IPSP                                                             M. Baer
Internet-Draft                                              Sparta, Inc.
Expires: April 20, August 21, 2005                                      R. Charlet
                                                                    Self
                                                             W. Hardaker
                                                            Sparta, Inc.
                                                                R. Story
                                                     Revelstone Software
                                                                 C. Wang
                                                        SmartPipes, Inc.
                                                        October
                                                ARO/North Carolina State
                                                              University
                                                       February 20, 2004 2005

            IPsec Security Policy Database Configuration MIB
                     draft-ietf-ipsp-spd-mib-01.txt
                     draft-ietf-ipsp-spd-mib-02.txt

Status of this Memo

   This document is an Internet-Draft and is subject to all provisions
   of section 3 of RFC 3667.  By submitting this Internet-Draft, I certify each
   author represents that any applicable patent or other IPR claims of
   which I am he or she is aware have been or will be disclosed, and any of
   which I he or she become aware will be disclosed, in accordance with
   RFC 3668.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as
   Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on April 20, August 21, 2005.

Copyright Notice

   Copyright (C) The Internet Society (2004).  All Rights Reserved. (2005).

Abstract
   This document defines a SMIv2 Management Information Base (MIB)
   module for configuring the security policy database of a device
   implementing the IPSec IPsec protocol.  The policy-based packet filtering
   and the corresponding execution of actions described in this document
   is of a more general nature than for IPsec configuration only, alone, such
   as for configuration of a firewall.  This MIB module is designed with future extensibility
   in mind.  It is thus possible to externally add
   be extensible with other enterprise or standards based defined packet
   filters and actions to the policy-based packet filtering system defined in
   this document. actions.

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  The Internet-Standard Management Framework . . . . . . . . . .  3
   3.  Relationship to the DMTF Policy Model  . . . . . . . . . . . .  3
   4.  MIB Module Overview  . . . . . . . . . . . . . . . . . . . . .  4
     4.1   Usage Tutorial . . . . . . . . . . . . . . . . . . . . . .  4  5
       4.1.1   Notational conventions . . . . . . . . . . . . . . . .  4  5
       4.1.2   Implementing an example SPD policy . . . . . . . . . .  5  6
   5.  MIB definition . . . . . . . . . . . . . . . . . . . . . . . .  6  8
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 60 61
     6.1   Introduction . . . . . . . . . . . . . . . . . . . . . . . 60 61
     6.2   Protecting against in-authentic access . . . . . . . . . . 61 63
     6.3   Protecting against involuntary disclosure  . . . . . . . . 61 63
     6.4   Bootstrapping your configuration . . . . . . . . . . . . . 61 63
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 64
   8.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 62
   8. 64
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 62
   8.1 64
   9.1   Normative References . . . . . . . . . . . . . . . . . . . . 62
   8.2 64
   9.2   Informative References . . . . . . . . . . . . . . . . . . . 63 65
       Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 63 66
       Intellectual Property and Copyright Statements . . . . . . . . 65 67

1.  Introduction

   This document defines a MIB module for configuration of an IPsec
   security policy database (SPD).  The policy-based packet filtering
   and the corresponding execution of actions is of a more general
   nature than for IPsec configuration only, such as for configuration
   of a firewall.  It is possible to extend this MIB module and add
   other packet transforming actions to this MIB module if those actions needed to be that are performed conditionally on filtered
   network traffic.

   Companion documents [RFCXXXX], [RFCYYYY] document actions which are
   specific to IPsec and IKE.  No IPsec or IKE specific actions are
   defined within this document.

   Note: RFCXXXX and RFCYYYY should be replaced by the RFC Editor when
   these values are determined.

2.  The Internet-Standard Management Framework

   For a detailed overview of the documents that describe the current
   Internet-Standard Management Framework, please refer to section 7 of
   RFC 3410 [RFC3410]

   Managed objects are accessed via a virtual information store, termed
   the Management Information Base or MIB.  MIB objects are generally
   accessed through the Simple Network Management Protocol (SNMP).
   Objects in the MIB are defined using the mechanisms defined in the
   Structure of Management Information (SMI).  This memo specifies a MIB
   module that is compliant to the SMIv2, which is described in STD 58,
   RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
   [RFC2580].

3.  Relationship to the DMTF Policy Model

   The Distributed Management Task Force (DMTF) has created an object
   oriented model of IPsec policy information known as the IPsec Policy
   Model White Paper [IPPMWP].  The contents of this document are also
   reflected in the "IPsec Configuration Policy Model"
   (IPCP) [RFC3585]. [RFC3585] is based in large part on the DMTF's IPsec policy
   model.  The IPCP document describes a model for configuring IPsec.
   This MIB module is a task specific derivation (i.e.  an SMIv2
   instantiation) of the IPCP IPCP's IPsec configuration model for use with
   SNMPv3.

   The high-level areas where this MIB module diverges from the IPCP
   model are:

   o  Policies, Groups, Conditions, and some levels of Action Actions are
      generically named.  That is we dropped  In other words, IPsec specific prefixes like "SA",
      "SA" (Security Association), or
      "ipsec". "IPsec" are not used.  This naming
      convention is used because we feel that packet classification and the matching
      of conditions to actions is more general than IPsec and IPsec.  These tables
      could possibly be reused by other packet transforming actions
      which need to conditionally act on packets matching filters.

   o  Filters are implemented in a more generic and scalable manner,
      rather than enforcing the condition/filtering pairing of the IPCP
      and their its restrictions upon the user.  The  This MIB module offers a
      compound filter object to provide for greater flexibility than the
      IPCP when creating complex filters.

4.  MIB Module Overview

   The MIB module is modularized into several different parts: rules,
   filters, and actions.

   The rules section connects endpoints and groups of rules together.
   This is partially made up of the
   ipspEndpointToGroupTable, ipspGroupContentsTable, spdEndpointToGroupTable,
   spdGroupContentsTable, and the
   ipspRuleDefinitionTable. spdRuleDefinitionTable.  Each row of
   the ipspRuleDefinitionTable spdRuleDefinitionTable connects a filter(s) with filter to an action(s). action.  It should
   also be noted that by referencing the spdCompoundFilterTable, the
   spdRuleDefinitionTable's filter column can indicate a set of filters
   to be processed.  Likewise, by referencing the
   spdCompoundActionTable, the spdRuleDefinitionTable's action column
   can indicate multiple actions to be executed.

   This MIB is structured to allow for reuse through the future creation
   of extension tables that provide additional filters and/or actions.
   In fact, the companion documents to this one do just that to define
   IPsec and IKE specific actions to be used within this SPD
   configuration MIB.

   The filter section of the MIB module is composed of all the different
   types of filters in the Policy Model.  It is partially made up of the
   trueFilter, ipspCompoundFilterTable, ipspIpHeaderFilterTable,
   ipspIpOffsetFilterTable, ipspTimeFilterTable, and the
   ipspIpsoHeaderFilterTable.
   spdTrueFilter, spdCompoundFilterTable, spdSubfiltersTable
   spdIpHeaderFilterTable, spdIpOffsetFilterTable, spdTimeFilterTable,
   spdCompoundFilterTable, spdIpsoHeaderFilterTable.

   The action section of the this MIB module contains different action types
   from the Policy Model.  This document contains only the basic simple static
   actions
   needed required for the firewall processing (accept, drop, log, ...) that an IPsec SPD
   implementation will need. requires (e.g.  accept, drop, log, ...).  The
   companion documents to this document define the complex actions
   necessary for IPsec and IKE specific actions.

4.1  Usage Tutorial negotiations.

   As may have been noticed above, the MIB uses recursion similarly in
   several different places.  In order to make use particular the spdGroupContentsTable,
   the spdCompoundFilterTable / spdSubfiltersTable combination, and the
   spdCompoundActionTable / spdSubactionsTable combination can reference
   themselves.

   In the case of the tables contained in this document, spdGroupContentsTable, a
   general understanding of firewall processing must be first
   understood.  The processing of row can indicate a rule
   (i.e.  a row in the security policy database involves
   applying spdRuleDefinitionTable) or a group (i.e.  another
   set of firewall rules to an interface on one or more rows in the spdGroupContentsTable).  In this way a
   group can contain a device.  The
   given set of rules to apply to any given interface is and sub-groups.  Sub-groups are just
   other groups defined within in the ipspEndpointToGroupTable table.  This table maps a given
   interface spdGroupContentsTable.  There is no
   inherit MIB limit to a group the nesting of rules. groups within groups.

   The interface itself spdCompoundFilterTable / spdSubfiltersTable combination and
   spdCompoundActionTable / spdSubactionsTable combination are designed
   almost identically with in this
   table is specified using its assigned address.  There is also one
   group of rules per direction (inbound being for filters and outbound).

4.1.1  Notational conventions

   Notes about the other for
   actions respectively.  The following example operations:

   1.  All of descriptions for the example operations in compound
   filter tables can be directly applied to the following section make use
       of default values for all columns not listed. compound action tables.

   The operations and
       close are combination of the minimal SNMP Varbinds tables spdCompoundFilterTable and
   spdSubfiltersTable allow a user to create a set of filters that must can
   be sent.

   2.  The example operations are formatted such treated by any table that references it as a single filter.  A row (i.e.
   in the
       table's Entry object) is operated on by using spdCompoundFilterTable has the indexes to that basic configuration information
   for the compound filter.  It's name (spdCompFiltname) reference a set
   of rows in the spdSubfiltersTable.  Each row and in spdSubfiltersTable
   points at a row in another filter table.  In this way, a set of
   ordered filters making up the column values compound filter is created.  Note that
   it is possible for one of these rows in the spdSubfiltersTable to
   point at a row in the spdCompoundFilterTable.  This recursion allows
   the creation of a filter set that row.  It include other filter sets within
   it.  There is left as an
       exercise for no inherit MIB limit to the reader nesting of compound filters
   within compound filters.

4.1  Usage Tutorial

   In order to turn these into real SNMP operations
       using real OIDs and real varbinds make use of the tables contained in this document, a SET PDU.  Example:

       rowEntry(index1     = value1,
                index2     = value2)
             = (column1        = column_value1,
                column2        = column_value2)

4.1.2  Implementing an example SPD policy

   For our example, let us define and apply
   general understanding of firewall processing is necessary.  The
   processing of the following security policy for all
   incoming traffic on database involves applying a network interface:

   o  Drop all packets from the host 10.6.6.6.

   o  Accept all other packets.

   To do this, let us call the set of
   firewall rules (as to an interface on a group) "incoming" and device.  The given set of rules
   to apply them to the incoming traffic for the any given interface associated with is defined within the IPv4 address "10.0.0.1".  For these rules, let us apply
   ipspEndpointToGroupTable table.  This table maps a policy
   that accepts all traffic except for packets that arrive from given interface to
   a host
   with an IPv4 address group of "10.6.6.6".  To achieve rules.  In this policy, we would
   follow these steps:

   First, we need to create table, the interface itself is specified
   using its assigned address.  There is also one group of rules to institute this policy.  To
   accomplish this, first we have to create per
   direction (ingress and egress).

4.1.1  Notational conventions

   Notes about the filter for following example operations:

   1.  All of the host.  We
   could do this using example operations in the following section make use
       of default values for all columns not listed.  The operations and
       column values below are the minimal SNMP Varbinds that must be
       sent.

   2.  The example operations are formatted such that a row insertion into (i.e.  the
   spdIpHeaderFilterTable table:

   SpdIpHeaderFilterEntry(spdIpHeadFiltName = "10.6.6.6")
         = (spdIpHeadFiltType            = 0x80,        -- sourceAddress
            spdIpHeadFiltIPVersion       = 1,           -- IPv4
            spdIpHeadFiltSrcAddressBegin = 0x0a060606,
            spdIpHeadFiltSrcAddressEnd   = 0x0a060606,
            spdIpHeadFiltRowStatus       = 5)           -- createAndGo

   Next, we need to bind this filter
       table's Entry object) is operated on by using the indexes to an action that
       row and the column values for the that row.

   3.  The following is a generic example of "drop" the notation used in a new
   rule.  We can do the
       following section's examples of this as follows:

   spdRuleDefinitionEntry(spdRuleDefName MIB's usage:

       rowEntry(index1     = "drop from 10.6.6.6") value1,
                index2     = (spdRuleDefFilter value2)
             =
                   spdIpHeadFiltType.8.49.48.46.54.46.54.46.54,
            spdRuleDefAction (column1        = spdDropAction.0,
            spdRuleDefRowStatus column_value1,
                column2        = 5)           -- createAndGo

   We also need column_value2)

   4.  The following is a rule specific example of the notation used in the
       following section's examples of this MIB's usage.  In order to accept all other packets:

   spdRuleDefinitionEntry(spdRuleDefName
       set the address status column to deprecated for a row in the
       IP-MIB::ipAddressTable with the index values of ipAddressAddrType
       = "accept all") ipv4 and ipAddressAddr = (spdRuleDefFilter 192.0.2.1.  The example notation would
       look like the following:

       ipAddressEntry(ipAddressAddrType = spdTrueFilter.0,
            spdRuleDefAction 1,           -- ipv4
                      ipAddressAddr     = spdAcceptAction.0,
            spdRuleDefRowStatus 0x0a000001 ) -- 192.0.2.1
                   = (ipAddressStatus   = 5) 2)           -- createAndGo

   Now, we need deprecated

4.1.2  Implementing an example SPD policy

   For our example, let us define and apply the following policy for all
   ingress traffic on a network interface:

   o  Drop all packets from the host 10.6.6.6.

   o  Accept all other packets.

   To do this, let us call the set of rules (as a group) "ingress" and
   apply them to the ingress traffic for the interface associated with
   the IPv4 address 10.0.0.1.  For these rules, let us apply a policy
   that accepts all traffic except for packets that arrive from a host
   with an IPv4 address of "10.6.6.6".  To achieve this policy, we would
   follow these steps:

   First, we need to create the rules to institute this policy.  To
   accomplish this, first we have to create the filter for the host.  We
   could do this using the following row insertion into the
   spdIpHeaderFilterTable table:

   SpdIpHeaderFilterEntry(spdIpHeadFiltName = "10.6.6.6")
         = (spdIpHeadFiltType            = 0x80,        -- sourceAddress
            spdIpHeadFiltIPVersion       = 1,           -- IPv4
            spdIpHeadFiltSrcAddressBegin = 0x0a060606,
            spdIpHeadFiltSrcAddressEnd   = 0x0a060606,
            spdIpHeadFiltRowStatus       = 4)           -- createAndGo

   Next, we need to bind this filter to an action of "drop" in a new
   rule.  We can do this as follows:

   spdRuleDefinitionEntry(spdRuleDefName = "drop from 10.6.6.6")
         = (spdRuleDefFilter             =
                   spdIpHeadFiltType.8.49.48.46.54.46.54.46.54,
            spdRuleDefAction             = spdDropAction.0,
            spdRuleDefRowStatus          = 4)           -- createAndGo

   We also need a rule to accept all other packets:

   spdRuleDefinitionEntry(spdRuleDefName = "accept all")
         = (spdRuleDefFilter             = spdTrueFilter.0,
            spdRuleDefAction             = spdAcceptAction.0,
            spdRuleDefRowStatus          = 4)           -- createAndGo

   Now, we need to put these two rules into a group.  We will put the
   "accept all" rule at the very end (i.e.  assign it the highest
   priority number), so it is matched last.  Then, at an earlier
   priority (1000), we will insert the "drop from 10.6.6.6" rule.  We
   will do this by putting the rules into the group "incoming". "ingress".

