1215 [4]. The=0A second= version, called SMIv2, is described in STD 58, RFC 2578=0A [5], STD= 58, RFC 2579 [6] and STD 58, RFC 2580 [7].=0A=0A o Message protocols= for transferring management information. The=0A first version of the= SNMP message protocol is called SNMPv1 and=0A described in RFC 1157= [8]. A second version of the SNMP message=0A protocol, which is not= an Internet standards track protocol, is=0A called SNMPv2c and= described in RFC 1901 [9] and RFC 1906 [10].=0A The third version of= the message protocol is called SNMPv3 and=0A described in RFC 1906= [10], RFC 2572 [11] and RFC 2574 [12].=0A=0A o Protocol operations for= accessing management information. The=0A first set of protocol= operations and associated PDU formats is=0A described in STD 15, RFC= 1157 [8]. A second set of protocol=0A operations and associated PDU= formats is described in RFC 1905=0A [13].=0A=0A o A set of= fundamental applications described in RFC 2573 [14] and=0A the= view-based access control mechanism described in RFC 2575=0A [15].=0A= =0A Managed objects are accessed via a virtual information store, termed= =0A the Management Information Base or MIB. Objects in the MIB are=0A = defined using the mechanisms defined in the SMI.=0A=0A=0AExpires September= 2000 [Page 2]=0A=0C=0AINTERNET-DRAF= T DOCSIS Subscriber Management MIB March 2000=0A=0A This= memo specifies a MIB module that is compliant to the SMIv2. A=0A MIB= conforming to the SMIv1 can be produced through the appropriate=0A = translations. The resulting translated MIB MUST be semantically=0A = equivalent, except where objects or events are omitted because no=0A = translation is possible (use of Counter64). Some machine readable=0A = information in SMIv2 will be converted into textual descriptions in=0A = SMIv1 during the translation process. However, this loss of machine=0A = readable information is not considered to change the semantics of the=0A = MIB.=0A=0A2. Overview=0A=0A This MIB provides a set of objects required= for the management of=0A DOCSIS Cable Modem Termination Systems (CMTS).= The specification is=0A derived in part from the operational model= described in the DOCSIS=0A Radio Frequency Interface Specification [16].= These managed objects=0A facilitate protection of the cable network from= misuse by=0A subscribers.=0A=0A Much of this MIB duplicates= capabilities found in the DOCSIS Cable=0A Device MIB [17]. While it is= expected that the Cable Device MIB will=0A be used to prevent unwanted= traffic from entering the cable network,=0A it is also possible that a= malicious user might tamper with cable=0A modem software, disabling its= filtering policies. This MIB provides a=0A more secure mechanism, since= physical access to the CMTS is=0A controlled by the network operator.=0A= =0A In particular, this MIB provides two capabilities: first, to limit=0A = the IP addresses behind a modem, and, second, to provide protocol=0A = filtering to and from a modem. The first duplicates the capabilities=0A = of the docsDevCpe group [17]. This provides for either learned or=0A = provisioned subscriber premises host IP addresses behind a cable=0A = modem.=0A=0A The filtering capability is similar to that provided in= docsDevFilter=0A [17]. Rather than maintaining a separate list of= filters for each=0A modem at the CMTS, however, it is assumed that large= numbers of=0A modems will share filtering characteristics. Therefore,= modems are=0A grouped so as to share common filter lists.=0A=0A2.1.= Structure of the MIB=0A=0A This MIB is structured in five tables:=0A=0A = o The docsSubMgtCpeControlTable controls the acceptance of=0A = subscriber host addresses behind a cable modem.=0A=0A o The= docsSubMgtCpeIpTable monitors the subscriber host addresses=0A which= the CMTS believes to exist behind the cable modem.=0A=0A o The= docsSubMgtPktFilterTable specifies filtering criteria which=0A can= be applied to packets destined to or originating from a=0A cable= modem.=0A=0AExpires September 2000 = [Page 3]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A o The docsSubMgtTcpUdpFilterTable augments=0A = docsSubMgtPktFilterTable with optional TCP or UDP port filtering=0A = criteria.=0A=0A o The docsSubMgtCmFilterTable binds a cable modem to= an ordered=0A list of filters from docsSubMgtPktFilterTable.=0A=0A = The docsSubMgtCpeControlTable, docsSubMgtCpeIpTable, and=0A = docsSubMgtCmFilterTable augment the docsIfCmtsCmStatusTable from=0A [18].= As such, each entry in these tables is bound to a registered=0A cable= modem, as perceived by the CMTS.=0A=0A The docsSubMgtPktFilterTable uses= two indices. The first identifies=0A the group to which a cable modem may= be bound. The second is the=0A ordering of filter criteria within each= group. Any number of modems=0A may be bound to the same group.=0A=0A2.2.= Management requirements=0A=0A The DOCSIS cable modem provisioning model= requires that cable modems=0A use TFTP to acquire a list of parameters.= The modem then passes many=0A of these parameters to the CMTS in the= DOCSIS Registration message.=0A The parameter values are digitally signed= by the creator of the TFTP=0A contents, and the signature is verified by= the CMTS. In general,=0A then, the CMTS need not itself be configured= with the attributes of=0A its cable modems. It will acquire these values= through the=0A Registration process that is secured by the digital= signature.=0A=0A Cable modem subscriber management, as described here,= modifies this=0A process slightly for reasons of data reduction and ease= of=0A administrative control. In the case of filtering management, for= =0A example, the tables are maintained through SNMP at the CMTS, and the= =0A modem registration merely signals the index values for the rows that= =0A apply to that modem.=0A=0A2.2.1. Interaction with DOCSIS provisioning= for CPE address control=0A=0A Rows in docsSubMgtCpeControlTable are= created by the CMTS for each=0A modem as a result of the DOCSIS= registration process. The DOCSIS=0A registration attributes may include= items semantically equivalent to=0A those in the DocsDevCpe branch of the= DOCSIS Cable Device MIB [17]:=0A=0A o docsDevCpeEnroll=0A o = docsDevCpeIpMax=0A o docsDevCpeIp=0A=0A Successful DOCSIS= registration shall have the effect of setting the=0A corresponding fields= in the docsSubMgtCpeControlTable and the=0A docsSubMgtCpeIpTable. If not= present, the default at registration=0A shall be to set= docsSubMgtCpeControlActive to false.=0A=0A Rows in docsSubMgtCpeIpTable= are created through any of three ways:=0A DOCSIS registration (as= described above), learning by the CMTS, or=0A=0AExpires September 2000 = [Page 4]=0A=0C=0AINTERNET-DRAFT = DOCSIS Subscriber Management MIB March 2000=0A=0A through some= unspecified administrative mechanism on the CMTS. The=0A docsDevCpeIpMax= table bound applies only to the first two.=0A=0A The CMTS may learn= addresses by simply snooping source IP addresses=0A from each cable= modem. Other learning mechanisms (for example, ARP=0A snooping) may be= used. The learning mechanism is not defined by this=0A document.=0A=0A2.2= .2. Interaction with DOCSIS provisioning for filtering=0A=0A Rows in= docsSubMgtCmFilterTable are created by the CMTS for each=0A modem as a= result of the DOCSIS registration process. The DOCSIS=0A registration= attributes may include four indices:=0A=0A o one identifying the= upstream filter group for packets=0A originating from the cable modem= (i.e., those packets whose=0A source MAC address matches that of the= cable modem).=0A o one identifying the upstream filter group for= packets=0A originating from subscribers attached to the cable modem= (i.e.,=0A those packets whose source MAC address does not match that= of=0A the cable modem).=0A o one identifying the downstream= filter group for packets=0A destined to the cable modem (i.e., those= packets whose=0A destination MAC address matches that of the cable= modem).=0A o one identifying the downstream filter group for packets=0A= destined to subscribers attached to the cable modem (i.e.,=0A = those packets whose destination MAC address does not match=0A that of= the cable modem).=0A=0A Successful registration shall have the effect of= setting=0A docsSubMgtCmFilterDownstream, docsSubMgtCmFilterUpstream,=0A = docsSubMgtSubFilterDownstream, and docsSubMgtSubFilterUpstream, for=0A = that modem (just as if set through the SNMP protocol). If the DOCSIS=0A = attributes are not present, the effect shall be to set the modem's=0A = filter groups to the values of docsSubMgtCmFilterUpDefault,=0A = docsSubMgtCmFilterDownDefault, docsSubMgtSubFilterUpDefault, and=0A = docsSubMgtSubFilterDownDefault.=0A=0A2.2.3. Distinguishing Modem from= Subscriber Traffic=0A=0A All traffic originating from or destined to a= subscriber site is=0A potentially suspect, and subject to suppression by= the network=0A operator. This is true even if the traffic is ostensibly= sourced or=0A sunk by the cable modem itself, rather than the subscriber= hosts=0A behind the modem. To provide more nuanced administrative= control,=0A this document allows separate filter policies for modems and= hosts.=0A For example, modem policies may limit modems to= server-subnet-only=0A access, while allowing a different scope to= subscribers.=0A=0A The CMTS chooses the filter set to apply based solely= on the MAC=0A address (source MAC upstream, destination MAC downstream).= If the MAC=0A address matches that of the modem, then the=0A = docsSubMgtCmFilterUp/Downstream pair is used; otherwise the=0A=0AExpires= September 2000 [Page= 5]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A docsSubMgtSubFilterUp/Downstream pair is applied.=0A=0A = If the CM acts as a router rather than as a DOCSIS bridging=0A = forwarder, then the network operator will only use the=0A = docsSubMgtCmFilterUp/Downstream pair.=0A=0A2.2.4. Row Existence of= docsSubMgtTcpUdpFilterTable=0A=0A The docsSubMgtTcpUdpFilterTable exists= apart from the=0A docsSubMgtPktFilterTable because its filtering criteria= is expected=0A to be applied to a minority of modems relative to=0A = docsSubMgtPktFilterTable. It is separate in order to emphasize this=0A = expectation to both CMTS vendors and network operators. The rules for=0A = row creation are:=0A=0A o Row creation in docsSubMgtTcpUdpFilterTable= is disallowed unless=0A the corresponding row in= docsSubMgtPktFilterTable already=0A exists (or that row is being= created simultaneously in the same=0A SNMP SET message).=0A=0A o = Deletion of the row in docsSubMgtPktFilterTable deletes the=0A = corresponding row in docsSubMgtTcpUdpFilterTable.=0A=0A o Row creation= for docsSubMgtPktFilterTable does not create the=0A corresponding= row in docsSubMgtTcpUdpFilterTable.=0A=0A o Row deletion of= docsSubMgtTcpUdpFilterTable does not delete the=0A corresponding row= in docsSubMgtPktFilterTable.=0A=0A2.2.5. Notes on Table Bounds=0A=0A = Throughout this document, index bounds for both filter groups and=0A = filters within a group are arbitrarily set at 1024. This does not=0A = impose a minimum requirement, but is chosen to be sufficiently large=0A = for any expected implementation. It is expected that the Data over=0A = Cable System Interface Specification (DOCSIS) process will define=0A = minimum-supported-size bounds for these objects for DOCSIS-compliant=0A = devices, but that is beyond the scope of this document. Early DOCSIS=0A = discussions anticipated a requirement for thirty groups of twenty=0A = filters each. Similarly, the maximum number of CPE addresses is=0A = arbitrarily bounded at 1024, although the corresponding modem table=0A = for the cable device MIB [17] is bounded at 16.=0A=0A3. Definitions=0A=0A = DOCS-SUBMGT-MIB DEFINITIONS ::=3D BEGIN=0A=0A IMPORTS=0A = MODULE-IDENTITY,=0A OBJECT-TYPE,=0A Counter32,=0A = Integer32,=0A experimental,=0A=0AExpires September 2000 = [Page 6]=0A=0C=0AINTERNET-DRAFT = DOCSIS Subscriber Management MIB March 2000=0A=0A --= BITS=0A FROM SNMPv2-SMI=0A TEXTUAL-CONVENTION,= =0A RowStatus,=0A TruthValue=0A FROM= SNMPv2-TC=0A OBJECT-GROUP,=0A MODULE-COMPLIANCE=0A = FROM SNMPv2-CONF=0A docsIfCmtsCmStatusIndex,=0A = docsIfCmtsCmStatusEntry=0A FROM DOCS-IF-MIB; --= RFC2670=0A=0A docsSubMgt MODULE-IDENTITY=0A LAST-UPDATED = "0003090000Z" -- March 9, 2000=0A ORGANIZATION "IETF IPCDN= Working Group"=0A CONTACT-INFO=0A " Wilson= Sawyer=0A Postal: Arris Interactive=0A = 6 Riverside Drive=0A Andover, MA 01810=0A = U.S.A.=0A Phone: +1 978 946 4711=0A = E-mail: wsawyer@ieee.org"=0A DESCRIPTION=0A = "This is the CMTS centric subscriber management MIB for=0A DOCSIS= compliant CMTS. This will be rooted in experimental=0A space= with a future transition to be incorporated into the=0A cable= device MIB."=0A -- temporary: the following to be assigned by RFC= editor. For now,=0A -- use original experimental docsDev value: {= docsDev 4 }=0A ::=3D { experimental 83 4 }=0A=0A=0A = docsSubMgtObjects OBJECT IDENTIFIER ::=3D { docsSubMgt 1 }=0A=0A=0A = IpV4orV6Addr ::=3D TEXTUAL-CONVENTION=0A STATUS current=0A = DESCRIPTION=0A "An IP V4 or V6 address expressed as an octet= string. The=0A zero length string is equal to both 0.0.0.0 and the= IPv6 :0=0A address."=0A SYNTAX OCTET STRING (SIZE (0 | 4 |= 16))=0A=0A=0A=0A docsSubMgtCpeControlTable OBJECT-TYPE=0A SYNTAX = SEQUENCE OF DocsSubMgtCpeControlEntry=0A MAX-ACCESS not-accessible=0A= STATUS current=0A DESCRIPTION=0A "This table extends= the docsIfCmtsCmStatusTable and adds 4=0A=0AExpires September 2000 = [Page 7]=0A=0C=0AINTERNET-DRAFT DOCSIS= Subscriber Management MIB March 2000=0A=0A objects which= reflect the state of subscriber management on a=0A particular CM."=0A= ::=3D { docsSubMgtObjects 1 }=0A=0A docsSubMgtCpeControlEntry= OBJECT-TYPE=0A SYNTAX DocsSubMgtCpeControlEntry=0A MAX-ACCESS= not-accessible=0A STATUS current=0A DESCRIPTION=0A = "A row in the docsSubMgtCpeControlTable. All the values=0A are= either set from the system default, or are set from objects=0A = included in the DOCSIS registration request sent upstream to=0A the= CMTS from the CM."=0A AUGMENTS { docsIfCmtsCmStatusEntry }=0A = ::=3D {docsSubMgtCpeControlTable 1 }=0A=0A DocsSubMgtCpeControlEntry ::= =3D SEQUENCE=0A {=0A docsSubMgtCpeControlMaxCpeIp = Integer32,=0A docsSubMgtCpeControlActive TruthValue,=0A = docsSubMgtCpeControlLearnable TruthValue,=0A = docsSubMgtCpeControlReset TruthValue=0A }=0A=0A=0A = docsSubMgtCpeControlMaxCpeIp OBJECT-TYPE=0A SYNTAX = Integer32(0..1024)=0A MAX-ACCESS read-write=0A STATUS current= =0A DESCRIPTION=0A "The number of simultaneous IP addresses= permitted behind=0A the CM. If this is set to zero, all CPE traffic= from the CM is=0A dropped. If the provisioning object corresponding= to=0A docsSubMgtCpeIpTable includes more CPE IP address entries for= =0A this modem than the value of this object, then this object is=0A = set to the count of the number of rows in docsSubMgtCpeIpTable=0A = that have the same docsIfCmtsCmStatusIndex value. (E.g. if the=0A CM= has 5 IP addresses specified for it, this value is 5). This=0A limit= applies to learned and docsis-provisioned entries, but=0A does not= limit entries added through some administrative=0A process at the= CMTS. If not set through DOCSIS provisioning,=0A this object defaults= to docsSubMgtCpeMaxIpDefault. Note that=0A this object is only= meaningful if docsSubMgtCpeControlActive=0A is true."=0A ::=3D= { docsSubMgtCpeControlEntry 1 }=0A=0A docsSubMgtCpeControlActive= OBJECT-TYPE=0A SYNTAX TruthValue=0A MAX-ACCESS read-write=0A = STATUS current=0A DESCRIPTION=0A "If this is set to= true, CMTS based CPE control is active and=0A all the actions= required by the various filter tables and=0A=0AExpires September 2000 = [Page 8]=0A=0C=0AINTERNET-DRAFT = DOCSIS Subscriber Management MIB March 2000=0A=0A controls= apply at the CMTS. If this is set to false, no=0A subscriber= management filtering is done at the CMTS (but other=0A filters may= apply). If not set through DOCSIS provisioning,=0A this object= defaults to docsSubMgtCpeActiveDefault."=0A ::=3D {= docsSubMgtCpeControlEntry 2 }=0A=0A=0A docsSubMgtCpeControlLearnable= OBJECT-TYPE=0A SYNTAX TruthValue=0A MAX-ACCESS read-write=0A = STATUS current=0A DESCRIPTION=0A "If this is set to= true, the CMTS may learn up to=0A docsSubMgtMaxCpeIp addresses (less= any DOCSIS-provisioned=0A entries) related to this CM. Those IP= addresses are added (by=0A internal process) to the= docsSubMgtCpeIpTable. The nature of the=0A learning mechanism is not= specified here. If not set through=0A DOCSIS provisioning, this= object defaults to=0A docsSubMgtCpeLearnableDefault. Note that this= object is only=0A meaningful if docsSubMgtCpeControlActive is true."