Internet Engineering Task Force (IETF) R. Bush
Request for Comments: 6945 Internet Initiative Japan
Category: Standards Track B. Wijnen
ISSN: 2070-1721 RIPE NCC
K. Patel
Cisco Systems
M. Baer
SPARTA
May 2013
Definitions of Managed Objects for the Resource Public Key Infrastructure (RPKI) to Router Protocol
从资源公钥基础设施 (RPKI) 到路由器协议的受管对象定义
Abstract
摘要
This document defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes objects used for monitoring the Resource Public Key Infrastructure (RPKI) to Router Protocol.
本文档定义了管理信息库（MIB）的一部分，供互联网社区的网络管理协议使用。它特别描述了用于监控资源公钥基础设施（RPKI）到路由器协议的对象。
Status of This Memo
本备忘录的地位
This is an Internet Standards Track document.
这是一份互联网标准跟踪文件。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
本文件是互联网工程任务组 (IETF) 的成果。它代表了 IETF 社区的共识。它已接受公众审查，并经互联网工程指导小组 (IESG) 批准发布。有关互联网标准的更多信息，请参见 RFC 5741 第 2 节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6945.
有关本文件的当前状态、任何勘误以及如何提供反馈的信息，请访问 http://www.rfc-editor.org/info/rfc6945。
Copyright Notice
版权声明
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有 (c) 2013 IETF 信托基金会和文件作者。保留所有权利。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文档受 BCP 78 和本文档发布之日有效的 IETF 信托基金《与 IETF 文档有关的法律规定》 (http://trustee.ietf.org/license-info) 的约束。请仔细阅读这些文件，因为它们描述了您对本文档的权利和限制。从本文档中提取的代码组件必须包含信托法律条款第 4.e 节所述的简化 BSD 许可文本，并且按照简化 BSD 许可的规定提供，但不提供担保。
Table of Contents
目录
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 2
2. The Internet-Standard Management Framework . . . . . . . . . 2
3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 3
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22
6. Security Considerations . . . . . . . . . . . . . . . . . . . 22
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 23
7.1. Normative References . . . . . . . . . . . . . . . . . . 23
7.2. Informative References . . . . . . . . . . . . . . . . . 24
This document defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it defines objects used for monitoring the RPKI-Router Protocol [RFC6810].
本文件定义了管理信息库（MIB）的一部分，供因特网社区的网络管理协议使用。它特别定义了用于监控 RPKI 路由器协议 [RFC6810] 的对象。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
本文档中的关键词 "MUST"、"MUST NOT"、"REQUIRED"、"SHALL"、"SHALL NOT"、"SHOULD"、"SHOULD NOT"、"RECOMMENDED"、"NOT RECOMMENDED"、"MAY "和 "OPTIONAL "应按照 RFC 2119 [RFC2119] 中的描述进行解释。
For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 [RFC3410]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB.
有关描述当前互联网标准管理框架的文件的详细概述，请参阅 RFC 3410 [RFC3410] 第 7 节。受管对象可通过虚拟信息库（称为管理信息库或 MIB）进行访问。
MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579], and STD 58, RFC 2580 [RFC2580].
MIB 对象通常通过简单网络管理协议（SNMP）进行访问。MIB 中的对象是使用管理信息结构（SMI）中定义的机制定义的。本备忘录规定了符合 SMIv2 的 MIB 模块，SMIv2 在 STD 58、RFC 2578 [RFC2578]、STD 58、RFC 2579 [RFC2579] 和 STD 58、RFC 2580 [RFC2580] 中进行了描述。
The objects defined in this document are used to monitor the RPKI-Router Protocol [RFC6810]. The MIB module defined here is broken into these tables: the RPKI-Router Cache Server (Connection) Table, the RPKI-Router Cache Server Errors Table, and the RPKI-Router Prefix Origin Table.
本文档中定义的对象用于监控 RPKI-Router 协议 [RFC6810]。此处定义的 MIB 模块分为以下几个表：RPKI-路由器缓存服务器（连接）表、RPKI-路由器缓存服务器错误表和 RPKI-路由器前缀来源表。
The RPKI-Router Cache Server Table contains information about the state and current activity of connections with the RPKI-router cache servers. It also contains counters for the number of messages received and sent, plus the number of announcements, withdrawals, and active records. The RPKI-Router Cache Server Errors Table contains counters of occurrences of errors on the connections (if any). The RPKI-Router Prefix Origin Table contains IP prefixes with their minimum and maximum prefix lengths and the Origin Autonomous System (AS). This data is the collective set of information received from all RPKI cache servers that the router is connected with. The cache servers are running the RPKI-Router Protocol.
RPKI 路由器缓存服务器表包含与 RPKI 路由器缓存服务器连接的状态和当前活动相关的信息。它还包含接收和发送信息数量的计数器，以及公告、撤回和活动记录的数量。RPKI-Router 缓存服务器错误表（RPKI-Router Cache Server Errors Table）包含连接错误计数器（如有）。RPKI-Router 前缀起源表包含 IP 前缀及其最小和最大前缀长度以及起源自治系统（AS）。这些数据是从路由器连接的所有 RPKI 缓存服务器接收到的信息集合。缓存服务器运行的是 RPKI 路由器协议。
Two notifications have been defined to inform a Network Management Station (NMS) or operators about changes in the connection state of the connections listed in the RPKI-Router Cache Server (Connection) Table.
定义了两种通知，用于向网络管理站（NMS）或操作员通报 RPKI 路由器缓存服务器（连接）表中所列连接的连接状态变化。
The following MIB module imports definitions from [RFC2578], [RFC2579], [RFC2580], [RFC4001], and [RFC2287]. That means we have a normative reference to each of those documents.
以下 MIB 模块导入了 [RFC2578]、[RFC2579]、[RFC2580]、[RFC4001] 和 [RFC2287] 中的定义。这意味着我们对这些文件都有规范性引用。
The MIB module also has a normative reference to the RPKI-Router Protocol [RFC6810]. Furthermore, for background and informative information, the MIB module refers to [RFC1982], [RFC4252], [RFC5246], and [RFC5925].
