path: root/doc/rfc/rfc5324.txt

Network Working Group                                       C. DeSanti
Request for Comments: 5324                                    F. Maino
Category: Standards Track                                K. McCloghrie
                                                         Cisco Systems
                                                        September 2008


            MIB for Fibre-Channel Security Protocols (FC-SP)

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   This memo defines a portion of the Management Information Base (MIB)
   for use with network management protocols in the Internet community.
   In particular, it describes managed objects for information related
   to FC-SP, the Security Protocols defined for Fibre Channel.

Table of Contents

   1. Introduction ....................................................3
   2. The Internet-Standard Management Framework ......................3
   3. Overview of Fibre Channel .......................................3
      3.1. Introduction ...............................................3
      3.2. Zoning .....................................................4
      3.3. Virtual Fabrics ............................................5
      3.4. Security ...................................................5
           3.4.1. Authentication ......................................5
           3.4.2. Security Associations ...............................6
           3.4.3. Fabric Security Policies ............................7
           3.4.4. Policy Model ........................................8
           3.4.5. Policy Objects ......................................9
                  3.4.5.1. Policy Object Names .......................10
           3.4.6. Three Kinds of Switches ............................10
           3.4.7. Security Policy Management .........................11
           3.4.8. FC-SP Zoning .......................................11
   4. Document Overview ..............................................12
      4.1. Fibre Channel Management Instance .........................12
      4.2. Entity Name ...............................................12
      4.3. Fabric Index ..............................................13
      4.4. Interface Index ...........................................13
      4.5. Syntax for Policy Object Names ............................14



De Santi, et al.            Standards Track                     [Page 1]
^L
RFC 5324                     MIB for FC-SP                September 2008


      4.6. Certificates, CAs, and CRLs ...............................14
      4.7. Traffic Selectors .........................................15
      4.8. The MIB Modules ...........................................16
           4.8.1. The T11-FC-SP-TC-MIB Module ........................16
           4.8.2. The T11-FC-SP-AUTHENTICATION-MIB Module ............16
           4.8.3. The T11-FC-SP-ZONING-MIB Module ....................16
           4.8.4. The T11-FC-SP-POLICY-MIB Module ....................17
           4.8.5. The T11-FC-SP-SA-MIB Module ........................17
      4.9. Rate Control for Notifications ............................18
   5. Relationship to Other MIB Modules ..............................19
   6. MIB Module Definitions .........................................20
      6.1. The T11-FC-SP-TC-MIB Module ...............................20
      6.2. The T11-FC-SP-AUTHENTICATION-MIB Module ...................33
      6.3. The T11-FC-SP-ZONING-MIB Module ...........................52
      6.4. The T11-FC-SP-POLICY-MIB Module ...........................64
      6.5. The T11-FC-SP-SA-MIB Module ..............................152
   7. IANA Considerations ...........................................204
   8. Security Considerations .......................................204
      8.1. Information Not Defined in This Document .................204
      8.2. The T11-FC-SP-TC-MIB Module ..............................204
      8.3. The T11-FC-SP-AUTHENTICATION-MIB Module ..................205
      8.4. The T11-FC-SP-ZONING-MIB Module ..........................206
      8.5. The T11-FC-SP-POLICY-MIB Module ..........................207
      8.6. The T11-FC-SP-SA-MIB Module ..............................209
      8.7. Recommendations Common to All MIB Modules ................211
   9. Normative References ..........................................212
   10. Informative References .......................................213
   11. Acknowledgements .............................................215























De Santi, et al.            Standards Track                     [Page 2]
^L
RFC 5324                     MIB for FC-SP                September 2008


1.  Introduction

   This memo defines a portion of the Management Information Base (MIB)
   for use with network management protocols in the Internet community.
   In particular, it describes managed objects for information
   concerning the Fibre Channel Security Protocols (FC-SP), as specified
   in [FC-SP].  The FC-SP standard includes the definition of protocols
   to authenticate Fibre Channel entities, protocols to set up session
   keys, protocols to negotiate the parameters required to ensure frame-
   by-frame integrity and confidentiality, and protocols to establish
   and distribute policies across a Fibre Channel Fabric.

   This memo was initially developed by the INCITS T11 committee
   (http://www.t11.org), which subsequently approved it for forwarding
   to the IETF.

   This memo uses one of the following terms:

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in BCP 14, RFC 2119
   [RFC2119].

2.  The Internet-Standard Management Framework

   For a detailed overview of the documents that describe the current
   Internet-Standard Management Framework, please refer to section 7 of
   RFC 3410 [RFC3410].

   Managed objects are accessed via a virtual information store, termed
   the Management Information Base, or MIB.  MIB objects are generally
   accessed through the Simple Network Management Protocol (SNMP).
   Objects in the MIB are defined using the mechanisms defined in the
   Structure of Management Information (SMI).  This memo specifies a MIB
   module that is compliant to the SMIv2, which is described in STD 58,
   RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579], and STD 58, RFC 2580
   [RFC2580].

3.  Overview of Fibre Channel

3.1.  Introduction

   Fibre Channel (FC) is logically a bidirectional point-to-point serial
   data channel, structured for high performance.  Fibre Channel
   provides a general transport vehicle for higher-level protocols such
   as Small Computer System Interface (SCSI) command sets, the High-
   Performance Parallel Interface (HIPPI) data framing, IP (Internet
   Protocol), IEEE 802.2, and others.



De Santi, et al.            Standards Track                     [Page 3]
^L
RFC 5324                     MIB for FC-SP                September 2008


   Physically, Fibre Channel is an interconnection of multiple
   communication points, called N_Ports, interconnected either by a
   switching network, called a Fabric, or by a point-to-point link.  A
   Fibre Channel "Node" consists of one or more N_Ports.  A Fabric may
   consist of multiple Interconnect Elements, some of which are
   Switches.  An N_Port connects to the Fabric via a port on a Switch
   called an F_Port.  When multiple FC Nodes are connected to a single
   port on a Switch via an "Arbitrated Loop" topology, the Switch port
   is called an FL_Port, and the Nodes' ports are called NL_Ports.  The
   term Nx_Port is used to refer to either an N_Port or an NL_Port.  The
   term Fx_Port is used to refer to either an F_Port or an FL_Port.  A
   Switch port, which is interconnected to another Switch port via an
   Inter-Switch Link (ISL), is called an E_Port.  A B_Port connects a
   bridge device with an E_Port on a Switch; a B_Port provides a subset
   of E_Port functionality.

   Many Fibre Channel components, including the Fabric, each Node, and
   most ports, have globally unique names.  These globally unique names
   are typically formatted as World Wide Names (WWNs).  More information
   on WWNs can be found in [FC-FS-2].  WWNs are expected to be
   persistent across agent and unit resets.

   Fibre Channel frames contain 24-bit address identifiers that identify
   the frame's source and destination ports.  Each FC port has both an
   address identifier and a WWN.  When a Fabric is in use, the FC
   address identifiers are dynamic and are assigned by a Switch.  Each
   octet of a 24-bit address represents a level in an address hierarchy,
   with a Domain_ID being the highest level of the hierarchy.

3.2.  Zoning

   Zones within a Fabric provide a mechanism to control frame delivery
   between Nx_Ports ("Hard Zoning") or to expose selected views of Name
   Server information ("Soft Zoning").

   Communication is only possible when the communicating endpoints are
   members of a common zone.  This technique is similar to virtual
   private networks in that the Fabric has the ability to group devices
   into Zones.

   Hard zoning and soft zoning are two different means of realizing
   this.  Hard zoning is enforced in the Fabric (i.e., Switches),
   whereas soft zoning is enforced at the endpoints (e.g., Host Bus
   Adapters) by relying on the endpoints to not send traffic to an
   N_Port_ID not obtained from the Name Server with a few exceptions for
   well known Addresses (e.g., the Name Server).





De Santi, et al.            Standards Track                     [Page 4]
^L
RFC 5324                     MIB for FC-SP                September 2008


   Administrators create Zones to increase network security, and prevent
   data loss or corruption, by controlling access between devices or
   user groups.

3.3.  Virtual Fabrics

   The standard for an interconnecting Fabric containing multiple Fabric
   Switch elements is [FC-SW-4].  [FC-SW-4] carries forward the earlier
   specification for the operation of a single Fabric in a physical
   infrastructure, and augments it with the definition of Virtual
   Fabrics and with the specification of how multiple Virtual Fabrics
   can operate within one or more physical infrastructures.  The use of
   Virtual Fabrics provides for each frame to be tagged in its header to
   indicate which one of several Virtual Fabrics that frame is being
   transmitted on.  All frames entering a particular "Core Switch"
   [FC-SW-4] (i.e., a physical Switch) on the same Virtual Fabric are
   processed by the same "Virtual Switch" within that Core Switch.

3.4.  Security

   The Fibre Channel Security Protocols (FC-SP) standard [FC-SP]
   describes the protocols used to implement security in a Fibre Channel
   Fabric, including the definition of:

      - protocols to authenticate Fibre Channel entities,

      - protocols to set up session keys,

      - protocols to negotiate the parameters required to ensure frame-
        by-frame integrity and confidentiality, and

      - protocols to establish and distribute (security) policies across
        a Fibre Channel Fabric.

3.4.1.  Authentication

   Two entities may negotiate whether authentication is required and
   which Authentication Protocol is to be used.  Authentication can be
   used in Switch-to-Switch, Node-to-Switch, and Node-to-Node
   communication.  The defined Authentication Protocols are able to
   perform mutual authentication with optional shared key establishment.
   The shared key computed at the end of an Authentication Transaction
   may be used to establish Security Associations.








De Santi, et al.            Standards Track                     [Page 5]
^L
RFC 5324                     MIB for FC-SP                September 2008


   The Fabric security architecture is defined for several
   authentication infrastructures.  Secret-based, certificate-based, and
   password-based authentication infrastructures are accommodated.
   Specific authentication protocols that directly leverage these three
   authentication infrastructures are defined.

   With a secret-based infrastructure, entities within the Fabric
   environment that establish a security relationship share a common
   secret or centralize the secret administration in an external (e.g.,
   RADIUS [RFC2865], Diameter [RFC3588], or Terminal Access Controller
   Access Control System (TACACS) [RFC1492]) server.  Entities may
   mutually authenticate with other entities by using the Diffie-Hellman
   Challenge Handshake Authentication Protocol (DH-CHAP) [FC-SP].
   Security Associations may be set up using the session key computed at
   the end of the DH-CHAP transaction.

   With a certificate-based infrastructure, entities within the Fabric
   environment are certified by a trusted Certificate Authority (CA).
   The resulting certificates bind each entity to a public-private key
   pair that may be used to mutually authenticate with other certified
   entities via the Fibre Channel Certificate Authentication Protocol
   (FCAP) [FC-SP].  Security Associations may be set up by using these
   entity certificates and associated keys or by using the session key
   computed at the end of the FCAP transaction.

   With a password-based infrastructure, entities within the Fabric
   environment that establish a security relationship have knowledge of
   the password-based credential material of other entities.  Entities
   may use this credential material to mutually authenticate with other
   entities using the Fibre Channel Password Authentication Protocol
   (FCPAP) [FC-SP].  Security Associations may be set up using the
   session key computed at the end of the FCPAP transaction.

   In addition to DH-CHAP, FCAP, and FCPAP, one other Authentication
   Protocol is defined: Internet Key Exchange Protocol version 2-AUTH
   (IKEv2-AUTH), which refers to the use of an SA Management Transaction
   of the Security Association Management Protocol (see below) to
   perform two functions: not only SA management but also
   authentication.  The credentials used in an IKEv2-AUTH transaction
   are either strong shared secrets or certificates.

3.4.2.  Security Associations

   A subset of the IKEv2 protocol [RFC4306] suitable for Fibre Channel
   is defined as the (Fibre Channel) Security Association Management
   protocol [RFC4595].  This protocol -- which is *not* IPsec --
   provides the means to establish Security Associations (SAs) between
   Fibre Channel entities.  Traffic Selectors are defined to specify



De Santi, et al.            Standards Track                     [Page 6]
^L
RFC 5324                     MIB for FC-SP                September 2008


   which type of traffic has to be protected by which SA, and what the
   characteristics of the protection are.  Two mechanisms are available
   to protect specific classes of traffic:

      - ESP_Header is used to protect FC-2 frames (see [FC-FS-2] and the
        conceptually similar mechanisms in [RFC4303]), and

      - CT_Authentication is used to protect CT_IUs (Common Transport
        Information Units) [FC-GS-5].

   An entity protecting specific classes of traffic maintains an
   internal Security Association Database (SADB) that contains the
   currently active Security Associations and Traffic Selectors.

   Each active SA has a Security Association entry in the SADB.  Each SA
   entry includes the SA's SPI (the Security Parameters Index, which is
   included in frames transmitted on the SA), a Sequence Number counter,
   and the parameters for the selected transforms (e.g., encryption
   algorithm, integrity algorithm, mode of operation of the algorithms,
   keys).

   Each active Traffic Selector has an entry in the SADB that indicates
   whether it is used for ingress traffic or for egress traffic.  These
   Traffic Selector entries are ordered such that they are searched
   (when checking for a match) in the given order.  Two types of Traffic
   Selector entries may be present:

      - Traffic Selector entries identifying FC-2 frames or CT_IUs to be
        bypassed or discarded; and

      - Traffic Selector entries identifying FC-2 frames or CT_IUs to be
        protected or verified.  These entries point to the corresponding
        SA entry defining the parameters and the security processing to
        be performed.

   SAs are unidirectional, but they always exist as an SA pair of the
   same type, one in each direction.

3.4.3.  Fabric Security Policies

   Two separate approaches to defining Policies are adopted in FC-SP,
   but both approaches follow the same general concept for their Policy
   model.  One is the definition of a Policy Model for Fabric Policies
   that focus on Security.  These Security Policies specify the
   membership and connectivity allowed within a Fabric, and also which
   IP hosts are allowed to manage a Fabric.





De Santi, et al.            Standards Track                     [Page 7]
^L
RFC 5324                     MIB for FC-SP                September 2008


   The other approach is to define a variant of the Enhanced Zoning
   model defined in [FC-SW-4] and [FC-GS-5], such that the variant
   specifies extensions for use in a secure environment.  This variant
   of Zoning, denoted as "FC-SP Zoning", follows the same general
   concepts of the Policy model for Security Policies, but keeps Zoning
   management and enforcement completely independent from the management
   and enforcement of other policies.

3.4.4.  Policy Model

   Figure 25 of [FC-SP] depicts FC-SP's policy management model like
   this:

   *****          ************************
   *   *          *  Policy              *    *********************
   * M *  Add,    *  Configuration       *    * Policy            *
   * A *  Get,    *  Entity              *    * Enforcement       *
   * N *  Remove  *                      *    * Entity            *
   * A *  Policy  *  +----------------+  *    *                   *
   * G *  Objects *  | Non-Active     |  *    *  +-------------+  *
   * I *<-------->*  | Policy Objects |==*====*=>| Active      |  *
   * N *          *  +----------------+  *    *  | Policy      |  *
   * G *          ************************    *  | Objects     |  *
   *   *                                      *  +-------------+  *
   *   *              Activate Policy Summary *                   *
   * E *=====================================>*  +-------------+  *
   * N *            Deactivate Policy Summary *  | Policy      |  *
   * T *=====================================>*  | Summary     |  *
   * I *                                      *  | Object      |  *
   * T *            Get Policy Summary        *  +-------------+  *
   * Y *<-------------------------------------*                   *
   *   *            Get Policy Objects        *                   *
   *   *<-------------------------------------*                   *
   *****                                      *********************

   Note that the arrows in the picture above are used to indicate the
   movement of "data", rather than the direction of "messages", e.g.,
   for a "Get" (with no data) in one direction which invokes a
   "Response" (typically with data) in the reverse direction, the
   diagram has arrows only for the "with data" direction.











De Santi, et al.            Standards Track                     [Page 8]
^L
RFC 5324                     MIB for FC-SP                September 2008


3.4.5.  Policy Objects

   The Policies to be enforced by a Fabric are specified in a set of
   Policy Objects.  The various types of Policy Objects are:

      - The Policy Summary Object is a list of pointers to other Policy
        Objects, one pointer per each other active Policy Object.  Each
        pointer in a Policy Summary Object is paired with a
        cryptographic hash of the referenced Policy Object.

      - The Switch Membership List Object is a Fabric-wide Policy Object
        that defines which Switches are allowed to be part of a Fabric.

      - The Node Membership List Object is a Fabric-wide Policy Object
        that defines which Nodes are allowed to be connected to a
        Fabric.

      - The IP Management List Object is a Fabric-wide Policy Object
        that describes which IP hosts are allowed to manage a Fabric.

      - A Switch Connectivity Object is a per-Switch Policy Object that
        describes the topology restrictions for a specific Switch; it
        specifies the other Switches or Nodes to which the particular
        Switch may be connected at the Node level and/or at the Port
        level.

      - Attribute Objects are Fabric-wide Policy Objects that define
        optional attributes to be associated with Switches or Nodes.
        They allow the extension of this policy model by defining new
        attributes as required.

   Note that the administratively specified name for a Fabric is
   contained in the Switch Membership List Object (not in the Policy
   Summary Object).

   When FC-SP is in use, each Fabric has a set of active Policy Objects:

      - one Policy Summary Object,

      - one Switch Membership List Object,

      - one Node Membership List Object,

      - one IP Management List Object,

      - zero or more Switch Connectivity Objects, and

      - zero or more Attribute Objects.



De Santi, et al.            Standards Track                     [Page 9]
^L
RFC 5324                     MIB for FC-SP                September 2008


   The active Policy Objects specify the Policies currently being
   enforced.  In addition, policies not currently being enforced are
   contained in non-active Policy Objects.  To change the active Policy
   Objects, the non-active Policy Objects are edited as necessary and a
   new Policy Summary Object that includes/references the changed Policy
   Objects is activated.

3.4.5.1.  Policy Object Names

   Every Policy Object has a name.  In a Fabric's database of Policy
   Objects, a Policy Object Name is specified as a type/length/value
   (see section 7.2 of [FC-SP]).  The possible types are:

      - Node_Name

      - Restricted Node_Name

      - Port_Name

      - Restricted Port_Name

      - Wildcard

      - Negated Wildcard

      - Alphanumeric Name

      - IPv6 Address Range

      - IPv4 Address Range

3.4.6.  Three Kinds of Switches

   For a Fabric composed of n Switches and m Nodes, the potential
   complexity of Switch Connectivity Objects is O(n**2) to describe
   Switch to Switch connections, and O(n*m) for Switch to Node
   connections.  To provide better scaling, the Switch Connectivity
   Objects are not Fabric-wide information, but are distributed only to
   where they are needed.  To support this, the policy model supports
   three kinds of Switches in a Fabric:

      - Server Switches, which maintain the Fabric-wide Policy Objects,
        all the Switch Connectivity Objects, and a full copy of the FC-
        SP Zoning Database;

      - Autonomous Switches, which maintain the Fabric-wide Policy
        Objects, their own Switch Connectivity Object, and a full copy
        of the FC-SP Zoning Database; and



De Santi, et al.            Standards Track                    [Page 10]
^L
RFC 5324                     MIB for FC-SP                September 2008


      - Client Switches, which maintain the Fabric-wide Policy Objects,
        their own Switch Connectivity Object, and a subset of the FC-SP
        Active Zone Set (which is the configurations of zones currently
        being enforced by a Fabric, see section 10.4.3.3 of [FC-SW-4]).

3.4.7.  Security Policy Management

   Security Policy can be changed in a server session [FC-GS-5] with a
   Security Policy Server.  All write access to a Security Policy Server
   occurs within a server session.  While read access to a Security
   Policy Server may occur at any time, the consistency of the returned
   data is guaranteed only inside a server session.

   The Enhanced Commit Service [FC-SW-4] is used to perform Fabric
   operations as and when necessary (see table 144 of [FC-SP]).  Many of
   these operations are named as if they were acronyms, e.g., SSB for
   Server Session Begin; SSE for Server Session End; SW_ILS for Switch
   Fabric Internal Link Services; EACA for Enhanced Acquire Change
   Authorization; ERCA for Enhanced Release Change Authorization; SFC
   for Stage Fabric Configuration.

   Each server session begins and ends, with a SSB request and a SSE
   request respectively, sent to a Security Policy Server.  In the
   Fabric, the SSB requests a lock of the Fabric via an EACA SW_ILS,
   while the SSE requests a release of the lock via the ERCA SW_ILS
   [FC-SW-4].  Active and non-active Policy Objects are persistent in
   that they survive after the end of a server session.

3.4.8.  FC-SP Zoning

   To preserve backward compatibility with existing Zoning definitions
   and implementations, FC-SP Zoning is defined as a variant of the
   Enhanced Zoning model defined in [FC-SW-4] and [FC-GS-5] that follows
   the general concepts of the Policy model for Security Policy
   Management, but keeps Zoning management and enforcement completely
   independent.

   FC-SP Zoning allows for some Switches to retain less than a complete
   replicated copy of the Zoning Database, as follows:

      - Server Switches maintain the policies data structures for all
        Switches in the Fabric plus a replica of the Zoning data
        structures;

      - Autonomous Switches maintain only the subset of policies data
        structures relevant for their operations plus a replica of the
        Zoning Database; and




De Santi, et al.            Standards Track                    [Page 11]
^L
RFC 5324                     MIB for FC-SP                September 2008


      - Client Switches maintain only the subset of policies data
        structures and the subset of the Active Zone Set relevant for
        their operations.

   When Client Switches are deployed in a Fabric, at least one Server
   Switch must also be deployed in the same Fabric.  A client-server
   protocol allows Client Switches to dynamically retrieve the Zoning
   information they may require from the Server Switches.

   A management application manages the Fabric Zoning configuration
   through the Fabric Zone Server, while other policies are managed
   through the Security Policy Server.  A new Zoning Check Protocol
   replaces the Zone Merge Protocol [FC-SW-4], and new command codes are
   defined for the SFC SW_ILS to distribute the FC-SP Zoning
   configuration on a Fabric.  The Zoning definitions are ordered to
   allow for the computation of a hash of the Active Zone Set and a hash
   of the Zone Set Database, plus other optional security data (e.g.,
   for integrity protection of Zoning information).

4.  Document Overview

   This document defines five MIB modules that together provide the
   means for monitoring the operation of, and configuring some
   parameters of, one or more instances of the FC-SP protocols.

4.1.  Fibre Channel Management Instance

   A Fibre Channel management instance is defined in [RFC4044] as a
   separable managed instance of Fibre Channel functionality.  Fibre
   Channel functionality may be grouped into Fibre Channel management
   instances in whatever way is most convenient for the
   implementation(s).  For example, one such grouping accommodates a
   single SNMP agent having multiple AgentX [RFC2741] sub-agents, with
   each sub-agent implementing a different Fibre Channel management
   instance.

   The object, fcmInstanceIndex, is IMPORTed from the FC-MGMT-MIB
   [RFC4044] as the index value to uniquely identify each Fibre Channel
   management instance, for example, within the same SNMP context
   ([RFC3411] section 3.3.1).

4.2.  Entity Name

   A central capability of FC-SP is the use of an Authentication
   Protocol.  The purpose of each of the possible Authentication
   Protocols is to allow a Fibre Channel entity to be assured of the
   identity of each entity with which it is communicating.  Examples of
   such entities are Fibre Channel Switches and Fibre Channel Nx_Ports.



De Santi, et al.            Standards Track                    [Page 12]
^L
RFC 5324                     MIB for FC-SP                September 2008


   Each entity is identified by a name.  The FC-MGMT-MIB [RFC4044]
   defines MIB objects for such names:

      - for entities that are Fibre Channel Switches, the definition of
        a Fibre Channel management instance allows multiple Switches to
        be managed by the same Fibre Channel management instance.  In
        this case, each entity is a Switch and has the name given by the
        MIB object, fcmSwitchWWN.

      - for entities other than Fibre Channel Switches, a Fibre Channel
        management instance can manage only one entity, and the name of
        the entity is given by the MIB object, fcmInstanceWwn.

4.3.  Fabric Index

   With multiple Fabrics, each Fabric has its own instances of the
   Fabric-related management instrumentation.  Thus, these MIB modules
   define all Fabric-related information in tables that are INDEX-ed by
   an arbitrary integer, named a "Fabric Index".  The syntax of a Fabric
   Index is T11FabricIndex, imported from T11-TC-MIB [RFC4439].  When a
   device is connected to a single physical Fabric, without use of any
   virtual Fabrics, the value of this Fabric Index will always be 1.  In
   an environment of multiple virtual and/or physical Fabrics, this
   index provides a means to distinguish one Fabric from another.

4.4.  Interface Index

   Several of the MIB modules defined in this document use the
   InterfaceIndexOrZero syntax in order to allow information to be
   specified/instantiated on a per-port/interface basis, e.g., for:
   statistics, Traffic Selectors, Security Associations, etc.  This
   allows the same object to be used either when there is a separate row
   for each of multiple ports/interfaces, or when multiple interfaces
   are represented by a single row.  The use of a zero value supports
   the simpler cases of: a) when there is only one port/interface, b)
   where the implementation chooses to aggregate the information for
   multiple ports/interfaces.  The minimum (for compliance) requirement
   is to implement any one of the above cases.

   When a Fabric Index and an object with the InterfaceIndexOrZero
   syntax are used together in a single INDEX clause, the
   InterfaceIndexOrZero object is listed before the Fabric Index in
   order to simplify management queries that retrieve information
   concerning multiple Fabrics connected to the same port/interface.







De Santi, et al.            Standards Track                    [Page 13]
^L
RFC 5324                     MIB for FC-SP                September 2008


4.5.  Syntax for Policy Object Names

   T11FcSpPolicyNameType and T11FcSpPolicyName are two Textual
   Conventions defined in this document (in the T11-FC-SP-TC-MIB module)
   to represent the types and values of Policy Object Names (see section
   3.4.5.1 above).  However, two of the nine possible types are IPv4
   Address Range and IPv6 Address Range.  It is standard practice in MIB
   modules to represent all IP addresses using the standard Textual
   Conventions defined in [RFC4001] for IP addresses: specifically,
   InetAddressType and InetAddress.  This document adheres to such
   standard practice to the following extent:

      - for MIB objects representing a Policy Object Name that can
        *only* be an IPv4 Address Range or an IPv6 Address Range, then
        those MIB objects are defined as a 3-tuple: (InetAddressType,
        InetAddress, InetAddress), in which the first address is the low
        end of the range, the second address is the high end of the
        range, and both addresses are of the type given by
        InetAddressType.

      - for MIB objects representing a Policy Object Name that is
        (possibly) of a different type, i.e., it is not (necessarily) an
        IPv4 or IPv6 Address Range, then those MIB objects are defined
        as a 2-tuple: (T11FcSpPolicyNameType, T11FcSpPolicyName), in
        which the first object represents the type of Policy Object Name
        and the second object represents the value of the Policy Object
        Name.  For MIB objects defined in this manner, if and when they
        represent a range of IP addresses: a) the value of
        T11FcSpPolicyNameType differentiates between an IPv4 Address
        Range and an IPv6 Address Range; and b) the value of
        T11FcSpPolicyName is one string containing the concatenation of
        the two addresses that are the low and high addresses of the
        range.  This is the same format as used within FC-SP Policy
        Objects [FC-SP].

4.6.  Certificates, CAs, and CRLs

   In order to authenticate with the FCAP protocol, each entity,
   identified by a unique Name, is provided with: a digital certificate
   associated with that Name, the private/public key pair that
   corresponds to the certificate, and with the Root Certificate (the
   certificate of the signing Certification Authority).  To authenticate
   another entity, an entity is required to be provided with the
   certificate of the associated Certification Authority.

   FCAP requires entities to support at least four Root Certificates
   against which received corresponding certificates can be validated.
   Support for certificate chains and verification of certificate chains



De Santi, et al.            Standards Track                    [Page 14]
^L
RFC 5324                     MIB for FC-SP                September 2008


   containing more than one certificate is optional.  Entities need to
   be able to access a Certificate Revocation List (CRL) for each
   configured Root Certificate, if one is available from the CA.
   Certificates on the CRL are considered invalid.

   The management of certificates, Certification Authorities, and
   Certificate Revocation Lists is the same in Fibre Channel networks as
   it is in other networks.  Therefore, this document does not define
   any MIB objects for such management.

4.7.  Traffic Selectors

   When Traffic Selectors are compared against an ingress or egress
   frame in order to determine the security processing to be applied to
   that frame, there are circumstances in which multiple Traffic
   Selectors, specifying different actions, can match with the frame.
   Specifically, when matching against an egress frame to decide which
   active Security Association to transmit on, or, against an ingress
   frame unprotected by FC-SP, i.e., without an SPI value in it, to
   decide which action ('drop' or 'bypass') to apply.  For these cases,
   the MIB includes a unique precedence value for each Traffic Selector
   such that the one with the numerically lowest precedence value is
   determined to be the one that matches.  In contrast, ingress frames
   on active Security Associations (i.e., protected by FC-SP) are
   compared against the set of traffic selectors negotiated when the
   Security Association was set up and identified by the SPI value
   contained in the frame; the action taken depends on whether any
   Traffic Selector matches, but not on which one.

   This difference between ingress and egress Traffic Selectors on
   active Security Associations is reflected in having separate MIB
   tables defined for them: the table for Traffic Selectors on egress
   SAs, t11FcSpSaTSelNegOutTable, has a precedence value in its INDEX
   clause; whereas the table for Traffic Selectors on ingress SAs,
   t11FcSpSaTSelNegInTable, has an arbitrary integer value in its INDEX
   clause.  For 'drop' and 'bypass' Traffic Selectors, one table,
   t11FcSpSaTSelDrByTable, having a precedence value in its INDEX
   clause, is sufficient for both ingress and egress traffic.













De Santi, et al.            Standards Track                    [Page 15]
^L
RFC 5324                     MIB for FC-SP                September 2008


4.8.  The MIB Modules

4.8.1.  The T11-FC-SP-TC-MIB Module

   This MIB module defines Textual Conventions that are being, or have
   the potential to be, used in more than one MIB module.  The module
   also defines Object Identifiers to identify the Cryptographic
   Algorithms listed in [FC-SP] so that they can be used as the value of
   various MIB objects that specify the algorithms being/to be used by
   an FC-SP implementation.

4.8.2.  The T11-FC-SP-AUTHENTICATION-MIB Module

   This MIB module specifies the management information required to
   manage FC-SP Authentication Protocols.  It defines three tables:

      - t11FcSpAuEntityTable -- a table of Fibre Channel entities that
        can be authenticated using FC-SP's Authentication Protocols,
        including the names, capabilities, and basic configuration
        parameters of the entities.

      - t11FcSpAuIfStatTable -- this table has two purposes: to be a
        list of the mappings of a FC-SP Authentication entity onto an
        interface and to contain Authentication Protocol per-interface
        statistics.

      - t11FcSpAuRejectTable -- a table of FC-SP Authentication Protocol
        transactions that were recently rejected.

   It also defines two notifications: one for sending a reject in
   response to an AUTH message and another for receiving a reject in
   response to an AUTH message.

4.8.3.  The T11-FC-SP-ZONING-MIB Module

   This MIB module specifies the extensions to the T11-FC-ZONE-SERVER-
   MIB module [RFC4936] for the management of FC-SP Zoning Servers.
   Specifically, it augments three tables defined in T11-FC-ZONE-SERVER-
   MIB:

      - t11FcSpZsServerTable -- to this table, it adds FC-SP Zoning
        information defined for Zone Servers.

      - t11ZsStatsTable -- to this table, it adds FC-SP Zoning
        statistics for Zone Servers.

      - t11ZsNotifyControlTable  -- to this table, it adds control
        information for FC-SP Zoning notifications.



De Santi, et al.            Standards Track                    [Page 16]
^L
RFC 5324                     MIB for FC-SP                September 2008


   It also defines two FC-SP Zoning notifications: one for success and
   one for failure in the joining of two Fabrics.

4.8.4.  The T11-FC-SP-POLICY-MIB Module

   This MIB module specifies management information that is used to
   manage FC-SP policies.  The MIB module has five parts:

      - Active Policy Objects - read-only MIB objects representing the
        set of active Policy Objects for each Fabric;

      - Activate/Deactivate Operations - read-write MIB objects for
        invoking operations, either 1) to activate policies that are
        specified as a set of non-active Policy Objects, or 2) to
        deactivate the currently active policies; also included are
        objects giving the status of invoked operations;

      - Non-Active Policy Objects - read-create MIB objects to create
        and modify non-active Policy Objects;

      - Statistics for FC-SP Security Policy Servers;

      - The definition and control of notifications for the success or
        failure of the activation or deactivation of FC-SP policies.

4.8.5.  The T11-FC-SP-SA-MIB Module

   This MIB module specifies the management information required to
   manage Security Associations established via FC-SP.  All of the
   tables in this MIB module are INDEX-ed by t11FcSpSaIfIndex, with
   syntax InterfaceIndexOrZero, which is either non-zero for a specific
   interface or zero for all (of the management instance's) interfaces
   to the particular Fabric.