= =0A ::=3D { docsSubMgtCpeControlEntry 3 }=0A=0A = docsSubMgtCpeControlReset OBJECT-TYPE=0A SYNTAX TruthValue=0A = MAX-ACCESS read-write=0A STATUS current=0A DESCRIPTION=0A = "This object always returns false on read. If this object is=0A = set to true, the rows with 'learned' addresses in=0A = docsSubMgtCpeIpTable for this CM are deleted from that table."=0A ::= =3D { docsSubMgtCpeControlEntry 4 }=0A=0A docsSubMgtCpeMaxIpDefault= OBJECT-TYPE=0A SYNTAX Integer32(0..1024)=0A MAX-ACCESS= read-write=0A STATUS current=0A DESCRIPTION=0A "The= default value for docsSubMgtCpeControlMaxCpeIp if not=0A signaled in= the DOCSIS Registration request. Upon initial CMTS=0A initialization,= this defaults to 16."=0A ::=3D { docsSubMgtObjects 2 }=0A=0A = docsSubMgtCpeActiveDefault OBJECT-TYPE=0A SYNTAX TruthValue=0A = MAX-ACCESS read-write=0A STATUS current=0A DESCRIPTION=0A = "The default value for docsSubMgtCpeControlActive if not=0A = signaled in the DOCSIS Registration request. Upon initial CMTS=0A = initialization, this defaults to false."=0A ::=3D { docsSubMgtObjects= 3 }=0A=0A docsSubMgtCpeLearnableDefault OBJECT-TYPE=0A=0AExpires= September 2000 [Page= 9]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A SYNTAX TruthValue=0A MAX-ACCESS read-write=0A= STATUS current=0A DESCRIPTION=0A "The default value= for docsSubMgtCpeControlLearnable if not=0A signaled in the DOCSIS= Registration request. Upon initial CMTS=0A initialization, this= defaults to true."=0A ::=3D { docsSubMgtObjects 4 }=0A=0A = docsSubMgtCpeIpTable OBJECT-TYPE=0A SYNTAX SEQUENCE OF= DocsSubMgtCpeIpEntry=0A MAX-ACCESS not-accessible=0A STATUS = current=0A DESCRIPTION=0A "A table of CPE IP addresses= known on a per CM basis."=0A ::=3D { docsSubMgtObjects 5 }=0A=0A = docsSubMgtCpeIpEntry OBJECT-TYPE=0A SYNTAX DocsSubMgtCpeIpEntry= =0A MAX-ACCESS not-accessible=0A STATUS current=0A = DESCRIPTION=0A "An entry in the docsSubMgtCpeIpTable. The first= index is=0A the specific modem we're referring to, the second index= is the=0A specific CPE IP entry."=0A INDEX {= docsIfCmtsCmStatusIndex,=0A docsSubMgtCpeIpIndex }=0A = ::=3D {docsSubMgtCpeIpTable 1 }=0A=0A DocsSubMgtCpeIpEntry ::=3D= SEQUENCE=0A {=0A docsSubMgtCpeIpIndex Integer32,=0A = docsSubMgtCpeIpAddr IpV4orV6Addr,=0A docsSubMgtCpeIpLearned = TruthValue=0A }=0A=0A=0A docsSubMgtCpeIpIndex OBJECT-TYPE=0A = SYNTAX Integer32(1..1024)=0A MAX-ACCESS not-accessible=0A = STATUS current=0A DESCRIPTION=0A "The index of this= CPE IP address relative to the indexed CM.=0A An entry is created= either through the included CPE IP addresses=0A in the provisioning= object, or via learning. If a CMTS receives=0A an IP packet from a= CM that contains a source IP address which=0A does not match one of= the docsSubMgtCpeIpAddr entries for this=0A CM, one of two things= occurs. If the number of entries is less=0A than= docsSubMgtCpeControlMaxCpeIp, the source address is added to=0A the= table and the packet is forwarded. If the number of entries=0A = equals the docsSubMgtCpeControlMaxCpeIp, AND=0A = docsSubMgtCpeControlActive is true, then the packet is dropped.=0A = Otherwise the packet is forwarded. "=0A=0AExpires September 2000 = [Page 10]=0A=0C=0AINTERNET-DRAFT DOCSIS= Subscriber Management MIB March 2000=0A=0A ::=3D {= docsSubMgtCpeIpEntry 1 }=0A=0A docsSubMgtCpeIpAddr OBJECT-TYPE=0A = SYNTAX IpV4orV6Addr=0A MAX-ACCESS read-only=0A STATUS = current=0A DESCRIPTION=0A "The IP address either set from= provisioning or learned via=0A wiretapping. See docsSubMgtCpeIpIndex= for the mechanism."=0A ::=3D { docsSubMgtCpeIpEntry 2 }=0A=0A = docsSubMgtCpeIpLearned OBJECT-TYPE=0A SYNTAX TruthValue=0A = MAX-ACCESS read-only=0A STATUS current=0A DESCRIPTION=0A = "If true, this entry was learned from IP packets sent=0A upstream= rather than from the provisioning objects."=0A ::=3D {= docsSubMgtCpeIpEntry 3 }=0A=0A=0A=0A -- The generic packet filter table. = Note that this just defines the=0A -- match criteria. The= docsSubMgtCmFilterTable links this table to=0A -- the specific modems.=0A= =0A docsSubMgtPktFilterTable OBJECT-TYPE=0A SYNTAX SEQUENCE OF= DocsSubMgtPktFilterEntry=0A MAX-ACCESS not-accessible=0A = STATUS current=0A DESCRIPTION=0A "A table of filter or= classifier criteria. Classifiers are=0A assigned by group to the= individual CMs. That assignment is made=0A via the configuration= objects sent upstream from the CM to the=0A CMTS during= registration."=0A ::=3D { docsSubMgtObjects 6 }=0A=0A = docsSubMgtPktFilterEntry OBJECT-TYPE=0A SYNTAX = DocsSubMgtPktFilterEntry=0A MAX-ACCESS not-accessible=0A = STATUS current=0A DESCRIPTION=0A "An entry in the= docsSubMgtPktFilterTable."=0A INDEX { docsSubMgtPktFilterGroup,=0A = docsSubMgtPktFilterIndex }=0A ::=3D= {docsSubMgtPktFilterTable 1 }=0A=0A DocsSubMgtPktFilterEntry ::=3D= SEQUENCE=0A {=0A docsSubMgtPktFilterGroup Integer32,=0A = docsSubMgtPktFilterIndex Integer32,=0A docsSubMgtPktFilterSrcAddr= IpV4orV6Addr,=0A docsSubMgtPktFilterSrcMask Integer32,=0A=0AExpires= September 2000 [Page= 11]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A docsSubMgtPktFilterDstAddr IpV4orV6Addr,=0A = docsSubMgtPktFilterDstMask Integer32,=0A docsSubMgtPktFilterUlp = Integer32,=0A docsSubMgtPktFilterTosValue OCTET STRING,=0A = docsSubMgtPktFilterTosMask OCTET STRING,=0A = docsSubMgtPktFilterAction INTEGER,=0A docsSubMgtPktFilterMatches = Counter32,=0A docsSubMgtPktFilterStatus RowStatus=0A }=0A=0A= =0A docsSubMgtPktFilterGroup OBJECT-TYPE=0A SYNTAX = Integer32(1..1024)=0A MAX-ACCESS not-accessible=0A STATUS = current=0A DESCRIPTION=0A "Identifies an ordered group of= filters. Each modem may be=0A associated with a filter group for its= upstream traffic=0A (docsSubMgtCmFilterUpstream) and a filter group= for its=0A downstream traffic (docsSubMgtCmFilterDownstream).= Typically,=0A many modems will use the same filter group."=0A = ::=3D { docsSubMgtPktFilterEntry 1 }=0A=0A=0A docsSubMgtPktFilterIndex= OBJECT-TYPE=0A SYNTAX Integer32(1..1024)=0A MAX-ACCESS = not-accessible=0A STATUS current=0A DESCRIPTION=0A = "An index which describes the ordering of a set of filter=0A = specifications within the group. Filters are applied in index=0A = order."=0A ::=3D { docsSubMgtPktFilterEntry 2 }=0A=0A = docsSubMgtPktFilterSrcAddr OBJECT-TYPE=0A SYNTAX IpV4orV6Addr=0A= MAX-ACCESS read-create=0A STATUS current=0A = DESCRIPTION=0A "The source IP address to match in the packet to= be=0A classified. By default, this is the all-zero's IP v4 and v6=0A= address. A packet matches the SrcAddr filter if the following is=0A = true:=0A AND (FilterSrcAddr, F(FilterSrcMask)) =3D=3D=0A = AND (Packet SrcAddr, F(FilterSrcMask)).=0A The mask value is= applied to both the match value in this table=0A and to the packet IP= address. The function 'F(n)' returns either=0A a 32 or 128 bit value= with the leftmost 'n' bits set to '1' and=0A the remaining rightmost= bits set to '0'."=0A DEFVAL { ''h }=0A ::=3D {= docsSubMgtPktFilterEntry 3 }=0A=0A docsSubMgtPktFilterSrcMask= OBJECT-TYPE=0A=0AExpires September 2000 = [Page 12]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A SYNTAX Integer32 (0..128)=0A = MAX-ACCESS read-create=0A STATUS current=0A DESCRIPTION= =0A "The number of leftmost bits in the source IP mask to match=0A= against the packet to be classified. This, taken with the=0A = SrcAddr specifies a matching criteria. By default, the pair=0A = specifies a filter which matches all source addresses. For IPv4=0A = addresses, the range is constrained to 0..32. An attempt to set=0A = this object to a value greater than 32 for an IPv4 address will=0A = result in this object being set to 32."=0A DEFVAL { 0 }=0A ::= =3D { docsSubMgtPktFilterEntry 4 }=0A=0A docsSubMgtPktFilterDstAddr= OBJECT-TYPE=0A =20 SYNTAX IpV4orV6Addr=0A MAX-ACCESS = read-create=0A STATUS current=0A DESCRIPTION=0A = "The destination IP address to match in the packet to be=0A = classified. By default, this is the all-zero's IP v4 and v6=0A = address. A packet matches the SrcAddr filter if the following is=0A = true:=0A AND (FilterDstAddr, F(FilterDstMask)) =3D=3D=0A = AND (Packet DstAddr, F(FilterDstMask)).=0A The mask value is= applied to both the match value in this table=0A and to the packet IP= address. The function 'F(n)' returns either=0A a 32 or 128 bit value= with the leftmost 'n' bits set to '1' and=0A the remaining rightmost= bits set to '0'."=0A DEFVAL { ''h }=0A ::=3D {= docsSubMgtPktFilterEntry 5 }=0A=0A docsSubMgtPktFilterDstMask= OBJECT-TYPE=0A SYNTAX Integer32 (0..128)=0A MAX-ACCESS = read-create=0A STATUS current=0A DESCRIPTION=0A = "The number of leftmost bits in the destination IP mask to=0A match= against the packet to be classified. This, taken with the=0A DstAddr= specifies a matching criteria. By default, the pair=0A specifies a= filter which matches all destination addresses. For=0A IPv4= addresses, the range is constrained to 0..32. An attempt=0A to set= this object to a value greater than 32 for an IPv4=0A address will= result in this object being set to 32."=0A DEFVAL { 0 }=0A ::= =3D { docsSubMgtPktFilterEntry 6 }=0A=0A docsSubMgtPktFilterUlp= OBJECT-TYPE=0A SYNTAX Integer32 (0..256)=0A MAX-ACCESS = read-create=0A STATUS current=0A DESCRIPTION=0A = "Upper level protocol to match. If this value is 256,=0A=0AExpires= September 2000 [Page= 13]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A matches ALL ULP values. Otherwise, this matches the= specific=0A protocol value. Note that if the packet ULP is either 6= (tcp) or=0A 17 (udp), then docsSubMgtPktTcpUdpFilterTable must also= be=0A consulted (if its entry exists) to see if this entry matches.= =0A Obviously, if this value is neither tcp, udp nor 256, then that=0A= table need not be matched against."=0A DEFVAL { 256 }=0A = ::=3D { docsSubMgtPktFilterEntry 7 }=0A=0A docsSubMgtPktFilterTosValue= OBJECT-TYPE=0A SYNTAX OCTET STRING (SIZE(1))=0A MAX-ACCESS= read-create=0A STATUS current=0A DESCRIPTION=0A = "The TOS value to match in the IP packet."=0A DEFVAL { '0'h }=0A = ::=3D { docsSubMgtPktFilterEntry 8 }=0A=0A docsSubMgtPktFilterTosMask= OBJECT-TYPE=0A SYNTAX OCTET STRING(SIZE(1))=0A MAX-ACCESS = read-create=0A STATUS current=0A DESCRIPTION=0A = "The mask to apply against the TOS value to be matched in the=0A IP= packet. The default for both these objects taken together=0A matches= all TOS values. A packet matches this filter if the=0A following is= true:=0A AND (FilterTosValue, FilterTosMask) =3D=3D=0A = AND (Packet TOS Value, FilterTosMask)."=0A DEFVAL { '0'h }=0A = ::=3D { docsSubMgtPktFilterEntry 9 }=0A=0A docsSubMgtPktFilterAction= OBJECT-TYPE=0A SYNTAX INTEGER=0A {=0A = accept(1),=0A drop(2)=0A = }=0A MAX-ACCESS read-create=0A STATUS current=0A = DESCRIPTION=0A "The action to take upon this filter matching. = Accept means=0A to accept the packet for further processing. Drop= means to drop=0A the packet."=0A DEFVAL { accept }=0A ::= =3D { docsSubMgtPktFilterEntry 10 }=0A=0A docsSubMgtPktFilterMatches= OBJECT-TYPE=0A SYNTAX Counter32=0A MAX-ACCESS read-only= =0A STATUS current=0A DESCRIPTION=0A "This object= counts the number of times this specific rule=0A=0AExpires September 2000 = [Page 14]=0A=0C=0AINTERNET-DRAFT = DOCSIS Subscriber Management MIB March 2000=0A=0A has been= matched. This is incremented any time this rule is=0A encountered= and all components match. It is only incremented for=0A the first= (lowest-indexed) filter matching a packet."=0A ::=3D {= docsSubMgtPktFilterEntry 11 }=0A=0A docsSubMgtPktFilterStatus= OBJECT-TYPE=0A SYNTAX RowStatus=0A MAX-ACCESS = read-create=0A STATUS current=0A DESCRIPTION=0A = "Standard rowStatus object for creating this row. Any object=0A in= this row which is writable may be changed at any time while=0A the= row is active."=0A ::=3D { docsSubMgtPktFilterEntry 12 }=0A=0A=0A = docsSubMgtTcpUdpFilterTable OBJECT-TYPE=0A SYNTAX SEQUENCE OF= DocsSubMgtTcpUdpFilterEntry=0A MAX-ACCESS not-accessible=0A = STATUS current=0A DESCRIPTION=0A "This is an adjunct to= docsSubMgtPktFilterTable. It provides=0A optional filtering= based on elements in TCP or UDP headers.=0A This table is= separate from docsSubMgtPktFilterTable only=0A because it is= expected to be used more rarely. This table=0A is not consulted= unless the upper-layer protocol is TCP,=0A UDP, or 'any'."=0A = ::=3D { docsSubMgtObjects 7 }=0A=0A docsSubMgtTcpUdpFilterEntry= OBJECT-TYPE=0A SYNTAX DocsSubMgtTcpUdpFilterEntry=0A = MAX-ACCESS not-accessible=0A STATUS current=0A DESCRIPTION=0A = "Defines filtering criteria for TCP and UDP headers."=0A = INDEX { docsSubMgtPktFilterGroup, docsSubMgtPktFilterIndex }=0A ::= =3D {docsSubMgtTcpUdpFilterTable 1 }=0A=0A DocsSubMgtTcpUdpFilterEntry ::= =3D SEQUENCE=0A {=0A docsSubMgtTcpUdpSrcPort Integer32,=0A = docsSubMgtTcpUdpDstPort Integer32,=0A docsSubMgtTcpFlagValues= BITS,=0A docsSubMgtTcpFlagMask BITS,=0A = docsSubMgtTcpUdpStatus RowStatus=0A }=0A=0A = docsSubMgtTcpUdpSrcPort OBJECT-TYPE=0A SYNTAX Integer32(0..65536)=0A= MAX-ACCESS read-create=0A STATUS current=0A DESCRIPTION= =0A "The source port to match. 65536 matches any value in= the=0A=0AExpires September 2000 = [Page 15]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A TCP or UDP source port field."=0A DEFVAL {= 65536 }=0A ::=3D { docsSubMgtTcpUdpFilterEntry 1 }=0A=0A = docsSubMgtTcpUdpDstPort OBJECT-TYPE=0A SYNTAX Integer32(0..65536)=0A= MAX-ACCESS read-create=0A STATUS current=0A DESCRIPTION= =0A "The destination port to match. 65536 matches any value in=0A= the TCP or UDP destination port field."=0A DEFVAL { 65536 }=0A = ::=3D { docsSubMgtTcpUdpFilterEntry 2 }=0A=0A=0A = docsSubMgtTcpFlagValues OBJECT-TYPE=0A SYNTAX BITS=0A = {=0A urgent(0),=0A ack(1),=0A = push(2),=0A reset(3),=0A = syn(4),=0A fin(5)=0A }=0A = MAX-ACCESS read-create=0A STATUS current=0A DESCRIPTION=0A = "The value of the flags of interest. The value of this=0A = object MUST always be a subset (proper or otherwise) of=0A = docsSubMgtTcpFlagMask. An attempt to violate this constraint=0A = returns an inconsistentValue error for an SNMPv2 or v3 agent=0A and a= badValue error for an SNMPv1 agent."=0A DEFVAL { {} }=0A ::=3D= { docsSubMgtTcpUdpFilterEntry 3 }=0A=0A=0A docsSubMgtTcpFlagMask= OBJECT-TYPE=0A SYNTAX BITS=0A {=0A = urgent(0),=0A ack(1),=0A push(2),=0A = reset(3),=0A syn(4),=0A = fin(5)=0A }=0A MAX-ACCESS read-create=0A = STATUS current=0A DESCRIPTION=0A "This bit set indicates= the flags of interest in the TCP=0A header for the packet to be= matched. For example to match all=0A packets where the urgent bit is= set, but that are not either syn=0A=0AExpires September 2000 = [Page 16]=0A=0C=0AINTERNET-DRAFT DOCSIS= Subscriber Management MIB March 2000=0A=0A or fin, the value= of docsSubMgtTcpFlagValues would be { urgent },=0A and the value of= this object would be { urgent, syn, fin }"=0A DEFVAL { {} }=0A = ::=3D { docsSubMgtTcpUdpFilterEntry 4 }=0A=0A=0A docsSubMgtTcpUdpStatus= OBJECT-TYPE=0A SYNTAX RowStatus=0A MAX-ACCESS read-create=0A = STATUS current=0A DESCRIPTION=0A "Standard row object= for this table. Any object in the=0A conceptual row may be modified= regardless of whether this row is=0A active or not."=0A ::=3D {= docsSubMgtTcpUdpFilterEntry 5 }=0A=0A=0A=0A docsSubMgtCmFilterTable= OBJECT-TYPE=0A SYNTAX SEQUENCE OF DocsSubMgtCmFilterEntry=0A = MAX-ACCESS not-accessible=0A STATUS current=0A DESCRIPTION=0A = "Binds filter groups to modems. This table identifies for=0A = each modem the upstream and downstream filter groups that apply=0A to= packets for that modem. Zero is used as a distinguished value=0A to= mean no filter group."=0A ::=3D { docsSubMgtObjects 8 }=0A=0A = docsSubMgtCmFilterEntry OBJECT-TYPE=0A SYNTAX = DocsSubMgtCmFilterEntry=0A MAX-ACCESS not-accessible=0A STATUS = current=0A DESCRIPTION=0A "Binds a filter group to each= direction of traffic for a=0A modem."=0A AUGMENTS {= docsIfCmtsCmStatusEntry }=0A ::=3D {docsSubMgtCmFilterTable 1 }=0A=0A= DocsSubMgtCmFilterEntry ::=3D SEQUENCE=0A {=0A = docsSubMgtSubFilterDownstream Integer32,=0A = docsSubMgtSubFilterUpstream Integer32,=0A = docsSubMgtCmFilterDownstream Integer32,=0A = docsSubMgtCmFilterUpstream Integer32=0A }=0A=0A = docsSubMgtSubFilterDownstream OBJECT-TYPE=0A SYNTAX = Integer32(0..1024)=0A MAX-ACCESS read-write=0A STATUS current= =0A DESCRIPTION=0A "The filter group applied to traffic= destined for subscribers=0A=0AExpires September 2000 = [Page 17]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber= Management MIB March 2000=0A=0A =20attached to the referenced= CM. This is set upon row creation to=0A either the default= (docsSubMgtSubFilterDownDefault), or to the=0A value in the= provisioning object sent upstream from the CM to the=0A CMTS during= registration. The value of this object is a pointer=0A into the= docsSubMgtPktFilterTable and refers to all filter rows=0A with= matching docsSubMgtPktFilterGroup indices. If there are no=0A = matching filter rows in that table, or if this object is set to=0A = zero, no filtering is applied to traffic destined to hosts=0A = attached to this CM."