MIB 模块还规范性地引用了 RPKI 路由器协议 [RFC6810]。此外，MIB 模块还参考了 [RFC1982]、[RFC4252]、[RFC5246] 和 [RFC5925]，以提供背景和信息资料。
RPKI-ROUTER-MIB DEFINITIONS ::= BEGIN
IMPORTS
进口
MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Integer32, Unsigned32, mib-2, Gauge32, Counter32 FROM SNMPv2-SMI -- RFC 2578
MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Integer32, Unsigned32, mib-2, Gauge32, Counter32 FROM SNMPv2-SMI -- RFC 2578
InetAddressType, InetAddress, InetPortNumber, InetAddressPrefixLength, InetAutonomousSystemNumber FROM INET-ADDRESS-MIB -- RFC 4001
InetAddressType, InetAddress, InetPortNumber, InetAddressPrefixLength, InetAutonomousSystemNumber FROM INET-ADDRESS-MIB -- RFC 4001
TEXTUAL-CONVENTION, TimeStamp FROM SNMPv2-TC -- RFC 2579
TEXTUAL-CONVENTION, TimeStamp FROM SNMPv2-TC -- RFC 2579
MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF -- RFC 2580
MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP FROM SNMPv2-CONF -- RFC 2580
LongUtf8String FROM SYSAPPL-MIB -- RFC 2287
LongUtf8String FROM SYSAPPL-MIB -- RFC 2287
;
;
rpkiRtrMIB MODULE-IDENTITY LAST-UPDATED "201305010000Z" ORGANIZATION "IETF Secure Inter-Domain Routing (SIDR) Working Group " CONTACT-INFO "Working Group Email: [email protected]
rpkiRtrMIB MODULE-IDENTITY LAST-UPDATED "201305010000Z" ORGANIZATION "IETF Secure Inter-Domain Routing (SIDR) Working Group " CONTACT-INFO "Working Group Email: [email protected]
Randy Bush Internet Initiative Japan 5147 Crystal Springs Bainbridge Island, WA 98110 USA Email: [email protected]
Randy Bush Internet Initiative Japan 5147 Crystal Springs Bainbridge Island, WA 98110 USA Email: [email protected]
Bert Wijnen RIPE NCC Schagen 33 3461 GL Linschoten Netherlands Email: [email protected]
Bert Wijnen RIPE NCC Schagen 33 3461 GL Linschoten Netherlands 电子邮箱：[email protected]
Keyur Patel Cisco Systems 170 W. Tasman Drive San Jose, CA 95134 USA Email: [email protected]
Keyur Patel 思科系统公司 170 W. Tasman Drive San Jose, CA 95134 美国 电子邮件：[email protected]
Michael Baer SPARTA P.O. Box 72682 Davis, CA 95617 USA Email: [email protected] "
Michael Baer SPARTA P.O. Box 72682 Davis, CA 95617 USA Email: [email protected] "
DESCRIPTION "This MIB module contains management objects to support monitoring of the Resource Public Key Infrastructure (RPKI) protocol on routers.
描述 "本 MIB 模块包含管理对象，用于支持监控路由器上的资源公钥基础架构 (RPKI) 协议。
Copyright (c) 2013 IETF Trust and the persons identified as authors of the code. All rights reserved.
Copyright (c) 2013 IETF Trust 和代码作者。保留所有权利。
Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info).
根据 IETF 托管组织的《IETF 文件相关法律条款》（http://trustee.ietf.org/license-info）第 4.c 节中规定的简化 BSD 许可中包含的许可条款，允许以源代码和二进制形式进行再分发和使用，无论修改与否。
This version of this MIB module is part of RFC 6945; see the RFC itself for full legal notices."
此版本的 MIB 模块是 RFC 6945 的一部分；有关完整的法律声明，请参阅 RFC 本身"。
REVISION "201305010000Z"
DESCRIPTION "Initial version, published as RFC 6945."
::= { mib-2 218 }
rpkiRtrNotifications OBJECT IDENTIFIER ::= { rpkiRtrMIB 0 }
rpkiRtrObjects OBJECT IDENTIFIER ::= { rpkiRtrMIB 1 }
rpkiRtrConformance OBJECT IDENTIFIER ::= { rpkiRtrMIB 2 }
-- ==============================================================
-- Textual Conventions used in this MIB module
-- ==============================================================
RpkiRtrConnectionType ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION "The connection type used between a router (as a
client) and a cache server.
The following types have been defined in RFC 6810:
ssh(1) - Section 7.1; see also RFC 4252.
tls(2) - Section 7.2; see also RFC 5246.
tcpMD5(3) - Section 7.3; see also RFC 2385.
tcpAO(4) - Section 7.4; see also RFC 5925.
tcp(5) - Section 7.
ipsec(6) - Section 7; see also RFC 4301.
other(7) - none of the above."
REFERENCE "The RPKI-Router Protocol, RFC 6810, Section 7"
SYNTAX INTEGER {
ssh(1),
tls(2),
tcpMD5(3),
tcpAO(4),
tcp(5),
ipsec(6),
other(7)
}
-- ==============================================================
-- Scalar objects
-- ==============================================================
rpkiRtrDiscontinuityTimer OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION "This timer represents the timestamp (value
of sysUpTime) at which time any of the
Counter32 objects in this MIB module
encountered a discontinuity.
For objects that use rpkiRtrDiscontinuityTimer to indicate discontinuity, only values received since the time indicated by rpkiRtrDiscontinuityTimer are comparable to each other. A manager should take the possibility of rollover into account when calculating difference values.
对于使用 rpkiRtrDiscontinuityTimer 指示不连续性的对象，只有自 rpkiRtrDiscontinuityTimer 指示的时间之后收到的值才具有可比性。管理程序在计算差值时应考虑到翻转的可能性。
In principle, that should only happen if the
SNMP agent or the instrumentation for this
MIB module starts or restarts."
::= { rpkiRtrObjects 1 }
-- ==============================================================
-- RPKI-Router Cache Server Connection Table
-- ==============================================================
rpkiRtrCacheServerTable OBJECT-TYPE
SYNTAX SEQUENCE OF RpkiRtrCacheServerTableEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION "This table lists the RPKI cache servers
known to this router/system."