   The MIB module consists of six parts:

      - a per-Fabric table, t11FcSpSaIfTable, of capabilities,
        parameters, status information, and counters; the counters
        include non-transient aggregates of per-SA transient counters;

      - three tables, t11FcSpSaPropTable, t11FcSpSaTSelPropTable, and
        t11FcSpSaTransTable, specifying the proposals for an FC-SP
        entity acting as an SA_Initiator to present to the SA_Responder
        during the negotiation of Security Associations.  The same
        information is also used by an FC-SP entity acting as an
        SA_Responder to decide what to accept during the negotiation of





De Santi, et al.            Standards Track                    [Page 17]
^L
RFC 5324                     MIB for FC-SP                September 2008


        Security Associations.  One of these tables,
        t11FcSpSaTransTable, is used not only for information about
        security transforms to propose and to accept, but also as agreed
        upon during the negotiation of Security Associations;

      - a table, t11FcSpSaTSelDrByTable, of Traffic Selectors having the
        security action of 'drop' or 'bypass' to be applied either to
        ingress traffic, which is unprotected by FC-SP, or to all egress
        traffic;

      - four tables, t11FcSpSaPairTable, t11FcSpSaTSelNegInTable,
        t11FcSpSaTSelNegOutTable, and t11FcSpSaTSelSpiTable, containing
        information about active bidirectional pairs of Security
        Associations; in particular, t11FcSpSaPairTable has one row per
        active bidirectional SA pair, t11FcSpSaTSelNegInTable and
        t11FcSpSaTSelNegOutTable contain information on the Traffic
        Selectors negotiated on the SAs, and the t11FcSpSaTSelSpiTable
        is an alternate lookup table such that the Traffic Selector(s)
        in use on a particular Security Association can be quickly
        determined based on its (ingress) SPI value;

      - a table, t11FcSpSaControlTable, of control and other information
        concerning the generation of notifications for events related to
        FC-SP Security Associations;

      - one notification, t11FcSpSaNotifyAuthFailure, generated on the
        occurrence of an Authentication failure for a received FC-2 or
        CT_IU frame.

4.9.  Rate Control for Notifications

   All but one of the notifications defined in the five MIB modules in
   this document are notifications that are generated based on events
   occurring in the "control plane", e.g., notifications that are
   generated at the frequency of operator-initiated activities.  The one
   exception is t11FcSpSaNotifyAuthFailure, which is generated based on
   an event occurring in the "data plane", and could (in a worst case
   scenario) occur for every received ingress frame.  Therefore, a
   method of rate controlling the generation of notifications is needed
   for t11FcSpSaNotifyAuthFailure, but not for any of the other
   notifications.

   For t11FcSpSaNotifyAuthFailure, rate control is achieved by
   specifying that a) after the first occurrence of an Authentication
   failure on any particular Security Association, the SNMP
   notifications for second and subsequent failures are suppressed for
   the duration of a time window and b) that even the notification for
   the first occurrence is suppressed after it is sent in the same time



De Santi, et al.            Standards Track                    [Page 18]
^L
RFC 5324                     MIB for FC-SP                September 2008


   window for a configured (in t11FcSpSaControlMaxNotifs) number of
   Security Associations within a Fabric.  Note that while these
   suppressions prevent the network from being flooded with
   notifications, the Authentication Failures themselves must still be
   detected and counted.

   The length of the time window is given by t11FcSpSaControlWindow, a
   read-write object in the t11FcSpSaControlTable.  If and when the time
   since the last generation of the notification is less than the value
   of sysUpTime (e.g., if one or more notifications have occurred since
   the last re-initialization of the management system), then
   t11FcSpSaControlElapsed and t11FcSpSaControlSuppressed contain the
   elapsed time since the last notification and the number of
   notifications suppressed in the window after sending the last one,
   respectively.  Otherwise, t11FcSpSaControlElapsed contains the value
   of sysUpTime and t11FcSpSaControlSuppressed has the value zero.

5.  Relationship to Other MIB Modules

   The first standardized MIB module for Fibre Channel [RFC2837] was
   focused on Fibre Channel Switches.  It was obsoleted by the more
   generic Fibre Channel Management MIB [RFC4044], which defines basic
   information for Fibre Channel Nodes and Switches, including
   extensions to the standard IF-MIB [RFC2863] for Fibre Channel
   interfaces.  Several other MIB modules have since been defined to
   extend [RFC4044] for various specific Fibre Channel functionality,
   (e.g., [RFC4438], [RFC4439], [RFC4625], [RFC4626], [RFC4747],
   [RFC4936], [RFC4935], and [RFC4983]).

   The MIB modules defined in this memo further extend [RFC4044] to
   cover the operation of Fibre Channel Security Protocols, as specified
   in [FC-SP].

   One part of the FC-SP specification is "FC-SP Zoning", which is an
   extension/variant of the Fibre Channel Zoning defined in [FC-GS-5].
   Management information for the latter is defined in the T11-FC-ZONE-
   SERVER-MIB module [RFC4936].  Consequently, the T11-FC-SP-ZONING-MIB
   module defined in this document defines the extensions to the T11-FC-
   ZONE-SERVER-MIB module that are needed to manage FC-SP Zoning.

   The MIB modules in this memo import some common Textual Conventions
   from T11-TC-MIB, defined in [RFC4439], and from INET-ADDRESS-MIB,
   defined in [RFC4001].

   If the RADIUS protocol is used for access to an external server,
   information about RADIUS Servers is likely to be available from the
   RADIUS-AUTH-CLIENT-MIB [RFC4668].




De Santi, et al.            Standards Track                    [Page 19]
^L
RFC 5324                     MIB for FC-SP                September 2008


6.  MIB Module Definitions

6.1.  The T11-FC-SP-TC-MIB Module

T11-FC-SP-TC-MIB  DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY, OBJECT-IDENTITY, mib-2,
    Unsigned32          FROM SNMPv2-SMI                  -- [RFC2578]
    TEXTUAL-CONVENTION  FROM SNMPv2-TC;                  -- [RFC2579]

t11FcTcMIB  MODULE-IDENTITY
    LAST-UPDATED  "200808200000Z"
    ORGANIZATION  "This MIB module was developed through the
                  coordinated effort of two organizations:
                  T11 began the development and the IETF (in
                  the IMSS Working Group) finished it."
    CONTACT-INFO
            "     Claudio DeSanti
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  EMail: cds@cisco.com

                  Keith McCloghrie
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  Email: kzm@cisco.com"
    DESCRIPTION
           "This MIB module defines Textual Conventions for use in
           the multiple MIB modules, which together define the
           instrumentation for an implementation of the Fibre Channel
           Security Protocols (FC-SP) specification.

           This MIB module also defines Object Identities (for use as
           possible values of MIB objects with syntax AutonomousType),
           including OIDs for the Cryptographic Algorithms defined
           in FC-SP.

           Copyright (C) The IETF Trust (2008).  This version
           of this MIB module is part of RFC 5324;  see the RFC
           itself for full legal notices."
    REVISION  "200808200000Z"
    DESCRIPTION
           "Initial version of this MIB module, published as RFC 5324."
    ::= { mib-2 175 }




De Santi, et al.            Standards Track                    [Page 20]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpIdentities OBJECT IDENTIFIER ::= { t11FcTcMIB 1 }
t11FcSpAlgorithms OBJECT IDENTIFIER ::= { t11FcSpIdentities 1 }

--
-- Textual Conventions
--

T11FcSpPolicyHashFormat ::=  TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "Identifies a cryptographic hash function used to create
           a hash value that summarizes an FC-SP Policy Object.

           Each definition of an object with this TC as its syntax
           must be accompanied by a corresponding definition of an
           object with T11FcSpPolicyHashValue as its syntax, and
           containing the hash value.

           The first two cryptographic hash functions are:

                Hash Type    Hash Tag     Hash Length (Bytes)
                  SHA-1     '00000001'h        20
                 SHA-256    '00000002'h        32
           "
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.3.1 and table 106.
            - FIPS PUB 180-2."
    SYNTAX        OCTET STRING (SIZE (4))

T11FcSpPolicyHashValue ::=  TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "Represents the value of the cryptographic hash function
           of an FC-SP Policy Object.

           Each definition of an object with this TC as its syntax
           must be accompanied by a corresponding definition of an
           object with T11FcSpPolicyHashFormat as its syntax.
           The corresponding object identifies the cryptographic
           hash function used to create the hash value."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.3.1 and table 106."
    SYNTAX        OCTET STRING (SIZE (0..64))




De Santi, et al.            Standards Track                    [Page 21]
^L
RFC 5324                     MIB for FC-SP                September 2008


T11FcSpHashCalculationStatus ::= TEXTUAL-CONVENTION
    STATUS       current
    DESCRIPTION
           "When some kind of 'database' is defined in a set of
           read-write MIB objects, it is common that multiple changes
           in the data need to be made at the same time.  So, if hash
           values are maintained for that data, those hash values are
           only correct if and when they are re-calculated after every
           change.  In such circumstances, the use of an object with
           this syntax allows the re-calculation of the hash values to
           be deferred until all changes have been made, and therefore
           the calculation need only be done once after all changes,
           rather than repeatedly/after each individual change.

           The definition of an object defined using this TC is
           required to specify which one or more instances of which
           MIB objects contain the hash values operated upon (or
           whose status is given) by the value of this TC.

           When read, the value of an object with this syntax is
           either:

             correct -- the identified MIB object instance(s)
                        contain the correct hash values; or
             stale   -- the identified MIB object instance(s)
                        contain stale (possibly incorrect) values.

           Writing a value of 'calculate' is a request to re-calculate
           and update the values of the corresponding instances of the
           identified MIB objects.  Writing a value of 'correct' or
           'stale' to this object is an error (e.g., 'wrongValue')."
    SYNTAX       INTEGER {
                     calculate(1),
                     correct(2),
                     stale(3)
                 }

T11FcSpAuthRejectReasonCode ::=  TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A reason code contained in an AUTH_Reject message, or
           in an SW_RJT (rejecting an AUTH_ILS), or in an LS_RJT
           (rejecting an AUTH-ELS)."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 17, 48, 52."
    SYNTAX        INTEGER {



De Santi, et al.            Standards Track                    [Page 22]
^L
RFC 5324                     MIB for FC-SP                September 2008


                      authFailure(1),
                      logicalError(2),
                      logicalBusy(3),
                      authILSNotSupported(4),
                      authELSNotSupported(5),
                      notLoggedIn(6)
                  }

T11FcSpAuthRejReasonCodeExp ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A reason code explanation contained in an AUTH_Reject
           message, or in an SW_RJT (rejecting an AUTH_ILS), or in
           an LS_RJT (rejecting an AUTH-ELS)."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Tables 18, 48, 52."
    SYNTAX        INTEGER {
                      authMechanismNotUsable(1),
                      dhGroupNotUsable(2),
                      hashFunctionNotUsable(3),
                      authTransactionAlreadyStarted(4),
                      authenticationFailed(5),
                      incorrectPayload(6),
                      incorrectAuthProtocolMessage(7),
                      restartAuthProtocol(8),
                      authConcatNotSupported(9),
                      unsupportedProtocolVersion(10),
                      logicalBusy(11),
                      authILSNotSupported(12),
                      authELSNotSupported(13),
                      notLoggedIn(14)
                  }

T11FcSpHashFunctions ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A set of zero, one, or more hash functions defined for
           use in FC-SP."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 14."
    SYNTAX        BITS {
                      md5(0),
                      sha1(1)
                  }



De Santi, et al.            Standards Track                    [Page 23]
^L
RFC 5324                     MIB for FC-SP                September 2008


T11FcSpSignFunctions ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A set of zero, one, or more signature functions defined
           for signing certificates for use with FCAP in FC-SP."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, tables 38 & 39."
    SYNTAX        BITS {
                      rsaSha1(0)
                  }

T11FcSpDhGroups ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A set of zero, one, or more DH Groups defined for use
           in FC-SP."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 15."
    SYNTAX        BITS {
                      null(0),
                      group1024(1),
                      group1280(2),
                      group1536(3),
                      group2048(4),
                      group3072(5),
                      group4096(6),
                      group6144(7),
                      group8192(8)
                  }

T11FcSpPolicyObjectType ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A value that identifies the type of an FC-SP Policy
           Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 102."
    SYNTAX   INTEGER {
                 summary(1),
                 switchMemberList(2),
                 nodeMemberList(3),
                 switchConnectivity(4),



De Santi, et al.            Standards Track                    [Page 24]
^L
RFC 5324                     MIB for FC-SP                September 2008


                 ipMgmtList(5),
                 attribute(6)
             }

T11FcSpPolicyNameType ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "The format and usage of a companion object having
           T11FcSpPolicyName as its syntax.

           Six of the values indicate the same format, i.e., they
           differ only in semantics.  That common format is a Fibre
           Channel 'Name_Identifier', i.e., the same syntax as
           'FcNameIdOrZero (SIZE(8))'.

           These six are three pairs of one restricted and one
           unrestricted.  Each usage of this syntax must specify
           what the meaning of 'restricted' is for that usage and
           how the characteristics and behavior of restricted
           names differ from unrestricted names.

           The six are:

             'nodeName'           - a Node_Name, which is the
                                    Name_Identifier associated
                                    with a Fibre Channel Node.

             'restrictedNodeName' - a Restricted Node_Name.

             'portName'           - the Name_Identifier associated
                                    with a Fibre Channel Port.

             'restrictedPortName' - a Restricted Port_Name.

             'wildcard'           - a Wildcard value that is used to
                                    identify 'all others' (typically,
                                    all other members of a Policy
                                    Object, not all other Policy
                                    Objects).

             'restrictedWildcard' - a Restricted Wildcard value.

           Other possible values are:

             'alphaNumericName'   - the value begins with an ASCII
           letter (upper or lower case) followed by (0 ... 63)
           characters from the set:  lower case letters, upper case
           letters, digits, and the four symbols: dollar-sign ($),



De Santi, et al.            Standards Track                    [Page 25]
^L
RFC 5324                     MIB for FC-SP                September 2008


           dash (-), caret (^), and underscore (_).

             'ipv6AddressRange'   - two IPv6 addresses in network
           byte order, the numerically smallest first and the
           numerically largest second; total length is 32 bytes.

             'ipv4AddressRange'   - two IPv4 addresses in network
           byte order, the numerically smallest first and the
           numerically largest second; total length is 8 bytes."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 103."
    SYNTAX   INTEGER {
                 nodeName(1),
                 restrictedNodeName(2),
                 portName(3),
                 restrictedPortName(4),
                 wildcard(5),
                 restrictedWildcard(6),
                 alphaNumericName(7),
                 ipv6AddressRange(8),
                 ipv4AddressRange(9)
             }

T11FcSpPolicyName ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A syntax used, when defining Policy Objects, for the
           name of something.

           An object that uses this syntax always identifies a
           companion object with syntax T11FcSpPolicyNameType
           such that the companion object specifies the format
           and usage of the object with this syntax.

           When the companion object has the value 'wildcard' or
           'restrictedWildcard', the value of the T11FcSpPolicyName
           object is:  '0000000000000000'h."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 103."
    SYNTAX   OCTET STRING (SIZE (1..64))

T11FcSpAlphaNumName ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION



De Santi, et al.            Standards Track                    [Page 26]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "A syntax used when defining Policy Objects for the
           name of something, where the name is always in the format
           specified by:

               T11FcSpPolicyNameType = 'alphaNumericName'
           "
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 103."
    SYNTAX   OCTET STRING (SIZE (1..64))

T11FcSpAlphaNumNameOrAbsent ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "An extension of the T11FcSpAlphaNumName TC with
           one additional possible value: the zero-length string
           to indicate the absence of a name."
    SYNTAX   OCTET STRING (SIZE (0..64))

T11FcSaDirection ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "The direction of frame transmission on a Security
           Association.  Note that Security Associations are
           unidirectional, but they always exist as part of an
           SA pair of the same type in opposite directions."
    SYNTAX   INTEGER { ingress(1), egress(2) }

T11FcSpiIndex ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "An SPI (Security Parameter Index) value is carried in the
           SPI field of a frame protected by the ESP_Header.  An SPI
           is also carried in the SAID field of a Common Transport
           Information Unit (CT_IU) protected by CT_Authentication.
           An SPI value identifies the Security Association on which
           the frame is being transmitted."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 4.7.2 and 4.7.3."
    SYNTAX   Unsigned32 (0..4294967295) -- the default range!!

T11FcSpPrecedence ::= TEXTUAL-CONVENTION
    DISPLAY-HINT "d"
    STATUS       current
    DESCRIPTION



De Santi, et al.            Standards Track                    [Page 27]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "The precedence of a Traffic Selector.  If a frame
           matches with two or more Traffic Selectors, then the match
           that takes precedence is the one with the Traffic Selector
           having the numerically smallest precedence value.  Note that
           precedence values are not necessarily contiguous."
    SYNTAX   Unsigned32 (0..4294967295)  -- the default range!!

T11FcRoutingControl ::= TEXTUAL-CONVENTION
    DISPLAY-HINT "1x"
    STATUS        current
    DESCRIPTION
           "A value stored in the R_CTL (Routing Control) 8-bit field
           of an FC-2 frame containing routing and information bits to
           categorize the frame function.

           For FC-2 frames, an R_CTL value typically distinguishes
           between control versus data frames and/or solicited versus
           unsolicited frames, and in combination with the TYPE field
           (see T11FcSpType), identifies a particular link-layer
           service/protocol using FC-2.

           For CT_Authentication, the information field in the R_CTL
           field contains '02'h for Request CT_IUs and '03'h for
           Response CT_IUs.

           The comparison of two values having this syntax is done
           by treating each string as an 8-bit numeric value."
    REFERENCE
           "- Fibre Channel - Framing and Signaling-2 (FC-FS-2),
              ANSI INCITS 424-2007, Project T11/1619-D,
              February 2007, section 9.3.
            - Fibre Channel - Generic Services-5 (FC-GS-5),
              ANSI INCITS 427-2006, sections 4.5.2.4.2, 4.5.2.4.3
              and table 12."
    SYNTAX   OCTET STRING (SIZE(1))

T11FcSpType ::= TEXTUAL-CONVENTION
    DISPLAY-HINT "2x"
    STATUS        current
    DESCRIPTION
           "A value, or combination of values, contained in a frame
           header used in identifying the link layer service/protocol
           of a frame.  The value is always two octets:

             - for FC-2 frames, the first octet is zero and the second
               octet contains the Data structure type (TYPE) value
               defined by FC-FS-2.  The TYPE value is used in
               combination with T11FcRoutingControl to identify a link



De Santi, et al.            Standards Track                    [Page 28]
^L
RFC 5324                     MIB for FC-SP                September 2008


               layer service/protocol.

             - for Common Transport Information Units (CT_IUs), the
               first octet contains a GS_Type value and the second
               octet contains a GS_Subtype value, defined by FC-GS-5.

           The comparison of two values having this syntax is done
           by treating each string as the numeric value obtained by
           numerically combining the individual octet's value as
           follows:

               (256 * 1st-octet) + 2nd-octet
           "
    REFERENCE
           "- Fibre Channel - Framing and Signaling-2 (FC-FS-2),
              ANSI INCITS 424-2007, Project T11/1619-D,
              February 2007, section 9.6.
            - Fibre Channel - Generic Services-5 (FC-GS-5),
              ANSI INCITS 427-2006, sections 4.3.2.4 and 4.3.2.5."
    SYNTAX   OCTET STRING (SIZE(2))

T11FcSpTransforms ::= TEXTUAL-CONVENTION
    STATUS        current
    DESCRIPTION
           "A list of the standardized transforms that are defined
           by FC-SP for use with ESP_Header, CT_Authentication, and/or
           IKEv2 Support."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              Appendix A.3.1, tables A.23, A.24, A.25, A.26."
    SYNTAX       BITS {
                     encrNull(0),
                     encrAesCbc(1),
                     encrAesCtr(2),
                     encrAesGcm(3),
                     encr3Des(4),
                     prfHmacMd5(5),
                     prfHmacSha1(6),
                     prfAesCbc(7),
                     authHmacMd5L96(8),
                     authHmacSha1L96(9),
                     authHmacMd5L128(10),
                     authHmacSha1L160(11),
                     encrNullAuthAesGmac(12),
                     dhGroups1024bit(13),
                     dhGroups2048bit(14)
                 }



De Santi, et al.            Standards Track                    [Page 29]
^L
RFC 5324                     MIB for FC-SP                September 2008


T11FcSpSecurityProtocolId ::= TEXTUAL-CONVENTION
    STATUS       current
    DESCRIPTION
           "A Security Protocol identifier to identify
           the protocol by which traffic is to be protected,
           e.g., ESP_Header or CT_Authentication."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.3.2.2 and table 67."
    SYNTAX       INTEGER { espHeader(1), ctAuth(2) }

T11FcSpLifetimeLeft ::= TEXTUAL-CONVENTION
    STATUS       current
    DESCRIPTION
           "This TC is used for one object of an associated pair
           of objects.  The object with this syntax specifies a
           remaining lifetime of something, e.g., of an SA, where
           the lifetime is given in the units specified by the other
           object of the pair which has T11FcSpLifetimeLeftUnits
           as its syntax."
    SYNTAX       Unsigned32

T11FcSpLifetimeLeftUnits ::= TEXTUAL-CONVENTION
    STATUS       current
    DESCRIPTION
           "An object, defined using T11FcSpLifetimeLeft TC as
           its syntax, is required to be one of an associated
           pair of objects such that the other object of the pair
           is defined with this T11FcSpLifetimeLeftUnits TC as
           its syntax and with its value specifying the
           units of the remaining lifetime given by the
           value of the T11FcSpLifetimeLeft object."
    SYNTAX       INTEGER {
                     seconds(1),      -- seconds
                     kiloBytes(2),    -- 10^^3 bytes
                     megaBytes(3),    -- 10^^6 bytes
                     gigaBytes(4),    -- 10^^9 bytes
                     teraBytes(5),    -- 10^^12 bytes
                     petaBytes(6),    -- 10^^15 bytes
                     exaBytes(7),     -- 10^^18 bytes
                     zettaBytes(8),   -- 10^^21 bytes
                     yottaBytes(9)    -- 10^^24 bytes
                 }

--
-- Object Identities to identify the Cryptographic Algorithms
-- listed in FC-SP.



De Santi, et al.            Standards Track                    [Page 30]
^L
RFC 5324                     MIB for FC-SP                September 2008


--

t11FcSpEncryptAlgorithms
     OBJECT IDENTIFIER ::= { t11FcSpAlgorithms 1 }

t11FcSpEncrNull OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The ENCR_NULL algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 70."
    ::= { t11FcSpEncryptAlgorithms 1 }

t11FcSpEncrAesCbc OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The ENCR_AES_CBC algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 70."
    ::= { t11FcSpEncryptAlgorithms 2 }

t11FcSpEncrAesCtr OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The ENCR_AES_CTR algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 70."
    ::= { t11FcSpEncryptAlgorithms 3 }

t11FcSpEncrAesGcm OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The ENCR_AES_GCM algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 70."
    ::= { t11FcSpEncryptAlgorithms 4 }

t11FcSpEncr3Des OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The ENCR_3DES algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 70."



De Santi, et al.            Standards Track                    [Page 31]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpEncryptAlgorithms 5 }

t11FcSpAuthAlgorithms
     OBJECT IDENTIFIER ::= { t11FcSpAlgorithms 2 }

t11FcSpAuthNull OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The AUTH_NONE algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 72."
    ::= { t11FcSpAuthAlgorithms 1 }

t11FcSpAuthHmacMd5L96 OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The AUTH_HMAC_MD5_96 algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 72."
    ::= { t11FcSpAuthAlgorithms 2 }

t11FcSpAuthHmacSha1L96 OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The AUTH_HMAC_SHA1_96 algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 72."
    ::= { t11FcSpAuthAlgorithms 3 }

t11FcSpAuthHmacMd5L128 OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The AUTH_HMAC_MD5_128 algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 72."
    ::= { t11FcSpAuthAlgorithms 4 }

t11FcSpAuthHmacSha1L160 OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The AUTH_HMAC_SHA1_160 algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 72."



De Santi, et al.            Standards Track                    [Page 32]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpAuthAlgorithms 5 }

t11FcSpEncrNullAuthAesGmac OBJECT-IDENTITY
    STATUS     current
    DESCRIPTION "The ENCR_NULL_AUTH_AES_GMAC algorithm."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 70."
    ::= { t11FcSpEncryptAlgorithms 6 }

END

6.2.  The T11-FC-SP-AUTHENTICATION-MIB Module

--********************************************************************
-- FC-SP Authentication Protocols
--

T11-FC-SP-AUTHENTICATION-MIB  DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE, OBJECT-IDENTITY,
    NOTIFICATION-TYPE,
    mib-2, Counter32, Unsigned32
                                      FROM SNMPv2-SMI  -- [RFC2578]
    MODULE-COMPLIANCE, OBJECT-GROUP,
    NOTIFICATION-GROUP
                                      FROM SNMPv2-CONF -- [RFC2580]
    StorageType, AutonomousType,
    TruthValue, TimeStamp             FROM SNMPv2-TC   -- [RFC2579]
    InterfaceIndex                    FROM IF-MIB      -- [RFC2863]
    fcmInstanceIndex,
    FcNameIdOrZero                    FROM FC-MGMT-MIB -- [RFC4044]
    t11FamLocalSwitchWwn
                       FROM T11-FC-FABRIC-ADDR-MGR-MIB -- [RFC4439]
    T11FabricIndex                    FROM T11-TC-MIB  -- [RFC4439]
    T11FcSpDhGroups,
    T11FcSpHashFunctions,
    T11FcSpSignFunctions,
    T11FcSpLifetimeLeft,
    T11FcSpLifetimeLeftUnits,
    T11FcSpAuthRejectReasonCode,
    T11FcSpAuthRejReasonCodeExp       FROM T11-FC-SP-TC-MIB;

t11FcSpAuthenticationMIB  MODULE-IDENTITY
    LAST-UPDATED  "200808200000Z"
    ORGANIZATION  "This MIB module was developed through the



De Santi, et al.            Standards Track                    [Page 33]
^L
RFC 5324                     MIB for FC-SP                September 2008


                  coordinated effort of two organizations:
                  T11 began the development and the IETF (in
                  the IMSS Working Group) finished it."
    CONTACT-INFO
            "     Claudio DeSanti
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  EMail: cds@cisco.com

                  Keith McCloghrie
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  Email: kzm@cisco.com"
    DESCRIPTION
           "This MIB module specifies the management information
           required to manage the Authentication Protocols defined by
           Fibre Channel's FC-SP specification.

           This MIB module defines three tables:

            - t11FcSpAuEntityTable is a table of Fibre Channel
              entities that can be authenticated using FC-SP's
              Authentication Protocols.

            - t11FcSpAuIfStatTable is a table with one row for each
              mapping of an Authentication entity onto an interface,
              containing statistics information.

            - t11FcSpAuRejectTable is a table of volatile information
              about FC-SP Authentication Protocol transactions
              that were most recently rejected.

           Copyright (C) The IETF Trust (2008).  This version
           of this MIB module is part of RFC 5324;  see the RFC
           itself for full legal notices."
    REVISION  "200808200000Z"
    DESCRIPTION
           "Initial version of this MIB module, published as RFC 5324."
    ::= { mib-2 176 }

t11FcSpAuMIBNotifications
                   OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 0 }
t11FcSpAuMIBObjects
                   OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 1 }
t11FcSpAuMIBConformance
                   OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 2 }



De Santi, et al.            Standards Track                    [Page 34]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpAuMIBIdentities
                   OBJECT IDENTIFIER ::= { t11FcSpAuthenticationMIB 3 }

--
-- OIDs defined for use as values of t11FcSpAuServerProtocol
--

t11FcSpAuServerProtocolRadius OBJECT-IDENTITY
    STATUS       current
    DESCRIPTION
           "This OID identifies RADIUS as the protocol used
           to communicate with an External Server as part of
           the process by which identities are verified.
           In this case, information about the RADIUS Servers
           is likely to be provided in radiusAuthServerExtTable
           defined in the RADIUS-AUTH-CLIENT-MIB."
    REFERENCE
           "radiusAuthServerExtTable in 'RADIUS Authentication
            Client MIB', RFC 4668, August 2006."
    ::= { t11FcSpAuMIBIdentities 1 }

t11FcSpAuServerProtocolDiameter OBJECT-IDENTITY
    STATUS       current
    DESCRIPTION
           "This OID identifies Diameter as the protocol used
           to communicate with an External Server as part of
           the process by which identities are verified."
    REFERENCE
           "RFC 3588, September 2003."
    ::= { t11FcSpAuMIBIdentities 2 }

t11FcSpAuServerProtocolTacacs OBJECT-IDENTITY
    STATUS       current
    DESCRIPTION
           "This OID identifies TACACS as the protocol used
           to communicate with an External Server as part of
           the process by which identities are verified."
    REFERENCE
           "RFC 1492, July 1993."
    ::= { t11FcSpAuMIBIdentities 3 }

--
-- Configuration for the Authentication Protocols
--

t11FcSpAuEntityTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpAuEntityEntry
    MAX-ACCESS   not-accessible



De Santi, et al.            Standards Track                    [Page 35]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS       current
    DESCRIPTION
           "A table of Fibre Channel entities that can be authenticated
           using FC-SP's Authentication Protocols.

           The purpose of an FC-SP Authentication Protocol is to verify
           that a claimed name is associated with the claiming entity.
           The Authentication Protocols can be used to authenticate
           Nx_Ports, B_Ports, or Switches."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 3.2.25."
    ::= { t11FcSpAuMIBObjects 1 }

t11FcSpAuEntityEntry OBJECT-TYPE
    SYNTAX       T11FcSpAuEntityEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Information about the configuration and capabilities of an
           FC-SP entity (which is managed within the Fibre Channel
           management instance identified by fcmInstanceIndex) on a
           particular Fabric with respect to FC-SP's Authentication
           Protocols."
    INDEX   { fcmInstanceIndex, t11FcSpAuEntityName,
              t11FcSpAuFabricIndex }
    ::= { t11FcSpAuEntityTable 1 }

T11FcSpAuEntityEntry ::= SEQUENCE {
    t11FcSpAuEntityName             FcNameIdOrZero,
    t11FcSpAuFabricIndex            T11FabricIndex,
    t11FcSpAuServerProtocol         AutonomousType,
                                                   -- Config parameters
    t11FcSpAuStorageType            StorageType,
    t11FcSpAuSendRejNotifyEnable    TruthValue,
    t11FcSpAuRcvRejNotifyEnable     TruthValue,
    t11FcSpAuDefaultLifetime        T11FcSpLifetimeLeft,
    t11FcSpAuDefaultLifetimeUnits   T11FcSpLifetimeLeftUnits,
    t11FcSpAuRejectMaxRows          Unsigned32,
                                                   -- Capabilities
    t11FcSpAuDhChapHashFunctions    T11FcSpHashFunctions,
    t11FcSpAuDhChapDhGroups         T11FcSpDhGroups,
    t11FcSpAuFcapHashFunctions      T11FcSpHashFunctions,
    t11FcSpAuFcapCertsSignFunctions T11FcSpSignFunctions,
    t11FcSpAuFcapDhGroups           T11FcSpDhGroups,
    t11FcSpAuFcpapHashFunctions     T11FcSpHashFunctions,
    t11FcSpAuFcpapDhGroups          T11FcSpDhGroups



De Santi, et al.            Standards Track                    [Page 36]
^L
RFC 5324                     MIB for FC-SP                September 2008


}

t11FcSpAuEntityName OBJECT-TYPE
    SYNTAX     FcNameIdOrZero (SIZE (8))
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
           "The name used to identify the FC-SP entity.

           For entities that are Fibre Channel Switches, this value
           corresponds to the Switch's value of fcmSwitchWWN.  For
           entities other than Fibre Channel Switches, this value
           corresponds to the value of fcmInstanceWwn for the
           corresponding Fibre Channel management instance."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.3.3.
            - fcmInstanceWwn & fcmSwitchWWN,
              'Fibre Channel Management MIB', RFC 4044, May 2005."
    ::= { t11FcSpAuEntityEntry 1 }

t11FcSpAuFabricIndex OBJECT-TYPE
    SYNTAX       T11FabricIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a
           particular Fabric to which the entity is attached."
    ::= { t11FcSpAuEntityEntry 2 }

t11FcSpAuServerProtocol OBJECT-TYPE
    SYNTAX       AutonomousType
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The protocol, if any, used by the entity to communicate
           with a third party (i.e., an External Server) as part of
           the process by which it verifies DH-CHAP responses.  For
           example, if the entity is using an external RADIUS server
           to verify DH-CHAP responses, then this object will have
           the value t11FcSpAuServerProtocolRadius.

           The value, zeroDotZero, is used to indicate that no
           protocol is being used to communicate with a third
           party to verify DH-CHAP responses.

           When no protocol is being used, or if the third party is



De Santi, et al.            Standards Track                    [Page 37]
^L
RFC 5324                     MIB for FC-SP                September 2008


           unreachable via the specified protocol, then locally
           configured information (if any) may be used instead."
    ::= { t11FcSpAuEntityEntry 3 }

t11FcSpAuStorageType OBJECT-TYPE
    SYNTAX       StorageType
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object specifies the memory realization of
           configuration information related to an FC-SP
           Entity on a particular Fabric: specifically, for
           MIB objects in the row containing this object.

           Even if an instance of this object has the value
           'permanent(4)', none of the information in the
           corresponding row of this table needs to be writable."
    ::= { t11FcSpAuEntityEntry 4 }

t11FcSpAuSendRejNotifyEnable OBJECT-TYPE
    SYNTAX     TruthValue
    MAX-ACCESS read-write
    STATUS     current
    DESCRIPTION
           "An indication of whether or not the entity should issue
           t11FcSpAuRejectSentNotify notifications when sending
           AUTH_Reject/SW_RJT/LS_RJT to reject an AUTH message.

           If the value of the object is 'true', then this type of
           notification is generated.  If the value is 'false',
           this type of notification is not generated."
    DEFVAL { false }
    ::= { t11FcSpAuEntityEntry 5 }

t11FcSpAuRcvRejNotifyEnable OBJECT-TYPE
    SYNTAX     TruthValue
    MAX-ACCESS read-write
    STATUS     current
    DESCRIPTION
           "An indication of whether or not the entity should issue
           t11FcSpAuRejectReceivedNotify notifications on the receipt
           of AUTH_Reject/SW_RJT/LS_RJT messages.