   SpdGroupContentsEntry(spdGroupContName     = "incoming", "ingress",
                         spdGroupContPriority = 65535)
        = (spdGroupContComponentName          = "accept all",
           spdGroupContRowStatus              = 5) 4)      -- createAndGo

   SpdGroupContentsEntry(spdGroupContName     = "incoming", "ingress",
                         spdGroupContPriority = 1000)
        = (spdGroupContComponentName          = "drop from 10.6.6.6",
           spdGroupContRowStatus              = 5) 4)      -- createAndGo

   Finally, we apply this group of rules to our interface:

   SpdEndpointToGroupEntry(spdEndGroupDirection = 1,    -- incoming ingress
                           spdEndGroupIdentType = 4,    -- IPv4
                           spdEndGroupAddress   = 0x0a000001)

        = (spdEndGroupName = "incoming", "ingress",
           spdEndGroupRowStatus = 5) 4)                    -- createAndGo
   This completes the necessary steps to implement the policy.  Once all
   of these rules have been applied, our policy should take effect.

5.  MIB definition

   IPSEC-SPD-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Integer32,
       mib-2                        FROM SNMPv2-SMI
                                           --rfc2578

       TEXTUAL-CONVENTION, RowStatus, TruthValue,
       TimeStamp, StorageType, VariablePointer, DateAndTime
                                           FROM SNMPv2-TC
                                           --rfc2579

       MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP
                                           FROM SNMPv2-CONF
                                           --rfc2580

       SnmpAdminString                     FROM SNMP-FRAMEWORK-MIB
                                           --rfc3411

       InetAddressType, InetAddress, InetPortNumber InetAddress
                                           FROM INET-ADDRESS-MIB
                                           --rfc3291

       diffServMIBMultiFieldClfrGroup, IfDirection,
       diffServMultiFieldClfrNextFree
                                           FROM DIFFSERV-MIB
                                           --rfc3289

       ;

   --
   -- module identity
   --

   spdMIB MODULE-IDENTITY
       LAST-UPDATED "200212100000Z" "200502170000Z"            -- 12 December 2002 17 January 2005
       ORGANIZATION "IETF IP Security Policy Working Group"
       CONTACT-INFO "Michael Baer
                     Sparta, Inc.
                     Phone: +1 530 902 3131
                     Email: baerm@tislabs.com
                     Ricky Charlet
                     Email: rcharlet@alumni.calpoly.edu

                     Wes Hardaker
                     Sparta, Inc.
                     P.O. Box 382
                     Davis, CA  95617
                     Phone: +1 530 792 1913
                     Email: hardaker@tislabs.com

                     Robert Story
                     Revelstone Software
                     PO Box 1812
                     Tucker, GA 30085
                     Phone: +1 770 617 3722
                     Email: ipsp-mib@revelstone.com

                     Cliff Wang
                     SmartPipes Inc.
                     Suite 300, 565 Metro Place South
                     Dublin, OH 43017
                     Phone: +1 614 923 6241
                     E-Mail: cliffwang2000@yahoo.com"
       DESCRIPTION
        "This MIB module defines configuration objects for managing
         IPsec Security Policy. Policies.

         Copyright (C) The Internet Society (2003). (2005). This version of
         this MIB module is part of RFC XXXX, ZZZZ, see the RFC itself for
         full legal notices."

   -- Revision History

       REVISION     "200401070000Z"     "200502170000Z"            -- 7 17 January 2004 2005
       DESCRIPTION  "Initial version, published as RFC xxxx." ZZZZ."
       -- RFC-editor assigns xxxx ZZZZ

   -- XXX: xxx: To be assigned by IANA
       ::= { mib-2 xxx }

   --
   -- groups of related objects
   --

   spdConfigObjects         OBJECT IDENTIFIER
        ::= { spdMIB 1 }
   spdNotificationObjects   OBJECT IDENTIFIER
        ::= { spdMIB 2 }
   spdConformanceObjects    OBJECT IDENTIFIER
        ::= { spdMIB 3 }
   spdActions                OBJECT IDENTIFIER
        ::= { spdMIB 4 }

   -- Note: the following subassignments have been used in other MIBs:
   -- IPSEC-IPSECACTION-MIB:
   --   ipsaMIB MODULE-IDENTITY ::= { spdActions 1 }
   -- IPSEC-IKEACTION-MIB: Textual Conventions
   --   ipiaMIB MODULE-IDENTITY ::= { spdActions 2 }

   --
   -- Textual Conventions
   --

   SpdBooleanOperator

   SpdBooleanOperator ::= TEXTUAL-CONVENTION
       STATUS   current
       DESCRIPTION
           "The SpdBooleanOperator operator is used to specify
            whether sub-components in a decision making process are
            ANDed or ORed together to decide if the resulting
            expression is true or false."
       SYNTAX      INTEGER { or(1), and(2) }

   SpdAdminStatus ::= TEXTUAL-CONVENTION
       STATUS   current
       DESCRIPTION
           "The SpdAdminStatus is used to specify the administrative
            status of an object. Objects which are disabled must not
            be used by the packet processing engine."
       SYNTAX      INTEGER { enabled(1), disabled(2) }

   SpdIPPacketLogging ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "d"
       STATUS   current
       DESCRIPTION
           "SpdIPPacketLogging specifies whether or not an audit
            message should be logged when a packet is passed through an
            SA. a
            Security Association (SA) and if some of that packet should
            be included in the log event.  A value of '-1' indicates no
            logging.  A value of '0' or greater indicates that logging
            should be done and how many bytes of the beginning of the
            packet to place in the log. Values greater than the size of
            the packet being processed indicate that the entire packet
            should be sent.

            Examples:
            '-1' no logging
            '0'  log but do not include any of the packet in the log
            '20' log and include the first 20 bytes of the packet
                 in the log."

       SYNTAX      Integer32 (-1..65535)
   --
   -- Policy group definitions
   --

   spdLocalConfigObjects OBJECT IDENTIFIER
        ::= { spdConfigObjects 1 }

   spdIncomingPolicyGroupName

   spdIngressPolicyGroupName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(0..32))
       MAX-ACCESS  read-write
       STATUS      current
       DESCRIPTION
           "This object indicates the policy group containing the
            global system policy that is to be applied on incoming ingress
            packets (I.E., arriving at a interface) when a given
            endpoint does not contain a policy definition in the
            spdEndpointToGroupTable.  Its value can be used as an index
            into the spdGroupContentsTable to retrieve a list of
            policies.  A zero length string indicates no system wide
            policy exits and the default policy of 'accept' 'drop' should be
            executed for incoming ingress packets until one is imposed by either
            this object or by the endpoint processing a given packet."
       ::= { spdLocalConfigObjects 1 }

   spdOutgoingPolicyGroupName

   spdEgressPolicyGroupName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(0..32))
       MAX-ACCESS  read-write
       STATUS      current
       DESCRIPTION
           "This object indicates the policy group containing the
            global system policy that is to be applied on outgoing egress
            packets (I.E., leaving an interface) when a given endpoint
            does not contain a policy definition in the
            spdEndpointToGroupTable.  Its value can be used as an index
            into the spdGroupContentsTable to retrieve a list of
            policies.  A zero length string indicates no system wide
            policy exits and the default policy of 'accept' 'drop' should be
            executed for outgoing egress packets until one is imposed by either
            this object or by the endpoint processing a given packet."
       ::= { spdLocalConfigObjects 2 }

   spdEndpointToGroupTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdEndpointToGroupEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table is used to map policy (groupings) onto an
            endpoint where traffic is to pass by.  Any policy group
            assigned to an endpoint is then used to control access
            to the traffic passing by it.

            If an endpoint has been configured with a policy group
            and no contained rule matches the incoming ingress packet, the
            default action in this case shall be to drop the packet.

            If no policy group has been assigned to an endpoint,
            then the policy group specified by
            spdSystemPolicyGroupName should be used for the
            endpoint."
       ::= { spdConfigObjects 2 }

   spdEndpointToGroupEntry OBJECT-TYPE
       SYNTAX      SpdEndpointToGroupEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A mapping assigning a policy group to an endpoint."
       INDEX { spdEndGroupDirection, spdEndGroupIdentType,
              spdEndGroupAddress }
       ::= { spdEndpointToGroupTable 1 }

   SpdEndpointToGroupEntry ::= SEQUENCE {
       spdEndGroupDirection                      INTEGER,                      IfDirection,
       spdEndGroupIdentType                      InetAddressType,
       spdEndGroupAddress                        InetAddress,
       spdEndGroupName                           SnmpAdminString,
       spdEndGroupLastChanged                    TimeStamp,
       spdEndGroupStorageType                    StorageType,
       spdEndGroupRowStatus                      RowStatus
   }

   spdEndGroupDirection OBJECT-TYPE
       SYNTAX      INTEGER { incoming(1), outgoing(2) }      IfDirection
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The
           "This object indicates which direction of the packet packets crossing
            the interface.  As
            packets arrive interface should be associated with which
            spdEndGroupName object.  Ingress packets, or leave an interface, the appropriate
            policy is applied according to packets into
            the direction it device match when this value is
            traveling: into inbound(1).  Egress
            packets or packets out of the device." device match when this value
            is outbound(2)."
       ::= { spdEndpointToGroupEntry 1 }

   spdEndGroupIdentType OBJECT-TYPE
       SYNTAX      InetAddressType
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The Internet Protocol version of the address associated
            with a given endpoint.  All addresses are represented as an
            array of octets in network byte order.  When combined with
            the spdEndGroupAddress these objects can be used to
            uniquely identify an endpoint that a set of policy groups
            should be applied to.  Devices supporting IPv4 MUST support
            the ipv4 value, and devices supporting IPv6 MUST support
            the ipv6 value.

            Values of unknown, ipv4z, ipv6z and dns are not legal
            values for this object."
       ::= { spdEndpointToGroupEntry 2 }

   spdEndGroupAddress OBJECT-TYPE
       SYNTAX      InetAddress (SIZE (4|16))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The address of a given endpoint, the format of which is
            specified by the spdEndGroupIdentType object." object.

            Note: Since spdEndGroupIdentType currently only allows IPv4
            and IPv6 address this value should be either 4 or 16 octets
            long.  But Implementors should be aware that if the size of
            spdEndGroupAddress ever exceeds 115 octets, column instance
            OIDs in this table will have more than 128 sub-identifiers
            and will be unaccessible using SNMPv1, SNMPv2c, or SNMPv3."
       ::= { spdEndpointToGroupEntry 3 }

   spdEndGroupName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The policy group name to apply to this endpoint.  The
            value of the spdEndGroupName object should then be used
            as an index into the spdGroupContentsTable to come up
            with a list of rules that MUST be applied to this
            endpoint."
       ::= { spdEndpointToGroupEntry 4 }

   spdEndGroupLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdEndpointToGroupEntry 5 }

   spdEndGroupStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent." permanent.

            For a storage type of permanent, none of the columns have
            to be writable."
       DEFVAL { nonVolatile }
       ::= { spdEndpointToGroupEntry 6 }

   spdEndGroupRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this row.

            The value of this object has no effect on whether other
            objects in this conceptual row can be modified.

            This object is considered 'notReady' and may not be set to
            active until one or more active rows exist within the
            spdGroupContentsTable for the group referenced by the
            spdEndGroupName object."
       ::= { spdEndpointToGroupEntry 7 }

   --
   -- policy group definition table
   --

   spdGroupContentsTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdGroupContentsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table contains a list of rules and/or subgroups
            contained within a given policy group.  The entries are
            sorted by the spdGroupContPriority object and MUST be
            executed in order according to this value, starting with
            the lowest value.  Once a group item has been processed,
            the processor MUST stop processing this packet if an action
            was executed as a result of the processing of a given
            group.  Iterating into the next policy group item by
            finding the next largest spdGroupContPriority object shall
            only be done if no actions were run when processing the
            last item for a given packet."
       ::= { spdConfigObjects 3 }

   spdGroupContentsEntry OBJECT-TYPE
       SYNTAX      SpdGroupContentsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines a given sub-component within a policy group." group.  A
            sub-component is either a rule or another group as
            indicated by spdGroupContCompontentType and referenced by
            spdGroupContCompontentName."
       INDEX   { spdGroupContName, spdGroupContPriority }
       ::= { spdGroupContentsTable 1 }

   SpdGroupContentsEntry ::= SEQUENCE {
       spdGroupContName                        SnmpAdminString,
       spdGroupContPriority                    Integer32,
       spdGroupContFilter                      VariablePointer,
       spdGroupContComponentType               INTEGER,
       spdGroupContComponentName               SnmpAdminString,
       spdGroupContLastChanged                 TimeStamp,
       spdGroupContStorageType                 StorageType,
       spdGroupContRowStatus                   RowStatus
   }

   spdGroupContName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The administrative name of this group."
       ::= { spdGroupContentsEntry 1 }

   spdGroupContPriority OBJECT-TYPE
       SYNTAX      Integer32 (0..65535)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The priority (sequence number) of the sub-component in
            this group."
       ::= { spdGroupContentsEntry 2 }

   spdGroupContFilter OBJECT-TYPE
       SYNTAX      VariablePointer
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "spdGroupContFilter points to a filter which is evaluated
            to determine whether the sub-component spdGroupContComponentName within
            this group row should be exercised.  Managers can use this object
            to classify groups of rules or subgroups together in order
            to achieve a greater degree of control and optimization
            over the execution order of the items within the group.  If
            the filter evaluates to false, the rule or subgroup will be
            skipped and the next rule or subgroup will be evaluated
            instead.

            An example usage of this object would be to limit a
            group of rules to executing only when the IP packet
            being process is designated to be processed by IKE.
            This effecitevly effectively creates a group of IKE specific rules.

            This MIB defines the following tables and scalars which
            may be pointed to by this column.  Implementations may
            choose to provide support for other filter tables or
            scalars as well:

                   spdIpHeaderFilterTable

                   diffServMultiFieldClfrTable
                   spdIpOffsetFilterTable
                   spdTimeFilterTable
                   spdCompoundFilterTable
                   spdTrueFilter

            If this column is set to a VariablePointer value which
            references a non-existent row in an otherwise supported
            table, the inconsistentName exception should be
            returned.  If the table or scalar pointed to by the
            VariablePointer is not supported at all, then an
            inconsistentValue exception should be returned."
       DEFVAL { spdTrueFilterInstance }
       ::= { spdGroupContentsEntry 3 }

   spdGroupContComponentType OBJECT-TYPE
       SYNTAX      INTEGER { reserved(0), group(1), rule(2) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Indicates whether the spdGroupContComponentName object
            is the name of another group defined within the
            spdGroupContentsTable or is the name of a rule defined
            within the spdRuleDefinitionTable."
       DEFVAL { rule }
       ::= { spdGroupContentsEntry 4 }

   spdGroupContComponentName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The name of the policy rule or subgroup contained within
            this group, as indicated by the spdGroupContComponentType
            object."
       ::= { spdGroupContentsEntry 5 }

   spdGroupContLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdGroupContentsEntry 6 }

   spdGroupContStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent." permanent.

            For a storage type of permanent, none of the columns have
            to be writable."
       DEFVAL { nonVolatile }
       ::= { spdGroupContentsEntry 7 }

   spdGroupContRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this row.

            The value of this object has no effect on whether other
            objects in this conceptual row can be modified.

            This object may not be set to active until the row to
            which the spdGroupContComponentName points to exists."
       ::= { spdGroupContentsEntry 8 }

   --
   -- policy definition table
   --

   spdRuleDefinitionTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdRuleDefinitionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table defines a policy rule by associating a filter
            or a set of filters to an action to be executed."
       ::= { spdConfigObjects 4 }

   spdRuleDefinitionEntry OBJECT-TYPE
       SYNTAX      SpdRuleDefinitionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A row defining a particular policy definition.  A rule
            definition binds a filter pointer to an action pointer."
       INDEX   { spdRuleDefName }
       ::= { spdRuleDefinitionTable 1 }

   SpdRuleDefinitionEntry ::= SEQUENCE {
       spdRuleDefName                          SnmpAdminString,
       spdRuleDefDescription                   SnmpAdminString,
       spdRuleDefFilter                        VariablePointer,
       spdRuleDefFilterNegated                 TruthValue,
       spdRuleDefAction                        VariablePointer,
       spdRuleDefAdminStatus                   SpdAdminStatus,
       spdRuleDefLastChanged                   TimeStamp,
       spdRuleDefStorageType                   StorageType,
       spdRuleDefRowStatus                     RowStatus
   }

   spdRuleDefName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "spdRuleDefName is the administratively assigned name of
            the rule referred to by the spdGroupContComponentName
            object."
       ::= { spdRuleDefinitionEntry 1 }

   spdRuleDefDescription OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "A user definable defined string.  This field may be used for
            your
            administrative tracking purposes."
       DEFVAL { "" }
       ::= { spdRuleDefinitionEntry 2 }

   spdRuleDefFilter OBJECT-TYPE
       SYNTAX      VariablePointer
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "spdRuleDefFilter points to a filter which is used to
            evaluate whether the action associated with this row should
            be fired or not.  The action will only fire if the filter
            referenced by this object evaluates to TRUE after first
            applying any negation required by the
            spdRuleDefFilterNegated object.

