]> IBM

Saeumerstrasse 4 Rueschlikon 8803 CH rha@zurich.ibm.com http://www.zurich.ibm.com/~rha

Routing Forwarding and Control Element Separation (forces) ForCES MIB This memo defines a Management Information Base (MIB) module for use with network management protocols in the Internet community. In particular, it defines managed objects for the Forwarding and Control Element Separation (ForCES) Network Element (NE).

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of . Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, , STD 58, and STD 58, .

The ForCES MIB module is a read-only MIB module that captures information related to the ForCES protocol (, , and ). The ForCES MIB module does not include information that is specified in other MIB modules, such as packet counters for interfaces, etc. More specifically, the information in the ForCES MIB module relative to associations (between Control Elements and Forwarding Elements) that are in the UP state includes: identifiers of the elements in the association, configuration parameters of the association, and statistics of the association.

The MIB module contains the latest ForCES protocol version supported by the Control Element (CE) (forcesLatestProtocolVersionSupported). Note that the CE must also allow interaction with Forwarding Elements (FEs) supporting earlier versions. For each association identified by the pair CE ID and FE ID, the following associated information is provided by the MIB module as an entry (forcesAssociationEntry) in the association table (forcesAssociationTable): Version number of the ForCES protocol running in this association (forcesAssociationRunningProtocolVersion). Time when the association entered the UP state (forcesAssociationTimeUp). Time when the association left the UP state (forcesAssociationTimeDown). Note that this is only used for notification purposes as the association is removed from the MIB immediately after it leaves the UP state. Number of ForCES Heartbeat messages sent from the CE (forcesAssociationHBMsgSent) and received by the CE (forcesAssociationHBMsgReceived) since the association entered the UP state. Number of operational ForCES messages sent from the CE (forcesAssociationOperMsgSent) and received by the CE (forcesAssociationOperMsgReceived) since the association entered the UP state. Only messages other than Heartbeat, Association Setup, Association Setup Response, and Association Teardown are counted. Finally, the MIB module defines the following notifications: Whenever an association enters the UP state, a notification (forcesAssociationEntryUp) is issued containing the version of the ForCES protocol running. CE ID and FE ID are concatenated to form the table index, hence they appear in the OID of the ForCES-protocol running-version object. Optionally, a notification (forcesAssociationEntryUpStats) can instead be issued with all associated information for this association, except forcesAssociationTimeDown. Whenever an association leaves the UP state, a notification (forcesAssociationEntryDown) is issued containing the version of the ForCES protocol running. Optionally, a notification (forcesAssociationEntryDownStats) can instead be issued with all associated information for this association. The reason is that the association and all its associated information will be removed from the MIB immediately after this notification has been issued.

Associations enter the UP state as soon as the CE has sent to the FE an Association Setup Response message containing a successful Association Setup Result. Only associations that are UP are reflected in this MIB module. Associations are removed from the MIB module as soon as they leave the UP state, i.e., if the CE has not received any message (Heartbeat or other protocol message) from the FE within a given time period or if an Association Teardown message has been sent by the CE. Statistics counters are initialized to zero when the association is created. If the same association goes down and comes back up, the counters will reset and the discontinuity can be discovered by checking the discontinuity timestamp. In addition, the time-up timestamp in the association allows to distinguish new associations from past ones with the same index. Note that the optional down notification contains the statistics with the final values of the statistics counters.

An NE consists of one or more FEs and one or more CEs. Where there is a single CE, that CE will have knowledge of all the associations in the NE and so can provide the information necessary to support the managed objects defined in this MIB module. Where there is more than one CE, information about the associations may be distributed among the CEs. Whether each CE implements the managed objects for the associations of which it is aware or whether the CEs cooperate to present the appearance of a single set of managed objects for all the associations in the NE is outside the scope of this document.

There are no management objects defined in this MIB module that have a MAX-ACCESS clause of read-write and/or read-create. So, if this MIB module is implemented correctly, then there is no risk that an intruder can alter or create any management objects of this MIB module via direct SNMP SET operations. Some of the readable objects in this MIB module (i.e., objects with a MAX-ACCESS other than not-accessible) may be considered sensitive or vulnerable in some network environments. It is thus important to control even GET and/or NOTIFY access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP. These are the tables and objects and their sensitivity/vulnerability: Objects in the forcesMibGroup are protocol versions. They are neither sensitive nor vulnerable. Objects in the forcesStatsGroup are statistics. They are neither sensitive nor vulnerable. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPsec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see , section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them.

The MIB module in this document uses the following IANA-assigned OBJECT IDENTIFIER values recorded in the SMI Numbers registry:

Editor's Note (to be removed prior to publication): the IANA is requested to assign a value for "XXX" under the 'mib-2' subtree and to record the assignment in the SMI Numbers registry. When the assignment has been made, the RFC Editor is asked to replace "XXX" (here and in the MIB module) with the assigned value and to remove this note.