           If the value of the object is 'true', then this type of
           notification is generated.  If the value is 'false',
           this type of notification is not generated."
    DEFVAL { false }
    ::= { t11FcSpAuEntityEntry 6 }



De Santi, et al.            Standards Track                    [Page 38]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpAuDefaultLifetime OBJECT-TYPE
    SYNTAX       T11FcSpLifetimeLeft
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "When the value of this object is non-zero, it specifies the
           default value of a lifetime, specified in units given by
           the corresponding instance of t11FcSpAuDefaultLifetimeUnits.
           This default lifetime is to be used for any Security
           Association that has no explicitly specified value for its
           lifetime.

           An SA's lifetime is either the time interval or the number
           of passed bytes, after which the SA has to be terminated and
           (if necessary) replaced with a new SA.

           If this object is zero, then there is no default value for
           lifetime."
    DEFVAL       { 28800 }         -- 8 hours (in units of seconds)
     ::= { t11FcSpAuEntityEntry 7 }

t11FcSpAuDefaultLifetimeUnits OBJECT-TYPE
    SYNTAX       T11FcSpLifetimeLeftUnits
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "The units in which the value of the corresponding
           instance of t11FcSpAuDefaultLifetime specifies a
           default lifetime for a Security Association that has
           no explicitly-specified value for its lifetime."
    DEFVAL       { seconds }
    ::= { t11FcSpAuEntityEntry 8 }

t11FcSpAuRejectMaxRows OBJECT-TYPE
    SYNTAX       Unsigned32 (0..1000)
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "The maximum number of rows in the t11FcSpAuRejectTable for
           this entity on this Fabric.  If and when an AUTH message is
           rejected, and the t11FcSpAuRejectTable already contains this
           maximum number of rows for the specific entity and Fabric,
           the row containing the oldest information is discarded and
           replaced by a row containing information about the new
           rejection.

           There will be less than this maximum number of rows in
           the t11FcSpAuRejectTable in exceptional circumstances,



De Santi, et al.            Standards Track                    [Page 39]
^L
RFC 5324                     MIB for FC-SP                September 2008


           e.g., after an agent restart.

           In an implementation that does not support the
           t11FcSpAuRejectTable, this object will always be zero."
    ::= { t11FcSpAuEntityEntry 9 }

t11FcSpAuDhChapHashFunctions OBJECT-TYPE
    SYNTAX     T11FcSpHashFunctions
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "The hash functions that the entity supports when using
           the DH-CHAP algorithm."
    ::= { t11FcSpAuEntityEntry 10 }

t11FcSpAuDhChapDhGroups OBJECT-TYPE
    SYNTAX     T11FcSpDhGroups
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "The DH Groups that the entity supports when using the
           DH-CHAP algorithm in FC-SP."
    ::= { t11FcSpAuEntityEntry 11 }

t11FcSpAuFcapHashFunctions OBJECT-TYPE
    SYNTAX     T11FcSpHashFunctions
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "The hash functions that the entity supports when
           specified as Protocol Parameters in the AUTH_Negotiate
           message for FCAP in FC-SP."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.5.2.1 and table 28."
    ::= { t11FcSpAuEntityEntry 12 }

t11FcSpAuFcapCertsSignFunctions OBJECT-TYPE
    SYNTAX     T11FcSpSignFunctions
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "The signature functions used within certificates that
           the entity supports when using FCAP in FC-SP."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),



De Santi, et al.            Standards Track                    [Page 40]
^L
RFC 5324                     MIB for FC-SP                September 2008


              February 2007, section 5.5.4.2 and tables 38 & 39."
    ::= { t11FcSpAuEntityEntry 13 }

t11FcSpAuFcapDhGroups OBJECT-TYPE
    SYNTAX     T11FcSpDhGroups
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "The DH Groups that the entity supports when using the
           FCAP algorithm in FC-SP."
    ::= { t11FcSpAuEntityEntry 14 }

t11FcSpAuFcpapHashFunctions OBJECT-TYPE
    SYNTAX     T11FcSpHashFunctions
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "The hash functions that the entity supports when using
           the FCPAP algorithm in FC-SP."
    ::= { t11FcSpAuEntityEntry 15 }

t11FcSpAuFcpapDhGroups OBJECT-TYPE
    SYNTAX     T11FcSpDhGroups
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "The DH Groups that the entity supports when using the
           FCPAP algorithm in FC-SP."
    ::= { t11FcSpAuEntityEntry 16 }

--
-- The Mapping of Authentication Entities onto Interfaces
-- and Statistics
--

t11FcSpAuIfStatTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpAuIfStatEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each FC-SP Authentication entity can operate on one or more
           interfaces, but at most one of them can operate on each
           interface.  A row in this table exists for each interface
           to each Fabric on which each Authentication entity operates.

           The objects within this table contain statistics information
           related to FC-SP's Authentication Protocols."
    ::= { t11FcSpAuMIBObjects 2 }



De Santi, et al.            Standards Track                    [Page 41]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpAuIfStatEntry OBJECT-TYPE
    SYNTAX       T11FcSpAuIfStatEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A set of Authentication Protocols statistics for an FC-SP
           Authentication entity (identified by t11FcSpAuEntityName) on
           one of its interfaces to a particular Fabric, which is
           managed within the Fibre Channel management instance
           identified by fcmInstanceIndex."
    INDEX   { fcmInstanceIndex, t11FcSpAuEntityName,
              t11FcSpAuIfStatInterfaceIndex,
              t11FcSpAuIfStatFabricIndex }
    ::= { t11FcSpAuIfStatTable 1 }

T11FcSpAuIfStatEntry ::= SEQUENCE {
    t11FcSpAuIfStatInterfaceIndex        InterfaceIndex,
    t11FcSpAuIfStatFabricIndex           T11FabricIndex,
    t11FcSpAuIfStatTimeouts              Counter32,
    t11FcSpAuIfStatInAcceptedMsgs        Counter32,
    t11FcSpAuIfStatInLsSwRejectedMsgs    Counter32,
    t11FcSpAuIfStatInAuthRejectedMsgs    Counter32,
    t11FcSpAuIfStatOutAcceptedMsgs       Counter32,
    t11FcSpAuIfStatOutLsSwRejectedMsgs   Counter32,
    t11FcSpAuIfStatOutAuthRejectedMsgs   Counter32
}

t11FcSpAuIfStatInterfaceIndex OBJECT-TYPE
    SYNTAX       InterfaceIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The interface on which the FC-SP Authentication entity
           operates and for which the statistics are collected."
    ::= { t11FcSpAuIfStatEntry 1 }

t11FcSpAuIfStatFabricIndex OBJECT-TYPE
    SYNTAX       T11FabricIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value identifying the particular Fabric for
           which the statistics are collected."
    ::= { t11FcSpAuIfStatEntry 2 }

t11FcSpAuIfStatTimeouts OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only



De Santi, et al.            Standards Track                    [Page 42]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS       current
    DESCRIPTION
           "The number of FC-SP Authentication Protocol messages sent
           by the particular entity on the particular Fabric on the
           particular interface, for which no response was received
           within a timeout period.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.11."
    ::= { t11FcSpAuIfStatEntry 3 }

t11FcSpAuIfStatInAcceptedMsgs OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of FC-SP Authentication Protocol messages
           received and accepted by the particular entity on the
           particular Fabric on the particular interface.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.1."
    ::= { t11FcSpAuIfStatEntry 4 }

t11FcSpAuIfStatInLsSwRejectedMsgs OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of FC-SP Authentication Protocol messages
           received by the particular entity on the particular Fabric
           on the particular interface, and rejected by a lower-level
           (SW_RJT or LS_RJT) reject.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.1."



De Santi, et al.            Standards Track                    [Page 43]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpAuIfStatEntry 5 }

t11FcSpAuIfStatInAuthRejectedMsgs OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of FC-SP Authentication Protocol messages
           received by the particular entity on the particular Fabric
           on the particular interface, and rejected by an AUTH_Reject
           message.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.1."
    ::= { t11FcSpAuIfStatEntry 6 }

t11FcSpAuIfStatOutAcceptedMsgs OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of FC-SP Authentication Protocol messages sent
           by the particular entity on the particular Fabric on the
           particular interface, which were accepted by the
           neighboring entity, i.e., not rejected by an AUTH_Reject
           message, nor by a lower-level (SW_RJT or LS_RJT) reject.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.1."
    ::= { t11FcSpAuIfStatEntry 7 }

t11FcSpAuIfStatOutLsSwRejectedMsgs OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of FC-SP Authentication Protocol messages sent
           by the particular entity on the particular Fabric on the
           particular interface, which were rejected by a lower-level
           (SW_RJT or LS_RJT) reject.



De Santi, et al.            Standards Track                    [Page 44]
^L
RFC 5324                     MIB for FC-SP                September 2008


           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.1."
    ::= { t11FcSpAuIfStatEntry 8 }

t11FcSpAuIfStatOutAuthRejectedMsgs OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of FC-SP Authentication Protocol messages sent
           by the particular entity on the particular Fabric on the
           particular interface, which were rejected by an
           AUTH_Reject message.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.1."
    ::= { t11FcSpAuIfStatEntry 9 }

--
-- Information about Authentication Protocol Transactions
-- which were recently rejected
--

t11FcSpAuRejectTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpAuRejectEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of volatile information about FC-SP Authentication
           Protocol transactions that were recently rejected with
           an AUTH_Reject message, or with an SW_RJT/LS_RJT.

           The maximum number of rows in this table for a specific
           entity on a specific Fabric is given by the value of the
           corresponding instance of t11FcSpAuRejectMaxRows.

           The syntax of t11FcSpAuRejTimestamp is TimeStamp, and thus
           its value rolls over to zero after approximately 497 days.
           To avoid any confusion due to such a rollover, rows should
           be deleted from this table before they are 497 days old.



De Santi, et al.            Standards Track                    [Page 45]
^L
RFC 5324                     MIB for FC-SP                September 2008


           This table will be empty if no AUTH_Reject messages,
           nor any SW_RJT/LS_RJT's rejecting an AUTH message,
           have been sent or received since the last
           re-initialization of the agent."
    ::= { t11FcSpAuMIBObjects 3 }

t11FcSpAuRejectEntry OBJECT-TYPE
    SYNTAX       T11FcSpAuRejectEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Information about one AUTH message (either an
           AUTH_ELS or an AUTH_ILS) that was rejected with an
           AUTH_Reject, SW_RJT or LS_RJT message, sent/received by
           the entity identified by values of fcmInstanceIndex and
           t11FcSpAuEntityName, on an interface to a particular
           Fabric."
    INDEX   { fcmInstanceIndex, t11FcSpAuEntityName,
              t11FcSpAuRejInterfaceIndex, t11FcSpAuRejFabricIndex,
              t11FcSpAuRejTimestamp }
    ::= { t11FcSpAuRejectTable 1 }

T11FcSpAuRejectEntry ::= SEQUENCE {
    t11FcSpAuRejInterfaceIndex        InterfaceIndex,
    t11FcSpAuRejFabricIndex           T11FabricIndex,
    t11FcSpAuRejTimestamp             TimeStamp,
    t11FcSpAuRejDirection             INTEGER,
    t11FcSpAuRejType                  INTEGER,
    t11FcSpAuRejAuthMsgString         OCTET STRING,
    t11FcSpAuRejReasonCode            T11FcSpAuthRejectReasonCode,
    t11FcSpAuRejReasonCodeExp         T11FcSpAuthRejReasonCodeExp
}

t11FcSpAuRejInterfaceIndex OBJECT-TYPE
    SYNTAX       InterfaceIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The interface on which the rejected AUTH message was
           sent or received."
    ::= { t11FcSpAuRejectEntry 1 }

t11FcSpAuRejFabricIndex OBJECT-TYPE
    SYNTAX       T11FabricIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value identifying the particular Fabric on



De Santi, et al.            Standards Track                    [Page 46]
^L
RFC 5324                     MIB for FC-SP                September 2008


           which the rejected AUTH message was sent or received."
    ::= { t11FcSpAuRejectEntry 2 }

t11FcSpAuRejTimestamp OBJECT-TYPE
    SYNTAX       TimeStamp
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The time at which the AUTH message was rejected.  If two
           rows have the same value of this object for the same
           entity on the same interface and Fabric, the value of
           this object for the later one is incremented by one."
    ::= { t11FcSpAuRejectEntry 3 }

t11FcSpAuRejDirection OBJECT-TYPE
    SYNTAX       INTEGER { sent(1), received(2) }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "An indication of whether the rejection was sent or
           received by the identified entity.

           The value 'sent(1)' corresponds to a notification of
           type t11FcSpAuRejectSentNotify; the value 'received(2)'
           corresponds to t11FcSpAuRejectReceivedNotify."
    ::= { t11FcSpAuRejectEntry 4 }

t11FcSpAuRejType OBJECT-TYPE
    SYNTAX       INTEGER {
                     authReject(1),
                     swRjt(2),
                     lsRjt(3)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "An indication of whether the rejection was an
           AUTH_Reject, an SW_RJT or an LS_RJT."
    ::= { t11FcSpAuRejectEntry 5 }

t11FcSpAuRejAuthMsgString OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE(0..255))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The binary content of the AUTH message that was
           rejected, formatted as an octet string (in network
           byte order) containing the content of the message.



De Santi, et al.            Standards Track                    [Page 47]
^L
RFC 5324                     MIB for FC-SP                September 2008


           If the binary content is unavailable, then the
           length is zero.  Otherwise, the first octet of the
           message identifies the type of message:

              '90'h - an AUTH_ELS, see Table 6 in FC-SP,
              '40'h - an AUTH_ILS, see Table 3 in FC-SP, or
              '41'h - an B_AUTH_ILS, see Table 5 in FC-SP.

           and the remainder of the message may be truncated."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Tables 3, 5 and 6."
    ::= { t11FcSpAuRejectEntry 6 }

t11FcSpAuRejReasonCode OBJECT-TYPE
    SYNTAX       T11FcSpAuthRejectReasonCode
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The reason code with which this AUTH message was
           rejected."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 17, 48, 52."
    ::= { t11FcSpAuRejectEntry 7 }

t11FcSpAuRejReasonCodeExp OBJECT-TYPE
    SYNTAX       T11FcSpAuthRejReasonCodeExp
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The reason code explanation with which this AUTH
           message was rejected."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 17, 48, 52."
    ::= { t11FcSpAuRejectEntry 8 }

--
-- Notifications
--

t11FcSpAuRejectSentNotify NOTIFICATION-TYPE
    OBJECTS   { t11FamLocalSwitchWwn,
                t11FcSpAuRejAuthMsgString,



De Santi, et al.            Standards Track                    [Page 48]
^L
RFC 5324                     MIB for FC-SP                September 2008


                t11FcSpAuRejType,
                t11FcSpAuRejReasonCode,
                t11FcSpAuRejReasonCodeExp }
    STATUS       current
    DESCRIPTION
           "This notification indicates that a Switch (identified
           by the value of t11FamLocalSwitchWwn) has sent a reject
           message of the type indicated by t11FcSpAuRejType in
           response to an AUTH message.

           The content of the rejected AUTH message is given by the
           value of t11FcSpAuRejAuthMsgString.  The values of the
           Reason Code and Reason Code Explanation in the
           AUTH_Reject/SW_RJT/LS_RJT are indicated by the values of
           t11FcSpAuRejReasonCode and t11FcSpAuRejReasonCodeExp."
    ::= { t11FcSpAuMIBNotifications 1 }

t11FcSpAuRejectReceivedNotify NOTIFICATION-TYPE
    OBJECTS   { t11FamLocalSwitchWwn,
                t11FcSpAuRejAuthMsgString,
                t11FcSpAuRejType,
                t11FcSpAuRejReasonCode,
                t11FcSpAuRejReasonCodeExp }
    STATUS       current
    DESCRIPTION
           "This notification indicates that a Switch (identified
           by the value of t11FamLocalSwitchWwn) has received a
           reject message of the type indicated by t11FcSpAuRejType
           in response to an AUTH message.

           The content of the rejected AUTH message is given by the
           value of t11FcSpAuRejAuthMsgString.  The values of the
           Reason Code and Reason Code Explanation in the
           AUTH_Reject/SW_RJT/LS_RJT are indicated by the values of
           t11FcSpAuRejReasonCode and t11FcSpAuRejReasonCodeExp."
    ::= { t11FcSpAuMIBNotifications 2 }

--
-- Conformance
--

t11FcSpAuMIBCompliances
                  OBJECT IDENTIFIER ::= { t11FcSpAuMIBConformance 1 }
t11FcSpAuMIBGroups
                  OBJECT IDENTIFIER ::= { t11FcSpAuMIBConformance 2 }

t11FcSpAuMIBCompliance MODULE-COMPLIANCE
    STATUS       current



De Santi, et al.            Standards Track                    [Page 49]
^L
RFC 5324                     MIB for FC-SP                September 2008


    DESCRIPTION
           "The compliance statement for entities that
           implement one or more of the Authentication Protocols
           defined in FC-SP."

    MODULE  -- this module
        MANDATORY-GROUPS { t11FcSpAuGeneralGroup,
                           t11FcSpAuRejectedGroup,
                           t11FcSpAuNotificationGroup }

        GROUP      t11FcSpAuIfStatsGroup
        DESCRIPTION
               "These counters, of particular FC-SP messages and
               events, are mandatory only for those systems that
               count such messages/events."

-- Write access is not required for any objects in this MIB module:

        OBJECT     t11FcSpAuStorageType
        MIN-ACCESS read-only
        DESCRIPTION
               "Write access is not required."

        OBJECT     t11FcSpAuSendRejNotifyEnable
        MIN-ACCESS read-only
        DESCRIPTION
               "Write access is not required."

        OBJECT     t11FcSpAuRcvRejNotifyEnable
        MIN-ACCESS read-only
        DESCRIPTION
               "Write access is not required."

        OBJECT     t11FcSpAuDefaultLifetime
        MIN-ACCESS read-only
        DESCRIPTION
               "Write access is not required."

        OBJECT     t11FcSpAuDefaultLifetimeUnits
        MIN-ACCESS read-only
        DESCRIPTION
               "Write access is not required."

        OBJECT     t11FcSpAuRejectMaxRows
        MIN-ACCESS read-only
        DESCRIPTION
               "Write access is not required."




De Santi, et al.            Standards Track                    [Page 50]
^L
RFC 5324                     MIB for FC-SP                September 2008


        ::= { t11FcSpAuMIBCompliances 1 }

-- Units of Conformance

t11FcSpAuGeneralGroup OBJECT-GROUP
    OBJECTS  { t11FcSpAuServerProtocol,
               t11FcSpAuStorageType,
               t11FcSpAuSendRejNotifyEnable,
               t11FcSpAuRcvRejNotifyEnable,
               t11FcSpAuDefaultLifetime,
               t11FcSpAuDefaultLifetimeUnits,
               t11FcSpAuRejectMaxRows,
               t11FcSpAuDhChapHashFunctions,
               t11FcSpAuDhChapDhGroups,
               t11FcSpAuFcapHashFunctions,
               t11FcSpAuFcapCertsSignFunctions,
               t11FcSpAuFcapDhGroups,
               t11FcSpAuFcpapHashFunctions,
               t11FcSpAuFcpapDhGroups,
               t11FcSpAuIfStatTimeouts }
    STATUS   current
    DESCRIPTION
           "A collection of objects for the capabilities and
           configuration parameters of FC-SP's Authentication
           Protocols.  The inclusion of t11FcSpAuIfStatTimeouts
           in this group provides information on mappings of
           Authentication entities onto interfaces."
    ::= { t11FcSpAuMIBGroups 1 }

t11FcSpAuIfStatsGroup OBJECT-GROUP
    OBJECTS  { t11FcSpAuIfStatInAcceptedMsgs,
               t11FcSpAuIfStatInLsSwRejectedMsgs,
               t11FcSpAuIfStatInAuthRejectedMsgs,
               t11FcSpAuIfStatOutAcceptedMsgs,
               t11FcSpAuIfStatOutLsSwRejectedMsgs,
               t11FcSpAuIfStatOutAuthRejectedMsgs }
    STATUS   current
    DESCRIPTION
           "A collection of objects for monitoring the
           operations of FC-SP's Authentication Protocols."
    ::= { t11FcSpAuMIBGroups 2 }

t11FcSpAuRejectedGroup OBJECT-GROUP
    OBJECTS  { t11FcSpAuRejDirection,
               t11FcSpAuRejType,
               t11FcSpAuRejAuthMsgString,
               t11FcSpAuRejReasonCode,
               t11FcSpAuRejReasonCodeExp }



De Santi, et al.            Standards Track                    [Page 51]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS   current
    DESCRIPTION
           "A collection of objects holding information concerning
           FC-SP Authentication Protocol transactions that were
           recently rejected with an AUTH_Reject, with an SW_RJT,
           or with an LS_RJT."
    ::= { t11FcSpAuMIBGroups 3 }

t11FcSpAuNotificationGroup NOTIFICATION-GROUP
    NOTIFICATIONS  { t11FcSpAuRejectSentNotify,
                     t11FcSpAuRejectReceivedNotify }
    STATUS   current
    DESCRIPTION
           "A collection of notifications for use in the management
           of FC-SP's Authentication Protocols."
    ::= { t11FcSpAuMIBGroups 4 }

END

6.3.  The T11-FC-SP-ZONING-MIB Module

--*******************************************************************
-- FC-SP Zoning
--

T11-FC-SP-ZONING-MIB  DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE,
    NOTIFICATION-TYPE, mib-2,
    Counter32
                        FROM SNMPv2-SMI                -- [RFC2578]
    TruthValue          FROM SNMPv2-TC                 -- [RFC2579]
    MODULE-COMPLIANCE, OBJECT-GROUP,
    NOTIFICATION-GROUP
                        FROM SNMPv2-CONF               -- [RFC2580]
    ifIndex             FROM IF-MIB                    -- [RFC2863]
    t11ZsServerEntry,
    t11ZsStatsEntry,
    t11ZsNotifyControlEntry,
    t11ZsFabricIndex    FROM T11-FC-ZONE-SERVER-MIB    -- [RFC4936]
    T11FcSpPolicyHashValue,
    T11FcSpPolicyHashFormat,
    T11FcSpHashCalculationStatus
                        FROM T11-FC-SP-TC-MIB;

t11FcSpZoningMIB  MODULE-IDENTITY
    LAST-UPDATED  "200808200000Z"



De Santi, et al.            Standards Track                    [Page 52]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ORGANIZATION  "This MIB module was developed through the
                  coordinated effort of two organizations:
                  T11 began the development and the IETF (in
                  the IMSS Working Group) finished it."
    CONTACT-INFO
            "     Claudio DeSanti
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  EMail: cds@cisco.com

                  Keith McCloghrie
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  Email: kzm@cisco.com"
    DESCRIPTION
           "This MIB module specifies the extensions to the
           T11-FC-ZONE-SERVER-MIB module that are necessary for the
           management of Fibre Channel's FC-SP Zoning Servers, as
           defined in the FC-SP specification.

           The persistence of values written to these MIB objects is
           the same as the persistence of the objects they extend,
           i.e., it is given by the value of the relevant instance of
           t11ZsServerDatabaseStorageType (defined in the
           T11-FC-ZONE-SERVER-MIB module).

           Copyright (C) The IETF Trust (2008).  This version
           of this MIB module is part of RFC 5324;  see the RFC
           itself for full legal notices."
    REVISION  "200808200000Z"
    DESCRIPTION
           "Initial version of this MIB module, published as RFC 5324."
    ::= { mib-2 177 }

t11FcSpZsMIBNotifications  OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 0 }
t11FcSpZsMIBObjects        OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 1 }
t11FcSpZsMIBConformance    OBJECT IDENTIFIER ::= { t11FcSpZoningMIB 2 }
t11FcSpZsConfiguration  OBJECT IDENTIFIER ::= { t11FcSpZsMIBObjects 1 }
t11FcSpZsStatistics     OBJECT IDENTIFIER ::= { t11FcSpZsMIBObjects 2 }

--
-- Augmenting the table of Zone Servers
--

t11FcSpZsServerTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpZsServerEntry



De Santi, et al.            Standards Track                    [Page 53]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table which provides FC-SP-specific information about
           the Zone Servers on each Fabric in one or more Switches."
    ::= { t11FcSpZsConfiguration 1 }

t11FcSpZsServerEntry OBJECT-TYPE
    SYNTAX       T11FcSpZsServerEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information relevant to FC-SP
           for a particular Zone Server for a particular Fabric
           on a particular Switch.  The Fabric and Switch are
           identified in the same manner as in t11ZsServerEntry."
    AUGMENTS   { t11ZsServerEntry }
    ::= { t11FcSpZsServerTable 1 }

T11FcSpZsServerEntry ::= SEQUENCE {
    t11FcSpZsServerCapabilityObject      BITS,
    t11FcSpZsServerEnabled               TruthValue,
    t11FcSpZoneSetHashStatus             T11FcSpHashCalculationStatus,
    t11FcSpActiveZoneSetHashType         T11FcSpPolicyHashFormat,
    t11FcSpActiveZoneSetHash             T11FcSpPolicyHashValue,
    t11FcSpZoneSetDatabaseHashType       T11FcSpPolicyHashFormat,
    t11FcSpZoneSetDatabaseHash           T11FcSpPolicyHashValue
}

t11FcSpZsServerCapabilityObject OBJECT-TYPE
    SYNTAX       BITS {
                     fcSpZoning(0)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "Capabilities of the Zone Server for the particular Fabric
           on the particular Switch, with respect to FC-SP Zoning:

               fcSpZoning -- set to 1 to indicate the Switch is
                             capable of supporting FC-SP Zoning.
           "
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 184."
    ::= { t11FcSpZsServerEntry 1 }




De Santi, et al.            Standards Track                    [Page 54]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpZsServerEnabled OBJECT-TYPE
    SYNTAX       TruthValue
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object indicates whether the Zone Server for the
           particular Fabric on the particular Switch, is operating in
           FC-SP Zoning mode."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 185."
    ::= { t11FcSpZsServerEntry 2 }

t11FcSpZoneSetHashStatus OBJECT-TYPE
    SYNTAX       T11FcSpHashCalculationStatus
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "When read, the value of this object is either:

             correct -- the corresponding instances of both
                        t11FcSpActiveZoneSetHash and
                        t11FcSpZoneSetDatabaseHash contain
                        the correct hash values; or
             stale   -- the corresponding instances of
                        t11FcSpActiveZoneSetHash and
                        t11FcSpZoneSetDatabaseHash contain
                        stale (possibly incorrect) values;

           Writing a value of 'calculate' is a request to re-calculate
           and update the values of the corresponding instances of both
           t11FcSpActiveZoneSetHash and t11FcSpZoneSetDatabaseHash.
           Writing a value of 'correct' or 'stale' to this object
           is an error (e.g., 'wrongValue').

           When the Active Zone Set and/or the Zone Set Database are
           updated, it is common that multiple changes need to be made
           at the same time.  In such circumstances, the use of this
           object allows the hash values to be updated only once after
           all changes, rather than repeatedly/after each individual
           change.

           If and when the corresponding instance of
           t11ZsServerDatabaseStorageType has the value 'permanent(4)',
           then if write access is supported to any instance of a
           read-write object in any row of any table governed by the
           'permanent' value of t11ZsServerDatabaseStorageType, then



De Santi, et al.            Standards Track                    [Page 55]
^L
RFC 5324                     MIB for FC-SP                September 2008


           write access to the corresponding instance of this object
           must also be supported."
    REFERENCE
           "t11ZsServerDatabaseStorageType in
           'Fibre Channel Zone Server MIB', RFC 4936, August 2007."
    DEFVAL      { stale }
    ::= { t11FcSpZsServerEntry 3 }

t11FcSpActiveZoneSetHashType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashFormat
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The format used for the hash value contained in the
           corresponding instance of t11FcSpActiveZoneSetHash."
    ::= { t11FcSpZsServerEntry 4 }

t11FcSpActiveZoneSetHash OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashValue
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The value of the hash for the current Active Zone Set.
            The format of this value is given by the corresponding
            instance of t11FcSpActiveZoneSetHashType."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 187."
    ::= { t11FcSpZsServerEntry 5 }

t11FcSpZoneSetDatabaseHashType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashFormat
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The format used for the hash value contained in the
           corresponding instance of t11FcSpZoneSetDatabaseHash."
    ::= { t11FcSpZsServerEntry 6 }

t11FcSpZoneSetDatabaseHash OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashValue
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The value of the hash for the current Zone Set Database.
            The format of this value is given by the corresponding
            instance of t11FcSpZoneSetDatabaseHashType."



De Santi, et al.            Standards Track                    [Page 56]
^L
RFC 5324                     MIB for FC-SP                September 2008


    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Table 187."
    ::= { t11FcSpZsServerEntry 7 }

--
-- Additional Statistics for FC-SP Zoning
--

t11FcSpZsStatsTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpZsStatsEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of statistics specific to FC-SP that are
           maintained by Zone Servers."
    ::= { t11FcSpZsStatistics 1 }

t11FcSpZsStatsEntry OBJECT-TYPE
    SYNTAX       T11FcSpZsStatsEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A set of statistics specific to FC-SP for a particular
           Zone Server for a particular Fabric on a particular Switch.
           The Fabric and Switch are identified in the same manner as
           in t11ZsStatsEntry."
    AUGMENTS   { t11ZsStatsEntry }
    ::= { t11FcSpZsStatsTable 1 }

T11FcSpZsStatsEntry ::= SEQUENCE {
    t11FcSpZsSPCMITrequestsSent       Counter32,
    t11FcSpZsSPCMITrequestsAccepted   Counter32,
    t11FcSpZsSPCMITrequestsRejected   Counter32,
    t11FcSpZsZcpRequestsSent          Counter32,
    t11FcSpZsZcpRequestsAccepted      Counter32,
    t11FcSpZsZcpRequestsRejected      Counter32,
    t11FcSpZsZirRequestsAccepted      Counter32,
    t11FcSpZsZirRequestsRejected      Counter32
}

t11FcSpZsSPCMITrequestsSent OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of SP Commit Zone Changes (SPCMIT) operation



De Santi, et al.            Standards Track                    [Page 57]
^L
RFC 5324                     MIB for FC-SP                September 2008


           requests sent by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 1 }

t11FcSpZsSPCMITrequestsAccepted OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of SP Commit Zone Changes (SPCMIT) operation
           requests received and accepted by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 2 }

t11FcSpZsSPCMITrequestsRejected OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of SP Commit Zone Changes (SPCMIT) operation
           requests received but rejected by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 3 }

t11FcSpZsZcpRequestsSent OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of Zoning Check Protocol (ZCP) requests sent
           by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 4 }

t11FcSpZsZcpRequestsAccepted OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of Zoning Check Protocol (ZCP) requests received



De Santi, et al.            Standards Track                    [Page 58]
^L
RFC 5324                     MIB for FC-SP                September 2008


           and accepted by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 5 }

t11FcSpZsZcpRequestsRejected OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of Zoning Check Protocol (ZCP) requests received
           but rejected by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 6 }

t11FcSpZsZirRequestsAccepted OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of Zoning Information Request (ZIR) requests
           received and accepted by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 7 }

t11FcSpZsZirRequestsRejected OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of Zoning Information Request (ZIR) requests
           received but rejected by the Zone Server.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    ::= { t11FcSpZsStatsEntry 8 }

--
--  Enable/Disable for Notifications
--

t11FcSpZsNotifyControlTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpZsNotifyControlEntry



De Santi, et al.            Standards Track                    [Page 59]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of control information for notifications
           generated due to Zone Server events related to
           FC-SP Zoning."
    ::= { t11FcSpZsConfiguration 2 }

t11FcSpZsNotifyControlEntry OBJECT-TYPE
    SYNTAX       T11FcSpZsNotifyControlEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry is an augmentation of the notification control
           information for a Zone Server for a particular Fabric on a
           particular Switch.  The Fabric and Switch are identified in
           the same manner as in t11ZsNotifyControlEntry."
    AUGMENTS   { t11ZsNotifyControlEntry }
    ::= { t11FcSpZsNotifyControlTable 1 }

T11FcSpZsNotifyControlEntry ::= SEQUENCE {
     t11FcSpZsNotifyJoinSuccessEnable    TruthValue,
     t11FcSpZsNotifyJoinFailureEnable    TruthValue
}

t11FcSpZsNotifyJoinSuccessEnable OBJECT-TYPE
    SYNTAX       TruthValue
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object specifies whether
           t11FcSpZsFabricJoinFailureNotify notifications should be
           generated by the Zone Server for this Fabric."
    ::= { t11FcSpZsNotifyControlEntry 1 }

t11FcSpZsNotifyJoinFailureEnable OBJECT-TYPE
    SYNTAX       TruthValue
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object specifies whether
           t11FcSpZsFabricJoinSuccessNotify notifications should be
           generated by the Zone Server for this Fabric."
    ::= { t11FcSpZsNotifyControlEntry 2 }

--
-- Notifications
--



De Santi, et al.            Standards Track                    [Page 60]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpZsFabricJoinSuccessNotify NOTIFICATION-TYPE
    OBJECTS      { ifIndex, t11ZsFabricIndex }
    STATUS       current
    DESCRIPTION
           "This notification indicates that a Switch that is part
           of one Fabric (indicated by the value of t11ZsFabricIndex)
           has successfully joined (on the interface indicated by the
           value of ifIndex) with a Switch that is part of another
           Fabric.

           If multiple Virtual Fabrics are configured on an interface,
           and all are successfully joined at the same time, and if
           the agent so chooses, then it can generate just one
           notification in which t11ZsFabricIndex has the value 4096."
    ::= { t11FcSpZsMIBNotifications 1 }

t11FcSpZsFabricJoinFailureNotify NOTIFICATION-TYPE
    OBJECTS      { ifIndex, t11ZsFabricIndex }
    STATUS       current
    DESCRIPTION
           "This notification indicates that an E_Port on the local
           Switch has entered the Isolated state because a join
           between two Fabrics failed.  The failure occurred on the
           local Fabric indicated by the value of t11ZsFabricIndex,
           on the interface indicated by the value of ifIndex.