            This MIB defines the following tables and scalars which
            may be pointed to by this column.  Implementations may
            choose to provide support for other filter tables or
            scalars as well:

                   spdIpHeaderFilterTable

                   diffServMultiFieldClfrTable
                   spdIpOffsetFilterTable
                   spdTimeFilterTable
                   spdCompoundFilterTable
                   spdTrueFilter

            If this column is set to a VariablePointer value which
            references a non-existent row in an otherwise supported
            table, the inconsistentName exception should be returned.
            If the table or scalar pointed to by the VariablePointer is
            not supported at all, then an inconsistentValue exception
            should be returned."
       ::= { spdRuleDefinitionEntry 3 }

   spdRuleDefFilterNegated OBJECT-TYPE
       SYNTAX      TruthValue
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "spdRuleDefFilterNegated specifies whether the filter
            referenced by the spdRuleDefFilter object should be
            negated or not."
       DEFVAL { false }
       ::= { spdRuleDefinitionEntry 4 }

   spdRuleDefAction OBJECT-TYPE
       SYNTAX      VariablePointer
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This column points to the action to be taken.  It may,
            but is not limited to, point to a row in one of the
            following tables:

               spdCompoundActionTable
               spdSaPreconfiguredActionTable
               spdIkeActionTable
               spdIpsecActionTable
               ipsaSaPreconfiguredActionTable
               ipiaIkeActionTable
               ipiaIpsecActionTable

            It may also point to one of the scalar objects beneath
            spdStaticActions.

            If this object is set to a pointer to a row in an
            unsupported (or unknown) table, an inconsistentValue
            error should be returned.

            If this object is set to point to a non-existent row in
            an otherwise supported table, an inconsistentName error
            should be returned."
       ::= { spdRuleDefinitionEntry 5 }

   spdRuleDefAdminStatus OBJECT-TYPE
       SYNTAX      SpdAdminStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Indicates whether the current rule definition should be
            considered active.  If enabled, it should be evaluated
            when processing packets.  If disabled, packets should
            continue to be processed by the rest of the rules
            defined in the spdGroupContentsTable as if this rule's
            filters had effectively failed."
       DEFVAL { enabled }
       ::= { spdRuleDefinitionEntry 6 }
   spdRuleDefLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdRuleDefinitionEntry 7 }

   spdRuleDefStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent." permanent.

            For a storage type of permanent, none of the columns have
            to be writable."
       DEFVAL { nonVolatile }
       ::= { spdRuleDefinitionEntry 8 }

   spdRuleDefRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this row.

            The value of this object has no effect on whether other
            objects in this conceptual row can be modified.

            This object may not be set to active until the
            containing contitions, filters and actions have been
            defined.  Once active, it must remain active until no
            policyGroupContents entries are referencing it."
       ::= { spdRuleDefinitionEntry 9 }

   --
   -- Policy compound filter definition table
   --

   spdCompoundFilterTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdCompoundFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A table defining a compound set of filters and their
            associated parameters.  A row in this table can either
            be pointed to by a spdRuleDefFilter object or by a
            ficSubFilter object."
       ::= { spdConfigObjects 5 }

   spdCompoundFilterEntry OBJECT-TYPE
       SYNTAX      SpdCompoundFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "An entry in the spdCompoundFilterTable.  A filter
            defined by this table is considered to have a TRUE
            return value if and only if:

              spdCompFiltLogicType is AND and all of the sub-filters
              associated with it, as defined in the spdSubfiltersTable,
              are all true themselves (after applying any requried required
              negation as defined by the ficFilterIsNegated object).

              spdCompFiltLogicType is OR and at least one of the
              sub-filters associated with it, as defined in the
              spdSubfiltersTable, is true itself (after applying any
              requried
              required negation as defined by the ficFilterIsNegated
              object)."
              object."
       INDEX       { spdCompFiltName }
       ::= { spdCompoundFilterTable 1 }

   SpdCompoundFilterEntry ::= SEQUENCE {
       spdCompFiltName                          SnmpAdminString,
       spdCompFiltDescription                   SnmpAdminString,
       spdCompFiltLogicType                     SpdBooleanOperator,
       spdCompFiltLastChanged                   TimeStamp,
       spdCompFiltStorageType                   StorageType,
       spdCompFiltRowStatus                     RowStatus
   }

   spdCompFiltName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A user definable string.  You may use this field for
            your administrative tracking purposes."
       ::= { spdCompoundFilterEntry 1 }

   spdCompFiltDescription OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "A user definable string.  You may use this field for
            your administrative tracking purposes."
       DEFVAL { ''H "" }
       ::= { spdCompoundFilterEntry 2 }

   spdCompFiltLogicType OBJECT-TYPE
       SYNTAX      SpdBooleanOperator
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Indicates whether the filters contained within this
            filter are functionally ANDed or ORed together."
       DEFVAL { and }
       ::= { spdCompoundFilterEntry 3 }

   spdCompFiltLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdCompoundFilterEntry 4 }

   spdCompFiltStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent." permanent.

            For a storage type of permanent, none of the columns have
            to be writable."
       DEFVAL { nonVolatile }
       ::= { spdCompoundFilterEntry 5 }

   spdCompFiltRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this row.

            The value of this object has no effect on whether other
            objects in this conceptual row can be modified.

            Once active, it may not have its value changed if any
            active rows in the spdRuleDefinitionTable are currently
            pointing at this row."
       ::= { spdCompoundFilterEntry 6 }

   --
   -- Policy filters in a cf table
   --

   spdSubfiltersTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdSubfiltersEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table defines a list of filters contained within a
            given compound filter set defined in the
            spdCompoundFilterTable."
       ::= { spdConfigObjects 6 }

   spdSubfiltersEntry OBJECT-TYPE
       SYNTAX      SpdSubfiltersEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "An entry into the list of filters for a given compound
            filter."
       INDEX       {  spdCompFiltName, spdSubFiltPriority }
       ::= { spdSubfiltersTable 1 }

   SpdSubfiltersEntry ::= SEQUENCE {
       spdSubFiltPriority                      Integer32,
       spdSubFiltSubfilter                     VariablePointer,
       spdSubFiltSubfilterIsNegated            TruthValue,
       spdSubFiltLastChanged                   TimeStamp,
       spdSubFiltStorageType                   StorageType,
       spdSubFiltRowStatus                     RowStatus
   }

   spdSubFiltPriority OBJECT-TYPE
       SYNTAX      Integer32 (0..65535)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The priority of a given filter within a condition.
            Implementations MAY choose to follow the ordering
            indicated by the manager that created the rows in order
            to allow the manager to intelligently construct filter
            lists such that faster filters are evaluated first."
       ::= { spdSubfiltersEntry 1 }

   spdSubFiltSubfilter OBJECT-TYPE
       SYNTAX      VariablePointer
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The location of the contained filter.  The value of this
            column should be a VariablePointer which references the
            properties for the filter to be included in this compound
            filter.

            This MIB defines the following tables and scalars which
            may be pointed to by this column.  Implementations may
            choose to provide support for other filter tables or
            scalars as well:

                   spdIpHeaderFilterTable

                   diffServMultiFieldClfrTable
                   spdIpsoHeaderFilterTable
                   spdIpOffsetFilterTable
                   spdTimeFilterTable
                   spdCompoundFilterTable
                   spdTrueFilter

            If this column is set to a VariablePointer value which
            references a non-existent row in an otherwise supported
            table, the inconsistentName exception should be
            returned.  If the table or scalar pointed to by the
            VariablePointer is not supported at all, then an
            inconsistentValue exception should be returned."
       ::= { spdSubfiltersEntry 2 }

   spdSubFiltSubfilterIsNegated OBJECT-TYPE
       SYNTAX      TruthValue
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Indicates whether the result of applying this subfilter
            should be negated or not."
       DEFVAL { false }
       ::= { spdSubfiltersEntry 3 }
   spdSubFiltLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdSubfiltersEntry 4 }

   spdSubFiltStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent." permanent.

            For a storage type of permanent, none of the columns have
            to be writable."
       DEFVAL { nonVolatile }
       ::= { spdSubfiltersEntry 5 }

   spdSubFiltRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this row.

            The value of this object has no effect on whether other
            objects in this conceptual row can be modified.

            This object can not be made active until the filter
            referenced by the ficSubFilter object is both defined
            and is active.  An attempt to do so will result in an
            inconsistentValue error."
       ::= { spdSubfiltersEntry 6 }

   --
   -- Static Filters
   --

   spdStaticFilters OBJECT IDENTIFIER ::= { spdConfigObjects 7 }
   spdTrueFilter OBJECT-TYPE
           SYNTAX      Integer32
           MAX-ACCESS  read-only
           STATUS      current
           DESCRIPTION
               "This scalar indicates a (automatic) true result for
                a filter.  I.e. error.

            If active, this is a filter object must remain active unless one of the
            following two conditions are met.  An attempt to set it to
            anything other than active while the following conditions
            are not met will result in an inconsistentValue error.  The
            two conditions are:

            I.  No active row in the SpdCompoundFilterTable exists
                which has a matching spdCompFiltName.
            II. Or at least one other active row in this table has a
                matching spdCompFiltName."
       ::= { spdSubfiltersEntry 6 }

   --
   -- Static Filters
   --

   spdStaticFilters OBJECT IDENTIFIER ::= { spdConfigObjects 7 }

   spdTrueFilter OBJECT-TYPE
           SYNTAX      Integer32
           MAX-ACCESS  read-only
           STATUS      current
           DESCRIPTION
               "This scalar indicates a (automatic) true result for
                a filter.  I.e. this is a filter that is always
                true, useful for adding as a default filter for a
                default action or a set of actions."
           ::= { spdStaticFilters 1 }

   spdTrueFilterInstance OBJECT IDENTIFIER ::= { spdTrueFilter 0 }

   --
   -- Policy IPHeader IP Offset filter definition table
   --

   spdIpHeaderFilterTable

   spdIpOffsetFilterTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdIpHeaderFilterEntry SpdIpOffsetFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table contains a list of filter definitions to be
            used within the spdRuleDefinitionTable or the
            spdSubfilterTable table."
            spdSubfiltersTable."
       ::= { spdConfigObjects 8 }

   spdIpHeaderFilterEntry

   spdIpOffsetFilterEntry OBJECT-TYPE
       SYNTAX      SpdIpHeaderFilterEntry      SpdIpOffsetFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A definition of a particular filter."
       INDEX       {  spdIpHeadFiltName  spdIpOffFiltName }
       ::= { spdIpHeaderFilterTable spdIpOffsetFilterTable 1 }

   SpdIpHeaderFilterEntry

   SpdIpOffsetFilterEntry ::= SEQUENCE {
       spdIpHeadFiltName
       spdIpOffFiltName                         SnmpAdminString,
       spdIpHeadFiltType                       BITS,
       spdIpHeadFiltIPVersion                  InetAddressType,
       spdIpHeadFiltSrcAddressBegin            InetAddress,
       spdIpHeadFiltSrcAddressEnd              InetAddress,
       spdIpHeadFiltDstAddressBegin            InetAddress,
       spdIpHeadFiltDstAddressEnd              InetAddress,
       spdIpHeadFiltSrcLowPort                 InetPortNumber,
       spdIpHeadFiltSrcHighPort                InetPortNumber,
       spdIpHeadFiltDstLowPort                 InetPortNumber,
       spdIpHeadFiltDstHighPort                InetPortNumber,
       spdIpHeadFiltProtocol                   Integer32,
       spdIpHeadFiltIPv6FlowLabel
       spdIpOffFiltOffset                       Integer32,
       spdIpHeadFiltLastChanged
       spdIpOffFiltType                         INTEGER,
       spdIpOffFiltValue                        OCTET STRING,
       spdIpOffFiltLastChanged                  TimeStamp,
       spdIpHeadFiltStorageType
       spdIpOffFiltStorageType                  StorageType,
       spdIpHeadFiltRowStatus
       spdIpOffFiltRowStatus                    RowStatus
   }

   spdIpHeadFiltName

   spdIpOffFiltName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The administrative name for this filter."
       ::= { spdIpHeaderFilterEntry spdIpOffsetFilterEntry 1 }

   spdIpHeadFiltType

   spdIpOffFiltOffset OBJECT-TYPE
       SYNTAX      BITS      Integer32 (0..65535)
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This is the byte offset from the front of the IP packet
            where the value or arithmetic comparison is done.  A
            value of '0' indicates the first byte in the packet."
       ::= { sourceAddress(0), destinationAddress(1),
                          sourcePort(2), destinationPort(3),
                          protocol(4), ipv6FlowLabel(5) spdIpOffsetFilterEntry 2 }

   spdIpOffFiltType OBJECT-TYPE
       SYNTAX INTEGER { equal(1),
                        notEqual(2),
                        arithmeticLess(3),
                        arithmeticGreaterOrEqual(4),
                        arithmeticGreater(5),
                        arithmeticLessOrEqual(6) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This defines the various tests that are used when
            evaluating a given filter.  The results of each test are
            ANDed together to produce the result of the entire
            filter.  When processing this filter, it is recommended
            for efficiency reasons that the filter halt processing
            the instant any of the specified tests fail.

            Once a row is 'active', this object's value may not be
            changed unless all the appropriate columns needed by the
            new value to be imposed on this object have column, spdIpOffFiltValue, has been
            appropriately configured.

            The various tests definable in this table are as follows:

            sourceAddress:

            equal:
              - Tests if the source address OCTET STRING, 'spdIpOffFiltValue', matches
                a value in the packet lies
                between starting at the spdIpHeadFiltSrcAddressBegin given offset in
                the packet and
                spdIpHeadFiltSrcAddressEnd objects.

                Note that setting these two objects comparing the entire OCTET STRING of
                'spdIpOffFiltValue'.  Any numeric values compared this
                way are assumed to be unsigned integer values in
                network byte order of the same
                address will limit the search to length as
                'spdIpOffFiltValue'.

            notEqual:
              - Tests if the exact OCTET STRING, 'spdIpOffFiltValue', does
                not match of a single address.  The format and length of value in the
                address objects are defined by packet starting at the
                spdIpHeadFiltIPVersion column.

                A row given
                offset in this table containing a spdIpHeadFiltType
                object with the sourceAddress object bit but without the spdIpHeadFiltIPVersion,
                spdIpHeadFiltSrcAddressBegin packet and
                spdIpHeadFiltSrcAddressEnd objects set will cause comparing to the spdIpHeadFiltRowStatus object entire OCTET
                STRING of 'spdIpOffFiltValue'.  Any numeric values
                compared this way are assumed to return be unsigned integer
                values in network byte order of the
                notReady state.

            destinationAddress: same length as
                'spdIpOffFiltValue'.

            arithmeticLess:
              - Tests if the destination address OCTET STRING, 'spdIpOffFiltValue', is
                arithmetically less than ('<') the value starting at
                the given offset within the packet.  The value in the
                packet lies
                between the spdIpHeadFiltDstAddressBegin and
                spdIpHeadFiltDstAddressEnd objects.  Note that
                setting these two objects is assumed to be an unsigned integer in network
                byte order of the same address will
                limit length as 'spdIpOffFiltValue'.

            arithmeticGreaterOrEqual:
              - Tests if the search OCTET STRING, 'spdIpOffFiltValue', is
                arithmetically greater than or equal to ('>=') the exact match of a single
                address.  The format and length of
                value starting at the address
                objects are defined by given offset within the spdIpHeadFiltIPVersion
                column.