::= { rpkiRtrObjects 2 }
rpkiRtrCacheServerTableEntry OBJECT-TYPE SYNTAX RpkiRtrCacheServerTableEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the rpkiRtrCacheServerTable. It holds management attributes associated with one connection to a RPKI cache server.
rpkiRtrCacheServerTableEntry OBJECT-TYPE SYNTAX RpkiRtrCacheServerTableEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "rpkiRtrCacheServerTable 表中的一个条目。它保存与 RPKI 缓存服务器的一个连接相关联的管理属性。
Implementers should be aware that if the rpkiRtrCacheServerRemoteAddress object exceeds 114 octets, the index values will exceed the 128 sub-identifier limit and cannot be accessed using SNMPv1, SNMPv2c, or SNMPv3."
实施人员应注意，如果 rpkiRtrCacheServerRemoteAddress 对象超过 114 个八位字节，索引值将超过 128 个子标识符的限制，并且无法使用 SNMPv1、SNMPv2c 或 SNMPv3 进行访问。
INDEX { rpkiRtrCacheServerRemoteAddressType,
rpkiRtrCacheServerRemoteAddress,
rpkiRtrCacheServerRemotePort
}
::= { rpkiRtrCacheServerTable 1 }
RpkiRtrCacheServerTableEntry ::= SEQUENCE {
rpkiRtrCacheServerRemoteAddressType InetAddressType,
rpkiRtrCacheServerRemoteAddress InetAddress,
rpkiRtrCacheServerRemotePort InetPortNumber,
rpkiRtrCacheServerLocalAddressType InetAddressType,
rpkiRtrCacheServerLocalAddress InetAddress,
rpkiRtrCacheServerLocalPort InetPortNumber,
rpkiRtrCacheServerPreference Unsigned32,
rpkiRtrCacheServerConnectionType RpkiRtrConnectionType,
rpkiRtrCacheServerConnectionStatus INTEGER,
rpkiRtrCacheServerDescription LongUtf8String,
rpkiRtrCacheServerMsgsReceived Counter32,
rpkiRtrCacheServerMsgsSent Counter32,
rpkiRtrCacheServerV4ActiveRecords Gauge32,
rpkiRtrCacheServerV4Announcements Counter32,
rpkiRtrCacheServerV4Withdrawals Counter32,
rpkiRtrCacheServerV6ActiveRecords Gauge32,
rpkiRtrCacheServerV6Announcements Counter32,
rpkiRtrCacheServerV6Withdrawals Counter32,
rpkiRtrCacheServerLatestSerial Unsigned32,
rpkiRtrCacheServerSessionID Unsigned32,
rpkiRtrCacheServerRefreshTimer Unsigned32,
rpkiRtrCacheServerTimeToRefresh Integer32,
rpkiRtrCacheServerId Unsigned32
}
rpkiRtrCacheServerRemoteAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The network address type of the connection to this RPKI cache server.
rpkiRtrCacheServerRemoteAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "RPKI 缓存服务器连接的网络地址类型。
Note: Only IPv4, IPv6, and DNS support are required
for read-only compliance with RFC 6945."
::= { rpkiRtrCacheServerTableEntry 1 }
rpkiRtrCacheServerRemoteAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The remote network address for this connection to this RPKI cache server.
rpkiRtrCacheServerRemoteAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "此 RPKI 缓存服务器连接的远程网络地址。
The format of the address is defined by the value of the corresponding instance of rpkiRtrCacheServerRemoteAddressType.
地址格式由 rpkiRtrCacheServerRemoteAddressType 对应实例的值定义。
This object matches the address type used within
the local router configuration. If the address is
of type dns (fqdn), then the router will resolve it
at the time it connects to the cache server."
::= { rpkiRtrCacheServerTableEntry 2 }
rpkiRtrCacheServerRemotePort OBJECT-TYPE
SYNTAX InetPortNumber (1..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION "The remote port number for this connection
to this RPKI cache server."
::= { rpkiRtrCacheServerTableEntry 3 }
rpkiRtrCacheServerLocalAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "The network address type of the connection to this RPKI cache server.
rpkiRtrCacheServerLocalAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "RPKI 缓存服务器连接的网络地址类型。
Note: Only IPv4, IPv6, and DNS support are required
for read-only compliance with RFC 6945."
::= { rpkiRtrCacheServerTableEntry 4 }
rpkiRtrCacheServerLocalAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "The local network address for this connection to this RPKI cache server.
rpkiRtrCacheServerLocalAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "此 RPKI 缓存服务器连接的本地网络地址。
The format of the address is defined by the value of the corresponding instance of rpkiRtrCacheServerLocalAddressType.
地址格式由 rpkiRtrCacheServerLocalAddressType 对应实例的值定义。
This object matches the address type used within
the local router configuration. If the address is
of type dns (fqdn), then the router will resolve it
at the time it connects to the cache server."
::= { rpkiRtrCacheServerTableEntry 5 }
rpkiRtrCacheServerLocalPort OBJECT-TYPE
SYNTAX InetPortNumber (1..65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The local port number for this connection
to this RPKI cache server."
::= { rpkiRtrCacheServerTableEntry 6 }
rpkiRtrCacheServerPreference OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The routers' preference for this RPKI cache server.
rpkiRtrCacheServerPreference OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "路由器对该 RPKI 缓存服务器的偏好。
A lower value means more preferred. If two entries have the same preference, then the order is arbitrary.
数值越小，表示优先级越高。如果两个条目具有相同的优先级，那么顺序就是任意的。
In two cases, the maximum value for an Unsigned32 object should be returned for this object: - If no order is specified in the RPKI-Router configuration. - If a preference value is configured that is larger than the max value for an Unsigned32 object."
在两种情况下，应为此对象返回 Unsigned32 对象的最大值： - 如果在 RPKI-Router 配置中没有指定顺序。- 如果配置的首选项值大于 Unsigned32 对象的最大值"。
REFERENCE "The RPKI-Router Protocol, RFC 6810, Section 8."