           If multiple Virtual Fabrics are configured on an interface,
           and all have a failure to join at the same time, and if the
           agent so chooses, then it can generate just one notification
           in which t11ZsFabricIndex has the value 4096."
    ::= { t11FcSpZsMIBNotifications 2 }

--
-- Conformance
--

t11FcSpZsMIBCompliances
                    OBJECT IDENTIFIER ::= { t11FcSpZsMIBConformance 1 }
t11FcSpZsMIBGroups  OBJECT IDENTIFIER ::= { t11FcSpZsMIBConformance 2 }

t11FcSpZsMIBCompliance MODULE-COMPLIANCE
    STATUS       current
    DESCRIPTION
           "The compliance statement for entities that
           implement the extensions specified in FC-SP for
           Fibre Channel's Zone Server."

    MODULE  -- this module



De Santi, et al.            Standards Track                    [Page 61]
^L
RFC 5324                     MIB for FC-SP                September 2008


        MANDATORY-GROUPS { t11FcSpZsObjectsGroup,
                           t11FcSpZsNotificationControlGroup,
                           t11FcSpZsNotificationGroup }

        GROUP        t11FcSpZsStatisticsGroup
        DESCRIPTION
            "These counters, containing Zone Server statistics,
            are mandatory only for those systems that count
            such events."

-- Write access is not required for any objects in this MIB module:

        OBJECT       t11FcSpZsServerEnabled
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpZoneSetHashStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpZsNotifyJoinSuccessEnable
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpZsNotifyJoinFailureEnable
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

    ::= { t11FcSpZsMIBCompliances 1 }

-- Units of Conformance

t11FcSpZsObjectsGroup OBJECT-GROUP
    OBJECTS  { t11FcSpZsServerCapabilityObject,
               t11FcSpZsServerEnabled,
               t11FcSpZoneSetHashStatus,
               t11FcSpActiveZoneSetHashType,
               t11FcSpActiveZoneSetHash,
               t11FcSpZoneSetDatabaseHashType,
               t11FcSpZoneSetDatabaseHash
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects for Zone configuration



De Santi, et al.            Standards Track                    [Page 62]
^L
RFC 5324                     MIB for FC-SP                September 2008


           information of a Zone Server capable of
           operating in FC-SP Zoning mode."
    ::= { t11FcSpZsMIBGroups 1 }

t11FcSpZsNotificationControlGroup OBJECT-GROUP
    OBJECTS  { t11FcSpZsNotifyJoinSuccessEnable,
               t11FcSpZsNotifyJoinFailureEnable
             }
    STATUS   current
    DESCRIPTION
           "A collection of notification control objects for
           monitoring Zone Server failures specific to FC-SP."
    ::= { t11FcSpZsMIBGroups 2 }

t11FcSpZsStatisticsGroup OBJECT-GROUP
    OBJECTS  { t11FcSpZsSPCMITrequestsSent,
               t11FcSpZsSPCMITrequestsAccepted,
               t11FcSpZsSPCMITrequestsRejected,
               t11FcSpZsZcpRequestsSent,
               t11FcSpZsZcpRequestsAccepted,
               t11FcSpZsZcpRequestsRejected,
               t11FcSpZsZirRequestsAccepted,
               t11FcSpZsZirRequestsRejected
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects for collecting Zone Server
            statistics which are specific to FC-SP."
    ::= { t11FcSpZsMIBGroups 3 }

t11FcSpZsNotificationGroup NOTIFICATION-GROUP
    NOTIFICATIONS { t11FcSpZsFabricJoinSuccessNotify,
                    t11FcSpZsFabricJoinFailureNotify
                  }
    STATUS        current
    DESCRIPTION
           "A collection of notification(s) for monitoring
           Zone Server events that are specific to FC-SP."
    ::= { t11FcSpZsMIBGroups 4 }

END










De Santi, et al.            Standards Track                    [Page 63]
^L
RFC 5324                     MIB for FC-SP                September 2008


6.4.  The T11-FC-SP-POLICY-MIB Module

--*******************************************************************
-- FC-SP Policy
--

T11-FC-SP-POLICY-MIB  DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, mib-2,
    Counter32, Unsigned32
                          FROM SNMPv2-SMI              -- [RFC2578]
    RowStatus, StorageType, TimeStamp,
    TruthValue            FROM SNMPv2-TC               -- [RFC2579]
    MODULE-COMPLIANCE, OBJECT-GROUP,
    NOTIFICATION-GROUP
                          FROM SNMPv2-CONF             -- [RFC2580]
    SnmpAdminString       FROM SNMP-FRAMEWORK-MIB      -- [RFC3411]
    InetAddress, InetPortNumber,
    InetAddressType       FROM INET-ADDRESS-MIB        -- [RFC4001]
    fcmInstanceIndex,
    FcNameIdOrZero,
    FcDomainIdOrZero      FROM FC-MGMT-MIB             -- [RFC4044]
    T11NsGs4RejectReasonCode
                          FROM T11-FC-NAME-SERVER-MIB  -- [RFC4438]
    T11FabricIndex        FROM T11-TC-MIB              -- [RFC4439]
    T11FcSpAlphaNumName,
    T11FcSpAlphaNumNameOrAbsent,
    T11FcSpPolicyName,
    T11FcSpPolicyNameType,
    T11FcSpPolicyObjectType,
    T11FcSpPolicyHashFormat,
    T11FcSpPolicyHashValue,
    T11FcSpHashCalculationStatus   FROM T11-FC-SP-TC-MIB;

t11FcSpPolicyMIB  MODULE-IDENTITY
    LAST-UPDATED  "200808200000Z"
    ORGANIZATION  "This MIB module was developed through the
                  coordinated effort of two organizations:
                  T11 began the development and the IETF (in
                  the IMSS Working Group) finished it."
    CONTACT-INFO
            "     Claudio DeSanti
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  EMail: cds@cisco.com




De Santi, et al.            Standards Track                    [Page 64]
^L
RFC 5324                     MIB for FC-SP                September 2008


                  Keith McCloghrie
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  Email: kzm@cisco.com"
    DESCRIPTION
           "This MIB module specifies the management information
           required to manage Fabric Policies as defined by Fibre
           Channel's FC-SP specification.

           FC-SP uses the term 'Policy Objects', sometimes abbreviated
           to just 'Objects', to refer to containers used to hold the
           data by which Fabric Policies are specified/stored.  This
           obviously has the potential to cause confusion between
           'Policy Objects' and 'MIB objects'.  The DESCRIPTIONs in
           this MIB module attempt to avoid such confusion by the use
           of different adjectives and capitalization, even though such
           mechanisms are less effective when used in descriptors.

           Some types of Policy Objects contain multiple items of
           information, each of which are held in the same format
           within the Policy Object.  In such cases, FC-SP uses the
           term 'Entry' to describe each instance of the common format.
           For example, FC-SP defines an Attribute Policy Object as
           containing one or more 'Attribute Entries'.  Again, this MIB
           module attempts to avoid confusion by the use of adjectives
           and capitalization to distinguish an Entry within a Policy
           Object from an entry within a MIB table.

           A Fabric's database of Policy Objects consists of a set of
           active Objects that are to be enforced by that Fabric, as
           well as non-active Objects that are not enforced.
           Operations defined (in FC-SP) for Policy Management are:

            - Add/Get/Remove operations on individual non-active
              Policy Objects,
            - Activate/Deactivate operations on a Policy Summary
              Object, and
            - Get operations on the active Policy Summary Object
              and/or on individual active Policy Objects.

           This MIB module has five parts:

            1) Active Policy Objects - read-only MIB objects
               representing the set of active Policy Objects for
               each Fabric,

            2) Activate/Deactivate Operations



De Santi, et al.            Standards Track                    [Page 65]
^L
RFC 5324                     MIB for FC-SP                September 2008


               - a read-write MIB object to invoke an Activate
                 operation of the policies specified via a non-active
                 Policy Summary Object, and
               - a read-write MIB object to invoke a Deactivate
                 operation.

            3) Non-active Policy Objects
               - read-create MIB objects to allow the creation of
                 non-active Policy Summary Objects (which reference
                 non-active Policy Objects), and
               - read-create MIB objects representing non-active
                 Policy Objects.

            4) Statistics

            5) Control information and Notifications

           Copyright (C) The IETF Trust (2008).  This version
           of this MIB module is part of RFC 5324;  see the RFC
           itself for full legal notices."
    REVISION  "200808200000Z"
    DESCRIPTION
           "Initial version of this MIB module, published as RFC 5324."
    ::= { mib-2 178 }

t11FcSpPoMIBNotifications  OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 0 }
t11FcSpPoMIBObjects        OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 1 }
t11FcSpPoMIBConformance    OBJECT IDENTIFIER ::= { t11FcSpPolicyMIB 2 }
t11FcSpPoActive         OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 1 }
t11FcSpPoOperations     OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 2 }
t11FcSpPoNonActive      OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 3 }
t11FcSpPoStatistics     OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 4 }
t11FcSpPoControl        OBJECT IDENTIFIER ::= { t11FcSpPoMIBObjects 5 }

--
--  Part 1 - Active Policy Objects
--

t11FcSpPoTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing top-level information about active
           FC-SP policies on various Fabrics."
    ::= { t11FcSpPoActive 1 }

t11FcSpPoEntry OBJECT-TYPE



De Santi, et al.            Standards Track                    [Page 66]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       T11FcSpPoEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about active FC-SP policies
           for a particular Fabric, managed as part of the Fibre
           Channel management instance identified by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex }
    ::= { t11FcSpPoTable 1 }

T11FcSpPoEntry ::= SEQUENCE {
    t11FcSpPoFabricIndex           T11FabricIndex,
    t11FcSpPoPolicySummaryObjName  T11FcSpAlphaNumName,
    t11FcSpPoAdminFabricName       FcNameIdOrZero,
    t11FcSpPoActivatedTimeStamp    TimeStamp
}

t11FcSpPoFabricIndex OBJECT-TYPE
    SYNTAX       T11FabricIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Fabric."
    ::= { t11FcSpPoEntry 1 }

t11FcSpPoPolicySummaryObjName OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The name of this Fabric's (active) Policy Summary Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.3 and table 104."
    ::= { t11FcSpPoEntry 2 }

t11FcSpPoAdminFabricName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The administratively-specified name for this Fabric, as
           specified in the active Switch Membership List Object.
           This value is meaningful only when Static Domain_IDs are
           in use in a Fabric (see FC-SW-4).  Static Domain_IDs are
           administratively enabled by a setting of the Switch Flags



De Santi, et al.            Standards Track                    [Page 67]
^L
RFC 5324                     MIB for FC-SP                September 2008


           in each Switch Entry in the Switch Membership List Object.
           If Static Domain_IDs are not in use, this value might be
           '0000000000000000'h.

           The t11FamEnable, t11FamFabricName, and
           t11FamConfigDomainIdType objects defined in the
           T11-FC-FABRIC-ADDR-MGR-MIB module are also concerned with
           the use of an administratively-specified name for a Fabric
           and Static Domain_IDs.  When FC-SP Policy is in use in a
           Fabric, the values of t11FamEnable, t11FamFabricName, and
           t11FamConfigDomainIdType must be read-only and reflect the
           active Policy Objects.  For example, the value of
           t11FamFabricName must reflect the value of
           t11FcSpPoAdminFabricName."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 108.
            - Fibre Channel - Switch Fabric-4 (FC-SW-4),
              ANSI INCITS 418-2006, April 2006, section 7.1.
            - Fibre Channel Fabric Address Manager MIB', RFC 4439,
              March 2006."
    ::= { t11FcSpPoEntry 3 }

t11FcSpPoActivatedTimeStamp OBJECT-TYPE
    SYNTAX       TimeStamp
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The value of sysUpTime at which this Fabric's Policy
           Summary Object was last activated, or zero if the same
           Policy Summary Object has been active since the last
           restart of the management system."
    ::= { t11FcSpPoEntry 4 }

--
-- The table of Policy Summary Objects
--

t11FcSpPoSummaryTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoSummaryEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of information about active Policy Objects listed
           within FC-SP Policy Summary Objects."
    ::= { t11FcSpPoActive 2 }




De Santi, et al.            Standards Track                    [Page 68]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpPoSummaryEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoSummaryEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one of the active
           Policy Objects listed within the Policy Summary Object for
           the Fabric identified by t11FcSpPoFabricIndex and managed
           within the Fibre Channel management instance identified by
           fcmInstanceIndex.

           How many Policy Objects of a given type can be active at
           any one time for a given Fabric depends on the type, as
           specified in FC-SP.  For some types, it is one per Fabric;
           for other types, more than one can be active per Fabric.
           In both of these cases, the absence of any entries in this
           table for a particular type is equivalent to there being one
           Policy Object of that type that is empty, e.g., a Switch
           Membership List Object that identifies zero Switches."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.3 and table 104."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoSummaryPolicyNameType,
             t11FcSpPoSummaryPolicyName }
    ::= { t11FcSpPoSummaryTable 1 }

T11FcSpPoSummaryEntry ::= SEQUENCE {
    t11FcSpPoSummaryPolicyNameType  T11FcSpPolicyNameType,
    t11FcSpPoSummaryPolicyName      T11FcSpPolicyName,
    t11FcSpPoSummaryPolicyType      T11FcSpPolicyObjectType,
    t11FcSpPoSummaryHashFormat      T11FcSpPolicyHashFormat,
    t11FcSpPoSummaryHashValue       T11FcSpPolicyHashValue
}

t11FcSpPoSummaryPolicyNameType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),
                     alphaNumericName(7)
                 }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The combination of t11FcSpPoSummaryPolicyNameType and
           t11FcSpPoSummaryPolicyName specify the name of the Policy
           Object contained in the Policy Summary Object.




De Santi, et al.            Standards Track                    [Page 69]
^L
RFC 5324                     MIB for FC-SP                September 2008


           The type of name is 'nodeName' if the value of the
           corresponding instance of t11FcSpPoSummaryPolicyType is
           'switchConnectivity', or 'alphaNumericName' otherwise."
    ::= { t11FcSpPoSummaryEntry 1 }

t11FcSpPoSummaryPolicyName OBJECT-TYPE
    SYNTAX       T11FcSpPolicyName
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The combination of t11FcSpPoSummaryPolicyNameType and
           t11FcSpPoSummaryPolicyName specify the name of the Policy
           Object contained in the Policy Summary Object."
    ::= { t11FcSpPoSummaryEntry 2 }

t11FcSpPoSummaryPolicyType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyObjectType
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The 'Identifier' that specifies the type of this
           Policy Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.3.1 and table 104."
    ::= { t11FcSpPoSummaryEntry 3 }

t11FcSpPoSummaryHashFormat OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashFormat
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The format of this Policy Object's hash value as
           contained in the corresponding instance of the
           t11FcSpPoSummaryHashValue object."
    ::= { t11FcSpPoSummaryEntry 4 }

t11FcSpPoSummaryHashValue OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashValue
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The hash value of this Policy Object, in the format
           identified by the corresponding instance of the
           t11FcSpPoSummaryHashFormat object."
    ::= { t11FcSpPoSummaryEntry 5 }




De Santi, et al.            Standards Track                    [Page 70]
^L
RFC 5324                     MIB for FC-SP                September 2008


--
-- Switch Entries in Active Switch Membership List Objects
--

t11FcSpPoSwMembTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoSwMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Switch Entries in active Switch Membership List
           Objects.

           One Switch Membership List Object is represented by all
           of the rows of this table that have the same values
           of fcmInstanceIndex and t11FcSpPoFabricIndex."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoActive 3 }

t11FcSpPoSwMembEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoSwMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Switch Entry
           within the active Switch Membership List Object for the
           Fabric identified by t11FcSpPoFabricIndex and managed
           within the Fibre Channel management instance identified
           by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoSwMembSwitchNameType, t11FcSpPoSwMembSwitchName }
    ::= { t11FcSpPoSwMembTable 1 }

T11FcSpPoSwMembEntry ::= SEQUENCE {
    t11FcSpPoSwMembSwitchNameType   T11FcSpPolicyNameType,
    t11FcSpPoSwMembSwitchName       FcNameIdOrZero,
    t11FcSpPoSwMembSwitchFlags      BITS,
    t11FcSpPoSwMembDomainID         FcDomainIdOrZero,
    t11FcSpPoSwMembPolicyDataRole   INTEGER,
    t11FcSpPoSwMembAuthBehaviour    BITS,
    t11FcSpPoSwMembAttribute        T11FcSpAlphaNumNameOrAbsent
}

t11FcSpPoSwMembSwitchNameType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),



De Santi, et al.            Standards Track                    [Page 71]
^L
RFC 5324                     MIB for FC-SP                September 2008


                     restrictedNodeName(2),
                     wildcard(5),
                     restrictedWildcard(6)
                 }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "If the value of this object is 'nodeName' or
           'restrictedNodeName', then the combination of
           this object and t11FcSpPoSwMembSwitchName specify the
           Switch Name of this Switch Entry.

           The membership is restricted or unrestricted based on the
           name type.  Restricted membership means that the Switch is
           not allowed to be part of the Fabric unless allowed by a
           specific Switch Connectivity Object.  Unrestricted
           membership means that the Switch is allowed to be part of
           the Fabric unless disallowed by a specific Switch
           Connectivity Object.

           The values of 'wildcard' and 'restrictedWildcard' provide
           the means to specify whether to allow/deny membership for
           Switches not explicitly named in the Switch Membership
           List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoSwMembEntry 1 }

t11FcSpPoSwMembSwitchName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "When the value of t11FcSpPoSwMembSwitchNameType is
           'wildcard' or 'restrictedWildcard', this object has the
           value '0000000000000000'h.

           Otherwise, the combination of t11FcSpPoSwMembSwitchNameType
           and this object specify the Switch Name of this Switch
           Entry."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoSwMembEntry 2 }




De Santi, et al.            Standards Track                    [Page 72]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpPoSwMembSwitchFlags OBJECT-TYPE
    SYNTAX       BITS {
                     staticDomainID(0),
                     insistentDomainID(1),
                     serialPortsAccess(2),
                     physicalPortsAccess(3),
                     managerRole(4)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "Configurable options in respect to the administration
           of Policy Objects at this Switch:

              'staticDomainID'      - if this bit is set, the Switch
           uses the 'Static Domain_IDs behavior' (as defined in
           FC-SW-4).  This bit needs to have the same setting for all
           Switches in a Fabric's Switch Membership List Object, or
           else the Fabric will partition.  If this bit is set, the
           Domain_ID for the Switch is given by the corresponding
           instance of t11FcSpPoSwMembDomainID.

              'insistentDomainID'   -  if this bit is set, the
           Switch uses the 'Insistent Domain_ID behavior' (see
           t11FamConfigDomainId of T11-FC-FABRIC-ADDR-MGR-MIB), the
           Domain_ID for the Switch is given by the corresponding
           instance of t11FcSpPoSwMembDomainID.

              'serialPortsAccess'   - the Switch allows management
           through serial ports when and only when this bit is set.

              'physicalPortsAccess' - the Switch allows management
           through the physical panel when and only when this bit
           is set.

              'managerRole'         - the Switch is allowed to change
           the Fabric Policy configuration (on receipt of any of the
           EACA, Enhanced Stage Fabric Configuration (ESFC), Enhanced
           Update Fabric Configuration (EUFC), ACA, SFC, or UFC
           SW_ILSs) if and only if this bit is set.

           Whenever a Fabric has Active Policy Objects, the value of
           the t11FamConfigDomainIdType object defined in the
           T11-FC-FABRIC-ADDR-MGR-MIB module must be read-only and
           reflect the values of the 'staticDomainID' and
           'insistentDomainID' bits of this object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,



De Santi, et al.            Standards Track                    [Page 73]
^L
RFC 5324                     MIB for FC-SP                September 2008


              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 112.
            - Fibre Channel - Switch Fabric-4 (FC-SW-4),
              ANSI INCITS 418-2006, April 2006, section 7.1.
            - t11FamConfigDomainIdType, T11-FC-FABRIC-ADDR-MGR-MIB,
              Fibre Channel Fabric Address Manager MIB, RFC 4439."
    ::= { t11FcSpPoSwMembEntry 3 }

t11FcSpPoSwMembDomainID OBJECT-TYPE
    SYNTAX       FcDomainIdOrZero
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The specified Domain_ID value when either of the
           'staticDomainID' or 'insistentDomainID' bits are set in
           the corresponding instance of t11FcSpPoSwMembSwitchFlags.

           Whenever a Fabric has Active Policy Objects, the value
           of the t11FamConfigDomainId object defined in the
           T11-FC-FABRIC-ADDR-MGR-MIB module must be read-only and
           reflect the value of this object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and tables 111 and 112.
            - t11FamConfigDomainId, T11-FC-FABRIC-ADDR-MGR-MIB,
              Fibre Channel Fabric Address Manager MIB, RFC 4439."
    ::= { t11FcSpPoSwMembEntry 4 }

t11FcSpPoSwMembPolicyDataRole OBJECT-TYPE
    SYNTAX       INTEGER {
                     client(1),
                     autonomous(2),
                     server(3)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The role of the Switch in terms of which Policy data
           it retains/maintains:

             'client' - the Switch operates as a Client Switch.
           A Client Switch maintains its own Switch Connectivity
           Object and all Fabric-wide List Objects.  If FC-SP
           Zoning is used, a Client Switch maintains only the
           subset of the Active Zone Set that it requires to
           enforce the current Fabric Zoning configuration.




De Santi, et al.            Standards Track                    [Page 74]
^L
RFC 5324                     MIB for FC-SP                September 2008


             'autonomous' -  the Switch operates as an Autonomous
           Switch.  An Autonomous Switch maintains its own Switch
           Connectivity Object and all Fabric-wide List Objects.
           This is the same as 'client' except that if FC-SP Zoning
           is used, an Autonomous Switch maintains a complete copy
           of the Fabric Zoning Database.

             'server' - the Switch operates as a Server Switch.
           A Server Switch maintains all Fabric-wide List Objects
           and the Switch Connectivity Objects of each Switch in
           the Fabric.  If FC-SP Zoning is used, a Server Switch
           maintains a complete copy of the Fabric Zoning Database."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 113."
    ::= { t11FcSpPoSwMembEntry 5 }

t11FcSpPoSwMembAuthBehaviour  OBJECT-TYPE
    SYNTAX       BITS {
                     mustAuthenticate(0),
                     rejectIsFailure(1)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The authentication behaviour of the Switch:

             'mustAuthenticate' - if this bit is set, all connections
           between this Switch and neighbor Switches must be
           authenticated.

             'rejectIsFailure' - if this bit is set, the rejection of
           an AUTH_Negotiate message must be considered as an
           authentication failure by this Switch."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 114."
    ::= { t11FcSpPoSwMembEntry 6 }

t11FcSpPoSwMembAttribute  OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumNameOrAbsent
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The name of an active Attribute Policy Object that is
           defined for this Switch, or the zero-length string.  The



De Santi, et al.            Standards Track                    [Page 75]
^L
RFC 5324                     MIB for FC-SP                September 2008


           zero-length string indicates that no Attribute Policy
           Object is defined for this Switch."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoSwMembEntry 7 }

--
-- Node Entries in Active Node Membership List Objects
--

t11FcSpPoNoMembTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNoMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Node Entries in active Node Membership List
           Objects.

           One Node Membership List Object is represented by all
           of the rows of this table that have the same values
           of fcmInstanceIndex and t11FcSpPoFabricIndex."
    ::= { t11FcSpPoActive 4 }

t11FcSpPoNoMembEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNoMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Node Entry
           within the active Node Membership List Object for the
           Fabric identified by t11FcSpPoFabricIndex and managed
           within the Fibre Channel management instance identified
           by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNoMembNodeNameType, t11FcSpPoNoMembNodeName }
    ::= { t11FcSpPoNoMembTable 1 }

T11FcSpPoNoMembEntry ::= SEQUENCE {
    t11FcSpPoNoMembNodeNameType   T11FcSpPolicyNameType,
    t11FcSpPoNoMembNodeName       FcNameIdOrZero,
    t11FcSpPoNoMembFlags          BITS,
    t11FcSpPoNoMembCtAccessIndex  Unsigned32,
    t11FcSpPoNoMembAttribute      T11FcSpAlphaNumNameOrAbsent
}

t11FcSpPoNoMembNodeNameType OBJECT-TYPE



De Santi, et al.            Standards Track                    [Page 76]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),
                     restrictedNodeName(2),
                     portName(3),
                     restrictedPortName(4),
                     wildcard(5),
                     restrictedWildcard(6)
                 }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "If the value of this object is 'wildcard' or
           'restrictedWildcard', this Node Entry applies to Nodes not
           explicitly named in the Node Membership List Object.

           Otherwise, the combination of this object and
           t11FcSpPoNoMembNodeName specify the name of this Node Entry
           in the active Node Membership List Object.  A Node is
           identified by its Node Name or by one or more of its Port
           Names.

           Restricted membership means that a Node is not allowed to be
           connected to the Fabric unless allowed by a specific Switch
           Connectivity Object.  Unrestricted membership means that a
           Node is allowed to be connected to the Fabric unless
           disallowed by a specific Switch Connectivity Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 116."
    ::= { t11FcSpPoNoMembEntry 1 }

t11FcSpPoNoMembNodeName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "If the value of t11FcSpPoNoMembNodeNameType is
           'wildcard' or 'restrictedWildcard', this object has the
           value '0000000000000000'h.

           Otherwise, the combination of t11FcSpPoNoMembNodeNameType
           and this object specify the name of this Node Entry is the
           active Node Membership List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 116."



De Santi, et al.            Standards Track                    [Page 77]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpPoNoMembEntry 2 }

t11FcSpPoNoMembFlags OBJECT-TYPE
    SYNTAX       BITS {
                     scsiEnclosureAccess(0),
                     authenticationRequired(1)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "Configurable options in respect to the administration
           of Policy Objects at this Node:

                'scsiEnclosureAccess'      - the Node is allowed to
           control any Switch through SCSI Enclosure Services if this
           bit is set.  If a Switch does not support SCSI Enclosure
           Services, this bit is ignored.

                'authenticationRequired'   - the Node is required to
           authenticate itself to any Switch to which it is connected
           if and only if this bit is set."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 118."
    ::= { t11FcSpPoNoMembEntry 3 }

t11FcSpPoNoMembCtAccessIndex  OBJECT-TYPE
    SYNTAX       Unsigned32 (0..4294967295)
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "If the value of this object is zero, then access by this
           Node to Generic Services is not limited by a Common
           Transport Access Specifier.

           Otherwise, the limits are specified by the set of Common
           Transport Access Descriptors contained in those rows of
           the t11FcSpPoCtDescrTable for the same Fabric and for which
           the value of t11FcSpPoCtDescrSpecifierIndex is the same as
           the value of this object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              section 7.1.4.1 and tables 118/119/120/121."
    ::= { t11FcSpPoNoMembEntry 4 }

t11FcSpPoNoMembAttribute  OBJECT-TYPE



De Santi, et al.            Standards Track                    [Page 78]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       T11FcSpAlphaNumNameOrAbsent
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The name of an active Attribute Policy Object that is
           defined for this Node, or the zero-length string.  The
           zero-length string indicates that no Attribute Policy
           Object is defined for this Node."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 116."
    ::= { t11FcSpPoNoMembEntry 5 }

--
--
-- Common Transport Access Descriptors
--

t11FcSpPoCtDescrTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoCtDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Common Transport Access Descriptors being used
           within active Policy Objects.

           A Common Transport Access Specifier is a list of Common
           Transport Access Descriptors that specify whether a Node
           is allowed to access a Generic Service or Sub-Server.

           An active Common Transport Access Specifier is represented
           by all rows of this table that have the same values of
           fcmInstanceIndex, t11FcSpPoFabricIndex, and
           t11FcSpPoCtDescrSpecifierIndex."
    ::= { t11FcSpPoActive 5 }

t11FcSpPoCtDescrEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoCtDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Common
           Transport Access Descriptor of an active Common Transport
           Access Specifier used within the Fabric identified by
           t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,



De Santi, et al.            Standards Track                    [Page 79]
^L
RFC 5324                     MIB for FC-SP                September 2008


             t11FcSpPoCtDescrSpecifierIndex, t11FcSpPoCtDescrIndex }
    ::= { t11FcSpPoCtDescrTable 1 }

T11FcSpPoCtDescrEntry ::= SEQUENCE {
    t11FcSpPoCtDescrSpecifierIndex   Unsigned32,
    t11FcSpPoCtDescrIndex            Unsigned32,
    t11FcSpPoCtDescrFlags            BITS,
    t11FcSpPoCtDescrGsType           OCTET STRING,
    t11FcSpPoCtDescrGsSubType        OCTET STRING
}

t11FcSpPoCtDescrSpecifierIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Common Transport Access Specifier within a Fabric."
    ::= { t11FcSpPoCtDescrEntry 1 }

t11FcSpPoCtDescrIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Common Transport Access Descriptor within a Common Transport
           Access Specifier."
    ::= { t11FcSpPoCtDescrEntry 2 }

t11FcSpPoCtDescrFlags OBJECT-TYPE
    SYNTAX       BITS {
                     allow(0),
                     gsTypeWildcard(1),
                     gsSubTypeWildcard(2),
                     readOnly(3)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The flag bits that specify how access is to be limited by
           this Common Transport Access Descriptor:

            - allow -- access to the specified Generic Service and
              Server is allowed if this bit is set, and is to be denied
              if this bit is not set.

            - gsTypeWildcard -- if this bit is set, the Generic Service



De Santi, et al.            Standards Track                    [Page 80]
^L
RFC 5324                     MIB for FC-SP                September 2008


              to be allowed/denied is specified by the value of
              t11FcSpPoCtDescrGsType.  If this bit is set, then the
              gsSubTypeWildcard bit must not be set.

            - gsSubTypeWildcard -- if this bit is set, the Generic
              Service to be allowed/denied is specified by the value of
              t11FcSpPoCtDescrGsSubType.  If this bit is set, then the
              gsTypeWildcard bit must not be set.

            - readOnly -- if this bit is set, then access is to be
              granted only for reading."
    ::= { t11FcSpPoCtDescrEntry 3 }

t11FcSpPoCtDescrGsType OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (1))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The GS_Type of the Generic Service (e.g., the FC-GS-5
           Management Service) that is subject to access control.
           This value is ignored if the gsTypeWildcard bit is not set
           in the corresponding value of t11FcSpPoCtDescrFlags."
    REFERENCE
           "- Fibre Channel - Generic Services-5 (FC-GS-5),
              ANSI INCITS 427-2006, section 4.3.2.4."
    ::= { t11FcSpPoCtDescrEntry 4 }

t11FcSpPoCtDescrGsSubType OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (1))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The GS_Subtype of the Generic Server (e.g., the Fabric Zone
           Server) that is subject to access control.  This value is
           ignored if the gsSubTypeWildcard bit is not set in the
           corresponding value of t11FcSpPoCtDescrFlags."
    REFERENCE
           "- Fibre Channel - Generic Services-5 (FC-GS-5),
              ANSI INCITS 427-2006, section 4.3.2.5."
    ::= { t11FcSpPoCtDescrEntry 5 }

--
--
-- Switches/Nodes in Active Switch Connectivity Objects
--

t11FcSpPoSwConnTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoSwConnEntry



De Santi, et al.            Standards Track                    [Page 81]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of active Switch Connectivity Objects.

           A Switch Connectivity Object defines to which other
           Switches or Nodes a particular Switch may/may not be
           connected at the Node level and/or at the Port level."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6.1, tables 123/124."
    ::= { t11FcSpPoActive 6 }

t11FcSpPoSwConnEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoSwConnEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains the name of either a Switch or a Node
           with which any port of a particular Switch, or a particular
           port of that Switch, is allowed or not allowed to be
           connected.

           The particular Switch is on the Fabric identified by
           t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoSwConnSwitchName, t11FcSpPoSwConnAllowedType,
             t11FcSpPoSwConnPortNameOrAll,
             t11FcSpPoSwConnAllowedIndex }
    ::= { t11FcSpPoSwConnTable 1 }

T11FcSpPoSwConnEntry ::= SEQUENCE {
    t11FcSpPoSwConnSwitchName       FcNameIdOrZero,
    t11FcSpPoSwConnAllowedType      INTEGER,
    t11FcSpPoSwConnPortNameOrAll    FcNameIdOrZero,
    t11FcSpPoSwConnAllowedIndex     Unsigned32,
    t11FcSpPoSwConnAllowedNameType  T11FcSpPolicyNameType,
    t11FcSpPoSwConnAllowedName      T11FcSpPolicyName
}

t11FcSpPoSwConnSwitchName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The name of the particular Switch for which this Switch



De Santi, et al.            Standards Track                    [Page 82]
^L
RFC 5324                     MIB for FC-SP                September 2008


           Connectivity Object specifies topology restrictions."
    ::= { t11FcSpPoSwConnEntry 1 }

t11FcSpPoSwConnAllowedType OBJECT-TYPE
    SYNTAX       INTEGER { switch(1), node(2) }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "This object specifies whether this row refers to
           Switch-to-Switch or Switch-to-Node connectivity, i.e.,
           whether the corresponding instance of
           t11FcSpPoSwConnAllowedName specifies the name of a Switch
           or the name of a Node."
    ::= { t11FcSpPoSwConnEntry 2 }

t11FcSpPoSwConnPortNameOrAll OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE(0 | 8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "This object specifies either the particular port to which
           this topology restriction applies, or if the value is the
           zero-length string, that the topology restriction applies
           to all ports on the particular Switch.