=0A ::=3D { docsSubMgtCmFilterEntry 1 }=0A=0A = docsSubMgtSubFilterUpstream OBJECT-TYPE=0A SYNTAX = Integer32(0..1024)=0A MAX-ACCESS read-write=0A STATUS current= =0A DESCRIPTION=0A "The filter group applied to traffic= originating from=0A subscribers attached to the referenced CM. This= is set upon row=0A creation to either the default= (docsSubMgtSubFilterUpDefault), or=0A to the value in the= provisioning object sent upstream from the CM=0A to the CMTS. The= value of this object is a pointer into the=0A = docsSubMgtPktFilterTable and refers to all filter rows with=0A = matching docsSubMgtPktFilterGroup indices. If there are no=0A = matching filter rows in that table, or if this object is set to=0A = zero, no filtering is applied to traffic originating from=0A hosts= attached to this CM."=0A ::=3D { docsSubMgtCmFilterEntry 2 }=0A=0A=0A= docsSubMgtCmFilterDownstream OBJECT-TYPE=0A SYNTAX = Integer32(0..1024)=0A MAX-ACCESS read-write=0A STATUS current= =0A DESCRIPTION=0A "The filter group applied to traffic= destined for the=0A referenced CM itself. This is set upon row= creation to either=0A the default (docsSubMgtCmFilterDownDefault), or= to the value in=0A the provisioning object sent upstream from the CM= to the CMTS=0A during registration. The value of this object is a= pointer into=0A the docsSubMgtPktFilterTable and refers to all filter= rows with=0A matching docsSubMgtPktFilterGroup indices. If there are= no=0A matching filter rows in that table, or if this object is set= to=0A zero, no filtering is applied to traffic destined to this CM."= =0A ::=3D { docsSubMgtCmFilterEntry 3 }=0A=0A = docsSubMgtCmFilterUpstream OBJECT-TYPE=0A SYNTAX Integer32(0..1024)= =0A MAX-ACCESS read-write=0A STATUS current=0A = DESCRIPTION=0A "The filter group applied to traffic originating= from the=0A referenced CM itself. This is set upon row creation to= either=0A the default (docsSubMgtCmFilterUpDefault), or to the value= in=0A=0AExpires September 2000 [Page= 18]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A the provisioning object sent upstream from the CM to= the CMTS.=0A The value of this object is a pointer into the=0A = docsSubMgtPktFilterTable and refers to all filter rows with=0A = matching docsSubMgtPktFilterGroup indices. If there are no=0A = matching filter rows in that table, or if this object is set=0A to= zero, no filtering is applied to traffic originating from=0A this= CM."=0A ::=3D { docsSubMgtCmFilterEntry 4 }=0A=0A = docsSubMgtSubFilterDownDefault OBJECT-TYPE=0A SYNTAX = Integer32(0..1024)=0A MAX-ACCESS read-write=0A STATUS current= =0A DESCRIPTION=0A "Upon a row creation in= docsSubMgtCmFilterTable,=0A docsSubMgtSubFilterDownstream is set to= this value if no=0A provisioning object is present to override it. = This object is=0A persistent across CMTS reboots. Upon initial CMTS= =0A initialization, this defaults to 0."=0A ::=3D {= docsSubMgtObjects 9 }=0A=0A docsSubMgtSubFilterUpDefault OBJECT-TYPE=0A = SYNTAX Integer32(0..1024)=0A MAX-ACCESS read-write=0A = STATUS current=0A DESCRIPTION=0A "Upon a row creation in= docsSubMgtCmFilterTable,=0A docsSubMgtSubFilterUpstream is set to= this value if no=0A provisioning object is present to override it. = This object is=0A persistent across CMTS reboots. Upon initial CMTS= =0A initialization, this defaults to 0."=0A ::=3D {= docsSubMgtObjects 10 }=0A=0A docsSubMgtCmFilterDownDefault OBJECT-TYPE=0A= SYNTAX Integer32(0..1024)=0A MAX-ACCESS read-write=0A = STATUS current=0A DESCRIPTION=0A "Upon a row creation in= docsSubMgtCmFilterTable,=0A docsSubMgtCmFilterDownstream is set to= this value if no=0A provisioning object is present to override it. = This object is=0A persistent across CMTS reboots. Upon initial CMTS= =0A initialization, this defaults to 0."=0A ::=3D {= docsSubMgtObjects 11 }=0A=0A docsSubMgtCmFilterUpDefault OBJECT-TYPE=0A = SYNTAX Integer32(0..1024)=0A MAX-ACCESS read-write=0A = STATUS current=0A DESCRIPTION=0A "Upon a row creation in= docsSubMgtCmFilterTable,=0A docsSubMgtCmFilterUpstream is set to this= value if no=0A provisioning object is present to override it. This= object is=0A=0AExpires September 2000 = [Page 19]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A persistent across CMTS reboots. Upon initial= CMTS=0A initialization, this defaults to 0."=0A ::=3D {= docsSubMgtObjects 12 }=0A=0A=0A=0A docsSubMgtNotification OBJECT= IDENTIFIER ::=3D { docsSubMgt 2 }=0A=0A docsSubMgtConformance= OBJECT IDENTIFIER ::=3D { docsSubMgt 3 }=0A docsSubMgtCompliances OBJECT= IDENTIFIER ::=3D=0A {= docsSubMgtConformance 1 }=0A docsSubMgtGroups OBJECT IDENTIFIER ::= =3D=0A { docsSubMgtConformance 2= }=0A=0A docsSubMgtBasicCompliance MODULE-COMPLIANCE=0A STATUS = current=0A DESCRIPTION=0A "The compliance statement for= CMTS devices that implement=0A CMTS centric subscriber management."= =0A=0A MODULE=0A=0A MANDATORY-GROUPS {=0A docsSubMgtGroup=0A = }=0A=0A ::=3D { docsSubMgtCompliances 1 }=0A=0A=0A = docsSubMgtGroup OBJECT-GROUP=0A OBJECTS {=0A = docsSubMgtCpeControlMaxCpeIp,=0A docsSubMgtCpeControlActive,= =0A docsSubMgtCpeControlLearnable,=0A = docsSubMgtCpeControlReset,=0A docsSubMgtCpeMaxIpDefault,=0A = docsSubMgtCpeActiveDefault,=0A = docsSubMgtCpeLearnableDefault,=0A docsSubMgtCpeIpAddr,=0A = docsSubMgtCpeIpLearned,=0A = docsSubMgtPktFilterSrcAddr,=0A docsSubMgtPktFilterSrcMask,=0A= docsSubMgtPktFilterDstAddr,=0A = docsSubMgtPktFilterDstMask,=0A docsSubMgtPktFilterUlp,=0A = docsSubMgtPktFilterTosValue,=0A = docsSubMgtPktFilterTosMask,=0A docsSubMgtPktFilterAction,=0A = docsSubMgtPktFilterMatches,=0A = docsSubMgtPktFilterStatus,=0A docsSubMgtTcpUdpSrcPort,=0A = docsSubMgtTcpUdpDstPort,=0A = docsSubMgtTcpFlagValues,=0A=0AExpires September 2000 = [Page 20]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber= Management MIB March 2000=0A=0A = docsSubMgtTcpFlagMask,=0A docsSubMgtTcpUdpStatus,=0A = docsSubMgtSubFilterDownstream,=0A = docsSubMgtSubFilterUpstream,=0A = docsSubMgtCmFilterDownstream,=0A docsSubMgtCmFilterUpstream,= =0A docsSubMgtSubFilterDownDefault,=0A = docsSubMgtSubFilterUpDefault,=0A = docsSubMgtCmFilterDownDefault,=0A = docsSubMgtCmFilterUpDefault=0A }=0A STATUS = current=0A DESCRIPTION=0A "The objects use= to managed host-based cable modems=0A via a set of CMTS= enforced controls."=0A ::=3D { docsSubMgtGroups 1 }=0A = END=0A=0A4. Acknowledgments=0A=0A Thanks to Guenter Roeck and Julie= McGray for reviewing early drafts.=0A=0A5. References=0A=0A=0A [1] = Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture=0A for= Describing SNMP Management Frameworks", RFC 2571, April=0A 1999.=0A= =0A [2] Rose, M. and K. McCloghrie, "Structure and Identification of=0A = Management Information for TCP/IP-based Internets", STD 16, RFC=0A = 1155, May 1990.=0A=0A [3] Rose, M. and K. McCloghrie, "Concise MIB= Definitions", STD 16,=0A RFC 1212, March 1991.=0A=0A [4] Rose,= M., "A Convention for Defining Traps for use with the=0A SNMP", RFC= 1215, March 1991.=0A=0A [5] McCloghrie, K., Perkins, D. and J.= Schoenwaelder, "Structure of=0A Management Information for Version 2= (SMIv2)", STD 58, RFC 2578,=0A April 1999.=0A=0A [6] McCloghrie,= K., Perkins, D. and J. Schoenwaelder, "Textual=0A Conventions for= SMIv2", STD 58, RFC 2579, April 1999.=0A=0A [7] McCloghrie, K., Perkins,= D. and J. Schoenwaelder, "Conformance=0A Statements for SMIv2", STD= 58, RFC 2580, April 1999.=0A=0A [8] Case, J., Fedor, M., Schoffstall, M.= and J. Davin, "Simple=0A Management Protocol", STD 15, RFC 1157, May= 1990.=0A=0A [9] Case, J., McCloghrie, K., Rose, M. and S.= Waldbusser,=0A=0AExpires September 2000 = [Page 21]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber Management MIB = March 2000=0A=0A "Introduction to Community-based SNMPv2",= RFC 1901, January=0A 1996.=0A=0A [10] Case, J., McCloghrie, K.,= Rose, M. and S. Waldbusser, "Transport=0A Mappings for Version 2 of= the Simple Network Management Protocol=0A (SNMPv2)", RFC 1906,= January 1996.=0A=0A [11] Case, J., Harrington D., Presuhn R. and B.= Wijnen, "Message=0A Processing and Dispatching for the Simple= Network Management=0A Protocol (SNMP)", RFC 2572, April 1999.=0A=0A = [12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM)=0A = for version 3 of the Simple Network Management Protocol=0A = (SNMPv3)", RFC 2574, April 1999.=0A=0A [13] Case, J., McCloghrie, K.,= Rose, M. and S. Waldbusser, "Protocol=0A Operations for Version 2 of= the Simple Network Management=0A Protocol (SNMPv2)", RFC 1905,= January 1996.=0A=0A [14] Levi, D., Meyer, P. and B. Stewart, "SNMP= Applications", RFC=0A 2573, April 1999.=0A=0A [15] Wijnen, B.,= Presuhn, R. and K. McCloghrie, "View-based Access=0A Control Model= (VACM) for the Simple Network Management Protocol=0A (SNMP)", RFC= 2575, April 1999.=0A=0A [16] "Data-Over-Cable Service Interface= Specifications: Cable Modem=0A Radio Frequency Interface= Specification SP-RFI-I04-980724",=0A DOCSIS, July 1998, available= at=0A http://www.cablemodem.com/.=0A=0A [17] StJohns, M. , "Cable= Device Management Information Base for=0A DOCSIS Compliant Cable= Modems and Cable Modem Termination=0A Systems", RFC2669, August= 1999.=0A=0A [18] StJohns, M. , "Radio Frequency (RF) Interface= Management=0A Information Base for MCNS/DOCSIS compliant RF= interfaces",=0A RFC2670, August 1999.=0A=0A [19] "Data-Over-Cable= Service Interface Specifications: Baseline=0A Privacy Interface= Specification SP-BPI-I02-990319",=0A DOCSIS, March 1999, available= at=0A http://www.cablemodem.com/.=0A=0A [20] "Data-Over-Cable= Service Interface Specifications: Baseline=0A Privacy Plus Interface= Specification SP-BPI+-I03-991105",=0A DOCSIS, November 1999,= available at=0A http://www.cablemodem.com/.=0A=0A6. Security= Considerations=0A=0A This MIB is intended to limit certain kinds of= network behavior by=0A subscriber hosts attached to cable modems,= including, for example, IP=0A=0AExpires September 2000 = [Page 22]=0A=0C=0AINTERNET-DRAFT DOCSIS Subscriber= Management MIB March 2000=0A=0A spoofing. These limitations may= be compromised, however, if the cable=0A modem's identity or registration= process is spoofed. The DOCSIS RFI=0A and privacy specifications [16],= [19], and [20] define a number of=0A mechanisms for assuring modem= identity.=0A=0A There are a number of management objects defined in this= MIB that=0A have a MAX-ACCESS clause of read-write and/or read-create. = Such=0A objects may be considered sensitive or vulnerable in some= network=0A environments. The support for SET operations in a non-secure= =0A environment without proper protection can have a negative effect on=0A= network operations.=0A=0A SNMPv1 by itself is not a secure environment.= Even if the network=0A itself is secure (for example by using IPSec),= even then, there is no=0A control as to who on the secure network is= allowed to access and=0A GET/SET (read/change/create/delete) the objects= in this MIB.=0A=0A It is recommended that the implementers consider the= security=0A features as provided by the SNMPv3 framework. Specifically,= the use=0A of the User-based Security Model RFC 2574 [12] and the View-= based=0A Access Control Model RFC 2575 [15] is recommended.=0A=0A It is= then a customer/user responsibility to ensure that the SNMP=0A entity= giving access to an instance of this MIB, is properly=0A configured to= give access to the objects only to those principals=0A (users) that have= legitimate rights to indeed GET or SET=0A (change/create/delete)= them.=0A=0A7. Author's Addresses=0A=0A Wilson Sawyer=0A Arris= Interactive=0A 6 Riverside Drive=0A Andover, MA 01810=0A = USA=0A=0A Phone: +1 978 946 4711=0A Email:= wsawyer@ieee.org=0A=0A=0A=0A Michael StJohns=0A @Home= Network=0A 425 Broadway=0A Redwood City, CA 94063=0A=0A = Phone: +1 650 569 5368=0A EMail:= stjohns@corp.home.net=0A=0A=0A=0A=0A=0A=0AExpires September 2000 = [Page 23]=0A=0A=0A=0A=0A --=====================_32567202==_ Content-Type: text/plain; charset="us-ascii" Wilson Sawyer wsawyer@ieee.org Arris Interactive (978) 946 4711 6 Riverside Drive fax (978) 946 4900 Andover, MA 01810 --=====================_32567202==_-- From owner-ipcdn@terayon.com Fri Mar 17 18:29:17 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA26253 for ; Fri, 17 Mar 2000 18:29:16 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id PAA05173 for ; Fri, 17 Mar 2000 15:29:12 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 17 Mar 2000 23:29:12 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id PAA08213; Fri, 17 Mar 2000 15:29:07 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id PAA14275 for ipcdn-outgoing; Fri, 17 Mar 2000 15:27:26 -0800 (PST) Message-Id: <4.3.1.2.20000317152209.00c98770@poptart> X-Sender: stjohns@poptart X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Fri, 17 Mar 2000 15:27:37 -0800 To: ipcdn@terayon.com From: "Mike St. Johns" Subject: Tentative Agenda - Adelaide IETF Cc: agenda@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Intro and Agenda Bashing - StJohns BPI MIB Closure - Rich Woundy DOCSIS/Euromodem Harmonization - Rich Woundy et al DOCSIS DHCP (?) Tentative - Rich Woundy Subscriber Management MIB - StJohns (for W Sawyer) Cable Device MIB SNMPv3/IPv6 Harmonization plus multi CPE interfaces - StJohns Other Items (QOS MIB?) Wrapup - StJohns (If there are other items that need to be brought up, please email them to me before Wed next week) From owner-ipcdn@terayon.com Mon Mar 20 17:37:20 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07861 for ; Mon, 20 Mar 2000 17:37:19 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id OAA10826 for ; Mon, 20 Mar 2000 14:37:19 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 20 Mar 2000 22:37:19 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id OAA23823; Mon, 20 Mar 2000 14:36:48 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id OAA05149 for ipcdn-outgoing; Mon, 20 Mar 2000 14:34:12 -0800 (PST) Message-Id: <200003202234.RAA26782@funnel.cisco.com> X-Sender: rwoundy@funnel X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.2 Date: Mon, 20 Mar 2000 17:31:29 -0500 To: ipcdn@terayon.com From: Rich Woundy Subject: Re: Tentative Agenda - Adelaide IETF In-Reply-To: <4.3.1.2.20000317152209.00c98770@poptart> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com At 03:27 PM 3/17/00 -0800, Mike St. Johns wrote: >DOCSIS DHCP (?) Tentative - Rich Woundy FYI. I submitted the following internet draft that I can discuss in the working group meeting. It is definitely on the agenda in the DHC working group. In the DOCSIS cable environment (the original motivation for this document), these messages are exchanged between the CMTS and the DHCP server. -- Rich >A New Internet-Draft is available from the on-line Internet-Drafts >directories. > > > Title : DHCP Lease Query > Author(s) : R. Woundy, K. Kinnear > Filename : draft-woundy-dhcpleasequery-00.txt > Pages : 11 > Date : 16-Mar-00 > >Access concentrators that act as DHCP relay agents need to determine >the endpoint locations of IP addresses across public broadband access >networks such as cable, DSL, and wireless networks. Because ARP >broadcasts are undesirable in public networks, many access >concentrator implementations 'glean' location information from DHCP >messages forwarded by its relay agent function. Unfortunately, the >typical access concentrator loses its gleaned information when the >access concentrator is rebooted or is replaced. This memo proposes >that when gleaned DHCP information is not available, the access >concentrator/relay agent obtains the location information directly >from the DHCP server(s) using a new, lightweight DHCPLEASEQUERY >message. > >A URL for this Internet-Draft is: >http://www.ietf.org/internet-drafts/draft-woundy-dhcpleasequery-00.txt > >Internet-Drafts are also available by anonymous FTP. Login with the username >"anonymous" and a password of your e-mail address. After logging in, >type "cd internet-drafts" and then > "get draft-woundy-dhcpleasequery-00.txt". > >A list of Internet-Drafts directories can be found in >http://www.ietf.org/shadow.html >or ftp://ftp.ietf.org/ietf/1shadow-sites.txt > > >Internet-Drafts can also be obtained by e-mail. > >Send a message to: > mailserv@ietf.org. >In