DEFVAL { 4294967295 }
::= { rpkiRtrCacheServerTableEntry 7 }
rpkiRtrCacheServerConnectionType OBJECT-TYPE
SYNTAX RpkiRtrConnectionType
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The connection type or transport security suite
in use for this RPKI cache server."
::= { rpkiRtrCacheServerTableEntry 8 }
rpkiRtrCacheServerConnectionStatus OBJECT-TYPE
SYNTAX INTEGER { up(1), down(2) }
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The connection status for this entry
(connection to this RPKI cache server)."
::= { rpkiRtrCacheServerTableEntry 9 }
rpkiRtrCacheServerDescription OBJECT-TYPE
SYNTAX LongUtf8String
MAX-ACCESS read-only
STATUS current
DESCRIPTION "Free form description/information for this
connection to this RPKI cache server."
::= { rpkiRtrCacheServerTableEntry 10 }
rpkiRtrCacheServerMsgsReceived OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "Number of messages received from this RPKI cache server via this connection.
rpkiRtrCacheServerMsgsReceived OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "通过此连接从 RPKI 缓存服务器接收到的消息数。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerTableEntry 11 }
rpkiRtrCacheServerMsgsSent OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "Number of messages sent to this RPKI cache server via this connection.
rpkiRtrCacheServerMsgsSent OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "通过此连接发送到此 RPKI 缓存服务器的消息数。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerTableEntry 12 }
rpkiRtrCacheServerV4ActiveRecords OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION "Number of active IPv4 records received from
this RPKI cache server via this connection."
::= { rpkiRtrCacheServerTableEntry 13 }
rpkiRtrCacheServerV4Announcements OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of IPv4 records announced by the RPKI cache server via this connection.
rpkiRtrCacheServerV4Announcements OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "RPKI 缓存服务器通过此连接宣布的 IPv4 记录数。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerTableEntry 14 }
rpkiRtrCacheServerV4Withdrawals OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of IPv4 records withdrawn by the RPKI cache server via this connection.
rpkiRtrCacheServerV4Withdrawals OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "RPKI 缓存服务器通过此连接撤回的 IPv4 记录数。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerTableEntry 15 }
rpkiRtrCacheServerV6ActiveRecords OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION "Number of active IPv6 records received from
this RPKI cache server via this connection."
::= { rpkiRtrCacheServerTableEntry 16 }
rpkiRtrCacheServerV6Announcements OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of IPv6 records announced by the RPKI cache server via this connection.
rpkiRtrCacheServerV6Announcements OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "RPKI 缓存服务器通过此连接宣布的 IPv6 记录数。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerTableEntry 17 }
rpkiRtrCacheServerV6Withdrawals OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of IPv6 records withdrawn by the RPKI cache server via this connection.
rpkiRtrCacheServerV6Withdrawals OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "RPKI 缓存服务器通过此连接撤回的 IPv6 记录数。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerTableEntry 18 }
rpkiRtrCacheServerLatestSerial OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "The latest serial number of data received from this RPKI server on this connection.
rpkiRtrCacheServerLatestSerial OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "在此连接上从 RPKI 服务器接收到的数据的最新序列号。
Note: this value wraps back to zero when it
reaches its maximum value."
REFERENCE "RFC 1982 and RFC 6810, Section 2"
::= { rpkiRtrCacheServerTableEntry 19 }
rpkiRtrCacheServerSessionID OBJECT-TYPE
SYNTAX Unsigned32 (0..65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The Session ID associated with the RPKI cache
server at the other end of this connection."
REFERENCE "RFC 6810, Section 2"
::= { rpkiRtrCacheServerTableEntry 20 }
rpkiRtrCacheServerRefreshTimer OBJECT-TYPE
SYNTAX Unsigned32 (60..7200)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The number of seconds configured for the refresh
timer for this connection to this RPKI cache
server."
REFERENCE "RFC 6810, Sections 6.1 and 8"
::= { rpkiRtrCacheServerTableEntry 21 }
rpkiRtrCacheServerTimeToRefresh OBJECT-TYPE SYNTAX Integer32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of seconds remaining before a new refresh is performed via a Serial Query to this cache server over this connection.
rpkiRtrCacheServerTimeToRefresh OBJECT-TYPE SYNTAX Integer32 UNITS "秒" MAX-ACCESS read-only STATUS current DESCRIPTION "通过此连接向高速缓存服务器进行串行查询刷新前的剩余秒数。
A negative value means that the refresh time has passed this many seconds and the refresh has not yet been completed. It will stop decrementing at the maximum negative value.
负值表示刷新时间已经过了这么多秒钟，但刷新尚未完成。它将在最大负值时停止递减。
Upon a completed refresh (i.e., a successful
and complete response to a Serial Query) the
value of this attribute will be reinitialized
with the value of the corresponding
rpkiRtrCacheServerRefreshTimer attribute."
REFERENCE "RFC 6810, Section 8"
::= { rpkiRtrCacheServerTableEntry 22 }
rpkiRtrCacheServerId OBJECT-TYPE SYNTAX Unsigned32 (1..4294967295) MAX-ACCESS read-only STATUS current DESCRIPTION "The unique ID for this connection.
rpkiRtrCacheServerId OBJECT-TYPE SYNTAX Unsigned32 (1..4294967295) MAX-ACCESS read-only STATUS current DESCRIPTION "此连接的唯一 ID。
An implementation must make sure this ID is unique
within this table. It is this ID that can be used
to find entries in the rpkiRtrPrefixOriginTable
that were created by announcements received on
this connection from this cache server."
REFERENCE "RFC 6810, Section 4"
::= { rpkiRtrCacheServerTableEntry 23 }
-- ==============================================================
-- Errors Table
-- ==============================================================
rpkiRtrCacheServerErrorsTable OBJECT-TYPE
SYNTAX SEQUENCE OF RpkiRtrCacheServerErrorsTableEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION "This table provides statistics on errors per
RPKI peer connection. These can be used for
debugging."