           In the FC-SP Policy Database, restrictions for a particular
           port are formatted within a Port Connectivity Entry of a
           Switch Connectivity Object, whereas restrictions for all
           ports on the Switch are specified in the main part of a
           Switch Connectivity Object, i.e., not in a Port Connectivity
           Entry."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6.1, tables 123/124."
    ::= { t11FcSpPoSwConnEntry 3 }

t11FcSpPoSwConnAllowedIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "When multiple rows in this table apply to the same
           port(s) in the same Switch's Switch Connectivity Object,
           this object provides a unique index value to distinguish
           between such rows."
    ::= { t11FcSpPoSwConnEntry 4 }




De Santi, et al.            Standards Track                    [Page 83]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpPoSwConnAllowedNameType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),
                     restrictedNodeName(2),
                     portName(3),
                     restrictedPortName(4),
                     wildcard(5),
                     restrictedWildcard(6)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "If the value of this object is 'wildcard' or
           'restrictedWildcard', this row specifies whether
           connectivity is allowed/not allowed with entities not
           explicitly named by other rows.

           Otherwise, the combination of t11FcSpPoSwConnAllowedNameType
           and t11FcSpPoSwConnAllowedName specify the name of:

           - a Switch (if t11FcSpPoSwConnAllowedType = 'switch'), or
           - a Node (if t11FcSpPoSwConnAllowedType = 'node')

           to which connectivity is:

            - allowed by 'nodeName' and 'portName',
            - not allowed by 'restrictedNodeName' and
              'restrictedPortName'."
    ::= { t11FcSpPoSwConnEntry 5 }

t11FcSpPoSwConnAllowedName OBJECT-TYPE
    SYNTAX       T11FcSpPolicyName (SIZE (8))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "If the value of t11FcSpPoSwConnAllowedNameType is
           'wildcard' or 'restrictedWildcard', this object has the
           value '0000000000000000'h.

           Otherwise, the combination of t11FcSpPoSwConnAllowedNameType
           and t11FcSpPoSwConnAllowedName specify the name of:

           - a Switch (if t11FcSpPoSwConnAllowedType = 'switch'), or
           - a Node (if t11FcSpPoSwConnAllowedType = 'node')

           to which connectivity is allowed/restricted."
    ::= { t11FcSpPoSwConnEntry 6 }




De Santi, et al.            Standards Track                    [Page 84]
^L
RFC 5324                     MIB for FC-SP                September 2008


--
-- IP Management Entries in Active IP Management List Objects
--

t11FcSpPoIpMgmtTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoIpMgmtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of IP Management Entries in active IP Management
           List Objects.  An IP Management List Object is a
           Fabric-wide Policy Object that describes which IP hosts
           are allowed to manage a Fabric.

           One IP Management List Object is represented by all
           of the rows of this table that have the same values
           of fcmInstanceIndex and t11FcSpPoFabricIndex."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7"
    ::= { t11FcSpPoActive 7 }

t11FcSpPoIpMgmtEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoIpMgmtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one IP Management
           Entry within the active IP Management List Object for the
           Fabric identified by t11FcSpPoFabricIndex and managed
           within the Fibre Channel management instance identified
           by fcmInstanceIndex.

           The Policy Object Name of an IP Management Entry Policy
           Object is either an IPv6 Address Range or an IPv4 Address
           Range, where in each case, the range is specified as two
           addresses: the low and high ends of the range.  In
           particular, since the Policy Object Name in this situation
           can only be an IPv6 Address Range or an IPv4 Address Range,
           it is represented here by three MIB objects defined as a
           (InetAddressType, InetAddress, InetAddress) tuple, in which
           the first address is the low end of the range, the second
           address is the high end of the range, and both addresses are
           of the type designated by InetAddressType.

           In theory, the use of t11FcSpPoIpMgmtEntryNameLow and
           t11FcSpPoIpMgmtEntryNameHigh (which both have the syntax



De Santi, et al.            Standards Track                    [Page 85]
^L
RFC 5324                     MIB for FC-SP                September 2008


           of InetAddress) in the INDEX could cause the need for
           excessively long OIDs.  In practice, this can't happen
           because FC-SP doesn't allow these objects to be specified
           as DNS names."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoIpMgmtEntryNameType,
             t11FcSpPoIpMgmtEntryNameLow,
             t11FcSpPoIpMgmtEntryNameHigh }
    ::= { t11FcSpPoIpMgmtTable 1 }

T11FcSpPoIpMgmtEntry ::= SEQUENCE {
    t11FcSpPoIpMgmtEntryNameType   InetAddressType,
    t11FcSpPoIpMgmtEntryNameLow    InetAddress,
    t11FcSpPoIpMgmtEntryNameHigh   InetAddress,
    t11FcSpPoIpMgmtWkpIndex        Unsigned32,
    t11FcSpPoIpMgmtAttribute       T11FcSpAlphaNumNameOrAbsent
}

t11FcSpPoIpMgmtEntryNameType OBJECT-TYPE
    SYNTAX       InetAddressType
                 -- INTEGER { ipv4(1), ipv6(2) }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The combination of t11FcSpPoIpMgmtNameType,
           t11FcSpPoIpMgmtNameLow, and t11FcSpPoIpMgmtNameHigh
           specify the Internet address range of this IP Management
           Entry in the IP Management List Object.

           The FC-SP specification does not allow the use of a
           DNS domain name to specify the address at the lower end
           or at the higher end of the Internet address range, nor does
           it allow the specification of a zone index.  Therefore, the
           type of address must be one of: 'ipv4', or 'ipv6'."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              sections 7.1.7.1 & 7.1.2, tables 103/126."
    ::= { t11FcSpPoIpMgmtEntry 1 }

t11FcSpPoIpMgmtEntryNameLow OBJECT-TYPE
    SYNTAX       InetAddress (SIZE(4 | 16))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The lower end of an Internet address range.  The type
           of this address is given by the corresponding instance
           of t11FcSpPoIpMgmtEntryNameType.



De Santi, et al.            Standards Track                    [Page 86]
^L
RFC 5324                     MIB for FC-SP                September 2008


           The combination of t11FcSpPoIpMgmtNameType,
           t11FcSpPoIpMgmtNameLow, and t11FcSpPoIpMgmtNameHigh
           specify the Internet address range of this IP Management
           Entry in the IP Management List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              sections 7.1.7.1 & 7.1.2, tables 103/126."
    ::= { t11FcSpPoIpMgmtEntry 2 }

t11FcSpPoIpMgmtEntryNameHigh OBJECT-TYPE
    SYNTAX       InetAddress (SIZE(4 | 16))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The higher end of an Internet address range.  The type
           of this address is given by the corresponding instance
           of t11FcSpPoIpMgmtEntryNameType.

           The combination of t11FcSpPoIpMgmtNameType,
           t11FcSpPoIpMgmtNameLow, and t11FcSpPoIpMgmtNameHigh
           specify the Internet address range of this IP Management
           Entry in the IP Management List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 7.1.7.1 & 7.1.2, tables 103/126."
    ::= { t11FcSpPoIpMgmtEntry 3 }

t11FcSpPoIpMgmtWkpIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (0..4294967295)
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "This object identifies the restrictions for IP management
           access by IP hosts in this range of IP addresses, specified
           as the set of Well-Known Protocols Access Descriptors
           contained in those rows of the t11FcSpPoWkpDescrTable for
           which the value of t11FcSpPoWkpDescrSpecifierIndex is the
           same as the value of this object.  A value of zero indicates
           that this IP Management Entry does not identify a Well-Known
           Protocols Access Specifier."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and tables 127/129."
    ::= { t11FcSpPoIpMgmtEntry 4 }




De Santi, et al.            Standards Track                    [Page 87]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpPoIpMgmtAttribute OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumNameOrAbsent
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The name of an active Attribute Policy Object that is
           defined for this IP Management entry or the zero-length
           string.  The zero-length string indicates that no Attribute
           Policy Object is defined for this IP Management entry."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 128."
    ::= { t11FcSpPoIpMgmtEntry 5 }

--
-- Well-Known Protocol Access Descriptors
--

t11FcSpPoWkpDescrTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoWkpDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of the Well-Known Protocol Access Descriptors
           being used within active Policy Objects.

           A Well-Known Protocol Access Specifier is a list of
           Well-Known Protocol Access Descriptors each of which
           specifies a protocol number, a port number, and/or various
           flags specifying how IP management access is restricted.

           A Well-Known Protocol Transport Access Specifier is
           represented by all rows of this table that have the
           same values of fcmInstanceIndex, t11FcSpPoFabricIndex,
           and t11FcSpPoWkpDescrSpecifierIndex."
    ::= { t11FcSpPoActive 8 }

t11FcSpPoWkpDescrEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoWkpDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Well-Known
           Protocol Access Descriptor of a Well-Known Protocol
           Access Specifier used within the Fabric identified by
           t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex."



De Santi, et al.            Standards Track                    [Page 88]
^L
RFC 5324                     MIB for FC-SP                September 2008


    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoWkpDescrSpecifierIndex, t11FcSpPoWkpDescrIndex }
    ::= { t11FcSpPoWkpDescrTable 1 }

T11FcSpPoWkpDescrEntry ::= SEQUENCE {
    t11FcSpPoWkpDescrSpecifierIndex   Unsigned32,
    t11FcSpPoWkpDescrIndex            Unsigned32,
    t11FcSpPoWkpDescrFlags            BITS,
    t11FcSpPoWkpDescrWkpNumber        Unsigned32,
    t11FcSpPoWkpDescrDestPort         InetPortNumber
}

t11FcSpPoWkpDescrSpecifierIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Well-Known Protocol Access Specifier within a Fabric."
    ::= { t11FcSpPoWkpDescrEntry 1 }

t11FcSpPoWkpDescrIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Well-Known Protocol Access Descriptor within a Well-Known
           Protocol Access Specifier."
    ::= { t11FcSpPoWkpDescrEntry 2 }

t11FcSpPoWkpDescrFlags OBJECT-TYPE
    SYNTAX       BITS {
                     allow(0),
                     wkpWildcard(1),
                     destPortWildcard(2),
                     readOnly(3)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The flag bits that specify how access is to be limited by
           this Well-Known Protocol Access Descriptor:

            - allow -- IP management access using this protocol/port
              is allowed if this bit is set, and to be denied if this
              bit is not set.




De Santi, et al.            Standards Track                    [Page 89]
^L
RFC 5324                     MIB for FC-SP                September 2008


            - wkpWildcard -- if this bit is set, the IP Protocol number
              of the Well-Known Protocol to be allowed/denied is
              specified by the value of t11FcSpPoWkpDescrWkpNumber.

            - destPortWildcard -- if this bit is set, the Destination
              (TCP/UDP) Port number of the Well-Known Protocol to be
              allowed/denied is specified by the value of
              t11FcSpPoWkpDescrDestPort.

            - readOnly -- if this bit is set, then access is to be
              granted only for reading."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 131."
    ::= { t11FcSpPoWkpDescrEntry 3 }

t11FcSpPoWkpDescrWkpNumber OBJECT-TYPE
    SYNTAX       Unsigned32 (0..255)
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "When the 'wkpWildcard' bit is set in the corresponding
           instance of t11FcSpPoWkpDescrFlags, this object specifies
           the IP protocol number of the Well-Known Protocol."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 131.
            - http://www.iana.org/assignments/protocol-numbers."
    ::= { t11FcSpPoWkpDescrEntry 4 }

t11FcSpPoWkpDescrDestPort OBJECT-TYPE
    SYNTAX       InetPortNumber
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "When the 'destPortWildcard' bit is set in the corresponding
           instance of t11FcSpPoWkpDescrFlags, this object specifies
           the Destination (TCP/UDP) Port number of the Well-Known
           Protocol.  When the 'destPortWildcard' bit is reset, this
           object is ignored (and can have the value zero)."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 131.
            - http://www.iana.org/assignments/port-numbers."
    ::= { t11FcSpPoWkpDescrEntry 5 }



De Santi, et al.            Standards Track                    [Page 90]
^L
RFC 5324                     MIB for FC-SP                September 2008


--
-- Attribute Entries in Active Attribute Policy Objects
--

t11FcSpPoAttribTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoAttribEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of the Attribute Policy Objects being used within
           active Policy Objects.  In the FC-SP Policy Database, each
           Attribute Policy Object consists of an Attribute Object Name
           and a set of Attribute Entries.

           An active Attribute Policy Object is represented by all the
           Attribute Entries in this table that have the same value
           of t11FcSpPoAttribName."
    ::= { t11FcSpPoActive 9 }

t11FcSpPoAttribEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoAttribEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each row contains information specific to an Attribute
           Entry contained within an Attribute Policy Object that is
           active within the Fabric identified by t11FcSpPoFabricIndex
           and managed within the Fibre Channel management instance
           identified by fcmInstanceIndex.

           For some types of Attribute Policy Objects, it is valuable
           to break out some semantically significant parts of the
           Policy Object's value into their own individual MIB
           objects; for example, to extract the one or more individual
           Authentication Protocol Identifiers and associated
           Authentication Protocol Parameters out of an Attribute
           Object containing a 'AUTH_Negotiate Message Payload'.
           For such types, another MIB table is defined to hold the
           extracted values in MIB objects specific to the Attribute
           Policy Object's type.  In such cases, the
           t11FcSpPoAttribExtension object in this table points to the
           other MIB table.

           If the value of one Attribute Entry is too large (more than
           256 bytes) to be contained within the value of one instance
           of t11FcSpPoAttribValue, then one row in this table contains
           the first 256 bytes, and one (or more) other row(s) in this
           table contain the rest of the value."



De Santi, et al.            Standards Track                    [Page 91]
^L
RFC 5324                     MIB for FC-SP                September 2008


    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoAttribName, t11FcSpPoAttribEntryIndex,
             t11FcSpPoAttribPartIndex }
    ::= { t11FcSpPoAttribTable 1 }

T11FcSpPoAttribEntry ::= SEQUENCE {
    t11FcSpPoAttribName         T11FcSpAlphaNumName,
    t11FcSpPoAttribEntryIndex   Unsigned32,
    t11FcSpPoAttribPartIndex    Unsigned32,
    t11FcSpPoAttribType         Unsigned32,
    t11FcSpPoAttribValue        OCTET STRING,
    t11FcSpPoAttribExtension    OBJECT IDENTIFIER
}

t11FcSpPoAttribName OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The name of the Attribute Policy Object containing one
           or more Attribute Entries."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.8.1 and table 133."
    ::= { t11FcSpPoAttribEntry 1 }

t11FcSpPoAttribEntryIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A unique value to distinguish this Attribute Entry
           from other Attribute Entries contained in the same
           Attribute Policy Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.8.1, tables 133/134."
    ::= { t11FcSpPoAttribEntry 2 }

t11FcSpPoAttribPartIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "When the value of an Attribute Entry is shorter than 257
           bytes, the whole value is contained in one instance of



De Santi, et al.            Standards Track                    [Page 92]
^L
RFC 5324                     MIB for FC-SP                September 2008


           t11FcSpPoAttribValue, and the value of this object is 1.

           If the value of an Attribute Entry is longer than 256 bytes,
           then that value is divided up on 256-byte boundaries such
           that all parts are 256 bytes long except the last part, which
           is shorter if necessary, with each such part contained in
           a separate row of this table, and the value of this object
           is set to the part number.  That is, this object has the
           value of 1 for bytes 0-255, the value of 2 for bytes
           256-511, etc."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.8.1, tables 134/135."
    ::= { t11FcSpPoAttribEntry 3 }

t11FcSpPoAttribType OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The type of attribute.  The first type to be defined is:

           t11FcSpPoAttribType    t11FcSpPoAttribValue
           ===================    ====================
             '00000001'h          The AUTH_Negotiate Message Payload
           "
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              section 7.1.8.1, tables 134/135 and table 10."
    ::= { t11FcSpPoAttribEntry 4 }

t11FcSpPoAttribValue OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (0..256))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The value of an Attribute Entry is divided up on 256-byte
           boundaries such that all parts are 256 bytes long except the
           last part, which is shorter if necessary, and each such part
           is contained in a separate instance of this object.

           The value of this object is independent of whether some
           parts of its value are broken out into separate MIB objects
           pointed to by the corresponding instance of
           t11FcSpPoAttribExtension."
    REFERENCE



De Santi, et al.            Standards Track                    [Page 93]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              section 7.1.8.1, tables 134/135 and table 10."
    ::= { t11FcSpPoAttribEntry 5 }

t11FcSpPoAttribExtension OBJECT-TYPE
    SYNTAX       OBJECT IDENTIFIER
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "For some types of Attribute Policy Object, the value of
           this MIB object points to type-specific MIB objects that
           contain individual/broken-out parts of the Attribute Policy
           Object's value.  If this object doesn't point to such
           type-specific MIB objects, then it contains the value:
           zeroDotZero.

           In particular, when the value of t11FcSpPoAttribType
           indicates 'AUTH_Negotiate Message Payload', one or more
           Authentication Protocol Identifiers and their associated
           Authentication Protocol Parameters are embedded within the
           value of the corresponding instance of t11FcSpPoAttribValue;
           MIB objects to contain these individual values are defined
           in the t11FcSpPoAuthProtTable.  Thus, for an 'AUTH_Negotiate
           Message Payload' Attribute, the value of this object
           contains an OID within the t11FcSpPoAuthProtTable, e.g.,
           of the whole table, of an individual row, or of an individual
           instance within the table."
    ::= { t11FcSpPoAttribEntry 6 }

--
-- Auth. Protocol Parameters in Active Attribute Policy Objects
--

t11FcSpPoAuthProtTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoAuthProtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Authentication Protocol Identifier and
           Authentication Protocol Parameters that are embedded in
           Attribute Policy Objects being used within active Policy
           Objects.

           This table is used for Attribute Entries of Attribute Policy
           Objects for which the value of t11FcSpPoAttribType indicates
           'AUTH_Negotiate Message Payload' and the value of
           t11FcSpPoAttribExtension contains the OID of this table."



De Santi, et al.            Standards Track                    [Page 94]
^L
RFC 5324                     MIB for FC-SP                September 2008


    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              sections 5.3.2 & 7.1.8.1, tables 134/135 and tables
              10/11."
    ::= { t11FcSpPoActive 10 }

t11FcSpPoAuthProtEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoAuthProtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about an Authentication
           Protocol that is extracted out of the Attribute Entry
           (identified by t11FcSpPoAttribEntryIndex) of the Policy
           Attribute Object (identified by t11FcSpPoAttribName), which
           is active within the Fabric identified by
           t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex.

           If the value of one Attribute Protocol Parameters string is
           too large (more than 256 bytes) to be contained within the
           value of one instance of t11FcSpPoAuthProtParams, then one
           row in this table contains the first 256 bytes, and one (or
           more) other row(s) in this table contain the rest of the
           value."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoAttribName, t11FcSpPoAttribEntryIndex,
             t11FcSpPoAuthProtIdentifier,
             t11FcSpPoAuthProtPartIndex }
    ::= { t11FcSpPoAuthProtTable 1 }

T11FcSpPoAuthProtEntry ::= SEQUENCE {
    t11FcSpPoAuthProtIdentifier   Unsigned32,
    t11FcSpPoAuthProtPartIndex    Unsigned32,
    t11FcSpPoAuthProtParams       OCTET STRING
}

t11FcSpPoAuthProtIdentifier OBJECT-TYPE
    SYNTAX       Unsigned32 (0..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The Authentication Protocol Identifier:

                    1      = DH-CHAP
                    2      = FCAP
                    3      = FCPAP



De Santi, et al.            Standards Track                    [Page 95]
^L
RFC 5324                     MIB for FC-SP                September 2008


                    4      = IKEv2
                    5      = IKEv2-AUTH
              240 thru 255 = Vendor Specific Protocols

            all other values are 'Reserved' (by T11)."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.3.2, table 11."
    ::= { t11FcSpPoAuthProtEntry 1 }

t11FcSpPoAuthProtPartIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "When the value of an Attribute Protocol Parameters string
           is shorter than 257 bytes, the whole value is contained in
           one instance of t11FcSpPoAuthProtParams, and the value of
           this object is 1. (This includes the case when the Attribute
           Protocol Parameters string is zero bytes in length.)

           If the value of an Authentication Protocol Parameters string
           is longer than 256 bytes, then that value is divided up on
           256-byte boundaries such that all parts are 256 bytes long
           except the last part, which is shorter if necessary, with
           each such part contained in a separate row of this table,
           and the value of this object is set to the part number.
           That is, this object has the value of 1 for bytes 0-255,
           the value of 2 for bytes 256-511, etc."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.3.2, table 10."
    ::= { t11FcSpPoAuthProtEntry 2 }

t11FcSpPoAuthProtParams OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (0..256))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The value of an Authentication Protocol Parameters string
           is divided up on 256-byte boundaries such that all parts
           are 256 bytes long except the last part, which is shorter
           if necessary, and each such part is contained in a
           separate instance of this object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,



De Santi, et al.            Standards Track                    [Page 96]
^L
RFC 5324                     MIB for FC-SP                September 2008


              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.3.2, table 10."
    ::= { t11FcSpPoAuthProtEntry 3 }

--
-- Part 2 - Activate/De-Activate Operations
--

--
-- Objects to Invoke Activate/De-Activate Operations
--

t11FcSpPoOperTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoOperEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table that allows Activate and Deactivate operations
           to be invoked for FC-SP Policies on various Fabrics.

           Activating a new policy configuration is a two-step
           process:

            1) create a single Policy Summary Object as a set of rows
               in the t11FcSpPoNaSummaryTable specifying a set of
               Policy Objects that describe the new configuration; and
            2) activate that Policy Summary Object using the
               t11FcSpPoOperActivate object defined in this table.

           Deactivating the current policy configuration is a one-step
           process: the current Policy Summary Object is deactivated
           using the t11FcSpPoOperDeActivate object."
    ::= { t11FcSpPoOperations 1 }

t11FcSpPoOperEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoOperEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry allows an Activate and/or Deactivate operation
           to be invoked on a particular Fabric, which is managed as
           part of the Fibre Channel management instance identified
           by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex }
    ::= { t11FcSpPoOperTable 1 }

T11FcSpPoOperEntry ::= SEQUENCE {
    t11FcSpPoOperActivate     T11FcSpAlphaNumName,



De Santi, et al.            Standards Track                    [Page 97]
^L
RFC 5324                     MIB for FC-SP                September 2008


    t11FcSpPoOperDeActivate   T11FcSpAlphaNumName,
    t11FcSpPoOperResult       INTEGER,
    t11FcSpPoOperFailCause    SnmpAdminString
}

t11FcSpPoOperActivate OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "Writing the name of a Policy Summary Object into this
           object is a request to activate the policy configuration
           described by the combination of all rows in
           t11FcSpPoNaSummaryTable that have that name as their
           value of t11FcSpPoNaSummaryName and are for the same
           Fabric.

           Before issuing such a request, the relevant rows in the
           t11FcSpPoNaSummaryTable must exist and represent a complete
           and consistent Policy Summary Object.  If they do not, the
           request will fail, with t11FcSpPoOperResult having the
           'badSummaryObject' value.

           When read, the value of this object is always the zero-
           length string.

           Writing to this object does not delete (or in any way
           affect) any rows in the MIB tables for non-active
           Policy Objects."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3.6.2"
    ::= { t11FcSpPoOperEntry 1 }

t11FcSpPoOperDeActivate OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "Writing the current value of t11FcSpPoPolicySummaryObjName
           into this object (for a particular Fabric) is a request
           to deactivate that Fabric's current policy configuration.
           Writing any other value into this object is an error
           (e.g., 'wrongValue').

           When read, the value of this object is always the zero-
           length string."



De Santi, et al.            Standards Track                    [Page 98]
^L
RFC 5324                     MIB for FC-SP                September 2008


    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3.6.3"
    ::= { t11FcSpPoOperEntry 2 }

t11FcSpPoOperResult OBJECT-TYPE
    SYNTAX       INTEGER {
                     activateSuccess(1),
                     badSummaryObject(2),
                     activateFailure(3),
                     deactivateSuccess(4),
                     deactivateFailure(5),
                     inProgress(6),
                     none(7)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "This object indicates the status/result of the last
           activation/deactivation that was invoked via the
           corresponding instance of t11FcSpPoOperActivate or
           t11FcSpPoOperDeActivate.

           When the value of this object is 'inProgress', the
           values of the corresponding instances of
           t11FcSpPoOperActivate and t11FcSpPoOperDeActivate
           cannot be modified.

           The value 'badSummaryObject' indicates an activation
           request that did not name a complete and consistent
           Policy Summary Object.

           The value 'none' indicates activation/deactivation
           has not been attempted since the last restart of
           the management system."
    ::= { t11FcSpPoOperEntry 3 }

t11FcSpPoOperFailCause OBJECT-TYPE
    SYNTAX       SnmpAdminString (SIZE (0..64))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "A textual message indicating the reason for the
           most recent activation/deactivation failure, or the
           zero-length string if no information is available
           (e.g., because the corresponding instance of
           t11FcSpPoOperResult has the value 'none').



De Santi, et al.            Standards Track                    [Page 99]
^L
RFC 5324                     MIB for FC-SP                September 2008


           When the corresponding instance of
           t11FcSpPoOperResult is either 'activateFailure'
           or 'deactivateFailure', the value of this object
           indicates the reason for that failure."
    ::= { t11FcSpPoOperEntry 4 }

--
-- Part 3 - Non-Active Policy Objects
--

--
-- Non-Active Policy Summary Objects Available for Activation
--

t11FcSpPoNaSummaryTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaSummaryEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of non-active Policy Summary Objects available
           to be activated.

           The functionality of this table deviates slightly from FC-SP
           in that FC-SP specifies that the only Policy Summary Object
           is the Active one, i.e., FC-SP does not store non-active
           Policy Summary Objects in the Policy Database.  Instead,
           FC-SP requires a new Policy Summary Object to be created
           for, and embedded within, every Activate (APS) request.
           Thus, the newly created Policy Summary Object outlasts the
           APS request only as the new active Policy Summary Object and
           only if the APS succeeds.  In contrast, the Activate
           operation provided by this MIB module consists of two steps:

           1) create a non-active Policy Summary Object as a set of
              entries in this table describing a new configuration;
           2) activate a Policy Summary Object (stored as a set of
              entries in this table) using t11FcSpPoOperActivate.

           These two steps are only loosely connected, i.e., the result
           of the first operation is a non-active Policy Summary Object
           that is retained (in this table) even if it isn't
           immediately activated.  Even after an attempt to activate
           it succeeds or fails, a non-active Policy Summary Object
           is not deleted, but is retained and still available for
           subsequent modification/re-use."
    ::= { t11FcSpPoNonActive 1 }

t11FcSpPoNaSummaryEntry OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 100]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       T11FcSpPoNaSummaryEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one non-active
           Policy Object within a non-active Policy Summary Object
           defined for potential use on the Fabric identified by
           t11FcSpPoFabricIndex, and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex.

           A non-active Policy Summary Object is described by a set
           of entries in this table that have the same value of
           t11FcSpPoNaSummaryName.

           As and when a Policy Summary Object is activated using the
           t11FcSpPoOperActivate object, if the activation is
           successful, existing rows (if any) in MIB tables for active
           Policy Objects are deleted and replaced by the appropriate
           new set of rows.  Existing rows in this table and/or in
           other tables for non-active Policy Objects are not
           affected by the activate operation.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.3 and table 104."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaSummaryName, t11FcSpPoNaSummaryPolicyType,
             t11FcSpPoNaSummaryPolicyIndex }
    ::= { t11FcSpPoNaSummaryTable 1 }

T11FcSpPoNaSummaryEntry ::= SEQUENCE {
    t11FcSpPoNaSummaryName            T11FcSpAlphaNumName,
    t11FcSpPoNaSummaryPolicyType      T11FcSpPolicyObjectType,
    t11FcSpPoNaSummaryPolicyIndex     Unsigned32,
    t11FcSpPoNaSummaryPolicyNameType  T11FcSpPolicyNameType,
    t11FcSpPoNaSummaryPolicyName      T11FcSpPolicyName,
    t11FcSpPoNaSummaryHashStatus      T11FcSpHashCalculationStatus,
    t11FcSpPoNaSummaryHashFormat      T11FcSpPolicyHashFormat,
    t11FcSpPoNaSummaryHashValue       T11FcSpPolicyHashValue,
    t11FcSpPoNaSummaryRowStatus       RowStatus
}

t11FcSpPoNaSummaryName OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName



De Santi, et al.            Standards Track                   [Page 101]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The name of the non-active Policy Summary Object that
           contains this Policy Object."
    ::= { t11FcSpPoNaSummaryEntry 1 }

t11FcSpPoNaSummaryPolicyType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyObjectType
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The 'Identifier' (i.e., the type) of this Policy Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.3.1 and table 104."
    ::= { t11FcSpPoNaSummaryEntry 2 }

t11FcSpPoNaSummaryPolicyIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A unique integer value to distinguish this Policy Object
           from any others that have the same type and that are
           contained in the same Policy Summary Object."
    ::= { t11FcSpPoNaSummaryEntry 3 }

t11FcSpPoNaSummaryPolicyNameType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),
                     alphaNumericName(7)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The combination of t11FcSpPoNaSummaryPolicyNameType and
           t11FcSpPoNaSummaryPolicyName specify the name of the
           non-active Policy Object identified by this row.

           The type of name must be 'nodeName' if the value of the
           corresponding instance of t11FcSpPoNaSummaryPolicyType is
           'switchConnectivity', or 'alphaNumericName' otherwise."
    ::= { t11FcSpPoNaSummaryEntry 4 }

t11FcSpPoNaSummaryPolicyName OBJECT-TYPE
    SYNTAX       T11FcSpPolicyName



De Santi, et al.            Standards Track                   [Page 102]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The combination of t11FcSpPoNaSummaryPolicyNameType and
           t11FcSpPoNaSummaryPolicyName specify the name of the
           non-active Policy Object identified by this row."
    ::= { t11FcSpPoNaSummaryEntry 5 }

t11FcSpPoNaSummaryHashStatus OBJECT-TYPE
    SYNTAX       T11FcSpHashCalculationStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "When read, the value of this object is either:

             correct -- the corresponding instance of
                        t11FcSpPoNaSummaryHashValue contains
                        the correct value; or
             stale   -- the corresponding instance of
                        t11FcSpPoNaSummaryHashValue contains
                        a stale (possibly incorrect) value;

           Writing a value of 'calculate' is a request to re-calculate
           and update the value of the corresponding instance of
           t11FcSpPoNaSummaryHashValue.  Writing a value of 'correct'
          or 'stale' to this object is an error (e.g., 'wrongValue')."
    DEFVAL      { stale }
    ::= { t11FcSpPoNaSummaryEntry 6 }

t11FcSpPoNaSummaryHashFormat OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashFormat
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The format of this Policy Object's hash value as
           contained in the corresponding instance of the
           t11FcSpPoNaSummaryHashValue object."
    DEFVAL      { '00000001'h }
    ::= { t11FcSpPoNaSummaryEntry 7 }

t11FcSpPoNaSummaryHashValue OBJECT-TYPE
    SYNTAX       T11FcSpPolicyHashValue
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The hash value of this Policy Object, in the format
           identified by the corresponding instance of the
           t11FcSpPoNaSummaryHashFormat object."



De Santi, et al.            Standards Track                   [Page 103]
^L
RFC 5324                     MIB for FC-SP                September 2008


    DEFVAL      { "" }
    ::= { t11FcSpPoNaSummaryEntry 8 }

t11FcSpPoNaSummaryRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.

           Before a row in this table can have 'active' status,
           a non-Active Policy Object must already be represented
           in the table corresponding to the value of
           t11FcSpPoNaSummaryPolicyType with the name given by the
           combination of t11FcSpPoNaSummaryPolicyNameType and
           t11FcSpPoNaSummaryPolicyName.  If such a Policy Object gets
           deleted from the relevant table, the row in this table must
           also get deleted.

           When a row has 'active' status, the only write-able MIB
           objects in this table are t11FcSpPoNaSummaryHashStatus and
           t11FcSpPoNaSummaryRowStatus."
    ::= { t11FcSpPoNaSummaryEntry 9 }

--
-- Non-Active Switch Membership List Objects
--

t11FcSpPoNaSwListTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaSwListEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of non-active Switch Membership List Objects."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 108."
    ::= { t11FcSpPoNonActive 2 }

t11FcSpPoNaSwListEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaSwListEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one non-active
           Switch Membership List Object for the Fabric identified
           by t11FcSpPoFabricIndex and managed within the Fibre



De Santi, et al.            Standards Track                   [Page 104]
^L
RFC 5324                     MIB for FC-SP                September 2008


           Channel management instance identified by
           fcmInstanceIndex.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaSwListName }
    ::= { t11FcSpPoNaSwListTable 1 }

T11FcSpPoNaSwListEntry ::= SEQUENCE {
    t11FcSpPoNaSwListName         T11FcSpAlphaNumName,
    t11FcSpPoNaSwListFabricName   FcNameIdOrZero,
    t11FcSpPoNaSwListRowStatus    RowStatus
}

t11FcSpPoNaSwListName OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The name of the Switch Membership List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 108."
    ::= { t11FcSpPoNaSwListEntry 1 }

t11FcSpPoNaSwListFabricName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The administratively specified Fabric_Name.  This value
           is meaningful only when static Domain_IDs are used in a
           Fabric.  If Static Domain_IDs are not used, the Fabric_Name
           is dynamically determined, in which case the value of this
           object can be '0000000000000000'h or the zero-length
           string."
    REFERENCE
           "- t11FamConfigDomainId, T11-FC-FABRIC-ADDR-MGR-MIB,
              Fibre Channel Fabric Address Manager MIB, RFC 4439;
            - ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, table 108."
    ::= { t11FcSpPoNaSwListEntry 2 }

t11FcSpPoNaSwListRowStatus OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 105]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time.