Editor's Note (to be removed prior to publication): Prior to RFC publication of this document, the RFC Editor is asked to remove this entire section titled "Changes from Previous Draft Versions". Changes from draft-ietf-forces-mib-09: Moved the DISPLAY-HINT clause in the ForcesProtocolVersion MIB object before the STATUS clause to be conformant with RFC2579 (comment from Bert). Changes from draft-ietf-forces-mib-08: Changed the MIB objects forcesAssociationOtherMsgSent and forcesAssociationOtherMsgReceived to forcesAssociationOperMsgSent and forcesAssociationOperMsgReceived as they are not all other messages besides HB (comment from the General Area Review Team). Changed MIB counter objects forcesAssociationHBMsgSent, forcesAssociationHBMsgReceived, forcesAssociationOperMsgSent, and forcesAssociationOperMsgReceived from Counter32 to ZeroBasedCounter32 (comment from Bert Wijnen). Adapted the paragraph about statistics counters in section "Associations kept in the MIB" Introduced a MIB object forcesAssociationCounterDiscontinuityTime, and added it to the forcesAssociationEntry as well as to the forcesAssociationEntryDownStats notification and the forcesStatsGroup compliance group. Added text on discontinuity for all counter objects. Removed MIB counters from the forcesAssociationEntryUpStats notification, as passing now zero values is useless. Changes from draft-ietf-forces-mib-07: They are editorial changes made as suggested by the General Area Review Team. Changes from draft-ietf-forces-mib-06: Informational RFCs 3654 and 3746 moved to Informative References section. Updated chairs' names in the MIB description. Update references to protocol and applicability drafts. Reversed the order of the two first sentences in section "Associations kept in the MIB" Changes from draft-ietf-forces-mib-05: Copyright statement in the MIB description corrected to IETF Trust. Changes from draft-ietf-forces-mib-04. They are changes suggested by the MIB doctor review, according to the MIB Review Checklist in Appendix A of RFC 4181: Changed MIB descriptions with "since the association entered the UP state" instead of "since the association is up". Updated the I-D boilerplate copyright statement. Removed last sentence of abstract. Moved the MIB boilerplate into a section of its own. Moved the MIB definition into a section of its own. Updated the Security Considerations section according to the boilerplate at http://www.ops.ietf.org/mib-security.html. Updated the MIB description with the copyright statement. Added DISPLAY-HINT to the ForCESProtocolVersion. Note that the smilint tool doesn't like it. Added IETF to the MODULE-IDENTITY ORGANIZATION. Updated CONTACT-INFO to indicate how to reach the group. Changed forcesAssocationTimeDown MAX-ACCESS to accessible-for-notify. Added text to DESCRIPTION of forcesAssociationTimeUp to indicate that it allows to uniquely identify associations with the same FE and CE IDs. Added two optional notifications that carry stats and added corresponding text in the last paragraph of section titled "Associations kept in the MIB". The reason is that optional objects such as stats in a mandatory notification are not supported. Changes from draft-ietf-forces-mib-03. They are small fixes to the text and the MIB module: Added MIB boilerplate according to http://www.ops.ietf.org/mib-boilerplate.html Clarified terminology with respect to MIB module and MIB managed objects. Added RFC Editor note to indicate RFC number for version 1 of ForCES protocol under ForcesProtocolVersion. Renumbered elements in forcesAssociationEntry starting with 1. Changed ForcesProtocolVersion from INTEGER to Integer32. Added forcesLatestProtocolVersionSupported into the mandatory forcesMibGroups conformance group. Explicitely added the forcesStatsGroup to the forcesMibCompliance compliance statement as optional. Moved the MIB Definition section to the front. Rephrased IANA Considerations section according to RFC 4181 Section 3.5.2. Added RFC Editor note to remove the "Changes from Previous Draft Revisions" section prior to publication. Changes from draft-ietf-forces-mib-02. They are refinements of the MIB module: Changed forcesAssociationCEID and forcesAssociationFEID from read-only to not-accessible to conform with Section 7.7 in . Removed forcesAssociationCEID and forcesAssociationFEID from the notifications. This information is conveyed in the OID anyway. Added MIB conformance information. Changes from draft-ietf-forces-mib-01. The changes are in response to the Working Group Last Call: Addition of two traps/notifications to signal the associations that enter or leave the UP state. Suppression of the DOWN and ESTABLISHING states. Only associations in the UP state are kept in the table. Split of the Message counters into Heartbeat and other messages. Addition of the current running version of ForCES protocol for each association in the UP state. Addition of the latest version of the ForCES protocol supported by the CE.

&rfc2119; &rfc2578; &rfc2579; &rfc2580; ETRI IBM Znyx Intel Zhejiang Gongshang University &rfc3410; &rfc3654; &rfc3746; Intel Intel ICIR ETRI

The author gratefully acknowledges the contributions of: Jinrong Fenggen, John Flick, Xiaoyi Guo, Joel Halpern, Tom Petch, and Jamal Hadi Salim.