                A row packet.
                The value in this table containing a spdIpHeadFiltType
                object with the destinationAddress object bit but
                without the spdIpHeadFiltIPVersion,
                spdIpHeadFiltDstAddressBegin and

                spdIpHeadFiltDstAddressEnd objects set will cause the spdIpHeadFiltRowStatus object packet is assumed to return be an unsigned
                integer in network byte order of the
                notReady state.

            sourcePort: same length as
                'spdIpOffFiltValue'.

            arithmeticGreater:
              - Tests if the source port of IP packets using a
                protocol that uses port numbers (at this time, UDP
                or TCP) lies between the spdIpHeadFiltSrcLowPort and
                spdIpHeadFiltSrcHighPort objects.  Note that setting
                these two objects to OCTET STRING, 'spdIpOffFiltValue', is
                arithmetically greater than ('>') the same address will limit value starting at
                the
                search to given offset within the exact match of a single port.

                A row packet.  The value in this table containing a spdIpHeadFiltType
                object with the sourcePort object bit but without
                the spdIpHeadFiltSrcLowPort, and
                spdIpHeadFiltSrcHighPort objects set will cause the
                spdIpHeadFiltRowStatus object
                packet is assumed to return the notReady
                state.

            destinationPort:
              - Tests if the source port be an unsigned integer in network
                byte order of IP packets using a
                protocol that uses port numbers (at this time, UDP
                or TCP) lies between the spdIpHeadFiltDstLowPort and
                spdIpHeadFiltDstHighPort objects.  Note that setting
                these two objects to the same address will limit the
                search to the exact match of a single port.

                A row in this table containing a spdIpHeadFiltType
                object with the sourcePort object bit but without
                the spdIpHeadFiltDstLowPort, and
                spdIpHeadFiltDstHighPort objects set will cause the
                spdIpHeadFiltRowStatus object to return the notReady
                state.

            protocol: length as 'spdIpOffFiltValue'.

            arithmeticLessOrEqual:
              - Tests to see if the packet being processed OCTET STRING, 'spdIpOffFiltValue', is for
                the given protocol type.

                A row in this table containing a spdIpHeadFiltType
                object with the protocol object bit but without the
                spdIpHeadFiltProtocol object set will cause the
                spdIpHeadFiltRowStatus object
                arithmetically less than or equal to return ('<=') the notReady
                state.

            ipv6FlowLabel:
              - Tests to see if value
                starting at the packet being processed contains
                an ipv6 Flow Label which matches given offset within the packet.  The
                value in the
             ipfIPv6FlowLabel object.  Setting this bit mandates
             that for the packet is assumed to match the filter, it must be an IPv6 packet.

                A row unsigned
                integer in this table containing a spdIpHeadFiltType
                object with the ipv6FlowLabel object bit but without
                the ipfIPv6FlowLabel object set will cause the
                spdIpHeadFiltRowStatus object to return network byte order of the notReady
                state." same length as
                'spdIpOffFiltValue'."

       ::= { spdIpHeaderFilterEntry 2 spdIpOffsetFilterEntry 3 }

   spdIpHeadFiltIPVersion
   spdIpOffFiltValue OBJECT-TYPE
       SYNTAX      InetAddressType      OCTET STRING (SIZE(0..1024))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The Internet Protocol version the addresses are to
           "spdIpOffFiltValue is used for match
            against.  The value of this property determines the size
            and format of the spdIpHeadFiltSrcAddressBegin,
            spdIpHeadFiltSrcAddressEnd,
            spdIpHeadFiltDstAddressBegin, and
            spdIpHeadFiltDstAddressEnd objects.

            Values of unknown, ipv4z, ipv6z and dns are not legal
            values for this object."
       DEFVAL  { ipv6 }
       ::= { spdIpHeaderFilterEntry 3 }

   spdIpHeadFiltSrcAddressBegin OBJECT-TYPE
       SYNTAX      InetAddress
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The starting address comparisons of a source address range that the
            packet must match against for this filter to be
            considered TRUE. at spdIpOffFiltOffset.  This object is only used
            if sourceAddress one of the match types is set chosen in
            spdIpHeadFiltType."
            spdIpOffFiltType."
       ::= { spdIpHeaderFilterEntry spdIpOffsetFilterEntry 4 }

   spdIpHeadFiltSrcAddressEnd

   spdIpOffFiltLastChanged OBJECT-TYPE
       SYNTAX      InetAddress      TimeStamp
       MAX-ACCESS  read-create  read-only
       STATUS      current
       DESCRIPTION
           "The ending address value of a source address range to check a
            packet against, where the starting is specified by the
            spdIpHeadFiltSrcAddressBegin object.  Set sysUpTime when this column to
            the same value as the spdIpHeadFiltSrcAddressBegin
            column to get an exact single address match.

            This object is only used if sourceAddress is set in
            spdIpHeadFiltType." row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdIpHeaderFilterEntry spdIpOffsetFilterEntry 5 }

   spdIpHeadFiltDstAddressBegin

   spdIpOffFiltStorageType OBJECT-TYPE
       SYNTAX      InetAddress      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The starting address storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent.

            For a destination address range that storage type of permanent, none of the packet must match against for this filter columns have
            to be
            considered TRUE.

            This object is only used if destinationAddress is set in
            spdIpHeadFiltType." writable."
       DEFVAL { nonVolatile }
       ::= { spdIpHeaderFilterEntry spdIpOffsetFilterEntry 6 }

   spdIpHeadFiltDstAddressEnd

   spdIpOffFiltRowStatus OBJECT-TYPE
       SYNTAX      InetAddress      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The ending address of a destination address range to
            check a packet against, where the first is specified by
           "This object indicates the spdIpHeadFiltDstAddressBegin object.  Set conceptual status of this
            column row.

            This object may not be set to active if the same value as requirements
            of the
            spdIpHeadFiltDstAddressBegin column to get an exact
            single address match.

            This spdIpOffFiltType object is only used are not met.  In other
            words, if destinationAddress is the associated value columns needed by a
            particular test have not been set, then attempting to
            change this row to an active state will result in an
            inconsistentValue error.  See the spdIpOffFiltType
            object description for further details.

            If active, this object must remain active if it is
            referenced by an active row in another table.  An attempt
            to set it to anything other than active while it is
            referenced by an active row in another table will result in
            spdIpHeadFiltType."
            an inconsistentValue error."
       ::= { spdIpHeaderFilterEntry spdIpOffsetFilterEntry 7 }

   spdIpHeadFiltSrcLowPort

   --
   -- Time/scheduling filter table
   --

   spdTimeFilterTable OBJECT-TYPE
       SYNTAX      InetPortNumber      SEQUENCE OF SpdTimeFilterEntry
       MAX-ACCESS  read-create  not-accessible
       STATUS      current
       DESCRIPTION
           "The low port of the port range
           "Defines a packet's source must
            match against.  To match, the port number must table of filters which can be
            greater than or equal to this value.

            This object is only used if sourcePort is set in
            spdIpHeadFiltType.

            The value of 0 for this object is illegal." to
            effectively enable or disable policies based on a valid
            time range."
       ::= { spdIpHeaderFilterEntry 8 spdConfigObjects 9 }

   spdIpHeadFiltSrcHighPort

   spdTimeFilterEntry OBJECT-TYPE
       SYNTAX      InetPortNumber      SpdTimeFilterEntry
       MAX-ACCESS  read-create  not-accessible
       STATUS      current
       DESCRIPTION
           "The high port of the port range
           "A row describing a packet's source must
            match against.  To match, the port number must given time frame for which a policy
            may be less
            than or equal filtered on to this value.

            This object is only used if sourcePort is set in
            spdIpHeadFiltType.

            The value of 0 place the rule active or
            inactive."
       INDEX   { spdTimeFiltName }
       ::= { spdTimeFilterTable 1 }

   SpdTimeFilterEntry ::= SEQUENCE {
       spdTimeFiltName                 SnmpAdminString,
       spdTimeFiltPeriodStart          DateAndTime,
       spdTimeFiltPeriodEnd            DateAndTime,
       spdTimeFiltMonthOfYearMask      BITS,
       spdTimeFiltDayOfMonthMask       OCTET STRING,
       spdTimeFiltDayOfWeekMask        BITS,
       spdTimeFiltStartTimeOfDayMask   DateAndTime,
       spdTimeFiltStopTimeOfDayMask    DateAndTime,
       spdTimeFiltLastChanged          TimeStamp,
       spdTimeFiltStorageType          StorageType,
       spdTimeFiltRowStatus            RowStatus
   }

   spdTimeFiltName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "An administratively assigned name for this object is illegal." filter."
       ::= { spdIpHeaderFilterEntry 9 spdTimeFilterEntry 1 }

   spdIpHeadFiltDstLowPort

   spdTimeFiltPeriodStart OBJECT-TYPE
       SYNTAX      InetPortNumber      DateAndTime
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The low port of the port range a packet's destination
            must match against.  To match, the port number must be
            greater than or equal starting time period for this filter.  In addition
            to a normal DateAndTime string, this value.

            This object is only used if destinationPort is may be set in
            spdIpHeadFiltType.

            The
            to the OCTET STRING value of 0 for this object THISANDPRIOR which indicates
            that the filter is illegal." valid from any time before now up
            until (at least) now."
       DEFVAL { '00000101000000002b0000'H }
       ::= { spdIpHeaderFilterEntry 10 spdTimeFilterEntry 2 }

   spdIpHeadFiltDstHighPort

   spdTimeFiltPeriodEnd OBJECT-TYPE
       SYNTAX      InetPortNumber      DateAndTime
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The high port of the port range a packet's destination
            must match against.  To match, the port number must be
            less than or equal ending time period for this filter.  In addition to
            a normal DateAndTime string, this value.

            This object is only used if destinationPort is may be set in
            spdIpHeadFiltType.

            The to
            the OCTET STRING value of 0 for this object THISANDFUTURE which indicates
            that the filter is illegal." valid without an ending date and/or
            time."
       DEFVAL { '99991231235959092b0000'H }
       ::= { spdIpHeaderFilterEntry 11 spdTimeFilterEntry 3 }

   spdIpHeadFiltProtocol

   spdTimeFiltMonthOfYearMask OBJECT-TYPE
       SYNTAX      Integer32 (0..255)      BITS { january(0), february(1), march(2),
                          april(3), may(4), june(5), july(6),
                          august(7), september(8), october(9),
                          november(10), december(11) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The protocol number
           "A bit mask which overlays the incoming packet must match
            against for this filter spdTimeFiltPeriodStart to be evaluated as true.

            This object is only used if protocol is
            spdTimeFiltPeriodEnd date range to further restrict the
            time period to a restricted set in
            spdIpHeadFiltType." of months of the year."
       DEFVAL { { january, february, march, april, may, june, july,
                  august, september, october, november, december } }
       ::= { spdIpHeaderFilterEntry 12 spdTimeFilterEntry 4 }

   spdIpHeadFiltIPv6FlowLabel

   spdTimeFiltDayOfMonthMask OBJECT-TYPE
       SYNTAX      Integer32 (0..1048575)      OCTET STRING (SIZE(4))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
          "The IPv6 Flow Label that
           "Defines which days of the packet must match against.

           This object month this time period is only used if ipv6FlowLabel
            valid for.  It is set in
           spdIpHeadFiltType."
       ::= { spdIpHeaderFilterEntry 13 }

   spdIpHeadFiltLastChanged a sequence of 32 BITS, where each BIT
            represents a corresponding day of the month starting
            from the left most bit being equal to the first day of
            the month.  The last bit in the string MUST be zero."
       DEFVAL { 'fffffffe'H }
       ::= { spdTimeFilterEntry 5 }

   spdTimeFiltDayOfWeekMask OBJECT-TYPE
       SYNTAX      BITS { monday(0), tuesday(1), wednesday(2),
                          thursday(3), friday(4), saturday(5),
                          sunday(6) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "A bit mask which overlays the spdTimeFiltPeriodStart to
            spdTimeFiltPeriodEnd date range to further restrict the
            time period to a restricted set of days within a given
            week."
       DEFVAL { { monday, tuesday, wednesday, thursday, friday,
                  saturday, sunday } }
       ::= { spdTimeFilterEntry 6 }

   spdTimeFiltStartTimeOfDayMask OBJECT-TYPE
       SYNTAX      DateAndTime
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Indicates the starting time of day for which this filter
            evaluates to true.  The date portions of the DateAndTime
            TC are ignored for purposes of evaluating this mask and
            only the time specific portions are used."
       DEFVAL { '00000000000000002b0000'H }
       ::= { spdTimeFilterEntry 7 }

   spdTimeFiltStopTimeOfDayMask OBJECT-TYPE
       SYNTAX      DateAndTime
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Indicates the ending time of day for which this filter
            evaluates to true.  The date portions of the DateAndTime TC
            are ignored for purposes of evaluating this mask and only
            the time specific portions are used.  If this starting and
            ending time values indicated by the
            spdTimeFiltStartTimeOfDayMask and
            spdTimeFiltStopTimeOfDayMask objects are equal, the filter
            is expected to be evaluated over the entire 24 hour
            period."
       DEFVAL { '00000000000000002b0000'H }
       ::= { spdTimeFilterEntry 8 }

   spdTimeFiltLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdIpHeaderFilterEntry 14 spdTimeFilterEntry 9 }

   spdIpHeadFiltStorageType

   spdTimeFiltStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent."
       DEFVAL { nonVolatile }
       ::= { spdIpHeaderFilterEntry 15 }

   spdIpHeadFiltRowStatus OBJECT-TYPE permanent.

            For a storage type of permanent, none of the columns have
            to be writable."
       DEFVAL { nonVolatile }
       ::= { spdTimeFilterEntry 10 }

   spdTimeFiltRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this
            row.

            This

            If active, this object may not be set to must remain active if the requirements
            of the spdIpHeadFiltType object are not met.  In other
            words, if the associated value columns needed it is
            referenced by a
            particular test have not been set, then attempting to
            change this an active row in another table.  An attempt
            to set it to anything other than active while it is
            referenced by an active state row in another table will result in
            an inconsistentValue error.  See the spdIpHeadFiltType
            object description for further details." error."
       ::= { spdIpHeaderFilterEntry 16 spdTimeFilterEntry 11 }

   --
   -- Policy IP Offset filter definition table IPSO protection authority filtering
   --

   spdIpOffsetFilterTable

   spdIpsoHeaderFilterTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdIpOffsetFilterEntry SpdIpsoHeaderFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table contains a list of IPSO header filter
            definitions to be used within the spdRuleDefinitionTable or
            the
            spdSubfilterTable." spdSubfiltersTable.  IPSO headers and their values are
            described in RFC1108."
       ::= { spdConfigObjects 9 10 }

   spdIpOffsetFilterEntry

   spdIpsoHeaderFilterEntry OBJECT-TYPE
       SYNTAX      SpdIpOffsetFilterEntry      SpdIpsoHeaderFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A definition of a particular filter."
       INDEX       {  spdIpOffFiltName  spdIpsoHeadFiltName }
       ::= { spdIpOffsetFilterTable spdIpsoHeaderFilterTable 1 }

   SpdIpOffsetFilterEntry

   SpdIpsoHeaderFilterEntry ::= SEQUENCE {
       spdIpOffFiltName
       spdIpsoHeadFiltName                     SnmpAdminString,
       spdIpOffFiltOffset                       Integer32,
       spdIpOffFiltType
       spdIpsoHeadFiltType                     BITS,
       spdIpsoHeadFiltClassification           INTEGER,
       spdIpOffFiltValue                        OCTET STRING,
       spdIpOffFiltLastChanged
       spdIpsoHeadFiltProtectionAuth           INTEGER,
       spdIpsoHeadFiltLastChanged              TimeStamp,
       spdIpOffFiltStorageType
       spdIpsoHeadFiltStorageType              StorageType,
       spdIpOffFiltRowStatus
       spdIpsoHeadFiltRowStatus                RowStatus
   }

   spdIpOffFiltName

   spdIpsoHeadFiltName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The administrative name for this filter."
       ::= { spdIpOffsetFilterEntry spdIpsoHeaderFilterEntry 1 }

   spdIpOffFiltOffset

   spdIpsoHeadFiltType OBJECT-TYPE
       SYNTAX      Integer32 (0..65535)      BITS { classificationLevel(0),
                          protectionAuthority(1) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This is the byte offset from the front of the IP packet
            where
           "The IPSO header fields to match the value or arithmetic comparison is done.  A
            value of '0' indicates the first byte in the packet." against."
       ::= { spdIpOffsetFilterEntry spdIpsoHeaderFilterEntry 2 }

   spdIpOffFiltType

   spdIpsoHeadFiltClassification OBJECT-TYPE
       SYNTAX      INTEGER { equal(1),
                        notEqual(2),
                        arithmeticLess(3),
                        arithmeticGreaterOrEqual(4),
                        arithmeticGreater(5),
                        arithmeticLessOrEqual(6) topSecret(61), secret(90),
                             confidential(150), unclassified(171) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This defines
           "The IPSO classification header field value must match
            the various tests that are used when
            evaluating a given filter.