::= { rpkiRtrObjects 3 }
rpkiRtrCacheServerErrorsTableEntry OBJECT-TYPE
SYNTAX RpkiRtrCacheServerErrorsTableEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION "An entry in the rpkiCacheServerErrorTable. It
holds management objects associated with errors
codes that were received on the specified
connection to a specific cache server."
REFERENCE "RFC 6810, Section 10"
AUGMENTS { rpkiRtrCacheServerTableEntry }
::= { rpkiRtrCacheServerErrorsTable 1 }
RpkiRtrCacheServerErrorsTableEntry ::= SEQUENCE {
rpkiRtrCacheServerErrorsCorruptData Counter32,
rpkiRtrCacheServerErrorsInternalError Counter32,
rpkiRtrCacheServerErrorsNoData Counter32,
rpkiRtrCacheServerErrorsInvalidRequest Counter32,
rpkiRtrCacheServerErrorsUnsupportedVersion Counter32,
rpkiRtrCacheServerErrorsUnsupportedPdu Counter32,
rpkiRtrCacheServerErrorsWithdrawalUnknown Counter32,
rpkiRtrCacheServerErrorsDuplicateAnnounce Counter32
}
rpkiRtrCacheServerErrorsCorruptData OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'Corrupt Data' errors received from the RPKI cache server at the other end of this connection.
rpkiRtrCacheServerErrorsCorruptData OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "从本连接另一端的 RPKI 缓存服务器接收到的'损坏数据'错误数目。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 1 }
rpkiRtrCacheServerErrorsInternalError OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'Internal Error' errors received from the RPKI cache server at the other end of this connection.
rpkiRtrCacheServerErrorsInternalError OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "从本连接另一端的 RPKI 缓存服务器收到的'内部错误'错误数目。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 2 }
rpkiRtrCacheServerErrorsNoData OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'No Data Available' errors received
rpkiRtrCacheServerErrorsNoData OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "收到的'无数据可用'错误数
from the RPKI cache server at the other end of this connection.
连接另一端的 RPKI 缓存服务器。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 3 }
rpkiRtrCacheServerErrorsInvalidRequest OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'Invalid Request' errors received from the RPKI cache server at the other end of this connection.
rpkiRtrCacheServerErrorsInvalidRequest OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "从本连接另一端的 RPKI 缓存服务器收到的'无效请求'错误的数量。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 4 }
rpkiRtrCacheServerErrorsUnsupportedVersion OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'Unsupported Protocol Version' errors received from the RPKI cache server at the other end of this connection.
rpkiRtrCacheServerErrorsUnsupportedVersion OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "从本连接另一端的 RPKI 缓存服务器收到的'不支持协议版本'错误的数量。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 5 }
rpkiRtrCacheServerErrorsUnsupportedPdu OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'Unsupported PDU Type' errors received from the RPKI cache server at the other end of this connection.
rpkiRtrCacheServerErrorsUnsupportedPdu OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "从本连接另一端的 RPKI 缓存服务器收到的'不支持的 PDU 类型'错误的数量。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 6 }
rpkiRtrCacheServerErrorsWithdrawalUnknown OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'Withdrawal of Unknown Record'
rpkiRtrCacheServerErrorsWithdrawalUnknown OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "'撤销未知记录'的数量"。
errors received from the RPKI cache server at the other end of this connection.
从连接另一端的 RPKI 缓存服务器收到的错误信息。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 7 }
rpkiRtrCacheServerErrorsDuplicateAnnounce OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The number of 'Duplicate Announcement Received' errors received from the RPKI cache server at the other end of this connection.
rpkiRtrCacheServerErrorsDuplicateAnnounce OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "从本连接另一端的 RPKI 缓存服务器收到的'收到重复公告'错误的数量。
Discontinuities are indicated by the value
of rpkiRtrDiscontinuityTimer."
::= { rpkiRtrCacheServerErrorsTableEntry 8 }
-- ==============================================================
-- The rpkiRtrPrefixOriginTable
-- ==============================================================
rpkiRtrPrefixOriginTable OBJECT-TYPE
SYNTAX SEQUENCE OF RpkiRtrPrefixOriginTableEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION "This table lists the prefixes that were
announced by RPKI cache servers to this system.
That is the prefixes and their Origin Autonomous
System Number (ASN) as received by announcements
via the RPKI-Router Protocol."
::= { rpkiRtrObjects 4 }
rpkiRtrPrefixOriginTableEntry OBJECT-TYPE SYNTAX RpkiRtrPrefixOriginTableEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the rpkiRtrPrefixOriginTable. This represents one announced prefix. If a cache server is removed from the local configuration, any table rows associated with that server (indicated by rpkiRtrPrefixOriginCacheServerId) are also removed from this table.
rpkiRtrPrefixOriginTableEntry OBJECT-TYPE SYNTAX RpkiRtrPrefixOriginTableEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "rpkiRtrPrefixOriginTable 中的一个条目。它代表一个已公布的前缀。如果从本地配置中删除了缓存服务器，则与该服务器相关的任何表行（由 rpkiRtrPrefixOriginCacheServerId 指示）也将从该表中删除。
Implementers should be aware that if the rpkiRtrPrefixOriginAddress object exceeds 111 octets, the index values will exceed the 128 sub-identifier limit and cannot be accessed using SNMPv1, SNMPv2c, or SNMPv3."
实施者应注意，如果 rpkiRtrPrefixOriginAddress 对象超过 111 个八位字节，索引值将超过 128 个子标识符的限制，并且无法使用 SNMPv1、SNMPv2c 或 SNMPv3 进行访问"。
INDEX { rpkiRtrPrefixOriginAddressType,
rpkiRtrPrefixOriginAddress,
rpkiRtrPrefixOriginMinLength,
rpkiRtrPrefixOriginMaxLength,
rpkiRtrPrefixOriginASN,
rpkiRtrPrefixOriginCacheServerId
}
::= { rpkiRtrPrefixOriginTable 1 }
RpkiRtrPrefixOriginTableEntry ::= SEQUENCE {
rpkiRtrPrefixOriginAddressType InetAddressType,
rpkiRtrPrefixOriginAddress InetAddress,
rpkiRtrPrefixOriginMinLength InetAddressPrefixLength,
rpkiRtrPrefixOriginMaxLength InetAddressPrefixLength,
rpkiRtrPrefixOriginASN InetAutonomousSystemNumber,
rpkiRtrPrefixOriginCacheServerId Unsigned32
}
rpkiRtrPrefixOriginAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "The network address type for this prefix.
rpkiRtrPrefixOriginAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS not-accessible STATUS current DESCRIPTION "此前缀的网络地址类型。
Note: Only IPv4 and IPv6 support are required
for read-only compliance with RFC 6945."