           If a row in this table is deleted, any row in the
           t11FcSpPoNaSwMembTable for the same Switch Membership
           List Object will also get deleted."
    ::= { t11FcSpPoNaSwListEntry 3 }

--
-- Switch Entries in Non-Active Switch Membership List Objects
--

t11FcSpPoNaSwMembTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaSwMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Switch Entries in non-active Switch Membership
           List Objects."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoNonActive 3 }

t11FcSpPoNaSwMembEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaSwMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Switch that
           is listed in a Switch Entry of a non-active Switch Membership
           List Object for the Fabric identified by t11FcSpPoFabricIndex
           and managed within the Fibre Channel management instance
           identified by fcmInstanceIndex.

           A row cannot exist unless there is a row in
           t11FcSpPoNaSwListTable for the given Switch Membership List
           Object, i.e., the row in t11FcSpPoNaSwListTable for a
           Switch Membership List Object must be created before (or
           simultaneously with) a row in this table for a Switch
           Entry in that Switch Membership List Object, and when a
           row in t11FcSpPoNaSwListTable is deleted, all rows in this
           table for Switch Entries in that Switch Membership List



De Santi, et al.            Standards Track                   [Page 106]
^L
RFC 5324                     MIB for FC-SP                September 2008


           Object also get deleted.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaSwListName,
             t11FcSpPoNaSwMembSwitchNameType,
             t11FcSpPoNaSwMembSwitchName }
    ::= { t11FcSpPoNaSwMembTable 1 }

T11FcSpPoNaSwMembEntry ::= SEQUENCE {
    t11FcSpPoNaSwMembSwitchNameType   T11FcSpPolicyNameType,
    t11FcSpPoNaSwMembSwitchName       FcNameIdOrZero,
    t11FcSpPoNaSwMembFlags            BITS,
    t11FcSpPoNaSwMembDomainID         FcDomainIdOrZero,
    t11FcSpPoNaSwMembPolicyDataRole   INTEGER,
    t11FcSpPoNaSwMembAuthBehaviour    BITS,
    t11FcSpPoNaSwMembAttribute        T11FcSpAlphaNumNameOrAbsent,
    t11FcSpPoNaSwMembRowStatus        RowStatus
}

t11FcSpPoNaSwMembSwitchNameType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),
                     restrictedNodeName(2),
                     wildcard(5),
                     restrictedWildcard(6)
                 }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "If the value of this object is 'nodeName' or
           'restrictedNodeName', then the combination of
           this object and t11FcSpPoNaSwMembSwitchName specify the
           Switch Name of this Switch Entry.

           The membership is restricted or unrestricted based on the
           name type.  Restricted membership means that the Switch is
           not allowed to be part of the Fabric unless allowed by a
           specific Switch Connectivity Object.  Unrestricted
           membership means that the Switch is allowed to be part of
           the Fabric unless disallowed by a specific Switch
           Connectivity Object.

           The values of 'wildcard' and 'restrictedWildcard' provide
           the means to specify whether to allow/deny membership for
           Switches not explicitly named in the Switch Membership



De Santi, et al.            Standards Track                   [Page 107]
^L
RFC 5324                     MIB for FC-SP                September 2008


           List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoNaSwMembEntry 1 }

t11FcSpPoNaSwMembSwitchName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "If the value of t11FcSpPoSwMembSwitchNameType is
           'wildcard' or 'restrictedWildcard', this object has the
           value '0000000000000000'h.

           Otherwise, the combination of
           t11FcSpPoNaSwMembSwitchNameType and this object specify the
           Switch Name of this Switch Entry."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoNaSwMembEntry 2 }

t11FcSpPoNaSwMembFlags OBJECT-TYPE
    SYNTAX       BITS {
                     staticDomainID(0),
                     insistentDomainID(1),
                     serialPortsAccess(2),
                     physicalPortsAccess(3),
                     managerRole(4)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "Configurable options in respect to the administration
           of Policy Objects at this Switch:

              'staticDomainID'     - the Switch uses the 'Static
           Domain_IDs behavior' (as defined in FC-SW-4) when this bit
           is set.  This bit should have the same setting for all
           Switches in a Fabric's Switch Membership List Object, or
           else the Fabric will partition.  If this bit is set,
           the 'insistentDomainID' bit must not be set.

              'insistentDomainID'  - if this bit is set, the Switch
           uses the 'Insistent Domain_IDs behavior' (as defined in



De Santi, et al.            Standards Track                   [Page 108]
^L
RFC 5324                     MIB for FC-SP                September 2008


           FC-SW-4), and the 'staticDomainID' bit must not be set.

              'serialPortsAccess'  - the Switch allows management
           through serial ports when and only when this bit is set.

              'physicalPortsAccess' - the Switch allows management
           through the physical panel when and only when this bit
           is set.

              'managerRole'        - the Switch is allowed to change
           the Fabric Policy configuration (on receipt of any of the
           EACA, ESFC, EUFC, ACA, SFC, or UFC SW_ILSs) if this bit is
           set."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 112."
    ::= { t11FcSpPoNaSwMembEntry 3 }

t11FcSpPoNaSwMembDomainID OBJECT-TYPE
    SYNTAX       FcDomainIdOrZero
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The Domain_ID to be used when either the 'staticDomainID'
           bit or the 'insistentDomainID' bit is set in the
           corresponding value of t11FcSpPoNaSwMembFlags."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and tables 111 and 112."
    ::= { t11FcSpPoNaSwMembEntry 4 }

t11FcSpPoNaSwMembPolicyDataRole OBJECT-TYPE
    SYNTAX       INTEGER {
                     client(1),
                     autonomous(2),
                     server(3)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The role of the Switch in terms of which Policy data
           it retains/maintains:

             'client' - the Switch operates as a Client Switch.
           A Client Switch maintains its own Switch Connectivity
           Object and all Fabric-wide List Objects.  If FC-SP



De Santi, et al.            Standards Track                   [Page 109]
^L
RFC 5324                     MIB for FC-SP                September 2008


           Zoning is used, a Client Switch maintains only the
           subset of the Active Zone Set that it requires to
           enforce the current Fabric Zoning configuration.

             'autonomous' -  the Switch operates as an Autonomous
           Switch.  An Autonomous Switch maintains its own Switch
           Connectivity Object and all Fabric-wide List Objects.
           This is the same as 'client' except that if FC-SP Zoning
           is used, an Autonomous Switch maintains a complete copy
           of the Fabric Zoning Database.

             'server' - the Switch operates as a Server Switch.
           A Server Switch maintains all Fabric-wide List Objects
           and the Switch Connectivity Objects of each Switch in
           the Fabric.  If FC-SP Zoning is used, a Server Switch
           maintains a complete copy of the Fabric Zoning Database."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 113."
    ::= { t11FcSpPoNaSwMembEntry 5 }

t11FcSpPoNaSwMembAuthBehaviour  OBJECT-TYPE
    SYNTAX       BITS {
                      mustAuthenticate(0),
                      rejectIsFailure(1)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The authentication behaviour of the Switch:

             'mustAuthenticate' - if this bit is set, all connections
           between this Switch and neighbor Switches must be
           authenticated.

             'rejectIsFailure' - if this bit is set, the rejection of
           an AUTH_Negotiate message must be considered as an
           authentication failure by this Switch."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 114."
    ::= { t11FcSpPoNaSwMembEntry 6 }

t11FcSpPoNaSwMembAttribute OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumNameOrAbsent
    MAX-ACCESS   read-create



De Santi, et al.            Standards Track                   [Page 110]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS       current
    DESCRIPTION
           "The name of a non-active Attribute Policy Object that
           is defined for this Switch.  The zero-length string
           indicates that no non-active Attribute Policy Object is
           defined for this Switch.

           The effect of having no rows in the t11FcSpPoNaAttribTable
           for which the value of t11FcSpPoNaAttribName is the
           same as the value of this object, is the same as
           this object's value being the zero-length string."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 110."
    ::= { t11FcSpPoNaSwMembEntry 7 }

t11FcSpPoNaSwMembRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time.

           A row cannot exist unless there is a row in the
           t11FcSpPoNaSwListTable for the Switch Membership List
           Object containing the Switch Entry for this Switch, i.e.,
           the row in t11FcSpPoNaSwListTable for a Switch Membership
           List Object must be created before (or simultaneously)
           with a row in this table for a Switch Entry in that
           Switch Membership List Object; and when a row in
           t11FcSpPoNaSwListTable is deleted, any row in this
           table for a Switch Entry in that Switch Membership
           List Object also gets deleted."
    ::= { t11FcSpPoNaSwMembEntry 8 }

--
-- Node Entries in Non-Active Node Membership List Objects
--

t11FcSpPoNaNoMembTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaNoMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Node Entries in non-active Node Membership List
           Objects.



De Santi, et al.            Standards Track                   [Page 111]
^L
RFC 5324                     MIB for FC-SP                September 2008


           One Node Membership List Object is represented by all
           the rows in this table that have the same value of
           t11FcSpPoNaNoMembListName."
    ::= { t11FcSpPoNonActive 4 }

t11FcSpPoNaNoMembEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaNoMembEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Node Entry of
           a non-active Node Membership List Object for the Fabric
           identified by t11FcSpPoFabricIndex and managed within
           the Fibre Channel management instance identified by
           fcmInstanceIndex.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaNoMembListName,
             t11FcSpPoNaNoMembNodeNameType,
             t11FcSpPoNaNoMembNodeName }
    ::= { t11FcSpPoNaNoMembTable 1 }

T11FcSpPoNaNoMembEntry ::= SEQUENCE {
    t11FcSpPoNaNoMembListName       T11FcSpAlphaNumName,
    t11FcSpPoNaNoMembNodeNameType   T11FcSpPolicyNameType,
    t11FcSpPoNaNoMembNodeName       FcNameIdOrZero,
    t11FcSpPoNaNoMembFlags          BITS,
    t11FcSpPoNaNoMembCtAccessIndex  Unsigned32,
    t11FcSpPoNaNoMembAttribute      T11FcSpAlphaNumNameOrAbsent,
    t11FcSpPoNaNoMembRowStatus      RowStatus
}

t11FcSpPoNaNoMembListName OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The name of the non-active Node Membership List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 116."
    ::= { t11FcSpPoNaNoMembEntry 1 }

t11FcSpPoNaNoMembNodeNameType OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 112]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),
                     restrictedNodeName(2),
                     portName(3),
                     restrictedPortName(4),
                     wildcard(5),
                     restrictedWildcard(6)
                 }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "If the value of this object is 'wildcard' or
           'restrictedWildcard', this Node Entry applies to Nodes not
           explicitly named in the Node Membership List Object.

           Otherwise, the combination of this object and
           t11FcSpPoNaNoMembNodeName specify the name of this Node Entry
           in the active Node Membership List Object.  A Node is
           identified by its Node Name or by one or more of its Port
           Names.

           Restricted membership means that a Node is not allowed to be
           connected to the Fabric unless allowed by a specific Switch
           Connectivity Object.  Unrestricted membership means that a
           Node is allowed to be connected to the Fabric unless
           disallowed by a specific Switch Connectivity Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 116."
    ::= { t11FcSpPoNaNoMembEntry 2 }

t11FcSpPoNaNoMembNodeName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "If the value of t11FcSpPoNaNoMembNodeNameType is
           'wildcard' or 'restrictedWildcard', this object has the
           value '0000000000000000'h.

           Otherwise, the combination of t11FcSpPoNaNoMembNodeNameType
           and this object specify the name of this Node Entry is the
           active Node Membership List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 116."



De Santi, et al.            Standards Track                   [Page 113]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpPoNaNoMembEntry 3 }

t11FcSpPoNaNoMembFlags OBJECT-TYPE
    SYNTAX       BITS {
                     scsiEnclosureAccess(0),
                     authenticationRequired(1)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "Configurable options in respect to the administration
           of Policy Objects at this Node:

                'scsiEnclosureAccess'      - the Node is allowed to
           control any Switch through SCSI Enclosure Services if this
           bit is set.  If a Switch does not support SCSI Enclosure
           Services, this bit is ignored.

                'authenticationRequired'   - the Node is required to
           authenticate itself to any Switch to which it is connected
           if and only if this bit is set."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 118."
    ::= { t11FcSpPoNaNoMembEntry 4 }

t11FcSpPoNaNoMembCtAccessIndex  OBJECT-TYPE
    SYNTAX       Unsigned32 (0..4294967295)
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "If the value of this object is zero, then access by this
           Node to Generic Services is not limited by a Common
           Transport Access Specifier.

           Otherwise, the limits are specified by the set of Common
           Transport Access Descriptors contained in those rows of
           the t11FcSpPoNaCtDescrTable for which the value of
           t11FcSpPoNaCtDescrSpecifierIndex is the same as the value
           of this object.  No such rows in t11FcSpPoNaCtDescrTable
           have the same effect as this object's value being zero."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              section 7.1.4.1 and tables 118/119/120/121."
    ::= { t11FcSpPoNaNoMembEntry 5 }




De Santi, et al.            Standards Track                   [Page 114]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpPoNaNoMembAttribute  OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumNameOrAbsent
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The name of a non-active Attribute Policy Object that
           is defined for this Node.  The zero-length string indicates
           that no non-active Attribute Policy Object is defined for
           this Node.

           The effect of having no rows in the t11FcSpPoNaAttribTable
           for which the value of t11FcSpPoNaAttribName is the
           same as the value of this object, is the same as
           this object's value being the zero-length string."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.4.1 and table 116."
    ::= { t11FcSpPoNaNoMembEntry 6 }

t11FcSpPoNaNoMembRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpPoNaNoMembEntry 7 }

--
--
-- Non-Active Common Transport Access Descriptors
--

t11FcSpPoNaCtDescrTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaCtDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Common Transport Access Descriptors referenced
           by non-active Policy Objects.

           A Common Transport Access Specifier is a list of Common
           Transport Access Descriptors that specify whether a Node
           is allowed to access a Generic Service or Sub-Server.

           A non-active Common Transport Access Specifier is
           represented by all rows of this table that have the same



De Santi, et al.            Standards Track                   [Page 115]
^L
RFC 5324                     MIB for FC-SP                September 2008


           values of fcmInstanceIndex, t11FcSpPoFabricIndex, and
           t11FcSpPoNaCtDescrSpecifierIndex."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.5"
    ::= { t11FcSpPoNonActive 5 }

t11FcSpPoNaCtDescrEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaCtDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Common Transport
           Access Descriptor of an non-active Common Transport Access
           Specifier used within the Fabric identified by
           t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaCtDescrSpecifierIndex, t11FcSpPoNaCtDescrIndex }
    ::= { t11FcSpPoNaCtDescrTable 1 }

T11FcSpPoNaCtDescrEntry ::= SEQUENCE {
    t11FcSpPoNaCtDescrSpecifierIndex   Unsigned32,
    t11FcSpPoNaCtDescrIndex            Unsigned32,
    t11FcSpPoNaCtDescrFlags            BITS,
    t11FcSpPoNaCtDescrGsType           OCTET STRING,
    t11FcSpPoNaCtDescrGsSubType        OCTET STRING,
    t11FcSpPoNaCtDescrRowStatus        RowStatus
}

t11FcSpPoNaCtDescrSpecifierIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Common Transport Access Specifier within a Fabric."
    ::= { t11FcSpPoNaCtDescrEntry 1 }

t11FcSpPoNaCtDescrIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current



De Santi, et al.            Standards Track                   [Page 116]
^L
RFC 5324                     MIB for FC-SP                September 2008


    DESCRIPTION
           "An index value that uniquely identifies a particular
           Common Transport Access Descriptor within a Common Transport
           Access Specifier."
    ::= { t11FcSpPoNaCtDescrEntry 2 }

t11FcSpPoNaCtDescrFlags OBJECT-TYPE
    SYNTAX       BITS {
                     allow(0),
                     gsTypeWildcard(1),
                     gsSubTypeWildcard(2),
                     readOnly(3)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The flag bits that specify how access is to be limited by
           this Common Transport Access Descriptor:

            - allow -- access to the specified Generic Service and
              Server is allowed if this bit is set, and is to be denied
              if this bit is not set.

            - gsTypeWildcard -- if this bit is set, the Generic Service
              to be allowed/denied is specified by the value of
              t11FcSpPoNaCtDescrGsType, and the gsSubTypeWildcard bit
              must not also be set.

            - gsSubTypeWildcard -- if this bit is set, the Generic
              Service to be allowed/denied is specified by the value of
              t11FcSpPoNaCtDescrGsSubType, and the gsTypeWildcard bit
              must not also be set.

            - readOnly -- if this bit is set, then access is to be
              granted only for reading."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              section 7.1.5.1, and tables 117, 118, and 120."
    ::= { t11FcSpPoNaCtDescrEntry 3 }

t11FcSpPoNaCtDescrGsType OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (1))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The GS_Type of the Generic Service (e.g., the FC-GS-5
           Management Service) that is subject to access control.



De Santi, et al.            Standards Track                   [Page 117]
^L
RFC 5324                     MIB for FC-SP                September 2008


           This value is ignored if the gsTypeWildcard bit is not set
           in the corresponding value of t11FcSpPoNaCtDescrFlags."
    REFERENCE
           "- ANSI INCITS 427-2006,
              Fibre Channel - Generic Services-5 (FC-GS-5),
              section 4.3.2.4.
            - ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.5.1 and table 120."
    ::= { t11FcSpPoNaCtDescrEntry 4 }

t11FcSpPoNaCtDescrGsSubType OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (1))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The GS_Subtype of the Generic Server (e.g., the Fabric Zone
           Server) that is subject to access control.  This value is
           ignored if the gsSubTypeWildcard bit is not set in the
           corresponding value of t11FcSpPoNaCtDescrFlags."
    REFERENCE
           "- ANSI INCITS 427-2006,
              Fibre Channel - Generic Services-5 (FC-GS-5),
              section 4.3.2.5.
            - ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.5.1 and table 120."
    ::= { t11FcSpPoNaCtDescrEntry 5 }

t11FcSpPoNaCtDescrRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpPoNaCtDescrEntry 6 }

--
-- Switches/Nodes in Non-Active Switch Connectivity Objects
--

t11FcSpPoNaSwConnTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaSwConnEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of non-active Switch Connectivity Objects.



De Santi, et al.            Standards Track                   [Page 118]
^L
RFC 5324                     MIB for FC-SP                September 2008


           A Switch Connectivity Object defines to which other
           Switches or Nodes a particular Switch may/may not be
           connected at the Node level and/or at the Port level."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6."
    ::= { t11FcSpPoNonActive 6 }

t11FcSpPoNaSwConnEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaSwConnEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains the name of a Switch/Node with which
           any port of a particular Switch on a particular Fabric, or
           a particular port on that Switch, is allowed or not allowed
           to be connected.

           The particular Fabric is identified by t11FcSpPoFabricIndex
           and managed within the Fibre Channel management instance
           identified by fcmInstanceIndex.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaSwConnSwitchName,
             t11FcSpPoNaSwConnAllowedType,
             t11FcSpPoNaSwConnPortNameOrAll,
             t11FcSpPoNaSwConnAllowedIndex }
    ::= { t11FcSpPoNaSwConnTable 1 }

T11FcSpPoNaSwConnEntry ::= SEQUENCE {
    t11FcSpPoNaSwConnSwitchName       FcNameIdOrZero,
    t11FcSpPoNaSwConnAllowedType      INTEGER,
    t11FcSpPoNaSwConnPortNameOrAll    FcNameIdOrZero,
    t11FcSpPoNaSwConnAllowedIndex     Unsigned32,
    t11FcSpPoNaSwConnAllowedNameType  T11FcSpPolicyNameType,
    t11FcSpPoNaSwConnAllowedName      FcNameIdOrZero,
    t11FcSpPoNaSwConnRowStatus        RowStatus
}

t11FcSpPoNaSwConnSwitchName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION



De Santi, et al.            Standards Track                   [Page 119]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "The name of the Switch for which this Switch Connectivity
           Object specifies topology restrictions."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6.1 and table 123."
    ::= { t11FcSpPoNaSwConnEntry 1 }

t11FcSpPoNaSwConnAllowedType OBJECT-TYPE
    SYNTAX       INTEGER { switch(1), node(2) }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "This object specifies whether this row refers to an
           'Allowed Switch' that concerns Switch-to-Switch
           connectivity or an 'Allowed Node' that concerns
           Switch-to-Node connectivity.  Consequently, this object's
           value indicates whether the corresponding instance of
           t11FcSpPoNaSwConnAllowedName specifies the name of a Switch
           or the name of a Node."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6.1 and table 123."
    ::= { t11FcSpPoNaSwConnEntry 2 }

t11FcSpPoNaSwConnPortNameOrAll OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE(0 | 8))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "This object specifies either the particular port on which
           this topology restriction applies, or if the value is the
           zero-length string, that the topology restriction applies
           to all ports of the Switch.

           In other words, if this object's value contains the name of
           a port, then this row represents a 'Port Connectivity Entry'
           (as described in FC-SP) within a Switch Connectivity Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6.1 and tables 123/124."
    ::= { t11FcSpPoNaSwConnEntry 3 }

t11FcSpPoNaSwConnAllowedIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible



De Santi, et al.            Standards Track                   [Page 120]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS       current
    DESCRIPTION
           "When multiple rows in this table refer to different
           'Allowed Switches' or to different 'Allowed Nodes' for the
           same port(s) in the same Switch Connectivity Object, this
           object provides a unique index value to distinguish between
           such rows."
    ::= { t11FcSpPoNaSwConnEntry 4 }

t11FcSpPoNaSwConnAllowedNameType OBJECT-TYPE
    SYNTAX       T11FcSpPolicyNameType {
                     nodeName(1),
                     restrictedNodeName(2),
                     portName(3),
                     restrictedPortName(4),
                     wildcard(5),
                     restrictedWildcard(6)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "If the value of this object is 'wildcard' or
           'restrictedWildcard', this row specifies whether
           connectivity is allowed/not allowed with entities not
           explicitly named by other rows.

           Otherwise, the combination of
           t11FcSpPoNaSwConnAllowedNameType and
           t11FcSpPoNaSwConnAllowedName specify the name of:

           - a Switch (if t11FcSpPoNaSwConnAllowedType = 'switch'), or
           - a Node (if t11FcSpPoNaSwConnAllowedType = 'node')

           to which connectivity is allowed/not allowed."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6.1 and tables 123/124."
    ::= { t11FcSpPoNaSwConnEntry 5 }

t11FcSpPoNaSwConnAllowedName OBJECT-TYPE
    SYNTAX       FcNameIdOrZero (SIZE (8))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "If t11FcSpPoNaSwConnAllowedNameType has the value
           'wildcard' or 'restrictedWildcard', this object has the
           value '0000000000000000'h.



De Santi, et al.            Standards Track                   [Page 121]
^L
RFC 5324                     MIB for FC-SP                September 2008


           Otherwise, the combination of
           t11FcSpPoNaSwConnAllowedNameType and
           t11FcSpPoNaSwConnAllowedName specify the name of:

           - a Switch (if t11FcSpPoNaSwConnAllowedType = 'switch'), or
           - a Node (if t11FcSpPoNaSwConnAllowedType = 'node')

           to which connectivity is allowed/not allowed."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.6.1 and tables 123/124."
    ::= { t11FcSpPoNaSwConnEntry 6 }

t11FcSpPoNaSwConnRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpPoNaSwConnEntry 7 }

--
-- IP Management Entries in Non-Active IP Management List Objects
--

t11FcSpPoNaIpMgmtTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaIpMgmtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of IP Management Entries in non-active IP
           Management List Objects.  The IP Management List Object is a
           Fabric-wide Policy Object that describes which IP hosts are
           allowed to manage a Fabric.

           One non-active IP Management List Object is represented by
           all rows of this table that have the same values of
           fcmInstanceIndex and t11FcSpPoFabricIndex."
    ::= { t11FcSpPoNonActive 7 }

t11FcSpPoNaIpMgmtEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaIpMgmtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one IP Management



De Santi, et al.            Standards Track                   [Page 122]
^L
RFC 5324                     MIB for FC-SP                September 2008


           entry within a non-active IP Management List Object for the
           Fabric identified by t11FcSpPoFabricIndex and managed
           within the Fibre Channel management instance identified
           by fcmInstanceIndex.

           The Policy Object Name of an IP Management Entry Policy
           Object is either an IPv6 Address Range or an IPv4 Address
           Range.  In a Fabric's database of Policy Objects, every
           Policy Object Name, including these Internet address ranges,
           is represented as a (T11FcSpPolicyNameType,
           T11FcSpPolicyName) tuple.  In contrast, this MIB module
           uses the conventional MIB syntax for IP addresses, and
           therefore represents the Policy Object Name of an IP
           Management Entry Policy Object as a (InetAddressType,
           InetAddress, InetAddress) tuple.

           In theory, the use of t11FcSpPoNaIpMgmtEntryNameLow and
           t11FcSpPoNaIpMgmtEntryNameHigh, which have the syntax of
           InetAddress, in the INDEX could cause the need for
           excessively long OIDs.  In practice, this can't happen
           because FC-SP doesn't allow these objects to be specified
           as DNS names.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaIpMgmtListName,
             t11FcSpPoNaIpMgmtEntryNameType,
             t11FcSpPoNaIpMgmtEntryNameLow,
             t11FcSpPoNaIpMgmtEntryNameHigh }
    ::= { t11FcSpPoNaIpMgmtTable 1 }

T11FcSpPoNaIpMgmtEntry ::= SEQUENCE {
    t11FcSpPoNaIpMgmtListName        T11FcSpAlphaNumName,
    t11FcSpPoNaIpMgmtEntryNameType   InetAddressType,
    t11FcSpPoNaIpMgmtEntryNameLow    InetAddress,
    t11FcSpPoNaIpMgmtEntryNameHigh   InetAddress,
    t11FcSpPoNaIpMgmtWkpIndex        Unsigned32,
    t11FcSpPoNaIpMgmtAttribute       T11FcSpAlphaNumNameOrAbsent,
    t11FcSpPoNaIpMgmtRowStatus       RowStatus
}

t11FcSpPoNaIpMgmtListName OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION



De Santi, et al.            Standards Track                   [Page 123]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "The name of a non-active Node Membership List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 125."
    ::= { t11FcSpPoNaIpMgmtEntry 1 }

t11FcSpPoNaIpMgmtEntryNameType OBJECT-TYPE
    SYNTAX       InetAddressType { ipv4(1), ipv6(2) }
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The combination of t11FcSpPoNaIpMgmtEntryNameType,
           t11FcSpPoNaIpMgmtNameLow, and t11FcSpPoNaIpMgmtNameHigh
           specify the Internet address range of this IP Management
           Entry in the IP Management List Object.

           The FC-SP specification does not allow this address to
           be specified using a DNS domain name, nor does it allow
           the specification of zone indexes.  Therefore, the
           type of address must be one of: 'ipv4' or 'ipv6'."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 7.1.7.1 and table 126."
    ::= { t11FcSpPoNaIpMgmtEntry 2 }

t11FcSpPoNaIpMgmtEntryNameLow OBJECT-TYPE
    SYNTAX       InetAddress (SIZE(4 | 16))
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The lower end of an Internet address range.  The type
           of this address is given by the corresponding instance
           of t11FcSpPoNaIpMgmtEntryNameType.

           The combination of t11FcSpPoNaIpMgmtEntryNameType,
           t11FcSpPoNaIpMgmtNameLow, and t11FcSpPoIpMgmtNameHigh
           specify the Internet address range of this IP Management
           Entry in the IP Management List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 7.1.7.1 and table 126."
    ::= { t11FcSpPoNaIpMgmtEntry 3 }

t11FcSpPoNaIpMgmtEntryNameHigh OBJECT-TYPE
    SYNTAX       InetAddress (SIZE(4 | 16))



De Santi, et al.            Standards Track                   [Page 124]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The higher end of an Internet address range.  The type
           of this address is given by the corresponding instance
           of t11FcSpPoNaIpMgmtEntryNameType.

           The combination of t11FcSpPoNaIpMgmtEntryNameType,
           t11FcSpPoNaIpMgmtNameLow, and t11FcSpPoNaIpMgmtNameHigh
           specify the Internet address range of this IP Management
           Entry in the IP Management List Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 7.1.7.1 and table 126."
    ::= { t11FcSpPoNaIpMgmtEntry 4 }

t11FcSpPoNaIpMgmtWkpIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (0..4294967295)
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "This object identifies the restrictions for IP management
           access by IP hosts in this range of IP addresses.

           The restrictions are specified as the set of Well-Known
           Protocols Access Descriptors contained in those rows of the
           t11FcSpPoNaWkpDescrTable for which the value of
           t11FcSpPoNaWkpDescrSpecifierIndx is the same as the value
           of this object.  If there are no such rows or if the value
           of this object is zero, then this IP Management Entry does
           not identify any Well-Known Protocols Access restrictions."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and tables 127/129."
    ::= { t11FcSpPoNaIpMgmtEntry 5 }

t11FcSpPoNaIpMgmtAttribute OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumNameOrAbsent
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The name of a non-active Attribute Policy Object that
           is defined for this IP Management entry.  The zero-length
           string indicates that no non-active Attribute Policy Object
           is defined for it.




De Santi, et al.            Standards Track                   [Page 125]
^L
RFC 5324                     MIB for FC-SP                September 2008


           The effect of having no rows in the t11FcSpPoNaAttribTable
           for which the value of t11FcSpPoNaAttribName is the same
           as the value of this object, is the same as this object's
           value being the zero-length string."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 128."
    ::= { t11FcSpPoNaIpMgmtEntry 6 }

t11FcSpPoNaIpMgmtRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpPoNaIpMgmtEntry 7 }

--
-- Non-Active Well-Known Protocol Access Descriptors
--

t11FcSpPoNaWkpDescrTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaWkpDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of the Well-Known Protocol Access Descriptors
           referenced from non-active Policy Objects.

           A Well-Known Protocol Access Specifier is a list of
           Well-Known Protocol Access Descriptors each of which
           specifies a protocol number, a port number, and/or various
           flags specifying how IP management access is restricted.

           A non-active Well-Known Protocol Transport Access Specifier
           is represented by all rows of this table that have the same
           values of fcmInstanceIndex, t11FcSpPoFabricIndex, and
           t11FcSpPoNaWkpDescrSpecifierIndx."
    ::= { t11FcSpPoNonActive 8 }

t11FcSpPoNaWkpDescrEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaWkpDescrEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Well-Known



De Santi, et al.            Standards Track                   [Page 126]
^L
RFC 5324                     MIB for FC-SP                September 2008


           Protocol Access Descriptor of a non-active Well-Known
           Protocol Access Specifier used within the Fabric identified
           by t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaWkpDescrSpecifierIndx,
             t11FcSpPoNaWkpDescrIndex }
    ::= { t11FcSpPoNaWkpDescrTable 1 }

T11FcSpPoNaWkpDescrEntry ::= SEQUENCE {
    t11FcSpPoNaWkpDescrSpecifierIndx    Unsigned32,
    t11FcSpPoNaWkpDescrIndex            Unsigned32,
    t11FcSpPoNaWkpDescrFlags            BITS,
    t11FcSpPoNaWkpDescrWkpNumber        Unsigned32,
    t11FcSpPoNaWkpDescrDestPort         InetPortNumber,
    t11FcSpPoNaWkpDescrRowStatus        RowStatus
}

t11FcSpPoNaWkpDescrSpecifierIndx OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           non-active Well-Known Protocol Access Specifier within
           a Fabric."
    ::= { t11FcSpPoNaWkpDescrEntry 1 }

t11FcSpPoNaWkpDescrIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Well-Known Protocol Access Descriptor within a
           non-active Well-Known Protocol Access Specifier."
    ::= { t11FcSpPoNaWkpDescrEntry 2 }

t11FcSpPoNaWkpDescrFlags OBJECT-TYPE
    SYNTAX       BITS {
                     allow(0),
                     wkpWildcard(1),
                     destPortWildcard(2),
                     readOnly(3)



De Santi, et al.            Standards Track                   [Page 127]
^L
RFC 5324                     MIB for FC-SP                September 2008


                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The flag bits that specify how access is to be limited by
           this Well-Known Protocol Access Descriptor:

            - allow -- IP management access using this protocol/port
              is allowed if this bit is set, and to be denied if this
              bit is not set.

            - wkpWildcard -- if this bit is set, the IP Protocol number
              of the Well-Known Protocol to be allowed/denied is
              specified by the value of t11FcSpPoNaWkpDescrWkpNumber.

            - destPortWildcard -- if this bit is set, the Destination
              (TCP/UDP) Port number of the Well-Known Protocol to be
              allowed/denied is specified by the value of
              t11FcSpPoNaWkpDescrDestPort.

            - readOnly -- if this bit is set, then access is to be
              granted only for reading."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 131."
    ::= { t11FcSpPoNaWkpDescrEntry 3 }

t11FcSpPoNaWkpDescrWkpNumber OBJECT-TYPE
    SYNTAX       Unsigned32 (0..255)
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "When the 'wkpWildcard' bit is set in the corresponding
           instance of t11FcSpPoNaWkpDescrFlags, this object specifies
           the IP protocol number of the Well-Known Protocol."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 131.
            - http://www.iana.org/assignments/protocol-numbers."
    ::= { t11FcSpPoNaWkpDescrEntry 4 }

t11FcSpPoNaWkpDescrDestPort OBJECT-TYPE
    SYNTAX       InetPortNumber
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION



De Santi, et al.            Standards Track                   [Page 128]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "When the 'destPortWildcard' bit is set in the corresponding
           instance of t11FcSpPoNaWkpDescrFlags, this object specifies
           the Destination (TCP/UDP) Port number of the Well-Known
           Protocol.  When the 'destPortWildcard' bit is reset, this
           object is ignored (and can have the value zero)."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.7.1 and table 131.
            - http://www.iana.org/assignments/port-numbers."
    ::= { t11FcSpPoNaWkpDescrEntry 5 }

t11FcSpPoNaWkpDescrRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpPoNaWkpDescrEntry 6 }

--
-- Attribute Entries in Non-Active Attribute Policy Objects
--

t11FcSpPoNaAttribTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaAttribEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of the Attribute Policy Objects being used within
           non-active Policy Objects.