            Once a row is 'active', this object's value may not be
            changed unless in this column if the column, spdIpOffFiltValue, has been
            appropriately configured.

            The various tests definable classificationLevel bit
            is set in this table the spdIpsoHeadFiltType field.

            The values of these enumerations are as follows:

            equal:
              - Tests if defined by
            RFC1108."
       ::= { spdIpsoHeaderFilterEntry 3 }

   spdIpsoHeadFiltProtectionAuth OBJECT-TYPE
       SYNTAX      INTEGER { genser(0), siopesi(1), sci(2),
                             nsa(3), doe(4) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The IPSO protection authority header field value must
            match the OCTET STRING, 'spdIpOffFiltValue', matches
                a value in this column if the packet starting at the given offset protection authority
            bit is set in the packet and comparing the entire OCTET STRING of
                'spdIpOffFiltValue'.  Any numeric values compared this
                way are assumed to be unsigned integer spdIpsoHeadFiltType field.

            The values in
                network byte order of these enumerations are defined by RFC1108.
            Hence the same length as
                'spdIpOffFiltValue'.

            notEqual:
              - Tests if reason the OCTET STRING, 'spdIpOffFiltValue', does SMIv2 convention of not match a value in the packet starting at the given
                offset using 0 in the packet and comparing to the entire OCTET
                STRING
            enum lists is violated here."
       ::= { spdIpsoHeaderFilterEntry 4 }

   spdIpsoHeadFiltLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of 'spdIpOffFiltValue'.  Any numeric values
                compared sysUpTime when this way are assumed to be unsigned integer
                values row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdIpsoHeaderFilterEntry 5 }

   spdIpsoHeadFiltStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in network byte order this table which
            were created through an external process may have a storage
            type of readOnly or permanent.

            For a storage type of permanent, none of the same length as
                'spdIpOffFiltValue'.

            arithmeticLess:
              - Tests if the OCTET STRING, 'spdIpOffFiltValue', is
                arithmetically less than ('<') the value starting at
                the given offset within the packet.  The value in the
                packet is assumed to be an unsigned integer in network
                byte order of the same length as 'spdIpOffFiltValue'.

            arithmeticGreaterOrEqual:
              - Tests if the OCTET STRING, 'spdIpOffFiltValue', is
                arithmetically greater than or equal to ('>=') the
                value starting at the given offset within the packet.
                The value in the packet is assumed to be an unsigned
                integer in network byte order of the same length as
                'spdIpOffFiltValue'.

            arithmeticGreater:
              - Tests if the OCTET STRING, 'spdIpOffFiltValue', is
                arithmetically greater than ('>') the value starting at
                the given offset within the packet.  The value in the
                packet is assumed to be an unsigned integer in network
                byte order of the same length as 'spdIpOffFiltValue'.

            arithmeticLessOrEqual:
              - Tests if the OCTET STRING, 'spdIpOffFiltValue', is
                arithmetically less than or equal to ('<=') the value
                starting at the given offset within the packet.  The
                value in the packet is assumed columns have
            to be an unsigned
                integer in network byte order of the same length as
                'spdIpOffFiltValue'." writable."
       DEFVAL { nonVolatile }
       ::= { spdIpOffsetFilterEntry 3 spdIpsoHeaderFilterEntry 6 }

   spdIpOffFiltValue

   spdIpsoHeadFiltRowStatus OBJECT-TYPE
       SYNTAX      OCTET STRING (SIZE(0..1024))      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "spdIpOffFiltValue is used for match comparisons
           "This object indicates the conceptual status of a
            packet at spdIpOffFiltOffset. this row.

            This object is only used may not be set to active if one of the match types is chosen in
            spdIpOffFiltType."
       ::= { spdIpOffsetFilterEntry 4 }

   spdIpOffFiltLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdIpOffsetFilterEntry 5 }

   spdIpOffFiltStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent."
       DEFVAL { nonVolatile }
       ::= { spdIpOffsetFilterEntry 6 }

   spdIpOffFiltRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this row.

            This object may not be set to active if the requirements requirements of
            the spdIpOffFiltType spdIpsoHeadFiltType object are not met.  In other
            words, if the associated value columns needed by a
            particular test have not been set, then attempting to
            change this row to an active state will result in an
            inconsistentValue error.  See the spdIpOffFiltType spdIpsoHeadFiltType
            object description for further details." details.

            If active, this object must remain active if it is
            referenced by an active row in another table.  An attempt
            to set it to anything other than active while it is
            referenced by an active row in another table will result in
            an inconsistentValue error."
       ::= { spdIpOffsetFilterEntry spdIpsoHeaderFilterEntry 7 }

   --
   -- Time/scheduling filter compound actions table
   --

   spdTimeFilterTable

   spdCompoundActionTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdTimeFilterEntry SpdCompoundActionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "Defines a table of filters which can be
           "Table used to
            effectively enable or disable policies based on allow multiple actions to be associated
            with a valid
            time range." rule.  It uses the spdSubactionsTable to do
            this."
       ::= { spdConfigObjects 10 11 }

   spdTimeFilterEntry
   spdCompoundActionEntry OBJECT-TYPE
       SYNTAX      SpdTimeFilterEntry      SpdCompoundActionEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A row describing a given time frame for which a policy
            may be filtered on to place in the rule active or
            inactive." spdCompoundActionTable."
       INDEX   { spdTimeFiltName spdCompActName }
       ::= { spdTimeFilterTable spdCompoundActionTable 1 }

   SpdTimeFilterEntry

   SpdCompoundActionEntry ::= SEQUENCE {
       spdTimeFiltName
       spdCompActName                      SnmpAdminString,
       spdTimeFiltPeriodStart          DateAndTime,
       spdTimeFiltPeriodEnd            DateAndTime,
       spdTimeFiltMonthOfYearMask      BITS,
       spdTimeFiltDayOfMonthMask       OCTET STRING,
       spdTimeFiltDayOfWeekMask        BITS,
       spdTimeFiltTimeOfDayMaskStart   DateAndTime,
       spdTimeFiltTimeOfDayMaskEnd     DateAndTime,
       spdTimeFiltLastChanged
       spdCompActExecutionStrategy         INTEGER,
       spdCompActLastChanged               TimeStamp,
       spdTimeFiltStorageType
       spdCompActStorageType               StorageType,
       spdTimeFiltRowStatus
       spdCompActRowStatus                 RowStatus
   }

   spdTimeFiltName

   spdCompActName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "An
           "This is an administratively assigned name for of this filter."
            compound action."
       ::= { spdTimeFilterEntry spdCompoundActionEntry 1 }

   spdTimeFiltPeriodStart

   spdCompActExecutionStrategy OBJECT-TYPE
       SYNTAX      DateAndTime      INTEGER { doAll(1),
                             doUntilSuccess(2),
                             doUntilFailure(3) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The starting time period for this filter.  In addition
            to a normal DateAndTime string, this
           "This object may be set
            to indicates how the OCTET STRING value THISANDPRIOR sub-actions are executed
            based on the success of the actions as they finish
            executing.

            doAll           - run each sub-action regardless of the
                              exit status of the previous action.
                              This parent action is always
                              considered to have acted successfully.

            doUntilSuccess  - run each sub-action until one succeeds,
                              at which indicates
            that point stop processing the filter
                              sub-actions within this parent
                              compound action.  If one of the
                              sub-actions did execute successfully,
                              this parent action is valid from any time before now up also considered
                              to have executed sucessfully.

            doUntilFailure  - run each sub-action until (at least) now." one fails,
                              at which point stop processing the
                              sub-actions within this compound
                              action.  If any sub-action fails, the
                              result of this parent action is
                              considered to have failed."
       DEFVAL { '00000101000000002b0000'H doUntilSuccess }
       ::= { spdTimeFilterEntry spdCompoundActionEntry 2 }

   spdTimeFiltPeriodEnd

   spdCompActLastChanged OBJECT-TYPE
       SYNTAX      DateAndTime      TimeStamp
       MAX-ACCESS  read-create  read-only
       STATUS      current
       DESCRIPTION
           "The ending time period for this filter.  In addition to
            a normal DateAndTime string, this object may be set to
            the OCTET STRING value THISANDFUTURE which indicates
            that the filter is valid without an ending date and/or
            time."
       DEFVAL { '99991231235959092b0000'H } of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdTimeFilterEntry spdCompoundActionEntry 3 }

   spdTimeFiltMonthOfYearMask

   spdCompActStorageType OBJECT-TYPE
       SYNTAX      BITS { january(0), february(1), march(2),
                          april(3), may(4), june(5), july(6),
                       august(7), september(8), october(9),
                       november(10), december(11) }      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "A bit mask
           "The storage type for this row.  Rows in this table which overlays the spdTimeFiltPeriodStart to
            spdTimeFiltPeriodEnd date range to further restrict the
            time period to
            were created through an external process may have a restricted set
            storage type of months readOnly or permanent.

            For a storage type of permanent, none of the year." columns have
            to be writable."
       DEFVAL { { january, february, march, april, may, june, july,
                  august, september, october, november, december } nonVolatile }
       ::= { spdTimeFilterEntry spdCompoundActionEntry 4 }

   spdTimeFiltDayOfMonthMask

   spdCompActRowStatus OBJECT-TYPE
       SYNTAX      OCTET STRING (SIZE(4))      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Defines which days of
           "This object indicates the month conceptual status of this time period is
            valid for.  It is a sequence row.

            The value of 32 BITS, where each BIT
            represents this object has no effect on whether other
            objects in this conceptual row can be modified.

            Once a corresponding day of the month starting
            from row in the left most bit being equal spdCompoundActionTable has been made
            active, this object may not be set to the destroy without
            first day of destroying all the month.  The last bit contained rows listed in the string MUST be zero."
       DEFVAL { 'fffffffe'H }
            spdSubactionsTable."
       ::= { spdTimeFilterEntry spdCompoundActionEntry 5 }

   spdTimeFiltDayOfWeekMask

   --
   -- actions contained within a compound action
   --

   spdSubactionsTable OBJECT-TYPE
       SYNTAX      BITS { monday(0), tuesday(1), wednesday(2),
                          thursday(3), friday(4), saturday(5),
                          sunday(6) }      SEQUENCE OF SpdSubactionsEntry
       MAX-ACCESS  read-create  not-accessible
       STATUS      current
       DESCRIPTION
           "A bit mask which overlays the spdTimeFiltPeriodStart to
            spdTimeFiltPeriodEnd date range to further restrict the
            time period to
           "This table contains a restricted set list of days the sub-actions within a
            given
            week."
       DEFVAL { { monday, tuesday, wednesday, thursday, friday,
                  saturday, sunday } } compound action.  Compound actions executing these
            actions MUST execute them in series based on the
            spdSubActPriority value, with the lowest value executing
            first."
       ::= { spdTimeFilterEntry 6 spdConfigObjects 12 }

   spdTimeFiltTimeOfDayMaskStart

   spdSubactionsEntry OBJECT-TYPE
       SYNTAX      DateAndTime      SpdSubactionsEntry
       MAX-ACCESS  read-create  not-accessible
       STATUS      current
       DESCRIPTION
           "Indicates the starting time of day for which this filter
            evaluates
           "A row containing a reference to true.  The date portions a given compound-action
            sub-action."
       INDEX   { spdCompActName, spdSubActPriority }
       ::= { spdSubactionsTable 1 }

   SpdSubactionsEntry ::= SEQUENCE {
       spdSubActPriority                          Integer32,
       spdSubActSubActionName                     VariablePointer,
       spdSubActLastChanged                       TimeStamp,
       spdSubActStorageType                       StorageType,
       spdSubActRowStatus                         RowStatus
   }

   spdSubActPriority OBJECT-TYPE
       SYNTAX      Integer32 (0..65535)
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The priority of the DateAndTime
            TC a given sub-action within a compound
            action.  The order in which sub-actions should be
            executed are ignored for purposes of evaluating based on the value from this mask and
            only column, with
            the time specific portions are used."
       DEFVAL { '00000000000000002b0000'H } lowest numeric value executing first."
       ::= { spdTimeFilterEntry 7 spdSubactionsEntry 1 }
   spdTimeFiltTimeOfDayMaskEnd
   spdSubActSubActionName OBJECT-TYPE
       SYNTAX      DateAndTime      VariablePointer
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "Indicates
           "This column points to the ending time of day for which this filter
            evaluates action to true.  The date portions be taken.  It may,
            but is not limited to, point to a row in one of the DateAndTime
            TC are ignored for purposes
            following tables:

               spdCompoundActionTable          - Allowing recursion
               ipsaSaPreconfiguredActionTable
               ipiaIkeActionTable
               ipiaIpsecActionTable

            It may also point to one of evaluating this mask and
            only the time specific portions are used. scalar objects beneath
            spdStaticActions.

            If this
            starting and ending time values indicated by the
            spdTimeFiltTimeOfDayMaskStart and
            spdTimeFiltTimeOfDayMaskEnd objects are equal, the
            filter object is expected set to a pointer to a row in an
            unsupported (or unknown) table, an inconsistentValue
            error should be evaluated over the entire 24
            hour period."
       DEFVAL { '00000000000000002b0000'H } returned.

            If this object is set to point to a non-existent row in
            an otherwise supported table, an inconsistentName error
            should be returned."
       ::= { spdTimeFilterEntry 8 spdSubactionsEntry 2 }

   spdTimeFiltLastChanged

   spdSubActLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdTimeFilterEntry 9 spdSubactionsEntry 3 }

   spdTimeFiltStorageType

   spdSubActStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type of readOnly or permanent." permanent.

            For a storage type of permanent, none of the columns have
            to be writable."
       DEFVAL { nonVolatile }
       ::= { spdTimeFilterEntry 10 spdSubactionsEntry 4 }

   spdTimeFiltRowStatus

   spdSubActRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this
            row." row.

            The value of this object has no effect on whether other
            objects in this conceptual row can be modified.