the body type: > "FILE /internet-drafts/draft-woundy-dhcpleasequery-00.txt". > >NOTE: The mail server at ietf.org can return the document in > MIME-encoded form by using the "mpack" utility. To use this > feature, insert the command "ENCODING mime" before the "FILE" > command. To decode the response(s), you will need "munpack" or > a MIME-compliant mail reader. Different MIME-compliant mail readers > exhibit different behavior, especially when dealing with > "multipart" MIME messages (i.e. documents which have been split > up into multiple messages), so check your local documentation on > how to manipulate these messages. > > >Below is the data which will enable a MIME compliant mail reader >implementation to automatically retrieve the ASCII version of the >Internet-Draft. >Content-Type: text/plain >Content-ID: <20000316144253.I-D@ietf.org> > >ENCODING mime >FILE /internet-drafts/draft-woundy-dhcpleasequery-00.txt > > From owner-ipcdn@terayon.com Mon Mar 20 17:58:11 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14797 for ; Mon, 20 Mar 2000 17:56:53 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id OAA11293 for ; Mon, 20 Mar 2000 14:56:46 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 20 Mar 2000 22:56:46 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id OAA25059; Mon, 20 Mar 2000 14:56:36 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id OAA05495 for ipcdn-outgoing; Mon, 20 Mar 2000 14:55:17 -0800 (PST) Message-ID: <38D6553F.4852095F@ne.arris-i.com> Date: Mon, 20 Mar 2000 11:43:43 -0500 From: Stuart Green Organization: Nortel Networks - Arris Interactive Venture X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.5.1 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: ipcdn@terayon.com, docsis-oss@cablelabs.com Subject: BPI+ MIB - Internet Draft 02 Content-Type: multipart/mixed; boundary="------------1483825CC3F3F6A052A937F8" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com This is a multi-part message in MIME format. --------------1483825CC3F3F6A052A937F8 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit The attached BPI+ MIB (02) internet draft will be submitted on March 27th to the IETF. The IETF is not accepting internet drafts until that date. This draft contains no changes from the raw MIB mailed on 0225. -- Stuart M. Green Nortel Networks - Arris Interactive Venture 6 Riverside Drive, Andover, MA 01810 tel:(978) 946-4664 email:stu.green@ne.arris-i.com email: stgreen@nortelnetworks.com http://www.nortelnetworks.com http://www.arris-i.com --------------1483825CC3F3F6A052A937F8 Content-Type: text/plain; charset=us-ascii; name="final.txt" Content-Disposition: inline; filename="final.txt" Content-Transfer-Encoding: 7bit INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 Management Information Base for DOCSIS Cable Modems and Cable Modem Termination Systems for Baseline Privacy Plus draft-ietf-ipcdn-bpiplus-mib-02.txt Mon Mar 27 16:35:27 EST 2000 Stuart M. Green Arris Interactive stu.green@ne.arris-i.com Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at: http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at: http://www.ietf.org/shadow.html. Abstract This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it defines a set of managed objects for SNMP-based management of the Baseline Privacy Plus features [17] of DOCSIS1.1-compliant[16] Cable Modems and Cable Modem Termination Systems. This memo specifies a MIB module in a manner that is compliant to the SNMP SMIv2 [5][6][7]. The set of objects are consistent with the SNMP framework and existing SNMP standards. This memo is a product of the IPCDN working group within the Internet Engineering Task Force. Comments are solicited and should be addressed to the working group's mailing list at ipcdn@terayon.com and/or the authors. Table of Contents 1. The SNMP Network Management Framework..............................2 2. Overview...........................................................3 Expires September 2000 [Page 1] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 2.1. Structure of the MIB.............................................3 2.1.1. Cable Modem....................................................3 2.1.2. Cable Modem Termination System.................................4 2.1.3. Common.........................................................4 3. Definitions........................................................4 4. Acknowledgments...................................................58 5. References........................................................59 6. Security Considerations...........................................60 7. Author's Address..................................................61 1. The SNMP Network Management Framework The SNMP Management Framework presently consists of five major components: o An overall architecture, described in RFC 2571 [1]. o Mechanisms for describing and naming objects and events for the purpose of management. The first version of this Structure of Management Information (SMI) is called SMIv1 and described in STD 16, RFC 1155 [2], STD 16, RFC 1212 [3] and RFC 1215 [4]. The second version, called SMIv2, is described in STD 58, RFC 2578 [5], STD 58, RFC 2579 [6] and STD 58, RFC 2580 [7]. o Message protocols for transferring management information. The first version of the SNMP message protocol is called SNMPv1 and described in RFC 1157 [8]. A second version of the SNMP message protocol, which is not an Internet standards track protocol, is called SNMPv2c and described in RFC 1901 [9] and RFC 1906 [10]. The third version of the message protocol is called SNMPv3 and described in RFC 1906 [10], RFC 2572 [11] and RFC 2574 [12]. o Protocol operations for accessing management information. The first set of protocol operations and associated PDU formats is described in STD 15, RFC 1157 [8]. A second set of protocol operations and associated PDU formats is described in RFC 1905 [13]. o A set of fundamental applications described in RFC 2573 [14] and the view-based access control mechanism described in RFC 2575 [15]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. Objects in the MIB are defined using the mechanisms defined in the SMI. This memo specifies a MIB module that is compliant to the SMIv2. A MIB conforming to the SMIv1 can be produced through the appropriate translations. The resulting translated MIB MUST be semantically equivalent, except where objects or events are omitted because no translation is possible (use of Counter64). Some machine readable information in SMIv2 will be converted into textual descriptions in Expires September 2000 [Page 2] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 SMIv1 during the translation process. However, this loss of machine readable information is not considered to change the semantics of the MIB. 2. Overview This MIB provides a set of objects required for the management of the Baseline Privacy Plus features of DOCSIS Cable Modem (CM) and Cable Modem Termination Systems (CMTS). The specification is derived from the operational model described in the DOCSIS Baseline Privacy Plus Specification [17]. DOCSIS Baseline Privacy Plus is composed of four distinct functional and manageable areas: o Key Exchange and Data Encryption o Cable Modem Authentication o Multicast Encryption o Authentication of Downloaded Software Images This MIB is an extension of the DOCSIS 1.0 Baseline Privacy MIB [19] which is derived from the operational model described in the DOCSIS Baseline Privacy Specification [18]. The original Baseline Privacy MIB structure has been mostly preserved in the Baseline Privacy Plus MIB. 2.1. Structure of the MIB This MIB is structured into several tables and objects: 2.1.1. Cable Modem o The docsBpi2CmBaseTable contains authorization key exchange information for one CM MAC interface. o The docsBpi2CmTEKTable contains traffic key exchange and data encryption information for a particular security association ID of the cable modem. o Multicast Encryption information is maintained under Docsbpi2CmMulticastObjects. There is currently one multicast table object which manages IP multicast encryption, docsBpi2CmIpMulticastMapTable. o Digital certificates used for cable modem authentication are accessible via docsBpi2CmDeviceCertTable. o Cryptographic suite capabilities for a CM MAC are maintained in the docsBpi2CmCryptoSuiteTable. Expires September 2000 [Page 3] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 2.1.2. Cable Modem Termination System o The docsBpi2CmtsBaseTable contains default settings and summary counters for the cable modem termination system. o The DocsBpi2CmtsAuthTable contains Authorization Key Exchange information for each CM MAC interface, as well as data from CM certificates used in cable modem authentication. o The docsBpi2CmtsTEKTable contains traffic key exchange and data encryption information for a particular security association ID. o Multicast Encryption information is maintained under Docsbpi2CmtsMulticastObjects. There are currently two multicast table objects. DocsBpi2CmtsIpMulticastMapTable is specifically designed for IP multicast encryption, whereas docsBpi2CmtsMulticastAuthTable is meant to manage all multicast security associations. o DocsBpi2CmtsCertObjects contains 2 manageable tables: one for provisioned cable modem certificates, the other for certification authority certificates. 2.1.3. Common o The docsBpi2CodeDownloadControl objects manage the authenticated software download process for a given device. 3. Definitions DOCS-BPI2-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Counter32, IpAddress, Integer32 FROM SNMPv2-SMI SnmpAdminString FROM SNMP-FRAMEWORK-MIB TEXTUAL-CONVENTION, DisplayString, MacAddress, RowStatus, TruthValue, DateAndTime FROM SNMPv2-TC OBJECT-GROUP, MODULE-COMPLIANCE FROM SNMPv2-CONF ifIndex Expires September 2000 [Page 4] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 FROM IF-MIB docsIfMib FROM DOCS-IF-MIB ; docsBpi2MIB MODULE-IDENTITY LAST-UPDATED "0002251930Z" ORGANIZATION "IETF IPCDN Working Group" CONTACT-INFO "--------------------------------------- Stuart M. Green Postal: Arris Interactive / Nortel Networks 6 Riverside Drive Andover, MA 01810 U.S.A. Tel: +1 978 946 4664 Fax: +1 978 946 4800 E-mail: stu.green@ne.arris-i.com --------------------------------------- Kaz Ozawa Postal: Cable Television Laboratories 400 Centennial Parkway Louisville, CO 80027 U.S.A. Tel: +1 303 661 3860 Fax: +1 303 661 9199 E-mail: k.ozawa@cablelabs.com --------------------------------------- Mike St. Johns Postal: @Home Network 425 Broadway Redwood City, CA 94063 U.S.A. Tel: +1 650 569 5368 E-mail: stjohns@corp.home.net --------------------------------------- Rich Woundy (BPI MIB) Postal: Cisco Systems 300 Apollo Drive Chelmsford, MA 01824 U.S.A. Tel: +1 978 244 8545 Fax: +1 978 244 8917 E-mail: rwoundy@cisco.com" DESCRIPTION "This is the MIB Module for the DOCSIS Baseline Privacy Plus Interface (BPI+) at cable modems (CMs) and cable modem termination systems (CMTSs)." ::= { docsIfMib 6 } Expires September 2000 [Page 5] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- Textual conventions X509Certificate ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "An X509 digital certificate encoded as an ASN.1 DER object." SYNTAX OCTET STRING (SIZE (0..1487)) docsBpi2MIBObjects OBJECT IDENTIFIER ::= { docsBpi2MIB 1 } -- Cable Modem Group docsBpi2CmObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 1 } -- -- The BPI+ base and authorization table for CMs, indexed by ifIndex -- docsBpi2CmBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic and authorization related Baseline Privacy Plus attributes of each CM MAC interface." ::= { docsBpi2CmObjects 1 } docsBpi2CmBaseEntry OBJECT-TYPE SYNTAX DocsBpi2CmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpi2CmBaseTable 1 } DocsBpi2CmBaseEntry ::= SEQUENCE { docsBpi2CmPrivacyEnable TruthValue, docsBpi2CmPublicKey OCTET STRING, docsBpi2CmAuthState INTEGER, docsBpi2CmAuthKeySequenceNumber Integer32, docsBpi2CmAuthExpiresOld DateAndTime, docsBpi2CmAuthExpiresNew DateAndTime, docsBpi2CmAuthReset TruthValue, docsBpi2CmAuthGraceTime Integer32, docsBpi2CmTEKGraceTime Integer32, docsBpi2CmAuthWaitTimeout Integer32, docsBpi2CmReauthWaitTimeout Integer32, Expires September 2000 [Page 6] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmOpWaitTimeout Integer32, docsBpi2CmRekeyWaitTimeout Integer32, docsBpi2CmAuthRejectWaitTimeout Integer32, docsBpi2CmSAMapWaitTimeout Integer32, docsBpi2CmSAMapMaxRetries Integer32, docsBpi2CmAuthentInfos Counter32, docsBpi2CmAuthRequests Counter32, docsBpi2CmAuthReplies Counter32, docsBpi2CmAuthRejects Counter32, docsBpi2CmAuthInvalids Counter32, docsBpi2CmAuthRejectErrorCode INTEGER, docsBpi2CmAuthRejectErrorString DisplayString, docsBpi2CmAuthInvalidErrorCode INTEGER, docsBpi2CmAuthInvalidErrorString DisplayString } docsBpi2CmPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this CM is provisioned to run Baseline Privacy Plus. This is analogous to the presence (or absence) of the Baseline Privacy Plus Configuration Settings. In addition, the Privacy Enable RFI encoding must be enabled for this object to be true." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1." ::= { docsBpi2CmBaseEntry 1 } docsBpi2CmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (74|106|140|204|270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [10], corresponding to the public key of the CM. The 74, 106, 140, 204, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, 1536 bit, and 2048 public moduli respectively." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.4." ::= { docsBpi2CmBaseEntry 2 } docsBpi2CmAuthState OBJECT-TYPE SYNTAX INTEGER { start(1), authWait(2), authorized(3), reauthWait(4), Expires September 2000 [Page 7] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 authRejectWait(5), silent(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the CM authorization FSM. The start state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.2.1." ::= { docsBpi2CmBaseEntry 3 } docsBpi2CmAuthKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the most recent authorization key sequence number for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpi2CmBaseEntry 4 } docsBpi2CmAuthExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the immediate predecessor of the most recent authorization for this FSM expires. If the CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmBaseEntry 5 } docsBpi2CmAuthExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the most recent authorization for this FSM expires. If the CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Expires September 2000 [Page 8] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmBaseEntry 6 } docsBpi2CmAuthReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE generates a Reauthorize event in the authorization FSM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.2.3.4." ::= { docsBpi2CmBaseEntry 7 } docsBpi2CmAuthGraceTime OBJECT-TYPE SYNTAX Integer32 (1..6047999) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for an authorization key. A CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires. The value of this object cannot be changed while the authorization state machine is running." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.3." ::= { docsBpi2CmBaseEntry 8 } docsBpi2CmTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..302399) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the TEK in seconds. The CM is expected to start trying to acquire a new TEK beginning TEK GraceTime seconds after the expiration of the immediate predecessor of the most recent TEK. The value of this object cannot be changed while the authorization state machine is running." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.6." ::= { docsBpi2CmBaseEntry 9 } docsBpi2CmAuthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" Expires September 2000 [Page 9] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorize Wait Timeout. The value of this object cannot be changed while the authorization state machine is running." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.1." ::= { docsBpi2CmBaseEntry 10 } docsBpi2CmReauthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Reauthorize Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.2." ::= { docsBpi2CmBaseEntry 11 } docsBpi2CmOpWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Operational Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.4." ::= { docsBpi2CmBaseEntry 12 } docsBpi2CmRekeyWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Rekey Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.5." ::= { docsBpi2CmBaseEntry 13 } Expires September 2000 [Page 10] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmAuthRejectWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..600) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorization Reject Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.7." ::= { docsBpi2CmBaseEntry 14 } docsBpi2CmSAMapWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the retransmission interval, in seconds, of SA Map Requests from the MAP Wait state." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.8." ::= { docsBpi2CmBaseEntry 15 } docsBpi2CmSAMapMaxRetries OBJECT-TYPE SYNTAX Integer32 (0..10) UNITS "count" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the maximum number of Map Request retries allowed." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.9." ::= { docsBpi2CmBaseEntry 16 } docsBpi2CmAuthentInfos OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an Authentication Information message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.9." ::= { docsBpi2CmBaseEntry 17 } Expires September 2000 [Page 11] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an Authorization Request message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.1." ::= { docsBpi2CmBaseEntry 18 } docsBpi2CmAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reply message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2." ::= { docsBpi2CmBaseEntry 19 } docsBpi2CmAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reject message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.3." ::= { docsBpi2CmBaseEntry 20 } docsBpi2CmAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Invalid message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.7." ::= { docsBpi2CmBaseEntry 21 } docsBpi2CmAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), Expires September 2000 [Page 12] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 unauthorizedSaid(4), permanentAuthorizationFailure(8) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.15." ::= { docsBpi2CmBaseEntry 22 } docsBpi2CmAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message received by the CM. This is a zero length string if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpi2CmBaseEntry 23 } docsBpi2CmAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.15." ::= { docsBpi2CmBaseEntry 24 } docsBpi2CmAuthInvalidErrorString OBJECT-TYPE Expires September 2000 [Page 13] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message received by the CM. This is a zero length string if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpi2CmBaseEntry 25 } -- -- The CM TEK Table, indexed by ifIndex and SAID -- docsBpi2CmTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key(TEK) association. The CM maintains (no more than) one TEK association per SAID per CM MAC interface." ::= { docsBpi2CmObjects 2 } docsBpi2CmTEKEntry OBJECT-TYPE SYNTAX DocsBpi2CmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the TEK association attributes of one SAID. The CM MUST create one entry per SAID, regardless of whether the SAID was obtained from a Registration Response message, from an Authorization Reply message, or from any future dynamic SAID establishment mechanisms." INDEX { ifIndex, docsBpi2CmTEKSAId } ::= { docsBpi2CmTEKTable 1 } DocsBpi2CmTEKEntry ::= SEQUENCE { docsBpi2CmTEKSAId Integer32, docsBpi2CmTEKSAType INTEGER, docsBpi2CmTEKDataEncryptAlg INTEGER, docsBpi2CmTEKDataAuthentAlg INTEGER, docsBpi2CmTEKState INTEGER, docsBpi2CmTEKKeySequenceNumber Integer32, docsBpi2CmTEKExpiresOld DateAndTime, docsBpi2CmTEKExpiresNew DateAndTime, Expires September 2000 [Page 14] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmTEKKeyRequests Counter32, docsBpi2CmTEKKeyReplies Counter32, docsBpi2CmTEKKeyRejects Counter32, docsBpi2CmTEKInvalids Counter32, docsBpi2CmTEKAuthPends Counter32, docsBpi2CmTEKKeyRejectErrorCode INTEGER, docsBpi2CmTEKKeyRejectErrorString DisplayString, docsBpi2CmTEKInvalidErrorCode INTEGER, docsBpi2CmTEKInvalidErrorString DisplayString } docsBpi2CmTEKSAId OBJECT-TYPE SYNTAX Integer32 (1..16383) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the DOCSIS Security Association ID (SAID)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.12." ::= { docsBpi2CmTEKEntry 1 } docsBpi2CmTEKSAType OBJECT-TYPE SYNTAX INTEGER { none(0), primary(1), static(2), dynamic(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the type of security association." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 2.1.3." ::= { docsBpi2CmTEKEntry 2 } docsBpi2CmTEKDataEncryptAlg OBJECT-TYPE SYNTAX INTEGER { none(0), des56CbcMode(1), des40CbcMode(2) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data encryption algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Expires September 2000 [Page 15] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 Section 4.2.2.20." ::= { docsBpi2CmTEKEntry 3 } docsBpi2CmTEKDataAuthentAlg OBJECT-TYPE SYNTAX INTEGER { none(0) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data authentication algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmTEKEntry 4 } docsBpi2CmTEKState OBJECT-TYPE SYNTAX INTEGER { start(1), opWait(2), opReauthWait(3), operational(4), rekeyWait(5), rekeyReauthWait(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the indicated TEK FSM. The start(1) state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.3.1." ::= { docsBpi2CmTEKEntry 5 } docsBpi2CmTEKKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the most recent TEK key sequence number for this TEK FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.2.10 and 4.2.2.13." ::= { docsBpi2CmTEKEntry 6 } docsBpi2CmTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current Expires September 2000 [Page 16] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmTEKEntry 7 } docsBpi2CmTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmTEKEntry 8 } docsBpi2CmTEKKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted a Key Request message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.4." ::= { docsBpi2CmTEKEntry 9 } docsBpi2CmTEKKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reply message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.5." ::= { docsBpi2CmTEKEntry 10 } docsBpi2CmTEKKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM Expires September 2000 [Page 17] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 has received a Key Reject message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.6." ::= { docsBpi2CmTEKEntry 11 } docsBpi2CmTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a TEK Invalid message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.8." ::= { docsBpi2CmTEKEntry 12 } docsBpi2CmTEKAuthPends OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times an Authorization Pending (Auth Pend) event occurred in this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.3.3.3." ::= { docsBpi2CmTEKEntry 13 } docsBpi2CmTEKKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSaid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Key Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.6 and 4.2.2.15." ::= { docsBpi2CmTEKEntry 14 } docsBpi2CmTEKKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) Expires September 2000 [Page 18] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Key Reject message received by the CM. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.6 and 4.2.2.6." ::= { docsBpi2CmTEKEntry 15 } docsBpi2CmTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent TEK Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.8 and 4.2.2.15." ::= { docsBpi2CmTEKEntry 16 } docsBpi2CmTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent TEK Invalid message received by the CM. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.8 and 4.2.2.6." ::= { docsBpi2CmTEKEntry 17 } -- -- The CM Multicast Objects Group -- docsBpi2CmMulticastObjects OBJECT IDENTIFIER ::= { docsBpi2CmObjects 3 } Expires September 2000 [Page 19] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- -- The CM Dynamic IP Multicast Mapping Table, indexed by IP multicast -- address and by ifindex -- docsBpi2CmIpMulticastMapTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table maps multicast IP addresses to SAIDs. It is intended to map DYNAMIC multicast IP addresses only." ::= { docsBpi2CmMulticastObjects 1 } docsBpi2CmIpMulticastMapEntry OBJECT-TYPE SYNTAX DocsBpi2CmIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the mapping of one multicast IP address to one SAID, as well as associated state, message counters, and error information." INDEX { ifIndex, docsBpi2CmIpMulticastAddress } ::= { docsBpi2CmIpMulticastMapTable 1 } DocsBpi2CmIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmIpMulticastAddress IpAddress, docsBpi2CmIpMulticastSAId Integer32, docsBpi2CmIpMulticastSAMapState INTEGER, docsBpi2CmIpMulticastSAMapRequests Counter32, docsBpi2CmIpMulticastSAMapReplies Counter32, docsBpi2CmIpMulticastSAMapRejects Counter32, docsBpi2CmIpMulticastSAMapRejectErrorCode INTEGER, docsBpi2CmIpMulticastSAMapRejectErrorString DisplayString } docsBpi2CmIpMulticastAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address to be mapped." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 5.4." ::= { docsBpi2CmIpMulticastMapEntry 1 } docsBpi2CmIpMulticastSAId OBJECT-TYPE SYNTAX Integer32 (0..16383) MAX-ACCESS read-only STATUS current DESCRIPTION Expires September 2000 [Page 20] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 "This object represents the SAID to which the IP multicast address has been mapped. If no SA Map Reply has been received for the IP address, this object should have the value 0." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.12." ::= { docsBpi2CmIpMulticastMapEntry 2 } docsBpi2CmIpMulticastSAMapState OBJECT-TYPE SYNTAX INTEGER { start(1), mapWait(2), mapped(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the SA Mapping FSM for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 5.3.1." ::= { docsBpi2CmIpMulticastMapEntry 3 } docsBpi2CmIpMulticastSAMapRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an SA Map Request message for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.10." ::= { docsBpi2CmIpMulticastMapEntry 4 } docsBpi2CmIpMulticastSAMapReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an SA Map Reply message for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.11." ::= { docsBpi2CmIpMulticastMapEntry 5 } docsBpi2CmIpMulticastSAMapRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current Expires September 2000 [Page 21] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 DESCRIPTION "The value of this object is the count of times the CM has received an SA MAP Reject message for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.12." ::= { docsBpi2CmIpMulticastMapEntry 6 } docsBpi2CmIpMulticastSAMapRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), noAuthForRequestedDSFlow(9), dsFlowNotMappedToSA(10) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent SA Map Reject message sent in response to an SA Map Request for this IP. It has value unknown(2) if the last Error-Code value was 0, and none(1) if no SA MAP Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.15." ::= { docsBpi2CmIpMulticastMapEntry 7 } docsBpi2CmIpMulticastSAMapRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent SA Map Reject message sent in response to an SA Map Request for this IP. It is a zero length string if no SA Map Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.6." ::= { docsBpi2CmIpMulticastMapEntry 8 } -- -- CM Cert Objects -- docsBpi2CmCertObjects OBJECT IDENTIFIER ::= { docsBpi2CmObjects 4 } -- -- CM Device Cert Table Expires September 2000 [Page 22] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- docsBpi2CmDeviceCertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmDeviceCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the Baseline Privacy Plus device certificates for each CM MAC interface." ::= { docsBpi2CmCertObjects 1 } docsBpi2CmDeviceCertEntry OBJECT-TYPE SYNTAX DocsBpi2CmDeviceCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains the device certificates of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpi2CmDeviceCertTable 1 } DocsBpi2CmDeviceCertEntry ::= SEQUENCE { docsBpi2CmDeviceCmCert X509Certificate, docsBpi2CmDeviceManufCert X509Certificate } docsBpi2CmDeviceCmCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-write STATUS current DESCRIPTION "The X509 DER-encoded cable modem certificate. Note: This object can be set only when the value is the null string. Once the object contains the certificate, its access MUST be read-only." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.1." ::= { docsBpi2CmDeviceCertEntry 1 } docsBpi2CmDeviceManufCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-only STATUS current DESCRIPTION "The X509 DER-encoded manufacturer certificate which signed the cable modem certificate." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.1." ::= { docsBpi2CmDeviceCertEntry 2 } Expires September 2000 [Page 23] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- -- CM Crypto Suite Table -- docsBpi2CmCryptoSuiteTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmCryptoSuiteEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the Baseline Privacy Plus cryptographic suite capabilites for each CM MAC interface." ::= { docsBpi2CmObjects 5 } docsBpi2CmCryptoSuiteEntry OBJECT-TYPE SYNTAX DocsBpi2CmCryptoSuiteEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains a cryptographic suite pair which this CM MAC supports." INDEX { ifIndex, docsBpi2CmCryptoSuiteIndex } ::= { docsBpi2CmCryptoSuiteTable 1 } DocsBpi2CmCryptoSuiteEntry ::= SEQUENCE { docsBpi2CmCryptoSuiteIndex Integer32, docsBpi2CmCryptoSuiteDataEncryptAlg INTEGER, docsBpi2CmCryptoSuiteDataAuthentAlg INTEGER } docsBpi2CmCryptoSuiteIndex OBJECT-TYPE SYNTAX Integer32 (1..1000) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index for a cryptographic suite row." ::= { docsBpi2CmCryptoSuiteEntry 1 } docsBpi2CmCryptoSuiteDataEncryptAlg OBJECT-TYPE SYNTAX INTEGER { none(0), des56CbcMode(1), des40CbcMode(2) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data encryption algorithm for this cryptographic suite capability." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmCryptoSuiteEntry 2 } Expires September 2000 [Page 24] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmCryptoSuiteDataAuthentAlg OBJECT-TYPE SYNTAX INTEGER { none(0) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data authentication algorithm for this cryptographic suite capability." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmCryptoSuiteEntry 3 } -- Cable Modem Termination System Group docsBpi2CmtsObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 2 } -- -- The BPI+ base table for CMTSs, indexed by ifIndex -- docsBpi2CmtsBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic Baseline Privacy attributes of each CMTS MAC interface." ::= { docsBpi2CmtsObjects 1 } docsBpi2CmtsBaseEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CMTS MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpi2CmtsBaseTable 1 } DocsBpi2CmtsBaseEntry ::= SEQUENCE { docsBpi2CmtsDefaultAuthLifetime Integer32, docsBpi2CmtsDefaultTEKLifetime Integer32, docsBpi2CmtsDefaultSelfSignedManufCertTrust INTEGER, docsBpi2CmtsCheckCertValidityPeriods TruthValue, docsBpi2CmtsAuthentInfos Counter32, Expires September 2000 [Page 25] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmtsAuthRequests Counter32, docsBpi2CmtsAuthReplies Counter32, docsBpi2CmtsAuthRejects Counter32, docsBpi2CmtsAuthInvalids Counter32, docsBpi2CmtsSAMapRequests Counter32, docsBpi2CmtsSAMapReplies Counter32, docsBpi2CmtsSAMapRejects Counter32 } docsBpi2CmtsDefaultAuthLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new authorization key." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.2." ::= { docsBpi2CmtsBaseEntry 1 } docsBpi2CmtsDefaultTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new Traffic Encryption Key (TEK)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.2." ::= { docsBpi2CmtsBaseEntry 2 } docsBpi2CmtsDefaultSelfSignedManufCertTrust OBJECT-TYPE SYNTAX INTEGER { trusted (1), untrusted (2) } MAX-ACCESS read-write STATUS current DESCRIPTION "This object determines the default trust of all (new) self-signed manufacturer certificates obtained after setting the object." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1" ::= { docsBpi2CmtsBaseEntry 3 } docsBpi2CmtsCheckCertValidityPeriods OBJECT-TYPE Expires September 2000 [Page 26] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE causes all certificates obtained thereafter to have their validity periods (and their chain's validity periods) checked against the current time of day. A FALSE setting will cause all certificates obtained thereafter to not have their validity periods (nor their chain's validity periods) checked against the current time of day." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.2" ::= { docsBpi2CmtsBaseEntry 4 } docsBpi2CmtsAuthentInfos OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authentication Information message from any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.9." ::= { docsBpi2CmtsBaseEntry 5 } docsBpi2CmtsAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.1." ::= { docsBpi2CmtsBaseEntry 6 } docsBpi2CmtsAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2." Expires September 2000 [Page 27] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 ::= { docsBpi2CmtsBaseEntry 7 } docsBpi2CmtsAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.3." ::= { docsBpi2CmtsBaseEntry 8 } docsBpi2CmtsAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.7." ::= { docsBpi2CmtsBaseEntry 9 } docsBpi2CmtsSAMapRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an SA Map Request message from any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.10." ::= { docsBpi2CmtsBaseEntry 10 } docsBpi2CmtsSAMapReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an SA Map Reply message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.11." ::= { docsBpi2CmtsBaseEntry 11 } docsBpi2CmtsSAMapRejects OBJECT-TYPE Expires September 2000 [Page 28] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an SA Map Reject message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.12." ::= { docsBpi2CmtsBaseEntry 12 } -- -- The CMTS Authorization Table, indexed by ifIndex and CM MAC -- address -- docsBpi2CmtsAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM authorization association. The CMTS maintains one authorization association with each Baseline Privacy-enabled CM on each CMTS MAC interface." ::= { docsBpi2CmtsObjects 2 } docsBpi2CmtsAuthEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one authorization association. The CMTS MUST create one entry per CM per MAC interface, based on the receipt of an Authorization Request message, and MUST not delete the entry before the CM authorization permanently expires." INDEX { ifIndex, docsBpi2CmtsAuthCmMacAddress } ::= { docsBpi2CmtsAuthTable 1 } DocsBpi2CmtsAuthEntry ::= SEQUENCE { docsBpi2CmtsAuthCmMacAddress MacAddress, docsBpi2CmtsAuthCmBpiVersion INTEGER, docsBpi2CmtsAuthCmPublicKey OCTET STRING, docsBpi2CmtsAuthCmKeySequenceNumber Integer32, docsBpi2CmtsAuthCmExpiresOld DateAndTime, docsBpi2CmtsAuthCmExpiresNew DateAndTime, docsBpi2CmtsAuthCmLifetime Integer32, docsBpi2CmtsAuthCmGraceTime Integer32, docsBpi2CmtsAuthCmReset INTEGER, docsBpi2CmtsAuthCmInfos Counter32, docsBpi2CmtsAuthCmRequests Counter32, docsBpi2CmtsAuthCmReplies Counter32, Expires September 2000 [Page 29] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmtsAuthCmRejects Counter32, docsBpi2CmtsAuthCmInvalids Counter32, docsBpi2CmtsAuthRejectErrorCode INTEGER, docsBpi2CmtsAuthRejectErrorString DisplayString, docsBpi2CmtsAuthInvalidErrorCode INTEGER, docsBpi2CmtsAuthInvalidErrorString DisplayString, docsBpi2CmtsAuthPrimarySAId Integer32, docsBpi2CmtsAuthBpkmCmCertValid INTEGER, docsBpi2CmtsAuthBpkmCmCert X509Certificate } docsBpi2CmtsAuthCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the physical address of the CM to which the authorization association applies." ::= { docsBpi2CmtsAuthEntry 1 } docsBpi2CmtsAuthCmBpiVersion OBJECT-TYPE SYNTAX INTEGER { bpi (0), bpiPlus (1) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the version of Baseline Privacy for which this CM has registered." ::= { docsBpi2CmtsAuthEntry 2 } docsBpi2CmtsAuthCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0|74|106|140|204|270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [10], corresponding to the public key of the CM. The 74, 106, 140, 204, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, 1536 bit, and 2048 public moduli respectively. This is a zero-length string if the CMTS does not retain the public key." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.4." ::= { docsBpi2CmtsAuthEntry 3 } docsBpi2CmtsAuthCmKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only Expires September 2000 [Page 30] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 STATUS current DESCRIPTION "The value of this object is the most recent authorization key sequence number for this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpi2CmtsAuthEntry 4 } docsBpi2CmtsAuthCmExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the immediate predecessor of the most recent authorization for this CM expires. If this CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization. Note: Implementation of this object is optional and MAY vary for CMs running in BPI mode." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmtsAuthEntry 5 } docsBpi2CmtsAuthCmExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the most recent authorization for this CM expires. If this CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmtsAuthEntry 6 } docsBpi2CmtsAuthCmLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to an authorization key for this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2 and Appendix A.2." ::= { docsBpi2CmtsAuthEntry 7 } Expires September 2000 [Page 31] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmtsAuthCmGraceTime OBJECT-TYPE SYNTAX Integer32 (1..6047999) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the authorization key in seconds. The CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires. Note: Tracking this value is optional on certain CMTS implementations." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.3." ::= { docsBpi2CmtsAuthEntry 8 } docsBpi2CmtsAuthCmReset OBJECT-TYPE SYNTAX INTEGER { noResetRequested(1), invalidateAuth(2), sendAuthInvalid(3), invalidateTeks(4) } MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to invalidateAuth(2) causes the CMTS to invalidate the current CM authorization key(s), but not to transmit an Authorization Invalid message nor to invalidate unicast TEKs. Setting this object to sendAuthInvalid(3) causes the CMTS to invalidate the current CM authorization key(s), and to transmit an Authorization Invalid message to the CM, but not to invalidate unicast TEKs. Setting this object to invalidateTeks(4) causes the CMTS to invalidate the current CM authorization key(s), to transmit an Authorization Invalid message to the CM, and to invalidate all unicast TEKs associated with this CM authorization. Reading this object returns the most-recently-set value of this object, or returns noResetRequested(1) if the object has not been set since the last CMTS reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5." ::= { docsBpi2CmtsAuthEntry 9 } docsBpi2CmtsAuthCmInfos OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authentication Information message from Expires September 2000 [Page 32] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.9." ::= { docsBpi2CmtsAuthEntry 10 } docsBpi2CmtsAuthCmRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.1." ::= { docsBpi2CmtsAuthEntry 11 } docsBpi2CmtsAuthCmReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2." ::= { docsBpi2CmtsAuthEntry 12 } docsBpi2CmtsAuthCmRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.3." ::= { docsBpi2CmtsAuthEntry 13 } docsBpi2CmtsAuthCmInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to this CM." Expires September 2000 [Page 33] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.7." ::= { docsBpi2CmtsAuthEntry 14 } docsBpi2CmtsAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSaid(4), permanentAuthorizationFailure(8) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.15." ::= { docsBpi2CmtsAuthEntry 15 } docsBpi2CmtsAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message transmitted to the CM. This is a zero length string if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpi2CmtsAuthEntry 16 } docsBpi2CmtsAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION Expires September 2000 [Page 34] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.15." ::= { docsBpi2CmtsAuthEntry 17 } docsBpi2CmtsAuthInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message transmitted to the CM. This is a zero length string if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpi2CmtsAuthEntry 18 } docsBpi2CmtsAuthPrimarySAId OBJECT-TYPE SYNTAX Integer32 (0..16383) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Primary Security Association identifier." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 2.1.3." ::= { docsBpi2CmtsAuthEntry 19 } docsBpi2CmtsAuthBpkmCmCertValid OBJECT-TYPE SYNTAX INTEGER { unknown (0), validCmChained (1), validCmTrusted (2), invalidCmUntrusted (3), invalidCAUntrusted (4), invalidCmOther (5), invalidCAOther (6) } MAX-ACCESS read-only STATUS current DESCRIPTION "Contains the reason why a CM's certificate is deemed valid or invalid. Return unknown if the CM is running BPI mode. Expires September 2000 [Page 35] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 ValidCmChained means the certificate is valid because it chains to a valid certificate. ValidCmTrusted means the certificate is valid because it has been provisioned (in the docsBpi2CmtsProvisionedCmCert table) to be trusted. InvalidCmUntrusted means the certificate is invalid because it has been provisioned (in the docsBpi2CmtsProvisionedCmCert table) to be untrusted. InvalidCAUntrusted means the certificate is invalid because it chains to an untrusted certificate. InvalidCmOther and InvalidCAOther refer to errors in parsing, validity periods, etc, which are attributable to the cm certificate or its chain respectively; additional information may be found in docsBpi2AuthRejectErrorString for these types of errors." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.2." ::= { docsBpi2CmtsAuthEntry 20 } docsBpi2CmtsAuthBpkmCmCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-only STATUS current DESCRIPTION "The X509 CM Certificate sent as part of a BPKM Authorization Request. Note: The NULL string must be returned if the entire certificate is not retained in the CMTS." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2." ::= { docsBpi2CmtsAuthEntry 21 } -- -- The CMTS TEK Table, indexed by ifIndex and SAID -- docsBpi2CmtsTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key (TEK) association. The CMTS maintains one TEK association per SAID on each CMTS MAC interface." ::= { docsBpi2CmtsObjects 3 } docsBpi2CmtsTEKEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION Expires September 2000 [Page 36] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 "Each entry contains objects describing attributes of one TEK association on a particular CMTS MAC interface. The CMTS MUST create one entry per SAID per MAC interface, based on the receipt of a Key Request message, and MUST not delete the entry before the CM authorization for the SAID permanently expires." INDEX { ifIndex, docsBpi2CmtsTEKSAId } ::= { docsBpi2CmtsTEKTable 1 } DocsBpi2CmtsTEKEntry ::= SEQUENCE { docsBpi2CmtsTEKSAId Integer32, docsBpi2CmtsTEKSAType INTEGER, docsBpi2CmtsTEKDataEncryptAlg INTEGER, docsBpi2CmtsTEKDataAuthentAlg INTEGER, docsBpi2CmtsTEKLifetime Integer32, docsBpi2CmtsTEKGraceTime Integer32, docsBpi2CmtsTEKKeySequenceNumber Integer32, docsBpi2CmtsTEKExpiresOld DateAndTime, docsBpi2CmtsTEKExpiresNew DateAndTime, docsBpi2CmtsTEKReset TruthValue, docsBpi2CmtsKeyRequests Counter32, docsBpi2CmtsKeyReplies Counter32, docsBpi2CmtsKeyRejects Counter32, docsBpi2CmtsTEKInvalids Counter32, docsBpi2CmtsKeyRejectErrorCode INTEGER, docsBpi2CmtsKeyRejectErrorString DisplayString, docsBpi2CmtsTEKInvalidErrorCode INTEGER, docsBpi2CmtsTEKInvalidErrorString DisplayString } docsBpi2CmtsTEKSAId OBJECT-TYPE SYNTAX Integer32 (1..16383) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the DOCSIS Security Association ID (SAID)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.12." ::= { docsBpi2CmtsTEKEntry 1 } docsBpi2CmtsTEKSAType OBJECT-TYPE SYNTAX INTEGER { none(0), primary(1), static(2), dynamic(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the type of security Expires September 2000 [Page 37] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 association. Dynamic does not apply to CMs running in BPI mode." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 2.1.3." ::= { docsBpi2CmtsTEKEntry 2 } docsBpi2CmtsTEKDataEncryptAlg OBJECT-TYPE SYNTAX INTEGER { none(0), des56CbcMode(1), des40CbcMode(2) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data encryption algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmtsTEKEntry 3 } docsBpi2CmtsTEKDataAuthentAlg OBJECT-TYPE SYNTAX INTEGER { none(0) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data authentication algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmtsTEKEntry 4 } docsBpi2CmtsTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to keys for this TEK association." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.5 and Appendix A.2." ::= { docsBpi2CmtsTEKEntry 5 } docsBpi2CmtsTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..302399) UNITS "seconds" Expires September 2000 [Page 38] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the TEK in seconds. The CM is expected to start trying to acquire a new TEK beginning TEK GraceTime seconds after the expiration of the immediate predecessor of the most recent TEK. Note: A CM in BPI mode is expected to start trying to acquire a new TEK beginning TEK GraceTime seconds before the expiration of the most recent TEK. Note: Tracking this value is optional on certain CMTS implementations." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.6." ::= { docsBpi2CmtsTEKEntry 6 } docsBpi2CmtsTEKKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the most recent TEK key sequence number for this SAID." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.2.10 and 4.2.2.13." ::= { docsBpi2CmtsTEKEntry 7 } docsBpi2CmtsTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmtsTEKEntry 8 } docsBpi2CmtsTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Expires September 2000 [Page 39] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmtsTEKEntry 9 } docsBpi2CmtsTEKReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE causes the CMTS to invalidate the current active TEK(s) (plural due to key transition periods), and to generate a new TEK for the associated SAID; the CMTS MAY also generate an unsolicited TEK Invalid message, to optimize the TEK synchronization between the CMTS and the CM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.3.3.5." ::= { docsBpi2CmtsTEKEntry 10 } docsBpi2CmtsKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received a Key Request message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.4." ::= { docsBpi2CmtsTEKEntry 11 } docsBpi2CmtsKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reply message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.5." ::= { docsBpi2CmtsTEKEntry 12 } docsBpi2CmtsKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reject message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Expires September 2000 [Page 40] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 Section 4.2.1.6." ::= { docsBpi2CmtsTEKEntry 13 } docsBpi2CmtsTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a TEK Invalid message." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.8." ::= { docsBpi2CmtsTEKEntry 14 } docsBpi2CmtsKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSaid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent Key Reject message sent in response to a Key Request for this SAID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.6 and 4.2.2.15." ::= { docsBpi2CmtsTEKEntry 15 } docsBpi2CmtsKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent Key Reject message sent in response to a Key Request for this SAID. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.6 and 4.2.2.6." ::= { docsBpi2CmtsTEKEntry 16 } docsBpi2CmtsTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), Expires September 2000 [Page 41] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent TEK Invalid message sent in association with this SAID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.8 and 4.2.2.15." ::= { docsBpi2CmtsTEKEntry 17 } docsBpi2CmtsTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent TEK Invalid message sent in association with this SAID. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.8 and 4.2.2.6." ::= { docsBpi2CmtsTEKEntry 18 } -- -- The CMTS Multicast Objects Group -- docsBpi2CmtsMulticastObjects OBJECT IDENTIFIER ::= { docsBpi2CmtsObjects 4 } -- -- The CMTS IP Multicast Mapping Table, indexed by IP multicast -- address and prefix, and by ifindex -- docsBpi2CmtsIpMulticastMapTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table maps multicast IP addresses to SAIDs. It is intended to map BOTH dynamic and static multicast IP addresses." ::= { docsBpi2CmtsMulticastObjects 1 } Expires September 2000 [Page 42] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmtsIpMulticastMapEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the mapping of one multicast IP address and prefix to one SAID, as well as associated message counters and error information. Note: For dynamic multicast IP addresses, create access does not apply." INDEX { ifIndex, docsBpi2CmtsIpMulticastAddress, docsBpi2CmtsIpMulticastPrefixLength } ::= { docsBpi2CmtsIpMulticastMapTable 1 } DocsBpi2CmtsIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmtsIpMulticastAddress IpAddress, docsBpi2CmtsIpMulticastPrefixLength Integer32, docsBpi2CmtsIpMulticastSAId Integer32, docsBpi2CmtsIpMulticastSAMapRequests Counter32, docsBpi2CmtsIpMulticastSAMapReplies Counter32, docsBpi2CmtsIpMulticastSAMapRejects Counter32, docsBpi2CmtsIpMulticastSAMapRejectErrorCode INTEGER, docsBpi2CmtsIpMulticastSAMapRejectErrorString DisplayString, docsBpi2CmtsIpMulticastMapControl RowStatus } docsBpi2CmtsIpMulticastAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address to be mapped, in conjunction with docsBpi2CmtsIpMulticastPrefixLength." ::= { docsBpi2CmtsIpMulticastMapEntry 1 } docsBpi2CmtsIpMulticastPrefixLength OBJECT-TYPE SYNTAX Integer32 (0..32) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address prefix length for this row. The value of this object represents the length in bits of docsBpiIpMulticastAddress for multicast address comparisons, using big-endian ordering. An IP multicast address matches this row if the (docsBpi2CmtsIpMulticastPrefixLength) most significant bits of the IP multicast address and of the (docsBpi2CmtsIpMulticastAddress) are identical. This object is similar in usage to an IP address mask. The value 0 corresponds to IP address mask 0.0.0.0, the value 1 corresponds to IP address mask 128.0.0.0, the value 8 corresponds to IP address mask 255.0.0.0, and Expires September 2000 [Page 43] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 the value 32 corresponds to IP address mask 255.255.255.255." ::= { docsBpi2CmtsIpMulticastMapEntry 2 } docsBpi2CmtsIpMulticastSAId OBJECT-TYPE SYNTAX Integer32 (1..16383) MAX-ACCESS read-create STATUS current DESCRIPTION "This object represents the multicast SAID to be used in this IP multicast address mapping entry." ::= { docsBpi2CmtsIpMulticastMapEntry 3 } docsBpi2CmtsIpMulticastSAMapRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an SA Map Request message for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.10." ::= { docsBpi2CmtsIpMulticastMapEntry 4 } docsBpi2CmtsIpMulticastSAMapReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an SA Map Reply message for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.11." ::= { docsBpi2CmtsIpMulticastMapEntry 5 } docsBpi2CmtsIpMulticastSAMapRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an SA Map Reject message for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.12." ::= { docsBpi2CmtsIpMulticastMapEntry 6 } docsBpi2CmtsIpMulticastSAMapRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), noAuthForRequestedDSFlow(9), Expires September 2000 [Page 44] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 dsFlowNotMappedToSA(10) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent SA Map Reject message sent in response to a SA Map Request for this IP. It has value unknown(2) if the last Error-Code value was 0, and none(1) if no SA MAP Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.15." ::= { docsBpi2CmtsIpMulticastMapEntry 7 } docsBpi2CmtsIpMulticastSAMapRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent SA Map Reject message sent in response to an SA Map Request for this IP. It is a zero length string if no SA Map Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.6." ::= { docsBpi2CmtsIpMulticastMapEntry 8 } docsBpi2CmtsIpMulticastMapControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the IP multicast address mapping entry." ::= { docsBpi2CmtsIpMulticastMapEntry 9 } -- -- The CMTS Multicast SAID Authorization Table, indexed by ifIndex by -- multicast SAID by CM MAC address -- docsBpi2CmtsMulticastAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the multicast SAID authorization for each CM on each CMTS MAC interface. Note: The CMTS need only track those CMs actively using Expires September 2000 [Page 45] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 the SAID." ::= { docsBpi2CmtsMulticastObjects 2 } docsBpi2CmtsMulticastAuthEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the key authorization of one cable modem for one multicast SAID for one CMTS MAC interface. Note: For dynamic multicast SAIDs, create access does not apply." INDEX { ifIndex, docsBpi2CmtsMulticastAuthSAId, docsBpi2CmtsMulticastAuthCmMacAddress } ::= { docsBpi2CmtsMulticastAuthTable 1 } DocsBpi2CmtsMulticastAuthEntry ::= SEQUENCE { docsBpi2CmtsMulticastAuthSAId Integer32, docsBpi2CmtsMulticastAuthCmMacAddress MacAddress, docsBpi2CmtsMulticastAuthControl RowStatus } docsBpi2CmtsMulticastAuthSAId OBJECT-TYPE SYNTAX Integer32 (1..16383) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the multicast SAID for authorization." ::= { docsBpi2CmtsMulticastAuthEntry 1 } docsBpi2CmtsMulticastAuthCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the MAC address of the CM to which the multicast SAID authorization applies." ::= { docsBpi2CmtsMulticastAuthEntry 2 } docsBpi2CmtsMulticastAuthControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the CM authorization for each multicast SAID." ::= { docsBpi2CmtsMulticastAuthEntry 3 } -- Expires September 2000 [Page 46] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- CMTS Cert Objects -- docsBpi2CmtsCertObjects OBJECT IDENTIFIER ::= { docsBpi2CmtsObjects 5 } -- -- CMTS Provisioned CM Cert Table -- docsBpi2CmtsProvisionedCmCertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsProvisionedCmCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table of CM certificate trust entries provisioned to the CMTS. This table overrides CM Certificate entries located in the CMTS' authorization table." ::= { docsBpi2CmtsCertObjects 1 } docsBpi2CmtsProvisionedCmCertEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsProvisionedCmCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the CMTS' provisioned CM certificate table." INDEX { docsBpi2CmtsProvisionedCmCertMacAddress } ::= { docsBpi2CmtsProvisionedCmCertTable 1 } DocsBpi2CmtsProvisionedCmCertEntry ::= SEQUENCE { docsBpi2CmtsProvisionedCmCertMacAddress MacAddress, docsBpi2CmtsProvisionedCmCertTrust INTEGER, docsBpi2CmtsProvisionedCmCertSource INTEGER, docsBpi2CmtsProvisionedCmCertStatus RowStatus, docsBpi2CmtsProvisionedCmCert X509Certificate } docsBpi2CmtsProvisionedCmCertMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of this row." ::= { docsBpi2CmtsProvisionedCmCertEntry 1 } docsBpi2CmtsProvisionedCmCertTrust OBJECT-TYPE SYNTAX INTEGER { trusted (1), untrusted (2) } MAX-ACCESS read-create Expires September 2000 [Page 47] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 STATUS current DESCRIPTION "Trust state for the provisioned CM certificate entry. Note: Setting this object need only override the validity of CM certificates sent in future authorization requests." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1." ::= { docsBpi2CmtsProvisionedCmCertEntry 2 } docsBpi2CmtsProvisionedCmCertSource OBJECT-TYPE SYNTAX INTEGER { snmp (1), configurationFile (2), externalDatabase (3), other (4) } MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates how the certificate reached the CMTS. Other means it originated from a source not identified above." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1." ::= { docsBpi2CmtsProvisionedCmCertEntry 3 } docsBpi2CmtsProvisionedCmCertStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Standard RowStatus object for creating and deleting this row." ::= { docsBpi2CmtsProvisionedCmCertEntry 4 } docsBpi2CmtsProvisionedCmCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-create STATUS current DESCRIPTION "An X509 DER-encoded certificate authority certificate. Note: The NULL string must be returned, on reads, if the entire certificate is not retained in the CMTS." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2." ::= { docsBpi2CmtsProvisionedCmCertEntry 5 } -- Expires September 2000 [Page 48] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- CMTS CA Cert Table -- docsBpi2CmtsCACertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsCACertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The table of known certificate authority certificates acquired by this device." ::= { docsBpi2CmtsCertObjects 2 } docsBpi2CmtsCACertEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsCACertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A row in the Certificate Authority certificate table." INDEX { docsBpi2CmtsCACertIndex } ::= {docsBpi2CmtsCACertTable 1 } DocsBpi2CmtsCACertEntry ::= SEQUENCE { docsBpi2CmtsCACertIndex Integer32, docsBpi2CmtsCACertSubject SnmpAdminString, docsBpi2CmtsCACertIssuer SnmpAdminString, docsBpi2CmtsCACertSerialNumber OCTET STRING, docsBpi2CmtsCACertTrust INTEGER, docsBpi2CmtsCACertSource INTEGER, docsBpi2CmtsCACertStatus RowStatus, docsBpi2CmtsCACert X509Certificate } docsBpi2CmtsCACertIndex OBJECT-TYPE SYNTAX Integer32 (1..10000) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index for this row." ::= { docsBpi2CmtsCACertEntry 1 } docsBpi2CmtsCACertSubject OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "Printable representation of (at least) the organizationName portion of the certificate's subject name. Additional fields MAY be present and SHOULD be separated by CR LF. Ordering of fields is CMTS vendor specific." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2.4" Expires September 2000 [Page 49] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 ::= { docsBpi2CmtsCACertEntry 2 } docsBpi2CmtsCACertIssuer OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "Printable representation of (at least) the commonName portion of the certificate's issuer name. Additional fields MAY be present and SHOULD be separated by CR LF. Ordering of fields is CMTS vendor specific." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2.4" ::= { docsBpi2CmtsCACertEntry 3 } docsBpi2CmtsCACertSerialNumber OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..32)) MAX-ACCESS read-only STATUS current DESCRIPTION "This CA certificate's serial number represented as an octet string." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2.2" ::= { docsBpi2CmtsCACertEntry 4 } docsBpi2CmtsCACertTrust OBJECT-TYPE SYNTAX INTEGER { trusted (1), untrusted (2), chained (3), root (4) } MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls the trust status of this certificate. Root certificates must be given root trust; manufacturer certificates must not be given root trust. Trust on root certificates must not change. Note: Setting this object need only affect the validity of CM certificates sent in future authorization requests; instantaneous effect need not occur." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1" ::= { docsBpi2CmtsCACertEntry 5 } docsBpi2CmtsCACertSource OBJECT-TYPE SYNTAX INTEGER { snmp (1), Expires September 2000 [Page 50] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 configurationFile (2), externalDatabase (3), other (4), authentInfo (5), compiledIntoCode (6) } MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates how the certificate reached the CMTS. Other means it originated from a source not identified above." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1" ::= { docsBpi2CmtsCACertEntry 6 } docsBpi2CmtsCACertStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Standard RowStatus object for creating and deleting entries in this table. Of the objects in the row controlled by this object, only docsBpi2CmtsCACertTrust may be modified while the row is active. Note: Deleting rows for actively used CA certs MAY NOT succeed depending on CMTS implementation." ::= { docsBpi2CmtsCACertEntry 7 } docsBpi2CmtsCACert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-create STATUS current DESCRIPTION "An X509 DER-encoded certificate authority certificate. Note: The NULL string must be returned, on reads, if the entire certificate is not retained in the CMTS." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2." ::= { docsBpi2CmtsCACertEntry 8 } -- -- Authenticated Software Download Objects -- -- -- Note: the authenticated software download objects are a -- CM requirement only. Expires September 2000 [Page 51] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- docsBpi2CodeDownloadControl OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 4 } docsBpi2CodeDownloadStatusCode OBJECT-TYPE SYNTAX INTEGER { configFileCvcVerified (1), configFileCvcRejected (2), snmpCvcVerified (3), snmpCvcRejected (4), codeFileVerified (5), codeFileRejected (6), other (7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value indicates the result of the latest config file CVC verification, SNMP CVC verification, or code file verification." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.3.2 & D.3.5.1." ::= { docsBpi2CodeDownloadControl 1 } docsBpi2CodeMfgCodeDownloadStatusString OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object indicates the additional information to the status code. The value will include the error code and error description which will be defined separately." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section TBD (see D.3.7)" ::= { docsBpi2CodeDownloadControl 2 } docsBpi2CodeMfgOrgName OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the device manufacturer's organizationName." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 3 } docsBpi2CodeMfgCodeAccessStart OBJECT-TYPE Expires September 2000 [Page 52] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the device manufacturer's current codeAccessStart value referenced to Greenwich Mean Time (GMT)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 4 } docsBpi2CodeMfgCvcAccessStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the device manufacturer's current cvcAccessStart value referenced to Greenwich Mean Time (GMT)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 5 } docsBpi2CodeCoSignerOrgName OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Co-Signer's organizationName." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 6 } docsBpi2CodeCoSignerCodeAccessStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Co-Signer's current codeAccessStart value referenced to Greenwich Mean Time (GMT)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 7 } docsBpi2CodeCoSignerCvcAccessStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only Expires September 2000 [Page 53] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 STATUS current DESCRIPTION "The value of this object is the Co-Signer's current cvcAccessStart value referenced to Greenwich Mean Time (GMT)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 8 } docsBpi2CodeCvcUpdate OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-write STATUS current DESCRIPTION "Setting a CVC to this object triggers the device to verify the CVC and update the cvcAccessStart value. If the device is not enabled to upgrade codefiles, or the CVC verification fails, the CVC will be rejected. Reading this object always returns the null string." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.3.2.2." ::= { docsBpi2CodeDownloadControl 9 } -- -- The BPI+ MIB Conformance Statements (with a placeholder for -- notifications) -- docsBpi2Notification OBJECT IDENTIFIER ::= { docsBpi2MIB 2 } docsBpi2Conformance OBJECT IDENTIFIER ::= { docsBpi2MIB 3 } docsBpi2Compliances OBJECT IDENTIFIER ::= { docsBpi2Conformance 1 } docsBpi2Groups OBJECT IDENTIFIER ::= { docsBpi2Conformance 2 } docsBpi2BasicCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "This is the compliance statement for devices which implement the DOCSIS Baseline Privacy Interface." MODULE -- docsBpi2MIB -- conditionally mandatory group GROUP docsBpi2CmGroup DESCRIPTION "This group is implemented only in CMs, not in CMTSs." Expires September 2000 [Page 54] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 -- conditionally mandatory group GROUP docsBpi2CmtsGroup DESCRIPTION "This group is implemented only in CMTSs, not in CMs." -- conditionally mandatory group GROUP docsBpi2CodeDownloadGroup DESCRIPTION "This group is required in CMs and is optional in CMTSs." -- relaxation on mandatory range OBJECT docsBpi2CmtsDefaultAuthLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpi2CmtsDefaultTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpi2CmtsAuthCmLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpi2CmtsTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." ::= { docsBpi2Compliances 1 } docsBpi2CmGroup OBJECT-GROUP OBJECTS { docsBpi2CmPrivacyEnable, docsBpi2CmPublicKey, docsBpi2CmAuthState, docsBpi2CmAuthKeySequenceNumber, docsBpi2CmAuthExpiresOld, docsBpi2CmAuthExpiresNew, Expires September 2000 [Page 55] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmAuthReset, docsBpi2CmAuthGraceTime, docsBpi2CmTEKGraceTime, docsBpi2CmAuthWaitTimeout, docsBpi2CmReauthWaitTimeout, docsBpi2CmOpWaitTimeout, docsBpi2CmRekeyWaitTimeout, docsBpi2CmAuthRejectWaitTimeout, docsBpi2CmSAMapWaitTimeout, docsBpi2CmSAMapMaxRetries, docsBpi2CmAuthentInfos, docsBpi2CmAuthRequests, docsBpi2CmAuthReplies, docsBpi2CmAuthRejects, docsBpi2CmAuthInvalids, docsBpi2CmAuthRejectErrorCode, docsBpi2CmAuthRejectErrorString, docsBpi2CmAuthInvalidErrorCode, docsBpi2CmAuthInvalidErrorString, docsBpi2CmTEKSAType, docsBpi2CmTEKDataEncryptAlg, docsBpi2CmTEKDataAuthentAlg, docsBpi2CmTEKState, docsBpi2CmTEKKeySequenceNumber, docsBpi2CmTEKExpiresOld, docsBpi2CmTEKExpiresNew, docsBpi2CmTEKKeyRequests, docsBpi2CmTEKKeyReplies, docsBpi2CmTEKKeyRejects, docsBpi2CmTEKInvalids, docsBpi2CmTEKAuthPends, docsBpi2CmTEKKeyRejectErrorCode, docsBpi2CmTEKKeyRejectErrorString, docsBpi2CmTEKInvalidErrorCode, docsBpi2CmTEKInvalidErrorString, docsBpi2CmIpMulticastSAId, docsBpi2CmIpMulticastSAMapState, docsBpi2CmIpMulticastSAMapRequests, docsBpi2CmIpMulticastSAMapReplies, docsBpi2CmIpMulticastSAMapRejects, docsBpi2CmIpMulticastSAMapRejectErrorCode, docsBpi2CmIpMulticastSAMapRejectErrorString, docsBpi2CmDeviceCmCert, docsBpi2CmDeviceManufCert, docsBpi2CmCryptoSuiteDataEncryptAlg, docsBpi2CmCryptoSuiteDataAuthentAlg } STATUS current DESCRIPTION "This collection of objects provides CM BPI+ status and control." ::= { docsBpi2Groups 1 } Expires September 2000 [Page 56] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmtsGroup OBJECT-GROUP OBJECTS { docsBpi2CmtsDefaultAuthLifetime, docsBpi2CmtsDefaultTEKLifetime, docsBpi2CmtsDefaultSelfSignedManufCertTrust, docsBpi2CmtsCheckCertValidityPeriods, docsBpi2CmtsAuthentInfos, docsBpi2CmtsAuthRequests, docsBpi2CmtsAuthReplies, docsBpi2CmtsAuthRejects, docsBpi2CmtsAuthInvalids, docsBpi2CmtsSAMapRequests, docsBpi2CmtsSAMapReplies, docsBpi2CmtsSAMapRejects, docsBpi2CmtsAuthCmBpiVersion, docsBpi2CmtsAuthCmPublicKey, docsBpi2CmtsAuthCmKeySequenceNumber, docsBpi2CmtsAuthCmExpiresOld, docsBpi2CmtsAuthCmExpiresNew, docsBpi2CmtsAuthCmLifetime, docsBpi2CmtsAuthCmGraceTime, docsBpi2CmtsAuthCmReset, docsBpi2CmtsAuthCmInfos, docsBpi2CmtsAuthCmRequests, docsBpi2CmtsAuthCmReplies, docsBpi2CmtsAuthCmRejects, docsBpi2CmtsAuthCmInvalids, docsBpi2CmtsAuthRejectErrorCode, docsBpi2CmtsAuthRejectErrorString, docsBpi2CmtsAuthInvalidErrorCode, docsBpi2CmtsAuthInvalidErrorString, docsBpi2CmtsAuthPrimarySAId, docsBpi2CmtsAuthBpkmCmCertValid, docsBpi2CmtsAuthBpkmCmCert, docsBpi2CmtsTEKSAType, docsBpi2CmtsTEKDataEncryptAlg, docsBpi2CmtsTEKDataAuthentAlg, docsBpi2CmtsTEKLifetime, docsBpi2CmtsTEKGraceTime, docsBpi2CmtsTEKKeySequenceNumber, docsBpi2CmtsTEKExpiresOld, docsBpi2CmtsTEKExpiresNew, docsBpi2CmtsTEKReset, docsBpi2CmtsKeyRequests, docsBpi2CmtsKeyReplies, docsBpi2CmtsKeyRejects, docsBpi2CmtsTEKInvalids, docsBpi2CmtsKeyRejectErrorCode, docsBpi2CmtsKeyRejectErrorString, docsBpi2CmtsTEKInvalidErrorCode, docsBpi2CmtsTEKInvalidErrorString, docsBpi2CmtsIpMulticastSAId, docsBpi2CmtsIpMulticastSAMapRequests, Expires September 2000 [Page 57] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 docsBpi2CmtsIpMulticastSAMapReplies, docsBpi2CmtsIpMulticastSAMapRejects, docsBpi2CmtsIpMulticastSAMapRejectErrorCode, docsBpi2CmtsIpMulticastSAMapRejectErrorString, docsBpi2CmtsIpMulticastMapControl, docsBpi2CmtsMulticastAuthControl, docsBpi2CmtsProvisionedCmCertTrust, docsBpi2CmtsProvisionedCmCertSource, docsBpi2CmtsProvisionedCmCertStatus, docsBpi2CmtsProvisionedCmCert, docsBpi2CmtsCACertSubject, docsBpi2CmtsCACertIssuer, docsBpi2CmtsCACertSerialNumber, docsBpi2CmtsCACertTrust, docsBpi2CmtsCACertSource, docsBpi2CmtsCACertStatus, docsBpi2CmtsCACert } STATUS current DESCRIPTION "This collection of objects provides CMTS BPI+ status and control." ::= { docsBpi2Groups 2 } docsBpi2CodeDownloadGroup OBJECT-GROUP OBJECTS { docsBpi2CodeDownloadStatusCode, docsBpi2CodeMfgCodeDownloadStatusString, docsBpi2CodeMfgOrgName, docsBpi2CodeMfgCodeAccessStart, docsBpi2CodeMfgCvcAccessStart, docsBpi2CodeCoSignerOrgName, docsBpi2CodeCoSignerCodeAccessStart, docsBpi2CodeCoSignerCvcAccessStart, docsBpi2CodeCvcUpdate } STATUS current DESCRIPTION "This collection of objects provide authenticated software download support." ::= { docsBpi2Groups 3 } END 4. Acknowledgments Kaz Ozawa (CableLabs/Toshiba) - Authenticated S/W Download Control Mike StJohns (@Home) - BPI MIB, 1st draft of BPI+ MIB Rich Woundy (Cisco) - BPI MIB Thanks to Mike Sabin (Com21) and Manson Wong (Cisco) for reviewing the BPI+ MIB. Expires September 2000 [Page 58] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 5. References [1] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture for Describing SNMP Management Frameworks", RFC 2571, April 1999. [2] Rose, M. and K. McCloghrie, "Structure and Identification of Management Information for TCP/IP-based Internets", STD 16, RFC 1155, May 1990. [3] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16, RFC 1212, March 1991. [4] Rose, M., "A Convention for Defining Traps for use with the SNMP", RFC 1215, March 1991. [5] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of Management Information for Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [6] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [7] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [8] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Management Protocol", STD 15, RFC 1157, May 1990. [9] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Introduction to Community-based SNMPv2", RFC 1901, January 1996. [10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport Mappings for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1906, January 1996. [11] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2572, April 1999. [12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", RFC 2574, April 1999. [13] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1905, January 1996. [14] Levi, D., Meyer, P. and B. Stewart, "SNMP Applications", RFC 2573, April 1999. Expires September 2000 [Page 59] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 [15] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999. [16] "Data-Over-Cable Service Interface Specifications: Cable Modem Radio Frequency Interface Specification SP-RFIv1.1-I03-991105", DOCSIS, November 1999, available at http://www.cablemodem.com/. [17] "Data-Over-Cable Service Interface Specifications: Baseline Privacy Plus Interface Specification SP-BPI+-I03-991105", DOCSIS, November 1999, available at http://www.cablemodem.com/. [18] "Data-Over-Cable Service Interface Specifications: Baseline Privacy Interface Specification SP-BPI-I02-990319", DOCSIS, March 1999, available at http://www.cablemodem.com/. [19] "Data-Over-Cable Service Interface Specifications: OSSI Baseline Privacy Interface MIB SP-OSSI-BPI-I01-980331", DOCSIS, March 1999, available at http://www.cablemodem.com/. 6. Security Considerations This MIB is intended to limit certain kinds of network behavior by subscriber hosts attached to cable modems, including, for example, IP spoofing. These limitations may be compromised, however, if the cable modem's identity or registration process is spoofed. The DOCSIS RFI and privacy specifications [16], [18], and [17] define a number of mechanisms for assuring modem identity. There are a number of management objects defined in this MIB that have a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. SNMPv1 by itself is not a secure environment. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB. It is recommended that the implementers consider the security features as provided by the SNMPv3 framework. Specifically, the use of the User-based Security Model RFC 2574 [12] and the View- based Access Control Model RFC 2575 [15] is recommended. It is then a customer/user responsibility to ensure that the SNMP entity giving access to an instance of this MIB, is properly Expires September 2000 [Page 60] INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB March 2000 configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them. 7. Author's Address Stuart M. Green Arris Interactive 6 Riverside Drive Andover, MA 01810 USA Phone: +1 978 946 4664 Email: stu.green@ne.arris-i.com Expires September 2000 [Page 61] --------------1483825CC3F3F6A052A937F8-- From owner-ipcdn@terayon.com Tue Mar 21 15:10:22 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11857 for ; Tue, 21 Mar 2000 15:10:21 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id MAA28182; Tue, 21 Mar 2000 12:07:48 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 21 Mar 2000 20:07:48 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id MAA09329; Tue, 21 Mar 2000 12:07:48 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id MAA17560 for ipcdn-outgoing; Tue, 21 Mar 2000 12:04:48 -0800 (PST) Message-Id: <200003212005.PAA16958@funnel.cisco.com> X-Sender: rwoundy@funnel X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.2 Date: Tue, 21 Mar 2000 15:02:04 -0500 To: ipcdn@terayon.com From: Rich Woundy Subject: Re: Tentative Agenda - Adelaide IETF In-Reply-To: <4.3.1.2.20000317152209.00c98770@poptart> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com At 03:27 PM 3/17/00 -0800, Mike St. Johns wrote: >BPI MIB Closure - Rich Woundy I believe we decided as a working group to publish the DOCSIS 1.0-oriented BPI MIB as an Informational RFC, and to put the BPI+ MIB on the standards track. I incorporated BPI MIB comments from the working group and published the following internet draft: . After reading RFC 2026 , it appears that an IETF last call is required to publish the BPI MIB as Informational; see the relevant process text below. I would like to request the working group to submit this draft to the IESG for publication as an Informational RFC. Is it possible to confirm this action (either by mailing list or in person) by the end of the ipcdn meeting in Adelaide next Tuesday? Do we need an official working group Last-Call? Are there any remaining objections? Note: the draft has been posted for more than the minimum two weeks. -- Rich Woundy 4.2.3 Procedures for Experimental and Informational RFCs ... Documents proposed for Experimental and Informational RFCs by IETF Working Groups go through IESG review. The review is initiated using the process described in section 6.1.1. 6.1.1 Initiation of Action A specification that is intended to enter or advance in the Internet standards track shall first be posted as an Internet-Draft (see section 2.2) unless it has not changed since publication as an RFC. It shall remain as an Internet-Draft for a period of time, not less than two weeks, that permits useful community review, after which a recommendation for action may be initiated. A standards action is initiated by a recommendation by the IETF Working group responsible for a specification to its Area Director, copied to the IETF Secretariat or, in the case of a specification not associated with a Working Group, a recommendation by an individual to the IESG. From owner-ipcdn@terayon.com Tue Mar 21 20:02:11 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27709 for ; Tue, 21 Mar 2000 20:02:10 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id QAA03679; Tue, 21 Mar 2000 16:59:26 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 22 Mar 2000 00:59:25 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id QAA26574; Tue, 21 Mar 2000 16:59:25 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id QAA22462 for ipcdn-outgoing; Tue, 21 Mar 2000 16:56:41 -0800 (PST) Message-Id: <4.3.1.2.20000321164942.06402dd0@poptart> X-Sender: stjohns@poptart X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Tue, 21 Mar 2000 16:51:48 -0800 To: ipcdn@terayon.com, ipcdn@terayon.com From: "Mike St. Johns" Subject: Re: Tentative Agenda - Adelaide IETF In-Reply-To: <200003212005.PAA16958@funnel.cisco.com> References: <4.3.1.2.20000317152209.00c98770@poptart> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Consider this the beginning of the working group last call for BPI. I'll submit this for Informational status when we get back from Adelaide. Let's talk about where BPI+ is at the meeting - I think we can probably do a wg last call after the meeting and place it on the standards track. Mike At 12:02 PM 3/21/00, Rich Woundy wrote: >At 03:27 PM 3/17/00 -0800, Mike St. Johns wrote: > >BPI MIB Closure - Rich Woundy > >I believe we decided as a working group to publish the DOCSIS 1.0-oriented >BPI MIB as an Informational RFC, and to put the BPI+ MIB on the standards >track. I incorporated BPI MIB comments from the working group and published >the following internet draft: >. > >After reading RFC 2026 , it appears >that an IETF last call is required to publish the BPI MIB as Informational; >see the relevant process text below. I would like to request the working >group to submit this draft to the IESG for publication as an Informational >RFC. > >Is it possible to confirm this action (either by mailing list or in person) >by the end of the ipcdn meeting in Adelaide next Tuesday? Do we need an >official working group Last-Call? Are there any remaining objections? > >Note: the draft has been posted for more than the minimum two weeks. > >-- Rich Woundy > >4.2.3 Procedures for Experimental and Informational RFCs > ... > > Documents proposed for Experimental and Informational RFCs by IETF > Working Groups go through IESG review. The review is initiated using > the process described in section 6.1.1. > >6.1.1 Initiation of Action > > A specification that is intended to enter or advance in the Internet > standards track shall first be posted as an Internet-Draft (see > section 2.2) unless it has not changed since publication as an RFC. > It shall remain as an Internet-Draft for a period of time, not less > than two weeks, that permits useful community review, after which a > recommendation for action may be initiated. > > A standards action is initiated by a recommendation by the IETF > Working group responsible for a specification to its Area Director, > copied to the IETF Secretariat or, in the case of a specification not > associated with a Working Group, a recommendation by an individual to > the IESG. From owner-ipcdn@terayon.com Fri Mar 31 19:13:14 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19698 for ; Fri, 31 Mar 2000 19:13:14 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id QAA19591; Fri, 31 Mar 2000 16:10:58 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 1 Apr 2000 00:10:58 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id QAA12080; Fri, 31 Mar 2000 16:10:56 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id QAA20209 for ipcdn-outgoing; Fri, 31 Mar 2000 16:08:13 -0800 (PST) Message-ID: <4FA371B64BDAD2119CF40008C7D9ADB302B96B97@indyexch5.indy.tce.com> From: Yost William To: "ipcdn mailing list (E-mail)" Subject: Diffie-Hellman USM Key MIB localized keys Date: Fri, 31 Mar 2000 12:33:54 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Type: text/plain; charset="iso-8859-1" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com The keys generated by using the usmDHKickstartTable are not supposed to be localized to the snmpEngineID of the agent are they? I don't think they are. I think the PKCS#5 V2 function is used to directly calculate the keys and they are installed as is. Is that right? ----------- William H. Yost, Thomson Consumer Electronics ------------ . Home of RCA, GE, and Proscan (317) 587-4816 yostw@tce.com . .There's 3 ways to do it: The DOCSIS way, The Right way, and My Way .