           A non-active Attribute Policy Object is represented by all
           the Attribute Entries in this table that have the same
           value of t11FcSpPoNaAttribName."
    ::= { t11FcSpPoNonActive 9 }

t11FcSpPoNaAttribEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaAttribEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Attribute
           Entry contained within an Attribute Policy Object
           that is non-active within the Fabric identified by
           t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex.



De Santi, et al.            Standards Track                   [Page 129]
^L
RFC 5324                     MIB for FC-SP                September 2008


           For some types of Attribute Policy Objects, it is valuable
           to break out some semantically significant parts of the
           Policy Object's value into their own individual MIB
           objects; for example, to extract the one or more individual
           Authentication Protocol Identifiers and associated

           Authentication Protocol Parameters out of an Attribute
           containing a 'AUTH_Negotiate Message Payload'.  For such
           types, another MIB table is defined to hold the extracted
           values in MIB objects specific to the Attribute Policy
           Object's type.  In such cases, the
           t11FcSpPoNaAttribExtension object in this table points to
           the other MIB table.

           If the value of one Attribute Entry is too large (more than
           256 bytes) to be contained within the value of one instance
           of t11FcSpPoNaAttribValue, then one row in this table
           contains the first 256 bytes, and one (or more) other row(s)
           in this table contain the rest of the value.

           The StorageType of a row in this table is specified by the
           instance of t11FcSpPoStorageType that is INDEX-ed by the
           same values of fcmInstanceIndex and t11FcSpPoFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaAttribName, t11FcSpPoNaAttribEntryIndex,
             t11FcSpPoNaAttribPartIndex }
    ::= { t11FcSpPoNaAttribTable 1 }

T11FcSpPoNaAttribEntry ::= SEQUENCE {
    t11FcSpPoNaAttribName         T11FcSpAlphaNumName,
    t11FcSpPoNaAttribEntryIndex   Unsigned32,
    t11FcSpPoNaAttribPartIndex    Unsigned32,
    t11FcSpPoNaAttribType         Unsigned32,
    t11FcSpPoNaAttribValue        OCTET STRING,
    t11FcSpPoNaAttribExtension    OBJECT IDENTIFIER,
    t11FcSpPoNaAttribRowStatus    RowStatus
}

t11FcSpPoNaAttribName OBJECT-TYPE
    SYNTAX       T11FcSpAlphaNumName
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The name of the Attribute Policy Object containing one
           or more Attribute Entries."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),



De Santi, et al.            Standards Track                   [Page 130]
^L
RFC 5324                     MIB for FC-SP                September 2008


              February 2007, section 7.1.8.1 and table 133."
    ::= { t11FcSpPoNaAttribEntry 1 }

t11FcSpPoNaAttribEntryIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A unique value to distinguish this Attribute Entry
           from other Attribute Entries contained in the same
           Attribute Policy Object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.8.1, tables 133/134."
    ::= { t11FcSpPoNaAttribEntry 2 }

t11FcSpPoNaAttribPartIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "When the value of an Attribute Entry is shorter than 257
           bytes, the whole value is contained in one instance of
           t11FcSpPoNaAttribValue, and the value of this object is 1.

           If the value of an Attribute Entry is longer than 256 bytes,
           then that value is divided up on 256-byte boundaries such
           that all parts are 256 bytes long except the last part which
           is shorter if necessary, with each such part contained in
           a separate row of this table, and the value of this object
           is set to the part number.  That is, this object has the
           value of 1 for bytes 0-255, the value of 2 for bytes
           256-511, etc."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.1.8.1, tables 134/135."
    ::= { t11FcSpPoNaAttribEntry 3 }

t11FcSpPoNaAttribType OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The type of attribute.  The first type to be defined is:

           t11FcSpPoNaAttribType    t11FcSpPoNaAttribValue



De Santi, et al.            Standards Track                   [Page 131]
^L
RFC 5324                     MIB for FC-SP                September 2008


           =====================    ======================
             '00000001'h          The AUTH_Negotiate Message Payload
           "
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              section 7.1.8.1, tables 134/135 and table 10."
    ::= { t11FcSpPoNaAttribEntry 4 }

t11FcSpPoNaAttribValue OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (0..256))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The value of an Attribute Entry is divided up on 256-byte
           boundaries such that all parts are 256 bytes long except the
           last part, which is shorter if necessary, and each such part
           is contained in a separate instance of this object.

           When the value of the corresponding instance of
           t11FcSpPoNaAttribExtension is not zeroDotZero, then the same
           underlying management data has its value contained both in
           this object and in the individual/broken-out parts pointed
           to by t11FcSpPoNaAttribExtension.  Thus, after any
           modification of the underlying management data, e.g., after
           a Set operation to the value of either MIB representation,
           then that modification is reflected in the values of both
           MIB representations."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP), February 2007,
              section 7.1.8.1, tables 134/135 and table 10."
    ::= { t11FcSpPoNaAttribEntry 5 }

t11FcSpPoNaAttribExtension OBJECT-TYPE
    SYNTAX       OBJECT IDENTIFIER
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "For some types of Attribute Policy Object, the value of
           this MIB object points to type-specific MIB objects that
           contain individual/broken-out parts of the Attribute Policy
           Object's value.  If this object doesn't point to such
           type-specific MIB objects, then it contains the value:
           zeroDotZero.

           In particular, when the value of t11FcSpPoNaAttribType
           indicates 'AUTH_Negotiate Message Payload', one or more



De Santi, et al.            Standards Track                   [Page 132]
^L
RFC 5324                     MIB for FC-SP                September 2008


           Authentication Protocol Identifiers and their associated
           Authentication Protocol Parameters are embedded within
           the value of the corresponding instance of
           t11FcSpPoNaAttribValue; MIB objects to contain these
           individual values are defined in the
           t11FcSpPoAuthProtTable.  Thus, for an 'AUTH_Negotiate
           Message Payload' Attribute, the value of this object would
           contain the OID of t11FcSpPoNaAuthProtTable.

           When the value of this object is not zeroDotZero, then the
           same underlying management data has its value contained in
           both the individual/broken-out parts pointed to by this
           object and in the corresponding instance of
           t11FcSpPoNaAttribValue.  Thus, after any modification of the
           underlying management data, e.g., after a Set operation to
           the value of either MIB representation, then that
           modification is reflected in the values of both MIB
           representations."
    ::= { t11FcSpPoNaAttribEntry 6 }

t11FcSpPoNaAttribRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpPoNaAttribEntry 7 }

--
-- Auth. Protocol Parameters in Non-Active Attribute Policy Objects
--

t11FcSpPoNaAuthProtTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoNaAuthProtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of Authentication Protocol Identifier and
           Authentication Protocol Parameters that are embedded in
           Attribute Policy Objects being used within non-active
           Policy Objects.

           This table is used for Attribute Entries of Attribute Policy
           Objects for which the value of t11FcSpPoNaAttribType
           indicates 'AUTH_Negotiate Message Payload' and the value of
           t11FcSpPoNaAttribExtension contains the OID of this table."
    REFERENCE



De Santi, et al.            Standards Track                   [Page 133]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 5.3.2 & 7.1.8.1,
              tables 134/135 and tables 10/11."
    ::= { t11FcSpPoNonActive 10 }

t11FcSpPoNaAuthProtEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoNaAuthProtEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each row contains information about an Authentication
           Protocol that is extracted out of the Attribute Entry
           (identified by t11FcSpPoNaAttribEntryIndex) of the
           non-active Policy Attribute Object (identified by
           t11FcSpPoNaAttribName) for the Fabric identified by
           t11FcSpPoFabricIndex and managed within the Fibre Channel
           management instance identified by fcmInstanceIndex.

           If the value of one Attribute Protocol Parameters string is
           too large (more than 256 bytes) to be contained within the
           value of one instance of t11FcSpPoNaAuthProtParams, then
           one row in this table contains the first 256 bytes, and
           one (or more) other row(s) in this table contain the rest
           of the value.

           The same underlying management data that is represented in
           rows of this table is also represented by the corresponding
           instances of t11FcSpPoNaAttribValue.  Thus, after any
           modification of the underlying management data, e.g., after
           a Set operation to the value of either MIB representation,
           then that modification is reflected in the values of both
           MIB representations."
    INDEX  { fcmInstanceIndex, t11FcSpPoFabricIndex,
             t11FcSpPoNaAttribName, t11FcSpPoNaAttribEntryIndex,
             t11FcSpPoNaAuthProtIdentifier,
             t11FcSpPoNaAuthProtPartIndex }
    ::= { t11FcSpPoNaAuthProtTable 1 }

T11FcSpPoNaAuthProtEntry ::= SEQUENCE {
    t11FcSpPoNaAuthProtIdentifier   Unsigned32,
    t11FcSpPoNaAuthProtPartIndex    Unsigned32,
    t11FcSpPoNaAuthProtParams       OCTET STRING,
    t11FcSpPoNaAuthProtRowStatus    RowStatus
}

t11FcSpPoNaAuthProtIdentifier OBJECT-TYPE
    SYNTAX       Unsigned32 (0..4294967295)



De Santi, et al.            Standards Track                   [Page 134]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The Authentication Protocol Identifier:

                    1      = DH-CHAP
                    3      = FCPAP
                    4      = IKEv2
                    5      = IKEv2-AUTH
              240 thru 255 = Vendor Specific Protocols

            all other values are 'Reserved' (by T11)."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.3.2, table 11."
    ::= { t11FcSpPoNaAuthProtEntry 1 }

t11FcSpPoNaAuthProtPartIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "When the value of an Attribute Protocol Parameters string
           is shorter than 257 bytes, the whole value is contained in
           one instance of t11FcSpPoNaAuthProtParams, and the value of
           this object is 1. (This includes the case when the Attribute
           Protocol Parameters string is zero bytes in length.)

           If the value of an Authentication Protocol Parameters string
           is longer than 256 bytes, then that value is divided up on
           256-byte boundaries such that all parts are 256 bytes long
           except the last part, which is shorter if necessary, with
           each such part contained in a separate row of this table,
           and the value of this object is set to the part number.
           That is, this object has the value of 1 for bytes 0-255,
           the value of 2 for bytes 256-511, etc."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.3.2, table 10."
    ::= { t11FcSpPoNaAuthProtEntry 2 }

t11FcSpPoNaAuthProtParams OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (0..256))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION



De Santi, et al.            Standards Track                   [Page 135]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "The value of an Authentication Protocol Parameters string
           is divided up on 256-byte boundaries such that all parts
           are 256 bytes long except the last part, which is shorter
           if necessary, and each such part is contained in a
           separate instance of this object."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 5.3.2, table 10."
    ::= { t11FcSpPoNaAuthProtEntry 3 }

t11FcSpPoNaAuthProtRowStatus  OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpPoNaAuthProtEntry 4 }

--
-- Part 4 - Statistics
--

t11FcSpPoStatsTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoStatsEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of statistics maintained by FC-SP Security
           Policy Servers."
    ::= { t11FcSpPoStatistics 1 }

t11FcSpPoStatsEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoStatsEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A set of statistics for the FC-SP Security Policy Server on
           the Fabric identified by the value of t11FcSpPoFabricIndex,
           and managed within the Fibre Channel management instance
           identified by fcmInstanceIndex."
    INDEX   { fcmInstanceIndex, t11FcSpPoFabricIndex }
    ::= { t11FcSpPoStatsTable 1 }

T11FcSpPoStatsEntry ::= SEQUENCE {
    t11FcSpPoInRequests     Counter32,
    t11FcSpPoInAccepts      Counter32,



De Santi, et al.            Standards Track                   [Page 136]
^L
RFC 5324                     MIB for FC-SP                September 2008


    t11FcSpPoInRejects      Counter32
}

t11FcSpPoInRequests OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of FC-SP Policy Management Requests
           (e.g., GPS, APS, etc.) received by this FC-SP
           Security Policy Server on this Fabric.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3."
    ::= { t11FcSpPoStatsEntry 1 }

t11FcSpPoInAccepts OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that this FC-SP Security Policy Server
           sent an Accept CT_IU on this Fabric in response to a
           received FC-SP Policy Management Request (e.g., GPS, APS,
           etc.).

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3."
    ::= { t11FcSpPoStatsEntry 2 }

t11FcSpPoInRejects OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that this FC-SP Security Policy Server
           sent a Reject CT_IU on this Fabric in response to a
           received FC-SP Policy Management Request (e.g., GPS, APS,
           etc.).




De Santi, et al.            Standards Track                   [Page 137]
^L
RFC 5324                     MIB for FC-SP                September 2008


           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3."
    ::= { t11FcSpPoStatsEntry 3 }

--
-- Part 5 - Control Information & Notifications
--

--
-- Control Information
--

t11FcSpPoServerAddress OBJECT-TYPE
    SYNTAX       FcNameIdOrZero
    MAX-ACCESS   accessible-for-notify
    STATUS       current
    DESCRIPTION
           "The WWN of the FC-SP Security Policy Server that
           received a request that is referenced in a
           notification."
    ::= { t11FcSpPoControl 1 }


t11FcSpPoControlTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpPoControlEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of control information, including the memory
           realization of FC-SP Policy Databases, and concerning
           the generation of notifications due to FC-SP
           Policy-related events."
    ::= { t11FcSpPoControl 2 }

t11FcSpPoControlEntry OBJECT-TYPE
    SYNTAX       T11FcSpPoControlEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains control information specific to FC-SP
           Policy and Policy-related events for the Fabric identified
           by the value of t11FcSpPoFabricIndex, and managed within
           the Fibre Channel management instance identified by
           fcmInstanceIndex."



De Santi, et al.            Standards Track                   [Page 138]
^L
RFC 5324                     MIB for FC-SP                September 2008


    INDEX   { fcmInstanceIndex, t11FcSpPoFabricIndex }
    ::= { t11FcSpPoControlTable 1 }

T11FcSpPoControlEntry ::= SEQUENCE {
     t11FcSpPoStorageType              StorageType,
     t11FcSpPoNotificationEnable       TruthValue,
     t11FcSpPoLastNotifyType           INTEGER,
     t11FcSpPoRequestSource            FcNameIdOrZero,
     t11FcSpPoReasonCode               T11NsGs4RejectReasonCode,
     t11FcSpPoCtCommandString          OCTET STRING,
     t11FcSpPoReasonCodeExp            Unsigned32,
     t11FcSpPoReasonVendorCode         OCTET STRING
}

t11FcSpPoStorageType OBJECT-TYPE
    SYNTAX       StorageType
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object specifies the memory realization of FC-SP
           Policy Objects and related information for a particular
           Fabric; specifically, for:

             - rows created and/or modified for the particular
               Fabric in these tables:

                   t11FcSpPoNaSummaryTable
                   t11FcSpPoNaSwListTable
                   t11FcSpPoNaSwMembTable
                   t11FcSpPoNaNoMembTable
                   t11FcSpPoNaCtDescrTable
                   t11FcSpPoNaSwConnTable
                   t11FcSpPoNaIpMgmtTable
                   t11FcSpPoNaWkpDescrTable
                   t11FcSpPoNaAttribTable

             - the activate and deactivate actions invoked through
               the t11FcSpPoOperActivate and t11FcSpPoOperDeActivate
               objects for the particular Fabric; and

             - modified information contained in the same row
               as an instance of this object.

           Even if an instance of this object has the value
           'permanent(4)', none of the information defined in
           this MIB module for the given Fabric needs to be
           writable."
    ::= { t11FcSpPoControlEntry 1 }



De Santi, et al.            Standards Track                   [Page 139]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpPoNotificationEnable OBJECT-TYPE
    SYNTAX       TruthValue
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object specifies whether the following types of
           notifications:

              t11FcSpPoNotifyActivation,
              t11FcSpPoNotifyActivateFail,
              t11FcSpPoNotifyDeactivation and
              t11FcSpPoNotifyDeactivateFail

           should be generated for this Fabric."
    ::= { t11FcSpPoControlEntry 2 }

t11FcSpPoLastNotifyType OBJECT-TYPE
    SYNTAX       INTEGER {
                     none(1),
                     activation(2),
                     activateFail(3),
                     deactivation(4),
                     deactivateFail(5)
                 }
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "An indication of which of the following types of
           notification is currently being/was most recently
           generated for the Fabric:

             'activation'     -- t11FcSpPoNotifyActivation
             'activateFail'   -- t11FcSpPoNotifyActivateFail
             'deactivation'   -- t11FcSpPoNotifyDeactivation
             'deactivateFail' -- t11FcSpPoNotifyDeactivateFail

           The value 'none' indicates that none of these types of
           notifications have been generated since the last restart
           of the network management system, and therefore that the
           corresponding instances of: t11FcSpPoRequestSource,
           t11FcSpPoReasonCode, t11FcSpPoCtCommandString,
           t11FcSpPoReasonCodeExp, and
           t11FcSpPoReasonVendorCode are irrelevant."
    ::= { t11FcSpPoControlEntry 3 }

t11FcSpPoRequestSource OBJECT-TYPE
    SYNTAX       FcNameIdOrZero
    MAX-ACCESS   read-only



De Santi, et al.            Standards Track                   [Page 140]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS       current
    DESCRIPTION
           "The WWN of the source of the (Activate Policy Summary
           or Deactivate Policy Summary) request for which the
           current/most recent notification of the type indicated by
           the corresponding instance of t11FcSpPoLastNotifyType
           is being/was generated.

           If no source is available, the value of this object is
           the zero-length string."
    DEFVAL { "" }
    ::= { t11FcSpPoControlEntry 4 }

t11FcSpPoReasonCode OBJECT-TYPE
    SYNTAX       T11NsGs4RejectReasonCode
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The reason code associated with the failure that is
           indicated when the value of the corresponding instance
           of t11FcSpPoLastNotifyType is 'activateFail' or
           'deactivateFail'.

           For other values of t11FcSpPoLastNotifyType, the value
           of this object is 'none(1)'."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3.6.2 & 7.3.6.3"
    ::= { t11FcSpPoControlEntry 5 }

t11FcSpPoCtCommandString OBJECT-TYPE
    SYNTAX        OCTET STRING (SIZE (0..255))
    MAX-ACCESS    read-only
    STATUS        current
    DESCRIPTION
           "The binary content of the failed request that is
           indicated when the value of the corresponding instance of
           t11FcSpPoLastNotifyType is 'activateFail' or
           'deactivateFail'.  The content of the request is formatted
           as an octet string (in network byte order) containing the
           CT_IU, as described in Table 2 of [FC-GS-5] (including the
           preamble).

           For other values of t11FcSpPoLastNotifyType, or if the
           CT_IU's content is unavailable, the value of this object
           is the zero-length string.




De Santi, et al.            Standards Track                   [Page 141]
^L
RFC 5324                     MIB for FC-SP                September 2008


           When the length of this object is 255 octets, it
           contains the first 255 octets of the CT_IU (in
           network-byte order)."
    ::= { t11FcSpPoControlEntry 6 }

t11FcSpPoReasonCodeExp OBJECT-TYPE
    SYNTAX       Unsigned32 (0..255)
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The reason code explanation associated with the failure
           that is indicated when the value of the corresponding
           instance of t11FcSpPoLastNotifyType is 'activateFail' or
           'deactivateFail'.

           For other values of t11FcSpPoLastNotifyType, the value
           of this object is zero."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3.6.2 & 7.3.6.3"
    ::= { t11FcSpPoControlEntry 7 }

t11FcSpPoReasonVendorCode  OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (0 | 1))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The vendor-specific reason code associated with the failure
           that is indicated when the value of the corresponding
           instance of t11FcSpPoLastNotifyType is 'activateFail' or
           'deactivateFail'.

           For other values of t11FcSpPoLastNotifyType, or if no
           vendor-specific reason code is available, the value
           of this object is the zero-length string."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3.6.2 & 7.3.6.3"
    ::= { t11FcSpPoControlEntry 8 }

--
-- Notification definitions
--

t11FcSpPoNotifyActivation NOTIFICATION-TYPE
    OBJECTS      { t11FcSpPoServerAddress,



De Santi, et al.            Standards Track                   [Page 142]
^L
RFC 5324                     MIB for FC-SP                September 2008


                   t11FcSpPoPolicySummaryObjName,
                   t11FcSpPoRequestSource }
    STATUS       current
    DESCRIPTION
           "This notification is generated whenever a Security
           Policy Server (indicated by the value of
           t11FcSpPoServerAddress) successfully completes the
           execution of an Activate Policy Summary request.
           The value of t11FcSpPoRequestSource indicates
           the source of the APS request.  The value of
           t11FcSpPoPolicySummaryObjName indicates the name of
           the activated Policy Summary Object."
    ::= { t11FcSpPoMIBNotifications 1 }

t11FcSpPoNotifyActivateFail NOTIFICATION-TYPE
    OBJECTS      { t11FcSpPoServerAddress,
                   t11FcSpPoRequestSource,
                   t11FcSpPoCtCommandString,
                   t11FcSpPoReasonCode,
                   t11FcSpPoReasonCodeExp,
                   t11FcSpPoReasonVendorCode }
    STATUS       current
    DESCRIPTION
           "This notification is generated whenever a Security Policy
           Server (indicated by the value of t11FcSpPoServerAddress)
           fails to complete the execution of an Activate Policy
           Summary request.

           The value of t11FcSpPoCtCommandString indicates the
           rejected request, and the values of t11FcSpPoReasonCode,
           t11FcSpPoReasonCodeExp, and t11FcSpPoReasonVendorCode
           indicate the reason for the rejection.  The value of
           t11FcSpPoRequestSource indicates the source of the
           request."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3.6.2."
    ::= { t11FcSpPoMIBNotifications 2 }

t11FcSpPoNotifyDeactivation NOTIFICATION-TYPE
    OBJECTS      { t11FcSpPoServerAddress,
                   t11FcSpPoRequestSource }
    STATUS       current
    DESCRIPTION
           "This notification is generated whenever a Security
           Policy Server (indicated by the value of
           t11FcSpPoServerAddress) successfully completes the



De Santi, et al.            Standards Track                   [Page 143]
^L
RFC 5324                     MIB for FC-SP                September 2008


           execution of a Deactivate Policy Summary request.
           The value of t11FcSpPoRequestSource indicates
           the source of the DPS request."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 7.3.6.3."
    ::= { t11FcSpPoMIBNotifications 3 }

t11FcSpPoNotifyDeactivateFail NOTIFICATION-TYPE
    OBJECTS      { t11FcSpPoServerAddress,
                   t11FcSpPoRequestSource,
                   t11FcSpPoCtCommandString,
                   t11FcSpPoReasonCode,
                   t11FcSpPoReasonCodeExp,
                   t11FcSpPoReasonVendorCode }
    STATUS       current
    DESCRIPTION
           "This notification is generated whenever a Security Policy
           Server (indicated by the value of t11FcSpPoServerAddress)
           fails to complete the execution of a Deactivate Policy
           Summary request.

           The value of t11FcSpPoCtCommandString indicates the
           rejected request, and the values of t11FcSpPoReasonCode,
           t11FcSpPoReasonCodeExp, and t11FcSpPoReasonVendorCode
           indicate the reason for the rejection.  The value of
           t11FcSpPoRequestSource indicates the source of the
           request."
    ::= { t11FcSpPoMIBNotifications 4 }

--
-- Conformance
--

t11FcSpPoMIBCompliances
                    OBJECT IDENTIFIER ::= { t11FcSpPoMIBConformance 1 }
t11FcSpPoMIBGroups  OBJECT IDENTIFIER ::= { t11FcSpPoMIBConformance 2 }

t11FcSpPoMIBCompliance MODULE-COMPLIANCE
    STATUS       current
    DESCRIPTION
           "The compliance statement for entities that
           support the Fabric Policies defined in FC-SP,"

    MODULE  -- this module
        MANDATORY-GROUPS { t11FcSpPoActiveObjectsGroup }




De Santi, et al.            Standards Track                   [Page 144]
^L
RFC 5324                     MIB for FC-SP                September 2008


        GROUP        t11FcSpPoNonActiveObjectsGroup
        DESCRIPTION
            "These objects are mandatory for FC-SP Security Policy
            Servers."

        GROUP        t11FcSpPoNotifyObjectsGroup
        DESCRIPTION
            "These objects are mandatory for FC-SP Security Policy
            Servers."

        GROUP        t11FcSpPoNotificationGroup
        DESCRIPTION
            "These notifications are mandatory for FC-SP Security
            Policy Servers."

        GROUP        t11FcSpPoOperationsObjectsGroup
        DESCRIPTION
            "These objects are mandatory only for FC-SP Security
            Policy Servers that support the activation/deactivation
            of policies via SNMP."

        GROUP        t11FcSpPoStatsObjectsGroup
        DESCRIPTION
            "These objects are optional."

-- Write access is not required for any objects in this MIB module:

        OBJECT       t11FcSpPoOperActivate
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoOperDeActivate
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoStorageType
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNotificationEnable
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSummaryPolicyNameType



De Santi, et al.            Standards Track                   [Page 145]
^L
RFC 5324                     MIB for FC-SP                September 2008


        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSummaryPolicyName
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSummaryHashStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSummaryRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwListFabricName
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwListRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwMembFlags
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwMembDomainID
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwMembPolicyDataRole
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwMembAuthBehaviour
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."



De Santi, et al.            Standards Track                   [Page 146]
^L
RFC 5324                     MIB for FC-SP                September 2008


        OBJECT       t11FcSpPoNaSwMembAttribute
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwMembRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaNoMembFlags
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaNoMembCtAccessIndex
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaNoMembAttribute
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaNoMembRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaCtDescrFlags
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaCtDescrGsType
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaCtDescrGsSubType
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaCtDescrRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION



De Santi, et al.            Standards Track                   [Page 147]
^L
RFC 5324                     MIB for FC-SP                September 2008


            "Write access is not required."

        OBJECT       t11FcSpPoNaSwConnAllowedNameType
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwConnAllowedName
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaSwConnRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaIpMgmtWkpIndex
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaIpMgmtAttribute
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaIpMgmtRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaWkpDescrFlags
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaWkpDescrWkpNumber
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaWkpDescrDestPort
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaWkpDescrRowStatus



De Santi, et al.            Standards Track                   [Page 148]
^L
RFC 5324                     MIB for FC-SP                September 2008


        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaAttribType
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaAttribValue
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaAttribRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaAuthProtParams
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

        OBJECT       t11FcSpPoNaAuthProtRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION
            "Write access is not required."

    ::= { t11FcSpPoMIBCompliances 1 }

-- Units of Conformance

t11FcSpPoActiveObjectsGroup OBJECT-GROUP
    OBJECTS  {   t11FcSpPoPolicySummaryObjName,
                 t11FcSpPoAdminFabricName,
                 t11FcSpPoActivatedTimeStamp,
                 t11FcSpPoSummaryPolicyType,
                 t11FcSpPoSummaryHashFormat,
                 t11FcSpPoSummaryHashValue,
                 t11FcSpPoSwMembSwitchFlags,
                 t11FcSpPoSwMembDomainID,
                 t11FcSpPoSwMembPolicyDataRole,
                 t11FcSpPoSwMembAuthBehaviour,
                 t11FcSpPoSwMembAttribute,
                 t11FcSpPoNoMembFlags,
                 t11FcSpPoNoMembCtAccessIndex,
                 t11FcSpPoNoMembAttribute,



De Santi, et al.            Standards Track                   [Page 149]
^L
RFC 5324                     MIB for FC-SP                September 2008


                 t11FcSpPoCtDescrFlags,
                 t11FcSpPoCtDescrGsType,
                 t11FcSpPoCtDescrGsSubType,
                 t11FcSpPoSwConnAllowedNameType,
                 t11FcSpPoSwConnAllowedName,
                 t11FcSpPoIpMgmtWkpIndex,
                 t11FcSpPoIpMgmtAttribute,
                 t11FcSpPoWkpDescrFlags,
                 t11FcSpPoWkpDescrWkpNumber,
                 t11FcSpPoWkpDescrDestPort,
                 t11FcSpPoAttribType,
                 t11FcSpPoAttribValue,
                 t11FcSpPoAttribExtension,
                 t11FcSpPoAuthProtParams
             }
    STATUS   current
    DESCRIPTION
           "A collection of MIB objects that contain information
           about active Policy Objects that express Fibre Channel
           Security (FC-SP) policy."
    ::= { t11FcSpPoMIBGroups 1 }

t11FcSpPoOperationsObjectsGroup OBJECT-GROUP
    OBJECTS  {   t11FcSpPoOperActivate,
                 t11FcSpPoOperDeActivate,
                 t11FcSpPoOperResult,
                 t11FcSpPoOperFailCause
             }
    STATUS   current
    DESCRIPTION
           "A collection of MIB objects that allow a new set of
           Fibre Channel Security (FC-SP) policies to be activated
           or an existing set to be deactivated."
    ::= { t11FcSpPoMIBGroups 2 }

t11FcSpPoNonActiveObjectsGroup OBJECT-GROUP
    OBJECTS  {   t11FcSpPoStorageType,
                 t11FcSpPoNaSummaryPolicyNameType,
                 t11FcSpPoNaSummaryPolicyName,
                 t11FcSpPoNaSummaryHashStatus,
                 t11FcSpPoNaSummaryHashFormat,
                 t11FcSpPoNaSummaryHashValue,
                 t11FcSpPoNaSummaryRowStatus,
                 t11FcSpPoNaSwListFabricName,
                 t11FcSpPoNaSwListRowStatus,
                 t11FcSpPoNaSwMembFlags,
                 t11FcSpPoNaSwMembDomainID,
                 t11FcSpPoNaSwMembPolicyDataRole,



De Santi, et al.            Standards Track                   [Page 150]
^L
RFC 5324                     MIB for FC-SP                September 2008


                 t11FcSpPoNaSwMembAuthBehaviour,
                 t11FcSpPoNaSwMembAttribute,
                 t11FcSpPoNaSwMembRowStatus,
                 t11FcSpPoNaNoMembFlags,
                 t11FcSpPoNaNoMembCtAccessIndex,
                 t11FcSpPoNaNoMembAttribute,
                 t11FcSpPoNaNoMembRowStatus,
                 t11FcSpPoNaCtDescrFlags,
                 t11FcSpPoNaCtDescrGsType,
                 t11FcSpPoNaCtDescrGsSubType,
                 t11FcSpPoNaCtDescrRowStatus,
                 t11FcSpPoNaSwConnAllowedNameType,
                 t11FcSpPoNaSwConnAllowedName,
                 t11FcSpPoNaSwConnRowStatus,
                 t11FcSpPoNaIpMgmtWkpIndex,
                 t11FcSpPoNaIpMgmtAttribute,
                 t11FcSpPoNaIpMgmtRowStatus,
                 t11FcSpPoNaWkpDescrFlags,
                 t11FcSpPoNaWkpDescrWkpNumber,
                 t11FcSpPoNaWkpDescrDestPort,
                 t11FcSpPoNaWkpDescrRowStatus,
                 t11FcSpPoNaAttribType,
                 t11FcSpPoNaAttribValue,
                 t11FcSpPoNaAttribExtension,
                 t11FcSpPoNaAttribRowStatus,
                 t11FcSpPoNaAuthProtParams,
                 t11FcSpPoNaAuthProtRowStatus
             }
    STATUS   current
    DESCRIPTION
           "A collection of MIB objects that contain information
           about non-active Policy Objects available for activation
           in order to change Fibre Channel Security (FC-SP) policy."
    ::= { t11FcSpPoMIBGroups 3 }

t11FcSpPoStatsObjectsGroup OBJECT-GROUP
    OBJECTS  {   t11FcSpPoInRequests,
                 t11FcSpPoInAccepts,
                 t11FcSpPoInRejects
             }
    STATUS   current
    DESCRIPTION
           "A collection of MIB objects that contain statistics
           that can be maintained by FC-SP Security Policy Servers."
    ::= { t11FcSpPoMIBGroups 4 }

t11FcSpPoNotifyObjectsGroup OBJECT-GROUP
    OBJECTS  {   t11FcSpPoNotificationEnable,



De Santi, et al.            Standards Track                   [Page 151]
^L
RFC 5324                     MIB for FC-SP                September 2008


                 t11FcSpPoServerAddress,
                 t11FcSpPoLastNotifyType,
                 t11FcSpPoRequestSource,
                 t11FcSpPoReasonCode,
                 t11FcSpPoCtCommandString,
                 t11FcSpPoReasonCodeExp,
                 t11FcSpPoReasonVendorCode
             }
    STATUS   current
    DESCRIPTION
           "A collection of MIB objects to control the generation of
           notifications concerning Fibre Channel Security (FC-SP)
           policy, and to hold information contained in such
           notifications."
    ::= { t11FcSpPoMIBGroups 5 }

t11FcSpPoNotificationGroup NOTIFICATION-GROUP
    NOTIFICATIONS  {   t11FcSpPoNotifyActivation,
                       t11FcSpPoNotifyActivateFail,
                       t11FcSpPoNotifyDeactivation,
                       t11FcSpPoNotifyDeactivateFail
                   }
    STATUS   current
    DESCRIPTION
           "A collection of notifications of events concerning
           Fibre Channel Security (FC-SP) policy."
    ::= { t11FcSpPoMIBGroups 6 }

END

6.5.  The T11-FC-SP-SA-MIB Module

--*******************************************************************
-- FC-SP Security Associations
--

T11-FC-SP-SA-MIB  DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,
    Unsigned32, Counter32, Counter64, TimeTicks, Gauge32,
    mib-2                 FROM SNMPv2-SMI              -- [RFC2578]
    RowStatus, StorageType, AutonomousType, TimeStamp,
    TruthValue            FROM SNMPv2-TC               -- [RFC2579]
    MODULE-COMPLIANCE, OBJECT-GROUP,
    NOTIFICATION-GROUP
                          FROM SNMPv2-CONF             -- [RFC2580]
    InterfaceIndex,



De Santi, et al.            Standards Track                   [Page 152]
^L
RFC 5324                     MIB for FC-SP                September 2008


    InterfaceIndexOrZero  FROM IF-MIB                  -- [RFC2863]
    fcmInstanceIndex,
    FcAddressIdOrZero     FROM FC-MGMT-MIB             -- [RFC4044]
    T11FabricIndex        FROM T11-TC-MIB              -- [RFC4439]
    T11FcSpType,
    T11FcSpiIndex,
    T11FcSpLifetimeLeft,
    T11FcSpLifetimeLeftUnits,
    T11FcSpSecurityProtocolId,
    T11FcRoutingControl,
    T11FcSaDirection,
    T11FcSpPrecedence,
    T11FcSpTransforms      FROM T11-FC-SP-TC-MIB;

t11FcSpSaMIB  MODULE-IDENTITY
    LAST-UPDATED  "200808200000Z"
    ORGANIZATION  "This MIB module was developed through the
                  coordinated effort of two organizations:
                  T11 began the development and the IETF (in
                  the IMSS Working Group) finished it."
    CONTACT-INFO
            "     Claudio DeSanti
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  EMail: cds@cisco.com

                  Keith McCloghrie
                  Cisco Systems, Inc.
                  170 West Tasman Drive
                  San Jose, CA 95134 USA
                  Email: kzm@cisco.com"
    DESCRIPTION
           "This MIB module specifies the management information
           required to manage Security Associations established via
           Fibre Channel's FC-SP specification.