            If active, this object must remain active unless one of the
            following two conditions are met.  An attempt to set it to
            anything other than active while the following conditions
            are not met will result in an inconsistentValue error.  The
            two conditions are:

            I.  No active row in the spdCompoundActionTable exists
                which has a matching spdCompActName.

            II. Or at least one other active row in this table has a
                matching spdCompActName."
       ::= { spdTimeFilterEntry 11 spdSubactionsEntry 5 }

   --
   -- IPSO protection authority filtering Static Actions
   --

   spdIpsoHeaderFilterTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdIpsoHeaderFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table contains a list of IPSO header filter
            definitions to

   -- these are static actions which can be used within pointed to by the spdRuleDefinitionTable
   -- spdRuleDefAction or the spdSubfilterTable.  IPSO headers and their values
            are described in RFC1108." spdSubActSubActionName objects to
   -- drop, accept or reject packets.

   spdStaticActions OBJECT IDENTIFIER ::= { spdConfigObjects 11 13 }

   spdIpsoHeaderFilterEntry

   spdDropAction    OBJECT-TYPE
       SYNTAX      SpdIpsoHeaderFilterEntry      Integer32
       MAX-ACCESS  not-accessible  read-only
       STATUS      current
       DESCRIPTION
           "A definition of
           "This scalar indicates that a particular filter."
       INDEX       {  spdIpsoHeadFiltName }
       ::= { spdIpsoHeaderFilterTable packet should be dropped
            WITHOUT action/packet logging.  This object returns a
            value of 1 }

   SpdIpsoHeaderFilterEntry for IPsec policy implementations that support
            the drop static action."
       ::= SEQUENCE {
       spdIpsoHeadFiltName                     SnmpAdminString,
       spdIpsoHeadFiltType                     BITS,
       spdIpsoHeadFiltClassification           INTEGER,
       spdIpsoHeadFiltProtectionAuth           INTEGER,
       spdIpsoHeadFiltLastChanged              TimeStamp,
       spdIpsoHeadFiltStorageType              StorageType,
       spdIpsoHeadFiltRowStatus                RowStatus spdStaticActions 1 }

   spdIpsoHeadFiltName

   spdDropActionLog OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))      Integer32
       MAX-ACCESS  not-accessible  read-only
       STATUS      current
       DESCRIPTION
           "The administrative name for this filter."
       ::= { spdIpsoHeaderFilterEntry 1 }

   spdIpsoHeadFiltType OBJECT-TYPE
       SYNTAX      BITS { classificationLevel(0),
                          protectionAuthority(1) }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The IPSO header fields to match the
           "This scalar indicates that a packet should be dropped
            WITH action/packet logging.  This object returns a value against."
            of 1 for IPsec policy implementations that support the
            drop static action with logging."
       ::= { spdIpsoHeaderFilterEntry spdStaticActions 2 }

   spdIpsoHeadFiltClassification

   spdAcceptAction OBJECT-TYPE
       SYNTAX      INTEGER { topSecret(61), secret(90),
                             confidential(150), unclassified(171) }      Integer32
       MAX-ACCESS  read-create  read-only
       STATUS      current
       DESCRIPTION
           "The IPSO classification header field value must match
            the
           "This Scalar indicates that a packet should be accepted
            (pass-through) WITHOUT action/packet logging.  This
            object returns a value in this column if the classificationLevel bit
            is set in the spdIpsoHeadFiltType field.

            The values of these enumerations are defined by
            RFC1108." 1 for IPsec policy
            implementations that support the accept static action."
       ::= { spdIpsoHeaderFilterEntry spdStaticActions 3 }

   spdIpsoHeadFiltProtectionAuth

   spdAcceptActionLog OBJECT-TYPE
       SYNTAX      INTEGER { genser(0), siopesi(1), sci(2),
                             nsa(3), doe(4) }      Integer32
       MAX-ACCESS  read-create  read-only
       STATUS      current
       DESCRIPTION
           "The IPSO protection authority header field value must
            match the
           "This scalar indicates that a packet should be accepted
            (pass-through) WITH action/packet logging.  This object
            returns a value in this column if the protection
            authority bit is set in the spdIpsoHeadFiltType field.

            The values of these enumerations are defined by RFC1108.
            Hence the reason 1 for IPsec policy implementations
            that support the SMIv2 convention of not using 0 in
            enum lists is violated here." accept static action with logging."
       ::= { spdIpsoHeaderFilterEntry spdStaticActions 4 }

   spdIpsoHeadFiltLastChanged

   --
   --
   -- Notification objects information
   --
   --

   spdNotificationVariables OBJECT IDENTIFIER ::=
      { spdNotificationObjects 1 }

   spdNotifications OBJECT IDENTIFIER ::=
      { spdNotificationObjects 0 }

   spdActionExecuted OBJECT-TYPE
       SYNTAX      TimeStamp      VariablePointer
       MAX-ACCESS  read-only  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
           "Points to the action instance that was executed that
            resulted in the notification being sent."
       ::= { spdIpsoHeaderFilterEntry 5 spdNotificationVariables 1 }

   spdIpsoHeadFiltStorageType

   spdIPEndpointAddType OBJECT-TYPE
       SYNTAX      StorageType      InetAddressType
       MAX-ACCESS  read-create  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "The storage
           "Contains the interface type for this row.  Rows in this table the interface that the
            packet which
            were created through an external process may have a
            storage type of readOnly or permanent."
       DEFVAL { nonVolatile } triggered the notification is passing
            through."
       ::= { spdIpsoHeaderFilterEntry 6 spdNotificationVariables 2 }

   spdIpsoHeadFiltRowStatus

   spdIPEndpointAddress OBJECT-TYPE
       SYNTAX      RowStatus      InetAddress
       MAX-ACCESS  read-create  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of this row.

            This object may not be set to active if
           "Contains the requirements
            of interface address for the spdIpsoHeadFiltType object are not met.  In other
            words, if interface that
            the associated value columns needed by a
            particular test have not been set, then attempting to
            change this row to an active state will result in an
            inconsistentValue error.  See packet which triggered the spdIpsoHeadFiltType
            object description for further details." notification is passing
            through."
       ::= { spdIpsoHeaderFilterEntry 7 spdNotificationVariables 3 }

   --
   -- compound actions table
   --

   spdCompoundActionTable

   spdIPSourceType OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdCompoundActionEntry      InetAddressType
       MAX-ACCESS  not-accessible  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "Table used to allow multiple actions to be associated
            with a rule.  It uses
           "Contains the spdSubactionsTable to do
            this." source address type of the packet which
            triggered the notification."
       ::= { spdConfigObjects 12 spdNotificationVariables 4 }

   spdCompoundActionEntry

   spdIPSourceAddress OBJECT-TYPE
       SYNTAX      SpdCompoundActionEntry      InetAddress
       MAX-ACCESS  not-accessible  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "A row in
           "Contains the spdCompoundActionTable."
       INDEX   { spdCompActName }
       ::= { spdCompoundActionTable 1 }

   SpdCompoundActionEntry source address of the packet which
            triggered the notification."
       ::= SEQUENCE {
       spdCompActName                      SnmpAdminString,
       spdCompActExecutionStrategy         INTEGER,
       spdCompActLastChanged               TimeStamp,
       spdCompActStorageType               StorageType,
       spdCompActRowStatus                 RowStatus spdNotificationVariables 5 }

   spdCompActName

   spdIPDestinationType OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))      InetAddressType
       MAX-ACCESS  not-accessible  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "This is an administratively assigned name
           "Contains the destination address type of this
            compound action." the packet
            which triggered the notification."
       ::= { spdCompoundActionEntry 1 spdNotificationVariables 6 }

   spdCompActExecutionStrategy

   spdIPDestinationAddress OBJECT-TYPE
       SYNTAX      INTEGER { reserved(0),
                             doAll(1),
                             doUntilSuccess(2),
                             doUntilFailure(3) }      InetAddress
       MAX-ACCESS  read-create  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "This object indicates how the sub-actions are executed
            based on the success of the actions as they finish
            executing.

            doAll           - run each sub-action regardless of the
                              exit status of the previous action.
                              This parent action is always
                              considered to have acted successfully.

            doUntilSuccess  - run each sub-action until one succeeds,
                              at which point stop processing
           "Contains the
                              sub-actions within this parent
                              compound action.  If one destination address of the
                              sub-actions did execute successfully,
                              this parent action is also considered
                              to have executed sucessfully.

            doUntilFailure  - run each sub-action until one fails,
                              at packet which point stop processing the
                              sub-actions within this compound
                              action.  If any sub-action fails,
            triggered the
                              result of this parent action is
                              considered to have failed."
       DEFVAL { doUntilSuccess } notification."
       ::= { spdCompoundActionEntry 2 spdNotificationVariables 7 }

   spdCompActLastChanged

   spdPacketDirection OBJECT-TYPE
       SYNTAX      TimeStamp      IfDirection
       MAX-ACCESS  read-only  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row
           "Indicates if the packet which triggered the action in
            questions was last modified
            or created either through SNMP SETs or by some other
            external means." ingress (inbound) our egress (outbound)."
       ::= { spdCompoundActionEntry 3 spdNotificationVariables 8 }

   spdCompActStorageType

   spdPacketPart OBJECT-TYPE
       SYNTAX      StorageType      OCTET STRING
       MAX-ACCESS  read-create  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "The storage type for this row.  Rows in this table which
            were created through an external process may have a
            storage type
           "Is the front part of readOnly or permanent."
       DEFVAL { nonVolatile }
       ::= { spdCompoundActionEntry 4 }

   spdCompActRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status of packet that triggered this row.
            notification.  The value initial size limit is determined by the
            smaller of this object has no effect on whether other
            objects in this conceptual row the size indicated by 'SpdIPPacketLogging' and
            the size of the triggering packet.

            The final limit is determined by the SNMP packet size when
            sending the notification.  The maximum size that can be modified.

            Once a row
            included will be the smaller of the initial size given
            above and the length that will fit in a single SNMP
            notification packet after the spdCompoundActionTable rest of the notification's
            objects and any other necessary packet data (headers
            encoding, etc...) has been made
            active, this object may not be set to destroy without
            first destroying all the contained rows listed included in the
            spdSubactionsTable." packet."
       ::= { spdCompoundActionEntry 5 spdNotificationVariables 9 }

   spdActionNotification NOTIFICATION-TYPE
       OBJECTS { spdActionExecuted, spdIPEndpointAddType,
                 spdIPEndpointAddress,
                 spdIPSourceType, spdIPSourceAddress,
                 spdIPDestinationType,
                 spdIPDestinationAddress,
                 spdPacketDirection }

   --
   -- actions contained within a compound action
   --

   spdSubactionsTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SpdSubactionsEntry
       MAX-ACCESS  not-accessible
       STATUS  current
       DESCRIPTION
           "This table contains
           "Notification that an action was executed by a list of rule.
            Only actions with logging enabled will result in this
            notification getting sent.  The objects sent must include
            the sub-actions spdActionExecuted object which will indicate which
            action was executed within a
            given compound the scope of the rule.
            Additionally the spdIPSourceType, spdIPSourceAddress,
            spdIPDestinationType, and spdIPDestinationAddress objects
            must be included to indicate the packet source and
            destination of the packet that triggered the action.  Compound actions executing these
            actions MUST execute them in series based on
            Finally the
            spdSubActPriority value, spdIPEndpointAddType, spdIPEndpointAddress,
            and spdPacketDirection objects are included to indicate
            which interface the action was executed in association with
            and if the lowest value executing
            first."
       ::= { spdConfigObjects 13 }

   spdSubactionsEntry OBJECT-TYPE
       SYNTAX      SpdSubactionsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A row containing a reference to packet was ingress or egress through the
            endpoint.

            Note that compound actions with multiple executed
            subactions may result in multiple notifications being sent
            from a given compound-action
            sub-action."
       INDEX   { spdCompActName, spdSubActPriority } single rule execution."
       ::= { spdSubactionsTable spdNotifications 1 }

   SpdSubactionsEntry ::= SEQUENCE

   spdPacketNotification NOTIFICATION-TYPE
       OBJECTS {
       spdSubActPriority                          Integer32,
       spdSubActSubActionName                     VariablePointer,
       spdSubActLastChanged                       TimeStamp,
       spdSubActStorageType                       StorageType,
       spdSubActRowStatus                         RowStatus spdActionExecuted, spdIPEndpointAddType,
                 spdIPEndpointAddress,
                 spdIPSourceType, spdIPSourceAddress,
                 spdIPDestinationType,
                 spdIPDestinationAddress,
                 spdPacketDirection,
                 spdPacketPart }

   spdSubActPriority OBJECT-TYPE
       SYNTAX      Integer32 (0..65535)
       MAX-ACCESS  not-accessible
       STATUS  current
       DESCRIPTION
           "The priority of a given sub-action within
           "Notification that a compound
            action.  The order packet passed through an SA.  Only
            SA's created by actions with packet logging enabled will
            result in this notification getting sent.  The objects
            sent must include the spdActionExecuted which sub-actions should be will
            indicate which action was executed are based on within the value from this column, with scope of
            the lowest numeric value executing first."
       ::= { spdSubactionsEntry 1 }

   spdSubActSubActionName OBJECT-TYPE
       SYNTAX      VariablePointer
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This column points to rule.  Additionally, the action to spdIPSourceType,
            spdIPSourceAddress, spdIPDestinationType, and
            spdIPDestinationAddress, objects must be taken.  It may,
            but is not limited to, point included to a row in one of
            indicate the
            following tables:

               spdCompoundActionTable          - Allowing recursion
               spdSaPreconfiguredActionTable
               spdIkeActionTable
               spdIpsecActionTable

            It may also point to one packet source and destination of the scalar packet
            that triggered the action.  The spdIPEndpointAddType,
            spdIPEndpointAddress, and spdPacketDirection objects beneath
            spdStaticActions.

            If this object is set to a pointer
            are included to a row in an
            unsupported (or unknown) table, an inconsistentValue
            error should be returned.

            If this object indicate which endpoint the packet was
            associated with.  Finally, spdPacketPart is set to point to a non-existent row in
            an otherwise supported table, an inconsistentName error
            should be returned."
       ::= { spdSubactionsEntry 2 }

   spdSubActLastChanged OBJECT-TYPE
       SYNTAX      TimeStamp
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
           "The value of sysUpTime when this row was last modified
            or created either through SNMP SETs or by some other
            external means."
       ::= { spdSubactionsEntry 3 }

   spdSubActStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type including
            for this row.  Rows in this table which
            were created through an external process may have sending a
            storage type variable sized part of readOnly or permanent."
       DEFVAL { nonVolatile }
       ::= { spdSubactionsEntry 4 }

   spdSubActRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the conceptual status front of this row.

            The the
            packet depending on the value of this object has no effect on whether other
            objects in this conceptual row can be modified." SpdIPPacketLogging."

       ::= { spdSubactionsEntry 5 spdNotifications 2 }
   --
   -- Static Actions
   --
   -- these are static actions which can be pointed to by the Conformance information
   -- spdRuleDefAction or the spdSubActSubActionName objects to
   -- drop, accept or reject packets.

   spdStaticActions

   spdCompliances OBJECT IDENTIFIER
       ::= { spdConfigObjects 14 spdConformanceObjects 1 }

   spdDropAction    OBJECT-TYPE
       SYNTAX      Integer32
       MAX-ACCESS  read-only
   spdGroups OBJECT IDENTIFIER
       ::= { spdConformanceObjects 2 }

   --
   -- Compliance statements
   --
   --
   spdRuleFilterCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "This scalar indicates
           "The compliance statement for SNMP entities that a packet should be dropped
            WITHOUT action/packet logging. include
            an IPsec MIB implementation with Endpoint, Rules, and
            filters support."
       MODULE -- This object returns a
            value of 1 Module
           MANDATORY-GROUPS { spdEndpointGroup,
                              spdGroupContentsGroup,
                              spdRuleDefinitionGroup,
                              spdStaticFilterGroup,
                              spdStaticActionGroup ,
                              diffServMIBMultiFieldClfrGroup }

           GROUP spdIpsecSystemPolicyNameGroup
           DESCRIPTION
               "This group is mandatory for IPsec policy Policy
                implementations that which support
            the drop static action."
       ::= { spdStaticActions 1 }

   spdDropActionLog OBJECT-TYPE
       SYNTAX      Integer32
       MAX-ACCESS  read-only
       STATUS      current a system policy group
                name."

           GROUP spdCompoundFilterGroup
           DESCRIPTION
               "This scalar indicates that a packet should be dropped
            WITH action/packet logging.  This object returns a value
            of 1 group is mandatory for IPsec policy Policy
                implementations that which support the
            drop static action with logging."
       ::= { spdStaticActions 2 }

   spdAcceptAction OBJECT-TYPE
       SYNTAX      Integer32
       MAX-ACCESS  read-only
       STATUS      current compound filters."