::= { rpkiRtrPrefixOriginTableEntry 1 }
rpkiRtrPrefixOriginAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The network address for this prefix.
rpkiRtrPrefixOriginAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "此前缀的网络地址。
The format of the address is defined by the
value of the corresponding instance of
rpkiRtrPrefixOriginAddressType."
::= { rpkiRtrPrefixOriginTableEntry 2 }
rpkiRtrPrefixOriginMinLength OBJECT-TYPE
SYNTAX InetAddressPrefixLength
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION "The minimum prefix length allowed for this prefix."
::= { rpkiRtrPrefixOriginTableEntry 3 }
rpkiRtrPrefixOriginMaxLength OBJECT-TYPE SYNTAX InetAddressPrefixLength MAX-ACCESS not-accessible STATUS current DESCRIPTION "The maximum prefix length allowed for this prefix.
rpkiRtrPrefixOriginMaxLength OBJECT-TYPE SYNTAX InetAddressPrefixLength MAX-ACCESS not-accessible STATUS current DESCRIPTION "此前缀允许的最大前缀长度。
Note, this value must be greater or equal to the
value of rpkiRtrPrefixOriginMinLength."
::= { rpkiRtrPrefixOriginTableEntry 4 }
rpkiRtrPrefixOriginASN OBJECT-TYPE
SYNTAX InetAutonomousSystemNumber (0..4294967295)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION "The ASN that is authorized to announce the
prefix or sub-prefixes covered by this entry."
::= { rpkiRtrPrefixOriginTableEntry 5 }
rpkiRtrPrefixOriginCacheServerId OBJECT-TYPE
SYNTAX Unsigned32 (1..4294967295)
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The unique ID of the connection to the cache
server from which this announcement was received.
That connection is identified/found by a matching
value in attribute rpkiRtrCacheServerId."
::= { rpkiRtrPrefixOriginTableEntry 6 }
-- ==============================================================
-- Notifications
-- ==============================================================
rpkiRtrCacheServerConnectionStateChange NOTIFICATION-TYPE OBJECTS { rpkiRtrCacheServerConnectionStatus, rpkiRtrCacheServerLatestSerial, rpkiRtrCacheServerSessionID } STATUS current DESCRIPTION "This notification signals a change in the status of an rpkiRtrCacheServerConnection.
rpkiRtrCacheServerConnectionStateChange NOTIFICATION-TYPE OBJECTS { rpkiRtrCacheServerConnectionStatus, rpkiRtrCacheServerLatestSerial, rpkiRtrCacheServerSessionID } STATUS current DESCRIPTION "该通知表示 rpkiRtrCacheServerConnection 的状态发生变化。STATUS current DESCRIPTION "此通知表示 rpkiRtrCacheServerConnection 的状态发生变化。
The management agent MUST throttle the generation of consecutive rpkiRtrCacheServerConnectionStateChange notifications such that there is at least a 5 second gap between them.
管理代理必须控制连续 rpkiRtrCacheServerConnectionStateChange 通知的生成，使它们之间至少有 5 秒钟的间隔。
If more than one notification has occurred locally
during that time, the most recent notification is
sent at the end of the 5 second gap and the others
are discarded."
::= { rpkiRtrNotifications 1 }
rpkiRtrCacheServerConnectionToGoStale NOTIFICATION-TYPE OBJECTS { rpkiRtrCacheServerV4ActiveRecords, rpkiRtrCacheServerV6ActiveRecords, rpkiRtrCacheServerLatestSerial, rpkiRtrCacheServerSessionID, rpkiRtrCacheServerRefreshTimer, rpkiRtrCacheServerTimeToRefresh } STATUS current DESCRIPTION "This notification signals that an RPKI cache server connection is about to go stale. It is suggested that this notification is generated when the value of the rpkiRtrCacheServerTimeToRefresh attribute goes below 60 seconds.
rpkiRtrCacheServerConnectionToGoStale NOTIFICATION-TYPE OBJECTS { rpkiRtrCacheServerV4ActiveRecords, rpkiRtrCacheServerV6ActiveRecords, rpkiRtrCacheServerLatestSerial, rpkiRtrCacheServerSessionID, rpkiRtrCacheServerRefreshTimer, rpkiRtrCacheServerTimeToRefresh } STATUS current DESCRIPTION "该通知表示 RPKI 缓存服务器连接即将失效。STATUS current DESCRIPTION "此通知表示 RPKI 缓存服务器连接即将过时。建议在 rpkiRtrCacheServerTimeToRefresh 属性的值低于 60 秒时生成此通知。
The SNMP agent MUST throttle the generation of
consecutive rpkiRtrCacheServerConnectionToGoStale
notifications such that there is at least a
5 second gap between them.
"
::= { rpkiRtrNotifications 2 }
-- ==============================================================
-- Module Compliance information
-- ==============================================================
rpkiRtrCompliances OBJECT IDENTIFIER ::=
{rpkiRtrConformance 1}
rpkiRtrGroups OBJECT IDENTIFIER ::=
{rpkiRtrConformance 2}
rpkiRtrRFC6945ReadOnlyCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for the rpkiRtrMIB module. There are only read-only objects in this MIB module, so the 'ReadOnly' in the name of this compliance statement is there only for clarity and truth in advertising.
rpkiRtrRFC6945ReadOnlyCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "rpkiRtrMIB 模块的合规性声明。本 MIB 模块中只有只读对象，因此本合规性声明名称中的'ReadOnly'只是为了清晰起见和广告宣传。
There are a number of INDEX objects that cannot be represented in the form of OBJECT clauses in SMIv2, but for which there are compliance requirements. Those requirements and similar requirements for related objects are expressed below, in pseudo-OBJECT clause form, in this description:
在 SMIv2 中，有许多 INDEX 对象无法以 OBJECT 条款的形式表示，但对这些对象有合规要求。这些要求以及相关对象的类似要求将在下文中以伪 OBJECT 子句的形式表达：
-- OBJECT rpkiRtrCacheServerRemoteAddressType
-- SYNTAX InetAddressType { ipv4(1), ipv6(2), dns(16) }
-- DESCRIPTION
-- The MIB requires support for the IPv4, IPv6, and DNS
-- InetAddressTypes for this object.