           GROUP spdIPOffsetFilterGroup
           DESCRIPTION
               "This Scalar indicates that a packet should group is mandatory for IPsec Policy
                implementations which support IP Offset filters.  In
                general, this SHOULD be accepted
            (pass-through) WITHOUT action/packet logging.  This
            object returns supported by a value of 1 compliant
                IPsec Policy implementation."

           GROUP spdTimeFilterGroup
           DESCRIPTION
               "This group is mandatory for IPsec policy Policy
                implementations that which support the accept static action."
       ::= { spdStaticActions 3 }

   spdAcceptActionLog OBJECT-TYPE
       SYNTAX      Integer32
       MAX-ACCESS  read-only
       STATUS      current time filters."

           GROUP spdIpsoHeaderFilterGroup
           DESCRIPTION
               "This scalar indicates that a packet should be accepted
            (pass-through) WITH action/packet logging.  This object
            returns a value of 1 group is mandatory for IPsec policy Policy
                implementations
            that which support the accept static action with logging."
       ::= { spdStaticActions 4 }
   --
   --
   -- Notification objects information
   --
   --

   spdNotificationVariables IPSO Header filters."

           GROUP  spdCompoundActionGroup
           DESCRIPTION
               "This group is mandatory for IPsec Policy
                implementations which support compound actions."

           OBJECT IDENTIFIER ::=
      { spdNotificationObjects 1 }

   spdNotifications      spdEndGroupLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT IDENTIFIER ::=      spdGroupContComponentType
           SYNTAX      INTEGER { spdNotificationObjects 0
                   rule(2)
           }

   spdActionExecuted OBJECT-TYPE
       SYNTAX      VariablePointer
       MAX-ACCESS  accessible-for-notify
       STATUS      current
           DESCRIPTION
           "Points to the action instance that was executed that
            resulted in
               "Support of the notification being sent." value group(1) is only required for
                implementations which support Policy Groups within
                Policy Groups."

           OBJECT      spdGroupContLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      spdRuleDefLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      spdCompFiltLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      spdSubFiltLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."
           OBJECT      spdIpOffFiltLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      spdTimeFiltLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      spdIpsoHeadFiltLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      spdCompActLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      spdSubActLastChanged
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object not required for compliance."

           OBJECT      diffServMultiFieldClfrNextFree
           MIN-ACCESS  not-accessible
           DESCRIPTION
                "This object is not required for compliance."

       ::= { spdNotificationVariables spdCompliances 1 }

   spdIPInterfaceType OBJECT-TYPE
       SYNTAX      InetAddressType
       MAX-ACCESS  accessible-for-notify

   spdLoggingCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "Contains the interface type
           "The compliance statement for the interface SNMP entities that the
            packet which triggered the notification in question is
            passing through." support
            sending notifications when actions are invoked."
       MODULE -- This Module
           MANDATORY-GROUPS { spdActionLoggingObjectGroup,
                              spdActionNotificationGroup }

       ::= { spdNotificationVariables spdCompliances 2 }

   spdIPInterfaceAddress OBJECT-TYPE
       SYNTAX      InetAddress
       MAX-ACCESS  accessible-for-notify

   --
   -- ReadOnly Compliances
   --
   spdRuleFilterReadOnlyCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "Contains the interface address
           "The compliance statement for the interface SNMP entities that
            the packet which triggered the notification include
            an IPsec MIB implementation with Endpoint, Rules, and
            filters support.

            If this MIB is implemented without support for read-create
            (i.e. in question read-only), it is passing through."
       ::= not in full compliance but it
            can claim read-only compliance. Such a device can then be
            monitored but can not be configured with this MIB."
       MODULE -- This Module
           MANDATORY-GROUPS { spdNotificationVariables 3 spdEndpointGroup,
                              spdGroupContentsGroup,
                              spdRuleDefinitionGroup,
                              spdStaticFilterGroup,
                              spdStaticActionGroup ,
                              diffServMIBMultiFieldClfrGroup }

   spdIPSourceType OBJECT-TYPE
       SYNTAX      InetAddressType
       MAX-ACCESS  accessible-for-notify
       STATUS      current

           GROUP spdIpsecSystemPolicyNameGroup
           DESCRIPTION
           "Contains the source address type of the packet
               "This group is mandatory for IPsec Policy
                implementations which
            triggered the notification in question."
       ::= { spdNotificationVariables 4 }

   spdIPSourceAddress OBJECT-TYPE
       SYNTAX      InetAddress
       MAX-ACCESS  accessible-for-notify
       STATUS      current support a system policy group
                name."

           GROUP spdCompoundFilterGroup
           DESCRIPTION
           "Contains the source address of the packet
               "This group is mandatory for IPsec Policy
                implementations which
            triggered the notification in question."
       ::= { spdNotificationVariables 5 }

   spdIPDestinationType OBJECT-TYPE
       SYNTAX      InetAddressType
       MAX-ACCESS  accessible-for-notify
       STATUS      current support compound filters."

           GROUP spdIPOffsetFilterGroup
           DESCRIPTION
           "Contains the destination address type of the packet
               "This group is mandatory for IPsec Policy
                implementations which triggered the notification in question."
       ::= { spdNotificationVariables 6 }

   spdIPDestinationAddress OBJECT-TYPE
       SYNTAX      InetAddress
       MAX-ACCESS  accessible-for-notify
       STATUS      current support IP Offset filters.  In
                general, this SHOULD be supported by a compliant
                IPsec Policy implementation."

           GROUP spdTimeFilterGroup
           DESCRIPTION
           "Contains the destination address of the packet
               "This group is mandatory for IPsec Policy
                implementations which
            triggered the notification in question."
       ::= { spdNotificationVariables 7 }

   spdPacketDirection OBJECT-TYPE
       SYNTAX      INTEGER { inbound(1), outbound(2) }
       MAX-ACCESS  accessible-for-notify
       STATUS      current
       DESCRIPTION
           "Indicates if the packet whic triggered the action in
            questions was inbound our outbound."
       ::= { spdNotificationVariables 8 }

   spdPacketPart OBJECT-TYPE
       SYNTAX      OCTET STRING
       MAX-ACCESS  accessible-for-notify
       STATUS      current support time filters."

           GROUP spdIpsoHeaderFilterGroup
           DESCRIPTION
           "Is the front part of the packet that triggered this
            notification.  The size
               "This group is determined by the value of
            'SpdIPPacketLogging' or the size of the packet,
            whichever mandatory for IPsec Policy
                implementations which support IPSO Header filters."

           GROUP  spdCompoundActionGroup
           DESCRIPTION
               "This group is smaller."
       ::= { spdNotificationVariables 9 }
   spdActionNotification NOTIFICATION-TYPE
       OBJECTS { spdActionExecuted, spdIPInterfaceType,
                 spdIPInterfaceAddress,
                 spdIPSourceType, spdIPSourceAddress,
                 spdIPDestinationType,
                 spdIPDestinationAddress,
                 spdPacketDirection }
       STATUS  current
       DESCRIPTION
           "Notification that an action was executed by a rule.
            Only actions with logging enabled will result in this
            notification getting sent.  The objects sent must
            include the spdActionExecuted object which will indicate
            which action was executed within the scope of the rule.
            Additionally the spdIPSourceType, spdIPSourceAddress,
            spdIPDestinationType, and spdIPDestinationAddress
            objects must be included to indicate the packet source
            and destination of the packet that triggered the action.
            Finally the spdIPInterfaceType, spdIPInterfaceAddress,
            and spdPacketDirection objects are included to indicate mandatory for IPsec Policy
                implementations which interface the action was executed in association
            with and if the packet was inbound or outbond through
            the endpoint.

            Note that support compound actions with multiple executed
            subactions may result in multiple notifications being
            sent from a single rule execution."
       ::= { spdNotifications 1 }

   spdPacketNotification NOTIFICATION-TYPE
       OBJECTS { spdActionExecuted, spdIPInterfaceType,
                 spdIPInterfaceAddress,
                 spdIPSourceType, spdIPSourceAddress,
                 spdIPDestinationType,
                 spdIPDestinationAddress,
                 spdPacketDirection,
                 spdPacketPart }
       STATUS  current actions."

           OBJECT       spdAcceptAction
           MIN-ACCESS   read-only
           DESCRIPTION
           "Notification that a packet passed through an SA.  Only
            SA's created by actions with packet logging enabled will
            result in this notification getting sent.  The objects
            sent must include the spdActionExecuted which will
            indicate which action was executed within the scope of
            the rule.  Additionally, the spdIPSourceType,
            spdIPSourceAddress, spdIPDestinationType, and
            spdIPDestinationAddress, objects must be included to
            indicate the packet source and destination of the packet
            that triggered the action.  The spdIPInterfaceType,
            spdIPInterfaceAddress, and spdPacketDirection objects
            are included to indicate which endpoint the packet was
            associated with.  Finally, spdPacketPart
              "Write access is not required."

           OBJECT       spdAcceptActionLog
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdCompActExecutionStrategy
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdCompActLastChanged
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required.  This object is not
               required for compliance."

           OBJECT       spdCompActRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdCompActStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdCompFiltDescription
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdCompFiltLastChanged
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required.  This object is not
               required for compliance."

           OBJECT       spdCompFiltLogicType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdCompFiltRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdCompFiltStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdDropAction
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdDropActionLog
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdEgressPolicyGroupName
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdEndGroupLastChanged
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required.  This object is not
               required for compliance."

           OBJECT       spdEndGroupName
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdEndGroupRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdEndGroupStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."
           OBJECT       spdGroupContComponentName
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdGroupContComponentType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is including
            for sending a variable sized part of the front of the
            packet depending on the value of SpdIPPacketLogging."

       ::= { spdNotifications 2 }

   --
   --
   -- Conformance information
   --
   --

   spdCompliances not required."

           OBJECT IDENTIFIER
       ::= { spdConformanceObjects 1 }
   spdGroups       spdGroupContFilter
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT IDENTIFIER
       ::= { spdConformanceObjects 2 }

   --
   -- Compliance statements
   --
   --
   spdRuleFilterCompliance MODULE-COMPLIANCE
       STATUS      current       spdGroupContLastChanged
           MIN-ACCESS   read-only
           DESCRIPTION
           "The compliance statement for SNMP entities that include
            an IPsec MIB implementation with Endpoint, Rules, and
            filters support."
       MODULE --
              "Write access is not required.  This Module
           MANDATORY-GROUPS { spdEndpointGroup,
                              spdGroupContentsGroup,
                              spdRuleDefinitionGroup,
                              spdIPHeaderFilterGroup,
                              spdStaticFilterGroup,
                           spdStaticActionGroup }

           GROUP spdIpsecSystemPolicyNameGroup
           DESCRIPTION
               "This group object is mandatory not
               required for IPsec Policy
                implementations which support a system policy group
                name."

           GROUP spdCompoundFilterGroup compliance."

           OBJECT       spdGroupContRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
               "This group
              "Write access is mandatory for IPsec Policy
                implementations which support compound filters."

           GROUP spdIPOffsetFilterGroup not required."

           OBJECT       spdGroupContStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
               "This group
              "Write access is mandatory for IPsec Policy
                implementations which support IP Offset filters.  In
                general, this SHOULD be supported by a compliant
                IPsec Policy implementation."

           GROUP spdTimeFilterGroup not required."

           OBJECT       spdIngressPolicyGroupName
           MIN-ACCESS   read-only
           DESCRIPTION
               "This group
              "Write access is mandatory for IPsec Policy
                implementations which support time filters."

           GROUP spdIpsoHeaderFilterGroup not required."

           OBJECT       spdIpOffFiltLastChanged
           MIN-ACCESS   read-only
           DESCRIPTION
               "This group
              "Write access is mandatory not required.  This object is not
               required for IPsec Policy
                implementations which support IPSO Header filters."

           GROUP  spdCompoundActionGroup compliance."

           OBJECT       spdIpOffFiltOffset
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdIpOffFiltRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdIpOffFiltStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdIpOffFiltType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdIpOffFiltValue
           MIN-ACCESS   read-only
           DESCRIPTION
               "This group
              "Write access is mandatory for IPsec Policy
                implementations which support compound actions." not required."

           OBJECT      spdEndGroupRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdIpsoHeadFiltClassification
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdEndGroupLastChanged       spdIpsoHeadFiltLastChanged
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This
              "Write access is not required.  This object is not
               required for compliance."

           OBJECT      spdGroupContComponentType
           SYNTAX      INTEGER {
                   rule(2)
           }       spdIpsoHeadFiltProtectionAuth
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the value group(1)
              "Write access is only required for
                implementations which support Policy Groups within
                Policy Groups." not required."

           OBJECT      spdGroupContRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdIpsoHeadFiltRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdGroupContLastChanged       spdIpsoHeadFiltStorageType
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This object
              "Write access is not required for compliance." required."

           OBJECT      spdRuleDefRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdIpsoHeadFiltType
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT       spdRuleDefAction
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdRuleDefAdminStatus
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdRuleDefDescription
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdRuleDefFilter
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdRuleDefFilterNegated
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdRuleDefLastChanged
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This
              "Write access is not required.  This object is not
               required for compliance."

           OBJECT      spdCompFiltRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdRuleDefRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdCompFiltLastChanged       spdRuleDefStorageType
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This
              "Write access is not required."

           OBJECT       spdSubActLastChanged
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required.  This object is not
               required for compliance."
           OBJECT      spdSubFiltRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdSubActRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT       spdSubActStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdSubActSubActionName
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT       spdSubFiltLastChanged
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This
              "Write access is not required.  This object is not
               required for compliance."

           OBJECT      spdIpHeadFiltIPVersion
           SYNTAX      InetAddressType {
                   ipv4(1), ipv6(2)
           }
           DESCRIPTION
               "Only the ipv4 and ipv6 values make sense for this
               object."       spdSubFiltRowStatus
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."

           OBJECT      spdIpHeadFiltRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdSubFiltStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdIpHeadFiltLastChanged       spdSubFiltSubfilter
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This object
              "Write access is not required for compliance." required."

           OBJECT      spdIpOffFiltRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdSubFiltSubfilterIsNegated
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdIpOffFiltLastChanged       spdTimeFiltDayOfMonthMask
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This object
              "Write access is not required for compliance." required."

           OBJECT      spdTimeFiltRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdTimeFiltDayOfWeekMask
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT       spdTimeFiltLastChanged
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This
              "Write access is not required.  This object is not
               required for compliance."

           OBJECT      spdIpsoHeadFiltRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdTimeFiltMonthOfYearMask
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdIpsoHeadFiltLastChanged       spdTimeFiltPeriodEnd
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This object
              "Write access is not required for compliance." required."

           OBJECT      spdCompActRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdTimeFiltPeriodStart
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdCompActLastChanged       spdTimeFiltRowStatus
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This object
              "Write access is not required for compliance." required."

           OBJECT      spdSubActRowStatus
           SYNTAX      RowStatus {
                   active(1), createAndGo(4), destroy(6)
           }       spdTimeFiltStartTimeOfDayMask
           MIN-ACCESS   read-only
           DESCRIPTION
               "Support of the values notInService(2), notReady(3),
                and createAndWait(5)
              "Write access is not required."

           OBJECT      spdSubActLastChanged       spdTimeFiltStopTimeOfDayMask
           MIN-ACCESS  not-accessible   read-only
           DESCRIPTION
                "This object
              "Write access is not required for compliance."

       ::= { spdCompliances 1 }

   spdLoggingCompliance MODULE-COMPLIANCE
       STATUS      current required."

           OBJECT       spdTimeFiltStorageType
           MIN-ACCESS   read-only
           DESCRIPTION
           "The compliance statement for SNMP entities that support
            sending notifications when actions are invoked."
       MODULE -- This Module
           MANDATORY-GROUPS { spdActionLoggingObjectGroup,
                              spdActionNotificationGroup }
              "Write access is not required."

           OBJECT       spdTrueFilter
           MIN-ACCESS   read-only
           DESCRIPTION
              "Write access is not required."
       ::= { spdCompliances 2 3 }

   --
   --
   -- Compliance Groups Definitions
   --

   --
   -- Endpoint, Rule, Filter Compliance Groups
   --

   spdEndpointGroup OBJECT-GROUP
       OBJECTS {
           spdEndGroupName, spdEndGroupLastChanged,
           spdEndGroupStorageType, spdEndGroupRowStatus
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy
           Endpoint Table Group." Table."
       ::= { spdGroups 1 }

   spdGroupContentsGroup OBJECT-GROUP
       OBJECTS {
           spdGroupContComponentType, spdGroupContFilter,
           spdGroupContComponentName, spdGroupContLastChanged,
           spdGroupContStorageType, spdGroupContRowStatus
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy
           Group Contents Table Group." Table."
       ::= { spdGroups 2 }

   spdIpsecSystemPolicyNameGroup OBJECT-GROUP
       OBJECTS {
           spdIncomingPolicyGroupName,
           spdOutgoingPolicyGroupName
           spdIngressPolicyGroupName,
           spdEgressPolicyGroupName
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects represent the System
           Policy Group Name Group." Names."
       ::= { spdGroups 3}

   spdRuleDefinitionGroup OBJECT-GROUP
       OBJECTS {
           spdRuleDefDescription, spdRuleDefFilter,
           spdRuleDefFilterNegated, spdRuleDefAction,
           spdRuleDefAdminStatus, spdRuleDefLastChanged,
           spdRuleDefStorageType, spdRuleDefRowStatus
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy Rule
           Definition Table Group." Table."
       ::= { spdGroups 4 }

   spdCompoundFilterGroup OBJECT-GROUP
       OBJECTS {
           spdCompFiltDescription, spdCompFiltLogicType,
           spdCompFiltLastChanged, spdCompFiltStorageType,
           spdCompFiltRowStatus, spdSubFiltSubfilter,
           spdSubFiltSubfilterIsNegated, spdSubFiltLastChanged,
           spdSubFiltStorageType, spdSubFiltRowStatus
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy
           Compound Filter Table and Filters in
            Compound Filters Sub-Filter Table Group."
       ::= { spdGroups 5 }

   spdStaticFilterGroup OBJECT-GROUP
           OBJECTS { spdTrueFilter }
        STATUS current
        DESCRIPTION
            "The static filter group.  Currently this is just a true
             filter."
       ::= { spdGroups 6 }

   spdIPHeaderFilterGroup OBJECT-GROUP
       OBJECTS {
           spdIpHeadFiltType, spdIpHeadFiltIPVersion,
           spdIpHeadFiltSrcAddressBegin, spdIpHeadFiltSrcAddressEnd,
           spdIpHeadFiltDstAddressBegin, spdIpHeadFiltDstAddressEnd,
           spdIpHeadFiltSrcLowPort, spdIpHeadFiltSrcHighPort,
           spdIpHeadFiltDstLowPort, spdIpHeadFiltDstHighPort,
           spdIpHeadFiltProtocol, spdIpHeadFiltIPv6FlowLabel,
           spdIpHeadFiltLastChanged, spdIpHeadFiltStorageType,
           spdIpHeadFiltRowStatus
       }
       STATUS current
       DESCRIPTION
           "The IPsec Policy IP Header Filter Table Group."
       ::= { spdGroups 7 }

   spdIPOffsetFilterGroup OBJECT-GROUP
       OBJECTS {
           spdIpOffFiltOffset, spdIpOffFiltType,
           spdIpOffFiltValue, spdIpOffFiltLastChanged,
           spdIpOffFiltStorageType, spdIpOffFiltRowStatus
       }

       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy IP
           Offset Filter Table Group." Table."
       ::= { spdGroups 8 7 }

   spdTimeFilterGroup OBJECT-GROUP
       OBJECTS {
           spdTimeFiltPeriodStart, spdTimeFiltPeriodEnd,
           spdTimeFiltMonthOfYearMask, spdTimeFiltDayOfMonthMask,
           spdTimeFiltDayOfWeekMask, spdTimeFiltTimeOfDayMaskStart,
           spdTimeFiltTimeOfDayMaskEnd, spdTimeFiltStartTimeOfDayMask,
           spdTimeFiltStopTimeOfDayMask, spdTimeFiltLastChanged,
           spdTimeFiltStorageType, spdTimeFiltRowStatus
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy Time
           Filter Table Group." Table."
       ::= { spdGroups 9 8 }

   spdIpsoHeaderFilterGroup OBJECT-GROUP
       OBJECTS {
           spdIpsoHeadFiltType, spdIpsoHeadFiltClassification,
           spdIpsoHeadFiltProtectionAuth, spdIpsoHeadFiltLastChanged,
           spdIpsoHeadFiltStorageType, spdIpsoHeadFiltRowStatus
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy IPSO
           Header Filter Table Group." Table."
       ::= { spdGroups 10 9 }

   --
   -- action compliance groups
   --

   spdStaticActionGroup OBJECT-GROUP
       OBJECTS {
           spdDropAction, spdAcceptAction,
           spdDropActionLog, spdAcceptActionLog
       }
       STATUS current
       DESCRIPTION
           "The
           "This group is made up of objects from the IPsec Policy
           Static Actions Group." Actions."
       ::= { spdGroups 11 10 }

   spdCompoundActionGroup OBJECT-GROUP
       OBJECTS {
           spdCompActExecutionStrategy, spdCompActLastChanged,
           spdCompActStorageType,

           spdCompActRowStatus, spdSubActSubActionName,
           spdSubActLastChanged, spdSubActStorageType,
           spdSubActRowStatus
       }
       STATUS current
       DESCRIPTION
           "The IPsec Policy Compound Action Table and Actions In
            Compound Action Table Group."
       ::= { spdGroups 12 11 }

   spdActionLoggingObjectGroup OBJECT-GROUP
       OBJECTS {
           spdActionExecuted,
           spdIPInterfaceType,   spdIPInterfaceAddress,
           spdIPEndpointAddType,   spdIPEndpointAddress,
           spdIPSourceType,        spdIPSourceAddress,
           spdIPDestinationType,   spdIPDestinationAddress,
           spdPacketDirection,     spdPacketPart
       }
       STATUS current
       DESCRIPTION
           "Notification objects."
           "This group is made up of all the Notification objects for
           this MIB."
       ::= { spdGroups 13 12 }

   spdActionNotificationGroup NOTIFICATION-GROUP
       NOTIFICATIONS {
           spdActionNotification,
           spdPacketNotification
       }
       STATUS current
       DESCRIPTION
               "Notifications."
               "This group is made up of all the Notifications for this
               MIB."
       ::= { spdGroups 14 13 }

   END

6.  Security Considerations

6.1  Introduction

   This document defines a MIB module used to configure IPsec policy
   services.  Since IPsec provides security services it is important
   that the IPsec configuration data be at least as protected as the
   IPsec provided security service.  There are two main threats you need
   to thwart when configuring IPsec devices.

   1.  Malicious Configuration: only the official administrators should
       be allowed to configure a device.  In other words,
       administrators' identities should be authenticated and their
       access rights checked before they are allowed to do device
       configuration.  The support for SET operations to the IPSP MIB in
       a non-secure environment, without proper protection, can have a
       negative effect on the security of the network traffic affected
       by the IPSP MIB.

   2.  Disclosure of Configuration:  Malicious parties should not be
       able to read configuration data while the data is in network
       transit.  Any knowledge about a device's IPsec policy
       configuration could help an unfriendly party compromise that
       device and/or the network(s) it protects.  It is thus important
       to control even GET access to these objects and possibly to even
       encrypt the values of these objects when sending them over the
       network via SNMP.

   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example (e.g.  by using IPsec),
   even then, there is earlier
   versions of SNMP have virtually no control as to who on the secure
   network is allowed to access and GET/SET (read/change/create/delete)
   the objects in this MIB module.

   It is RECOMMENDED that implementers consider the security features as
   provided by the SNMPv3 framework (see [RFC3410], section 8),
   including full support for the SNMPv3 cryptographic mechanisms (for
   authentication and privacy).

   Further, deployment of SNMP versions prior to SNMPv3 is NOT
   RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
   enable cryptographic security.  It is then a customer/operator
   responsibility to ensure that the SNMP entity giving access to an
   instance of this MIB module, module is properly configured to give access to
   the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.

   Therefore, when configuring data in the IPSEC-SPD-MIB, you SHOULD use
   SNMP version 3.  The rest of this discussion assumes the use of
   SNMPv3.  This is a real strength, because it allows administrators
   the ability to load new IPsec configuration on a device and keep the
   conversation private and authenticated under the protection of SNMPv3
   before any IPsec protections are available.  Once initial
   establishment of IPsec configuration on a device has been achieved,
   it would be possible to set up IPsec SAs to then also provide
   security and integrity services to the configuration conversation.
   This may seem redundant at first, but will be shown to have a use for
   added privacy protection below.

6.2  Protecting against in-authentic access

   The current SNMPv3 User Security Model provides for key based user
   authentication.  Typically, keys are derived from passwords (but are
   not required to be), and the keys are then used in HMAC algorithms
   (currently MD5 and SHA-1 HMACs are defined) to authenticate all SNMP
   data.  Each SNMP device keeps a (configured) list of users and keys.
   Under SNMPv3 user keys may be updated as often as an administrator
   cares to have users enter new passwords.  But Perfect Forward Secrecy
   for user keys is not yet provided by standards track documents,
   although RFC2786 defines an experimental method of doing so.

6.3  Protecting against involuntary disclosure

   While sending IPsec configuration data to a PEP, Policy Enforcement Point
   (PEP), there are a few critical parameters which MUST NOT be observed
   by third parties.
   These  Specifically, except for public keys, keying
   information MUST NOT be allowed to be observed by third parties.
   This include IKE Pre-Shared Keys and possibly the private key of a
   public/private key pair for use in a PKI.  Were either of those
   parameters to be known to a third party, they could then impersonate
   your
   the device to other IKE peers.  Aside from those critical parameters,
   policy administrators have an interest in not divulging any of their
   policy configuration.  Any knowledge about a device's configuration
   could help an unfriendly party compromise that device.  SNMPv3 offers
   privacy security services, but at the time this document was written,
   the only standardized encryption algorithm supported by SNMPv3 is the
   DES encryption algorithm.  Support for other (stronger) cryptographic
   algorithms is in the works and may be done as you read this. this (e.g.
   AES [RFC3826]).  Policy administrators SHOULD use a privacy security
   service to configure their IPsec policy which is at least as strong
   as the desired IPsec policy.  E.G., it is unwise to configure IPsec
   parameters implementing 3DES algorithms while only protecting that
   conversation with single DES.

6.4  Bootstrapping your configuration

   Hopefully

   Most vendors will not ship new products with a default SNMPv3
   user/password pair, but it is possible.  If a device does ship with a
   default user/password pair, policy administrators SHOULD either
   change the password or configure a new user, deleting the default
   user (or at a minimum, restrict the access of the default user).
   Most SNMPv3 distributions
   should hopefully should, hopefully, require an out-of-band
   initialization over a trusted medium, such as a local console
   connection.  If a product does install with default user/password
   information, these values should be changed before connecting to a
   network.

7.  IANA Considerations

   Only two IANA considerations exist for this document.  The first is
   just the node number allocation of the IPSEC-SPD-MIB itself.

   The IPSEC-SPD-MIB also allows for extension action MIB's and
   allocates a node, spdActions, for them.  IANA would be responsible
   for allocating the values under this node.

8.  Acknowledgments

   Many other people contributed thoughts and ideas that influenced this
   MIB module.  Some special thanks are in order for the following
   people:

         Lindy Foster     (Sparta, Inc.)
         John Gillis      (ADC)
         Jamie Jason      (Intel Corporation)
         Roger Hartmuller (Sparta, Inc.)
         David Partain    (Ericsson)
         Lee Rafalow      (IBM)
         Jon Saperia      (JDS Consulting)
         Eric Vyncke      (Cisco Systems)

8.

9.  References

8.1

9.1  Normative References

   [RFC3410]  Case, J., Mundy, R., Partain, D. and B. Stewart,
              "Introduction and Applicability Statements for
              Internet-Standard Management Framework", RFC 3410,
              December 2002.

   [RFC3411]  Harrington, D., Presuhn, R. and B. Wijnen, "An
              Architecture for Describing Simple Network Management
              Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
              December 2002.

   [RFC3412]  Case, J., Harrington, D., Presuhn, R. and B. Wijnen,
              "Message Processing and Dispatching for the Simple Network
              Management Protocol (SNMP)", STD 62, RFC 3412, December
              2002.

   [RFC3413]  Levi, D., Meyer, P. and B. Stewart, "Simple Network
              Management Protocol (SNMP) Applications", STD 62, RFC
              3413, December 2002.

   [RFC3414]  Blumenthal, U. and B. Wijnen, "User-based Security Model
              (USM) for version 3 of the Simple Network Management
              Protocol (SNMPv3)", STD 62, RFC 3414, December 2002.

   [RFC3415]  Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based
              Access Control Model (VACM) for the Simple Network
              Management Protocol (SNMP)", STD 62, RFC 3415, December
              2002.

   [RFC2578]  McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              McCloghrie, K., Rose, M. and S. Waldbusser, "Structure of
              Management Information Version 2 (SMIv2)", STD 58, RFC
              2578, April 1999.

   [RFC2579]  McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              McCloghrie, K., Rose, M. and S. Waldbusser, "Textual
              Conventions for SMIv2", STD 58, RFC 2579, April 1999.

   [RFC2580]  McCloghrie, K., Perkins, D. and J. Schoenwaelder,
              "Conformance Statements for SMIv2", STD 58, RFC 2580,
              April 1999.

   [RFC3585]  Jason, J., Rafalow, L. and E. Vyncke, "IPsec Configuration
              Policy Information Model", RFC 3585, August 2003.

8.2

9.2  Informative References

   [RFCXXXX]  Baer, M., Charlet, R., Hardaker, W., Story, R. and C.
              Wang, "IPsec Security Policy IPsec Action MIB", December
              2002.

   [RFCYYYY]  Baer, M., Charlet, R., Hardaker, W., Story, R. and C.
              Wang, "IPsec Security Policy IKE Action MIB", December
              2002.

   [IPPMWP]   Lortz, V. and L. Rafalow, "IPsec Policy Model White
              Paper", November 2000.

   [RFC3826]  Blumenthal, U., Maino, F. and K. McCloghrie, "The Advanced
              Encryption Standard (AES) Cipher Algorithm in the SNMP
              User-based Security Model", RFC 3826, June 2004.

Authors' Addresses

   Michael Baer
   Sparta, Inc.
   7075 Samuel Morse Drive
   Columbia, MD  21046
   US

   EMail: baerm@tislabs.com

   Ricky Charlet
   Self

   EMail: rcharlet@alumni.calpoly.edu

   Wes Hardaker
   Sparta, Inc.
   P.O. Box 382
   Davis, CA  95617
   US

   Phone: +1 530 792 1913
   EMail: hardaker@tislabs.com

   Robert Story
   Revelstone Software
   PO Box 1812
   Tucker, GA  30085
   US

   EMail: ipsp-mib@revelstone.com

   Cliff Wang
   SmartPipes, Inc.
   Suite 300, 565 Metro Place South
   Dublin, OH, OH  43017
   ARO/North Carolina State University
   4300 S. Miami Blvd
   RTP, NC  27709
   US

   EMail: cliffwang2000@yahoo.com cliffwangmail@yahoo.com

Intellectual Property Statement

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.

Disclaimer of Validity

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Copyright Statement

   Copyright (C) The Internet Society (2004). (2005).  This document is subject
   to the rights, licenses and restrictions contained in BCP 78, and
   except as set forth therein, the authors retain all their rights.

Acknowledgment

   Funding for the RFC Editor function is currently provided by the
   Internet Society.