-- OBJECT rpkiRtrCacheServerLocalAddressType
-- SYNTAX InetAddressType { ipv4(1), ipv6(2), dns(16) }
-- DESCRIPTION
-- The MIB requires support for the IPv4, IPv6, and DNS
-- InetAddressTypes for this object.
-- OBJECT rpkiRtrPrefixOriginAddressType
-- SYNTAX InetAddressType { ipv4(1), ipv6(2) }
-- DESCRIPTION
-- The MIB requires support for the IPv4, and IPv6
-- InetAddressTypes for this object.
"
MODULE -- This module MANDATORY-GROUPS { rpkiRtrCacheServerGroup, rpkiRtrPrefixOriginGroup, rpkiRtrNotificationsGroup }
MODULE -- 本模块 MANDATORY-GROUPS { rpkiRtrCacheServerGroup, rpkiRtrPrefixOriginGroup, rpkiRtrNotificationsGroup }
GROUP rpkiRtrCacheServerErrorsGroup DESCRIPTION "Implementation of this group is optional and would be useful for debugging."
GROUP rpkiRtrCacheServerErrorsGroup DESCRIPTION "该组的实现是可选的，将有助于调试"。
::= { rpkiRtrCompliances 1 }
rpkiRtrCacheServerGroup OBJECT-GROUP
OBJECTS {
rpkiRtrDiscontinuityTimer,
rpkiRtrCacheServerLocalAddressType,
rpkiRtrCacheServerLocalAddress,
rpkiRtrCacheServerLocalPort,
rpkiRtrCacheServerPreference,
rpkiRtrCacheServerConnectionType,
rpkiRtrCacheServerConnectionStatus,
rpkiRtrCacheServerDescription,
rpkiRtrCacheServerMsgsReceived,
rpkiRtrCacheServerMsgsSent,
rpkiRtrCacheServerV4ActiveRecords,
rpkiRtrCacheServerV4Announcements,
rpkiRtrCacheServerV4Withdrawals,
rpkiRtrCacheServerV6ActiveRecords,
rpkiRtrCacheServerV6Announcements,
rpkiRtrCacheServerV6Withdrawals,
rpkiRtrCacheServerLatestSerial,
rpkiRtrCacheServerSessionID,
rpkiRtrCacheServerRefreshTimer,
rpkiRtrCacheServerTimeToRefresh,
rpkiRtrCacheServerId
}
STATUS current
DESCRIPTION "The collection of objects to monitor the RPKI peer
connections."
::= { rpkiRtrGroups 1 }
rpkiRtrCacheServerErrorsGroup OBJECT-GROUP
OBJECTS {
rpkiRtrCacheServerErrorsCorruptData,
rpkiRtrCacheServerErrorsInternalError,
rpkiRtrCacheServerErrorsNoData,
rpkiRtrCacheServerErrorsInvalidRequest,
rpkiRtrCacheServerErrorsUnsupportedVersion,
rpkiRtrCacheServerErrorsUnsupportedPdu,
rpkiRtrCacheServerErrorsWithdrawalUnknown,
rpkiRtrCacheServerErrorsDuplicateAnnounce
}
STATUS current
DESCRIPTION "The collection of objects that may help in
debugging the communication between RPKI
clients and cache servers."
::= { rpkiRtrGroups 2 }
rpkiRtrPrefixOriginGroup OBJECT-GROUP
OBJECTS {
rpkiRtrPrefixOriginCacheServerId
}
STATUS current
DESCRIPTION "The collection of objects that represent
the prefix(es) and their validated Origin
ASes."
::= { rpkiRtrGroups 3 }
rpkiRtrNotificationsGroup NOTIFICATION-GROUP
NOTIFICATIONS { rpkiRtrCacheServerConnectionStateChange,
rpkiRtrCacheServerConnectionToGoStale
}
STATUS current
DESCRIPTION "The set of notifications to alert an NMS of change
in connections to RPKI cache servers."
::= { rpkiRtrGroups 4 }
END
结束
IANA has assigned the MIB module in this document the following OBJECT IDENTIFIER within the SMI Numbers registry.
IANA 在 SMI 编号注册表中为本文档中的 MIB 模块分配了以下 OBJECT IDENTIFIER。
Descriptor OBJECT IDENTIFIER value
---------- -----------------------
rpkiRtrMIB { mib-2 218 }
There are no management objects defined in this MIB module that have a MAX-ACCESS clause of read-write and/or read-create. So, if this MIB module is implemented correctly, then there is no risk that an intruder can alter or create any management objects of this MIB module via direct SNMP SET operations.
本 MIB 模块中没有定义 MAX-ACCESS 子句为读写和/或读创建的管理对象。因此，如果该 MIB 模块执行得当，入侵者就不会通过直接 SNMP SET 操作来更改或创建该 MIB 模块的任何管理对象。
Most of the readable objects in this MIB module (i.e., objects with a MAX-ACCESS other than not-accessible) may be considered sensitive or vulnerable in some network environments. They are vulnerable in the sense that when an intruder sees the information in this MIB module, then it might help him/her to set up an attack on the router or cache server. It is thus important to control even GET and/or NOTIFY access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP.
在某些网络环境中，本 MIB 模块中的大多数可读对象（即 MAX-ACCESS 不为不可访问的对象）可能被视为敏感或易受攻击的对象。它们的脆弱性在于，当入侵者看到此 MIB 模块中的信息时，可能会帮助他/她对路由器或缓存服务器发起攻击。因此，必须控制对这些对象的 GET 和/或 NOTIFY 访问，甚至在通过 SNMP 在网络上发送这些对象时对其值进行加密。
SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPsec), there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module.
SNMPv3 之前的 SNMP 版本不具备足够的安全性。即使网络本身是安全的（例如使用 IPsec），也无法控制安全网络中的哪些人可以访问和 GET/SET（读取/更改/创建/删除）此 MIB 模块中的对象。
Implementations MUST provide the security features described by the SNMPv3 framework (see [RFC3410]), including full support for authentication and privacy via the User-based Security Model (USM) [RFC3414] with the AES cipher algorithm [RFC3826]. Implementations MAY also provide support for the Transport Security Model (TSM) [RFC5591] in combination with a secure transport such as SSH [RFC5592] or TLS/DTLS [RFC6353].
实施必须提供 SNMPv3 框架（见 [RFC3410]）所描述的安全功能，包括通过基于用户的安全模型 (USM) [RFC3414] 和 AES 密码算法 [RFC3826] 对身份验证和隐私的全面支持。实施还可以结合 SSH [RFC5592] 或 TLS/DTLS [RFC6353] 等安全传输，提供对传输安全模型 (TSM) [RFC5591] 的支持。
Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them.
此外，不建议部署 SNMPv3 之前的 SNMP 版本。相反，建议部署 SNMPv3 并启用加密安全。然后，客户/运营商有责任确保访问该 MIB 模块实例的 SNMP 实体经过适当配置，只允许拥有合法权限的委托人（用户）访问对象，以便确实 GET 或 SET（更改/创建/删除）对象。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2287] Krupczak, C. and J. Saperia, "Definitions of System-Level Managed Objects for Applications", RFC 2287, February 1998.
[RFC2287] Krupczak, C. and J. Saperia, "Definitions of System-Level Managed Objects for Applications", RFC 2287, February 1998.
[RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. Schoenwaelder, Ed., "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
[RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. Schoenwaelder, Ed., "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Ed., Perkins, D., Ed., and J. Schoenwaelder, Ed., "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999.
[RFC2579] McCloghrie, K., Ed., Perkins, D., Ed., and J. Schoenwaelder, Ed., "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J. Schoenwaelder, "Textual Conventions for Internet Network Addresses", RFC 4001, February 2005.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J. Schoenwaelder, "Textual Conventions for Internet Network Addresses", RFC 4001, February 2005.
[RFC6810] Bush, R. and R. Austein, "The Resource Public Key Infrastructure (RPKI) to Router Protocol", RFC 6810, January 2013.
[RFC6810] Bush, R. and R. Austein, "The Resource Public Key Infrastructure (RPKI) to Router Protocol", RFC 6810, January 2013.
[RFC1982] Elz, R. and R. Bush, "Serial Number Arithmetic", RFC 1982, August 1996.
[RFC1982] Elz、R. 和 R. Bush，"序列号算术"，RFC 1982，1996 年 8 月。
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002.
[RFC3414] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", STD 62, RFC 3414, December 2002.
[RFC3414] Blumenthal, U. 和 B. Wijnen，"简单网络管理协议（SNMPv3）第 3 版基于用户的安全模型（USM）"，STD 62，RFC 3414，2002 年 12 月。
[RFC3826] Blumenthal, U., Maino, F., and K. McCloghrie, "The Advanced Encryption Standard (AES) Cipher Algorithm in the SNMP User-based Security Model", RFC 3826, June 2004.
[RFC3826] Blumenthal, U., Maino, F., and K. McCloghrie, "The Advanced Encryption Standard (AES) Cipher Algorithm in the SNMP User-based Security Model", RFC 3826, June 2004.
[RFC4252] Ylonen, T. and C. Lonvick, "The Secure Shell (SSH) Authentication Protocol", RFC 4252, January 2006.
[RFC4252] Ylonen, T. 和 C. Lonvick, "The Secure Shell (SSH) Authentication Protocol", RFC 4252, January 2006.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.
[RFC5246] Dierks、T. 和 E. Rescorla，"传输层安全（TLS）协议 1.2 版"，RFC 5246，2008 年 8 月。
[RFC5591] Harrington, D. and W. Hardaker, "Transport Security Model for the Simple Network Management Protocol (SNMP)", RFC 5591, June 2009.
[RFC5591] Harrington、D. 和 W. Hardaker，"简单网络管理协议 (SNMP) 的传输安全模型"，RFC 5591，2009 年 6 月。
[RFC5592] Harrington, D., Salowey, J., and W. Hardaker, "Secure Shell Transport Model for the Simple Network Management Protocol (SNMP)", RFC 5592, June 2009.
[RFC5592] Harrington, D., Salowey, J., and W. Hardaker, "Secure Shell Transport Model for the Simple Network Management Protocol (SNMP)", RFC 5592, June 2009.
[RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP Authentication Option", RFC 5925, June 2010.
[RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP Authentication Option", RFC 5925, June 2010.
[RFC6353] Hardaker, W., "Transport Layer Security (TLS) Transport Model for the Simple Network Management Protocol (SNMP)", RFC 6353, July 2011.
[RFC6353] Hardaker, W., "简单网络管理协议（SNMP）的传输层安全（TLS）传输模型"，RFC 6353，2011 年 7 月。
Authors' Addresses
作者地址
Randy Bush Internet Initiative Japan 5147 Crystal Springs Bainbridge Island, WA 98110 US
Randy Bush Internet Initiative Japan 5147 Crystal Springs Bainbridge Island, WA 98110 US
EMail: [email protected]
Bert Wijnen RIPE NCC Schagen 33 3461 GL Linschoten Netherlands
Bert Wijnen RIPE NCC Schagen 33 3461 GL Linschoten 荷兰
EMail: [email protected]
Keyur Patel Cisco Systems 170 W. Tasman Drive San Jose, CA 95134 USA
Keyur Patel 思科系统 170 W. Tasman Drive San Jose, CA 95134 USA
EMail: [email protected]
Michael Baer SPARTA P.O. Box 72682 Davis, CA 95617 USA
Michael Baer SPARTA P.O. Box 72682 Davis, CA 95617 USA
EMail: [email protected]