           The MIB module consists of six parts:

           - a per-Fabric table, t11FcSpSaIfTable, of capabilities,
             parameters, status information, and counters; the counters
             include non-transient aggregates of per-SA transient
             counters;

           - three tables, t11FcSpSaPropTable, t11FcSpSaTSelPropTable,
             and t11FcSpSaTransTable, specifying the proposals for an
             FC-SP entity acting as an SA_Initiator to present to the
             SA_Responder during the negotiation of Security



De Santi, et al.            Standards Track                   [Page 153]
^L
RFC 5324                     MIB for FC-SP                September 2008


             Associations.  The same information is also used by an
             FC-SP entity acting as an SA_Responder to decide what to
             accept during the negotiation of Security Associations.
             One of these tables, t11FcSpSaTransTable, is used not only
             for information about security transforms to propose and
             to accept, but also as agreed upon during the negotiation
             of Security Associations;

           - a table, t11FcSpSaTSelDrByTable, of Traffic Selectors
             having the security action of 'drop' or 'bypass' to be
             applied either to ingress traffic that is unprotected by
             FC-SP, or to all egress traffic;

           - four tables, t11FcSpSaPairTable, t11FcSpSaTSelNegInTable,
             t11FcSpSaTSelNegOutTable, and t11FcSpSaTSelSpiTable,
             containing information about active bidirectional pairs of
             Security Associations; in particular, t11FcSpSaPairTable
             has one row per active bidirectional SA pair,
             t11FcSpSaTSelNegInTable and t11FcSpSaTSelNegOutTable
             contain information on the Traffic Selectors negotiated on
             the SAs, and the t11FcSpSaTSelSpiTable is an alternate
             lookup table such that the Traffic Selector(s) in use on a
             particular Security Association can be quickly determined
             based on the (ingress) SPI value;

           - a table, t11FcSpSaControlTable, of control and other
             information concerning the generation of notifications for
             events related to FC-SP Security Associations;

           - one notification, t11FcSpSaNotifyAuthFailure, generated on
             the occurrence of an Authentication failure for a received
             FC-2 or CT_IU frame.

           Copyright (C) The IETF Trust (2008).  This version
           of this MIB module is part of RFC 5324;  see the RFC
           itself for full legal notices."
    REVISION  "200808200000Z"
    DESCRIPTION
           "Initial version of this MIB module, published as RFC 5324."
    ::= { mib-2 179 }

t11FcSpSaMIBNotifications OBJECT IDENTIFIER ::= { t11FcSpSaMIB 0 }
t11FcSpSaMIBObjects     OBJECT IDENTIFIER ::= { t11FcSpSaMIB 1 }
t11FcSpSaMIBConformance OBJECT IDENTIFIER ::= { t11FcSpSaMIB 2 }
t11FcSpSaBase           OBJECT IDENTIFIER ::= { t11FcSpSaMIBObjects 1 }
t11FcSpSaConfig         OBJECT IDENTIFIER ::= { t11FcSpSaMIBObjects 2 }
t11FcSpSaActive         OBJECT IDENTIFIER ::= { t11FcSpSaMIBObjects 3 }
t11FcSpSaControl        OBJECT IDENTIFIER ::= { t11FcSpSaMIBObjects 4 }



De Santi, et al.            Standards Track                   [Page 154]
^L
RFC 5324                     MIB for FC-SP                September 2008


--
--  Base-level Per-Fabric Information
--

t11FcSpSaIfTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaIfEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing per-Fabric information related to
           FC-SP Security Associations."
    ::= { t11FcSpSaBase 1 }

t11FcSpSaIfEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaIfEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information related to Security
           Associations on a particular Fabric, and managed as part
           of the Fibre Channel management instance identified by
           fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpSaIfIndex,
             t11FcSpSaIfFabricIndex }
    ::= { t11FcSpSaIfTable 1 }

T11FcSpSaIfEntry ::= SEQUENCE {
    t11FcSpSaIfIndex               InterfaceIndexOrZero,
    t11FcSpSaIfFabricIndex         T11FabricIndex,
             -- capabilities
    t11FcSpSaIfEspHeaderCapab      T11FcSpTransforms,
    t11FcSpSaIfCTAuthCapab         T11FcSpTransforms,
    t11FcSpSaIfIKEv2Capab          T11FcSpTransforms,
    t11FcSpSaIfIkev2AuthCapab      TruthValue,
             -- parameters and status
    t11FcSpSaIfStorageType         StorageType,
    t11FcSpSaIfReplayPrevention    TruthValue,
    t11FcSpSaIfReplayWindowSize    Unsigned32,
    t11FcSpSaIfDeadPeerDetections  Counter32,
    t11FcSpSaIfTerminateAllSas     INTEGER,
             -- summary frame counters
    t11FcSpSaIfOutDrops            Counter64,
    t11FcSpSaIfOutBypasses         Counter64,
    t11FcSpSaIfOutProcesses        Counter64,
    t11FcSpSaIfOutUnMatcheds       Counter64,
    t11FcSpSaIfInUnprotUnmtchDrops Counter64,
             -- aggregates of per-SA transient counters
    t11FcSpSaIfInDetReplays        Counter64,



De Santi, et al.            Standards Track                   [Page 155]
^L
RFC 5324                     MIB for FC-SP                September 2008


    t11FcSpSaIfInUnprotMtchDrops   Counter64,
    t11FcSpSaIfInBadXforms         Counter64,
    t11FcSpSaIfInGoodXforms        Counter64,
    t11FcSpSaIfInProtUnmtchs       Counter64
}

t11FcSpSaIfIndex OBJECT-TYPE
    SYNTAX       InterfaceIndexOrZero
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "This object has a non-zero value to identify a particular
           interface, or the value zero to indicate that the
           information in this row applies to all (of the management
           instance's) interfaces to the particular Fabric.

           If any row has a non-zero value of t11FcSpSaIfIndex, then
           all rows for the same Fibre Channel management instance must
           also have a non-zero value of t11FcSpSaIfIndex and thereby
           be specific to a particular interface.

           As and when zero values of t11FcSpSaIfIndex are used in
           this table, then they must also be used in each other
           table that has t11FcSpSaIfIndex in its INDEX clause."
    ::= { t11FcSpSaIfEntry 1 }

t11FcSpSaIfFabricIndex OBJECT-TYPE
    SYNTAX       T11FabricIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           Fabric."
    ::= { t11FcSpSaIfEntry 2 }

t11FcSpSaIfEspHeaderCapab OBJECT-TYPE
    SYNTAX       T11FcSpTransforms
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "A list of the standardized transforms supported by this
           entity on this interface for ESP_Header protection."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Appendix A.3.1, tables A.23, A.25."
    ::= { t11FcSpSaIfEntry 3 }




De Santi, et al.            Standards Track                   [Page 156]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpSaIfCTAuthCapab OBJECT-TYPE
    SYNTAX       T11FcSpTransforms
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "A list of the standardized transforms supported by this
           entity on this interface for CT_Authentication protection."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Appendix A.3.1, tables A.23, A.25."
    ::= { t11FcSpSaIfEntry 4 }

t11FcSpSaIfIKEv2Capab OBJECT-TYPE
    SYNTAX       T11FcSpTransforms
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "A list of the standardized transforms supported by this
           entity on this interface with IKEv2 protection."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, Appendix A.3.1, tables A.23, A.24,
              A.25, A.26."
    ::= { t11FcSpSaIfEntry 5 }

t11FcSpSaIfIkev2AuthCapab OBJECT-TYPE
    SYNTAX     TruthValue
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
           "An indication of whether the entity is capable of
           supporting the IKEv2-AUTH protocol on this interface, i.e.,
           concatenation of Authentication and SA Management
           Transactions, such that an SA Management Transaction is
           used to perform both the authentication function and
           SA management."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.7.2, and table A.27."
    ::= { t11FcSpSaIfEntry 6 }

t11FcSpSaIfStorageType OBJECT-TYPE
    SYNTAX       StorageType
    MAX-ACCESS   read-write
    STATUS       current



De Santi, et al.            Standards Track                   [Page 157]
^L
RFC 5324                     MIB for FC-SP                September 2008


    DESCRIPTION
           "This object specifies the memory realization of
           information related to FC-SP Security Associations
           for interface(s) to a particular Fabric; specifically,
           for rows created and/or modified in these tables:

                   t11FcSpSaPropTable
                   t11FcSpSaTSelDrByTable
                   t11FcSpSaControlTable

           and, for modified information contained in the same
           row as an instance of this object.

           Even if an instance of this object has the value
           'permanent(4)', none of the information defined in
           this MIB module for interface(s) to the given Fabric
           need to be writable."
    ::= { t11FcSpSaIfEntry 7 }

t11FcSpSaIfReplayPrevention  OBJECT-TYPE
    SYNTAX       TruthValue
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object indicates whether anti-replay protection is
           enabled for frame reception on this interface.

           Note that the replay-protection mechanism in FC-SP is
           conceptually similar to the corresponding mechanism in
           IPsec ESP."
    REFERENCE
           "- IP Encapsulating Security Payload (ESP),
              RFC 4303, December 2005, section 3.3.3."
    ::= { t11FcSpSaIfEntry 8 }

t11FcSpSaIfReplayWindowSize OBJECT-TYPE
    SYNTAX       Unsigned32
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "The size of the replay window to be used when
           anti-replay protection is enabled for frame reception
           on this interface.

           Note that the replay-protection mechanism in FC-SP is
           conceptually similar to the corresponding mechanism in
           IPsec ESP."
    REFERENCE



De Santi, et al.            Standards Track                   [Page 158]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "- IP Encapsulating Security Payload (ESP),
              RFC 4303, December 2005, section 3.4.3."
    ::= { t11FcSpSaIfEntry 9 }

t11FcSpSaIfDeadPeerDetections OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that a dead peer condition has been
           detected on this interface.

           This counter has no discontinuities other than those
           that all Counter32's have when sysUpTime=0."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 8.5.3.3."
    ::= { t11FcSpSaIfEntry 10 }

t11FcSpSaIfTerminateAllSas OBJECT-TYPE
    SYNTAX       INTEGER { noop(1), terminate(2) }
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "Setting this object to 'terminate' is a request to
           terminate all outstanding Security Associations on this
           interface.

           When read, the value of this object is always 'noop'.
           Setting this object to 'noop' has no effect."
    ::= { t11FcSpSaIfEntry 11 }

t11FcSpSaIfOutDrops OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of output frames that were dropped, instead
           of being transmitted on this interface, because they matched
           an active (at that time) Traffic Selector with an action of
           'Drop'.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 12 }

t11FcSpSaIfOutBypasses        OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 159]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of output frames that were transmitted
           unchanged by FC-SP on this interface because they matched
           an active (at that time) Traffic Selector with an action
           of 'Bypass'.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 13 }

t11FcSpSaIfOutProcesses       OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of output frames that were protected by FC-SP
           before being transmitted on this interface because they
           matched an active (at that time) Traffic Selector with an
           action of 'Process'.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 14 }

t11FcSpSaIfOutUnMatcheds OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of frames that were transmitted unchanged by
           FC-SP on this interface because they did not match any
           Traffic Selector active at that time.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 15 }

t11FcSpSaIfInUnprotUnmtchDrops OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of frames received on this interface that
           were dropped because they were unprotected and did not
           match any Traffic Selector active at that time.



De Santi, et al.            Standards Track                   [Page 160]
^L
RFC 5324                     MIB for FC-SP                September 2008


           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 16 }

t11FcSpSaIfInDetReplays OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that a replay has been detected on
           a Security Association that is currently active or was
           previously active on this interface.  Note that a frame
           that is discarded because it is 'behind' the window,
           i.e., too old, is counted as a replay.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 17 }

t11FcSpSaIfInUnprotMtchDrops OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that a frame received on this
           interface was dropped because it matched with a Traffic
           Selector for a Security Association that was active at
           the time of receipt but the frame was not protected as
           negotiated for that Security Association.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 18 }

t11FcSpSaIfInBadXforms OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that a frame received on this
           interface was dropped because of a failure of one of the
           transforms negotiated for the Security Association on
           which it was received.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 19 }




De Santi, et al.            Standards Track                   [Page 161]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpSaIfInGoodXforms OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of frames received on this interface on a
           Security Association for which the transforms negotiated
           for that Security Association were successfully applied,
           and that matched a Traffic Selector for that Security
           Association.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 20 }

t11FcSpSaIfInProtUnmtchs OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of frames received on this interface that
           were dropped because they did not match any of the Traffic
           Selectors negotiated for the Security Association on which
           they were received, even though the Security Association's
           transforms were successfully applied.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaIfEntry 21 }

--
--  Proposals to present in Security Association negotiation
--

t11FcSpSaPropTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaPropEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of proposals for an FC-SP entity acting as an
           SA_Initiator to present to the SA_Responder during the
           negotiation of Security Associations.  This information
           is also used by an FC-SP entity acting as an SA_Responder
           to decide what to accept during the negotiation of
           Security Associations."
    ::= { t11FcSpSaConfig 1 }

t11FcSpSaPropEntry OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 162]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       T11FcSpSaPropEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one proposal for
           the FC-SP entity to present, or what to accept, during
           the negotiation of Security Associations on one or more
           interfaces (identified by t11FcSpSaIfIndex) to a
           particular Fabric (identified by t11FcSpSaIfFabricIndex),
           and managed as part of the Fibre Channel management
           instance identified by fcmInstanceIndex.

           The StorageType of a row in this table is specified by
           the instance of t11FcSpSaIfStorageType that is INDEX-ed
           by the same values of fcmInstanceIndex, t11FcSpSaIfIndex
           and t11FcSpSaIfFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpSaIfIndex,
             t11FcSpSaIfFabricIndex,
             t11FcSpSaPropIndex }
    ::= { t11FcSpSaPropTable 1 }

T11FcSpSaPropEntry ::= SEQUENCE {
    t11FcSpSaPropIndex             Unsigned32,
    t11FcSpSaPropSecurityProt      T11FcSpSecurityProtocolId,
    t11FcSpSaPropTSelListIndex     Unsigned32,
    t11FcSpSaPropTransListIndex    Unsigned32,
    t11FcSpSaPropAcceptAlgorithm   INTEGER,
    t11FcSpSaPropOutMatchSucceeds  Counter64,
    t11FcSpSaPropRowStatus         RowStatus
}

t11FcSpSaPropIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           proposal for use on one or more interfaces to a Fabric."
    ::= { t11FcSpSaPropEntry 1 }

t11FcSpSaPropSecurityProt OBJECT-TYPE
    SYNTAX       T11FcSpSecurityProtocolId
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The Security Protocol identifier for this proposal, i.e.,
           whether the proposal is for traffic to be protected using
           ESP_Header or CT_Authentication."



De Santi, et al.            Standards Track                   [Page 163]
^L
RFC 5324                     MIB for FC-SP                September 2008


    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.3.2.2 and table 67."
    ::= { t11FcSpSaPropEntry 2 }

t11FcSpSaPropTSelListIndex OBJECT-TYPE
    SYNTAX       Unsigned32
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "When the value of this object is non-zero, it points
           to the proposal's list of Traffic Selectors.  The value
           must be non-zero in an active row of this table.

           The identified list is represented by all rows in the
           t11FcSpSaTSelPropTable for which t11FcSpSaTSelPropListIndex
           has the same value as this object (and with corresponding
           values of t11FcSpSaIfIndex and fcmInstanceIndex)."
    ::= { t11FcSpSaPropEntry 3 }

t11FcSpSaPropTransListIndex OBJECT-TYPE
    SYNTAX       Unsigned32
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "When the value of this object is non-zero, it points to
           the proposal's list of Transforms.  The value must be
           non-zero in an active row of this table.

           The identified list is represented by all rows in the
           t11FcSpSaTransTable for which t11FcSpSaTransListIndex
           has the same value as this object (and with corresponding
           values of t11FcSpSaIfIndex and fcmInstanceIndex)."
    ::= { t11FcSpSaPropEntry 4 }

t11FcSpSaPropAcceptAlgorithm OBJECT-TYPE
    SYNTAX       INTEGER {
                     intersection(1),
                     union(2),
                     other(3)
                 }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The algorithm by which an SA_Responder in an SA negotiation
           decides on which Traffic Selectors to specify in a response
           to an IKE_Create_Child_SA request.  This algorithm is used



De Santi, et al.            Standards Track                   [Page 164]
^L
RFC 5324                     MIB for FC-SP                September 2008


           when the Traffic Selectors specified by an SA_Initiator in
           an IKE_Create_Child_SA request overlap with this proposal's
           list of Traffic Selectors:

           intersection(1) - the SA_Responder specifies the largest
                         subset of what the SA_Initiator proposed,
                         which is also a subset of this proposal's
                         Traffic Selectors.

           union(2)    - the SA_Responder specifies the smallest
                         superset of what the SA_Initiator proposed,
                         which is also a superset of this proposal's
                         Traffic Selectors.

           other(3)    - the SA_Responder uses some other algorithm.
           "
    ::= { t11FcSpSaPropEntry 5 }

t11FcSpSaPropOutMatchSucceeds OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of egress frames that have matched a Traffic
           Selector that was negotiated to select traffic for an
           SA based on this proposal being accepted.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaPropEntry 6 }

t11FcSpSaPropRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of a row.  Values of object instances
           within an active row can be modified at any time.

           The status cannot be set to 'active' unless and
           until the instances of t11FcSpSaPropTSelListIndex
           and t11FcSpSaPropTransListIndex in the row have
           been set to point to active rows in the
           t11FcSpSaTSelPropTable and t11FcSpSaTransTable
           tables, respectively.  A row in this table is
           deleted if the active rows it points to are deleted."
    ::= { t11FcSpSaPropEntry 7 }




De Santi, et al.            Standards Track                   [Page 165]
^L
RFC 5324                     MIB for FC-SP                September 2008


--
--  Traffic Selector Proposals
--

t11FcSpSaTSelPropTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaTSelPropEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing information about Traffic Selectors
           to propose and/or to accept during the negotiation of
           Security Associations."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5.
            - Use of IKEv2 in FC-SP, RFC 4595,
              July 2006, section 4.4."
    ::= { t11FcSpSaConfig 2 }

t11FcSpSaTSelPropEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaTSelPropEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one Traffic
           Selector within a list of Traffic Selectors to propose,
           or for use in determining what to accept during Security
           Association negotiation.

           One such list is configured for use on a Fabric by
           configuring the list's value of t11FcSpSaTSelPropListIndex
           as the value of an instance of t11FcSpSaPropTSelListIndex,
           for corresponding values of t11FcSpSaIfIndex and
           fcmInstanceIndex.  Further, the proposing and accepting
           of Traffic Selectors is only done as a part of a proposal
           specified by a row of the t11FcSpSaPropTable, i.e.,
           in combination with the proposing and accepting of security
           transforms as specified by the combination of
           t11FcSpSaPropTSelListIndex and t11FcSpSaPropTransListIndex
           in one row of the t11FcSpSaPropTable.

           The StorageType of a row in this table is specified by
           the instance of t11FcSpSaTSelPropStorageType in that row."
    INDEX  { fcmInstanceIndex, t11FcSpSaIfIndex,
             t11FcSpSaTSelPropListIndex, t11FcSpSaTSelPropPrecedence }
    ::= { t11FcSpSaTSelPropTable 1 }




De Santi, et al.            Standards Track                   [Page 166]
^L
RFC 5324                     MIB for FC-SP                September 2008


T11FcSpSaTSelPropEntry ::= SEQUENCE {
    t11FcSpSaTSelPropListIndex    Unsigned32,
    t11FcSpSaTSelPropPrecedence   T11FcSpPrecedence,
    t11FcSpSaTSelPropDirection    T11FcSaDirection,
    t11FcSpSaTSelPropStartSrcAddr FcAddressIdOrZero,
    t11FcSpSaTSelPropEndSrcAddr   FcAddressIdOrZero,
    t11FcSpSaTSelPropStartDstAddr FcAddressIdOrZero,
    t11FcSpSaTSelPropEndDstAddr   FcAddressIdOrZero,
    t11FcSpSaTSelPropStartRCtl    T11FcRoutingControl,
    t11FcSpSaTSelPropEndRCtl      T11FcRoutingControl,
    t11FcSpSaTSelPropStartType    T11FcSpType,
    t11FcSpSaTSelPropEndType      T11FcSpType,
    t11FcSpSaTSelPropStorageType  StorageType,
    t11FcSpSaTSelPropRowStatus    RowStatus
}

t11FcSpSaTSelPropListIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that identifies a particular list of
           Traffic Selectors."
    ::= { t11FcSpSaTSelPropEntry 1 }

t11FcSpSaTSelPropPrecedence OBJECT-TYPE
    SYNTAX       T11FcSpPrecedence
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The precedence of this Traffic Selector.  Each
           Traffic Selector within a particular list of
           Traffic Selectors must have a different precedence.

           If an egress frame matches multiple Traffic Selectors,
           it should be transmitted on the SA associated with the
           Traffic Selector having the numerically smallest
           precedence value."
    ::= { t11FcSpSaTSelPropEntry 2 }

t11FcSpSaTSelPropDirection OBJECT-TYPE
    SYNTAX       T11FcSaDirection
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "An indication of whether this Traffic Selector is
           to be proposed for ingress or egress traffic."
    DEFVAL   { egress }



De Santi, et al.            Standards Track                   [Page 167]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpSaTSelPropEntry 3 }

t11FcSpSaTSelPropStartSrcAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { '000000'h }
    ::= { t11FcSpSaTSelPropEntry 4 }

t11FcSpSaTSelPropEndSrcAddr  OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically largest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { 'FFFFFF'h }
    ::= { t11FcSpSaTSelPropEntry 5 }

t11FcSpSaTSelPropStartDstAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { '000000'h }
    ::= { t11FcSpSaTSelPropEntry 6 }

t11FcSpSaTSelPropEndDstAddr OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 168]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically largest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { 'FFFFFF'h }
    ::= { t11FcSpSaTSelPropEntry 7 }

t11FcSpSaTSelPropStartRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically smallest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { '00'h }
    ::= { t11FcSpSaTSelPropEntry 8 }

t11FcSpSaTSelPropEndRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically largest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { 'FF'h }
    ::= { t11FcSpSaTSelPropEntry 9 }

t11FcSpSaTSelPropStartType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-create
    STATUS       current



De Santi, et al.            Standards Track                   [Page 169]
^L
RFC 5324                     MIB for FC-SP                September 2008


    DESCRIPTION
           "The numerically smallest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { '0000'h }
    ::= { t11FcSpSaTSelPropEntry 10 }

t11FcSpSaTSelPropEndType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically largest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.4.5."
    DEFVAL   { 'FFFF'h }
    ::= { t11FcSpSaTSelPropEntry 11 }

t11FcSpSaTSelPropStorageType OBJECT-TYPE
    SYNTAX       StorageType
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "This object specifies the memory realization of
           the information in this row.

           Even if an instance of this object has the value
           'permanent(4)', none of the information in its row
           needs to be writable."
    ::= { t11FcSpSaTSelPropEntry 12 }

t11FcSpSaTSelPropRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpSaTSelPropEntry 13 }




De Santi, et al.            Standards Track                   [Page 170]
^L
RFC 5324                     MIB for FC-SP                September 2008


--
--  Transform Proposals
--

t11FcSpSaTransTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaTransEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing information about security transforms
           to propose, to accept and/or agreed upon during the
           negotiation of Security Associations."
    ::= { t11FcSpSaConfig 3 }

t11FcSpSaTransEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaTransEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one proposal within a
           list of security transforms to be proposed, to be accepted,
           or already agreed upon, for use on a pair of Security
           Associations on one or more interfaces (identified by
           t11FcSpSaIfIndex), managed as part of the Fibre Channel
           management instance identified by fcmInstanceIndex.

           One such list is configured to be proposed or accepted for
           use on a Fabric, by having the list's value of
           t11FcSpSaTransListIndex be the value of an instance of
           t11FcSpSaPropTransListIndex for that Fabric.  Further,
           the proposing and accepting of security transforms is only
           done as a part of a proposal specified by a row of the
           t11FcSpSaPropTable, i.e., in combination with the proposing
           and accepting of Traffic Selectors as specified by the
           combination of t11FcSpSaPropTSelListIndex and
           t11FcSpSaPropTransListIndex in one row of the
           t11FcSpSaPropTable.

           The security (encryption and integrity) transform in use on
           an SA pair is indicated by having the pair's values of
           t11FcSpSaPairTransListIndex and t11FcSpSaPairTransIndex
           contain the values of t11FcSpSaTransListIndex and
           t11FcSpSaTransIndex for the transform's row in this table.

           The StorageType of a row in this table is specified by
           the instance of t11FcSpSaTransStorageType in that row."
    INDEX  { fcmInstanceIndex, t11FcSpSaIfIndex,
             t11FcSpSaTransListIndex, t11FcSpSaTransIndex }



De Santi, et al.            Standards Track                   [Page 171]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpSaTransTable 1 }

T11FcSpSaTransEntry ::= SEQUENCE {
    t11FcSpSaTransListIndex      Unsigned32,
    t11FcSpSaTransIndex          Unsigned32,
    t11FcSpSaTransSecurityProt   T11FcSpSecurityProtocolId,
    t11FcSpSaTransEncryptAlg     AutonomousType,
    t11FcSpSaTransEncryptKeyLen  Unsigned32,
    t11FcSpSaTransIntegrityAlg   AutonomousType,
    t11FcSpSaTransStorageType    StorageType,
    t11FcSpSaTransRowStatus      RowStatus
}

t11FcSpSaTransListIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies a particular
           list of security transforms to be proposed, to be accepted,
           or already agreed upon."
    ::= { t11FcSpSaTransEntry 1 }

t11FcSpSaTransIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that uniquely identifies one security
           transform within a list identified by
           t11FcSpSaTransListIndex."
    ::= { t11FcSpSaTransEntry 2 }

t11FcSpSaTransSecurityProt OBJECT-TYPE
    SYNTAX       T11FcSpSecurityProtocolId
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The Security Protocol identifier that indicates
           whether this transform is for traffic to be protected
           using ESP_Header or using CT_Authentication."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.3.2.2 and table 67."
    ::= { t11FcSpSaTransEntry 3 }

t11FcSpSaTransEncryptAlg OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 172]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       AutonomousType
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The Encryption Algorithm for this transform."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.3.2.3 and tables 69 & 70."
    ::= { t11FcSpSaTransEntry 4 }

t11FcSpSaTransEncryptKeyLen OBJECT-TYPE
    SYNTAX       Unsigned32
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The key length in bits to be used with an encryption
           algorithm that has a variable length key.  This object
           is ignored when the corresponding instance of
           t11FcSpSaTransEncryptAlg specifies an algorithm with a
           fixed length key."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.3.2.5 and table 77."
    ::= { t11FcSpSaTransEntry 5 }

t11FcSpSaTransIntegrityAlg OBJECT-TYPE
    SYNTAX       AutonomousType
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The Integrity Algorithm for this transform."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, section 6.3.2.3 and tables 69 & 72."
    ::= { t11FcSpSaTransEntry 6 }

t11FcSpSaTransStorageType OBJECT-TYPE
    SYNTAX       StorageType
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "This object specifies the memory realization of
           the information in this row.

           Even if an instance of this object has the value



De Santi, et al.            Standards Track                   [Page 173]
^L
RFC 5324                     MIB for FC-SP                September 2008


           'permanent(4)', none of the information in its row
           needs to be writable."
    ::= { t11FcSpSaTransEntry 7 }

t11FcSpSaTransRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.

           When an instance of t11FcSpSaPairTransListIndex points to
           a row in this table, values of object instances in the row
           cannot be modified nor can the row be deleted.  Otherwise,
           a row can be modified or deleted at any time."
    ::= { t11FcSpSaTransEntry 8 }

--
--  Traffic Selectors for Drop & Bypass
--

t11FcSpSaTSelDrByTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaTSelDrByEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing Traffic Selectors to select which
           traffic is to be dropped or is to bypass further
           security processing."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 4.6, 4.7, and 6.4.5.
            - Use of IKEv2 in FC-SP, RFC 4595,
              July 2006, section 4.4."
    ::= { t11FcSpSaConfig 4 }

t11FcSpSaTSelDrByEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaTSelDrByEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry represents one Traffic Selector having the
           security action of 'drop' or 'bypass', which is applied
           based on a precedence value, either to ingress traffic
           that is unprotected by FC-SP, or to all egress
           traffic on one or more interfaces (identified by
           t11FcSpSaIfIndex) to a particular Fabric (identified



De Santi, et al.            Standards Track                   [Page 174]
^L
RFC 5324                     MIB for FC-SP                September 2008


           by t11FcSpSaIfFabricIndex), and managed as part of the Fibre
           Channel management instance identified by fcmInstanceIndex.

           The StorageType of a row in this table is specified by
           the instance of t11FcSpSaIfStorageType that is INDEX-ed
           by the same values of fcmInstanceIndex, t11FcSpSaIfIndex
           and t11FcSpSaIfFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpSaIfIndex, t11FcSpSaIfFabricIndex,
             t11FcSpSaTSelDrByDirection, t11FcSpSaTSelDrByPrecedence }
    ::= { t11FcSpSaTSelDrByTable 1 }

T11FcSpSaTSelDrByEntry ::= SEQUENCE {
    t11FcSpSaTSelDrByDirection     T11FcSaDirection,
    t11FcSpSaTSelDrByPrecedence    T11FcSpPrecedence,
    t11FcSpSaTSelDrByAction        INTEGER,
    t11FcSpSaTSelDrByStartSrcAddr  FcAddressIdOrZero,
    t11FcSpSaTSelDrByEndSrcAddr    FcAddressIdOrZero,
    t11FcSpSaTSelDrByStartDstAddr  FcAddressIdOrZero,
    t11FcSpSaTSelDrByEndDstAddr    FcAddressIdOrZero,
    t11FcSpSaTSelDrByStartRCtl     T11FcRoutingControl,
    t11FcSpSaTSelDrByEndRCtl       T11FcRoutingControl,
    t11FcSpSaTSelDrByStartType     T11FcSpType,
    t11FcSpSaTSelDrByEndType       T11FcSpType,
    t11FcSpSaTSelDrByMatches       Counter64,
    t11FcSpSaTSelDrByRowStatus     RowStatus
}

t11FcSpSaTSelDrByDirection OBJECT-TYPE
    SYNTAX       T11FcSaDirection
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An indication of whether this Traffic Selector is
           for ingress or egress traffic."
    ::= { t11FcSpSaTSelDrByEntry 1 }

t11FcSpSaTSelDrByPrecedence OBJECT-TYPE
    SYNTAX       T11FcSpPrecedence
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The precedence of this Traffic Selector.  If and when a
           frame is compared against multiple Traffic Selectors, and
           multiple of them have a match with the frame, the security
           action to be taken for the frame is that specified for the
           matching Traffic Selector having the numerically smallest
           precedence value."
    ::= { t11FcSpSaTSelDrByEntry 2 }



De Santi, et al.            Standards Track                   [Page 175]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpSaTSelDrByAction OBJECT-TYPE
    SYNTAX       INTEGER { drop(1), bypass(2) }
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The security action to be taken for a frame that
           matches this Traffic Selector."
    DEFVAL   { drop }
    ::= { t11FcSpSaTSelDrByEntry 3 }

t11FcSpSaTSelDrByStartSrcAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    DEFVAL   { '000000'h }
    ::= { t11FcSpSaTSelDrByEntry 4 }

t11FcSpSaTSelDrByEndSrcAddr  OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically largest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    DEFVAL   { 'FFFFFF'h }
    ::= { t11FcSpSaTSelDrByEntry 5 }

t11FcSpSaTSelDrByStartDstAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    DEFVAL   { '000000'h }
    ::= { t11FcSpSaTSelDrByEntry 6 }

t11FcSpSaTSelDrByEndDstAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION



De Santi, et al.            Standards Track                   [Page 176]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "The numerically largest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    DEFVAL   { 'FFFFFF'h }
    ::= { t11FcSpSaTSelDrByEntry 7 }

t11FcSpSaTSelDrByStartRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically smallest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    DEFVAL   { '00'h }
    ::= { t11FcSpSaTSelDrByEntry 8 }

t11FcSpSaTSelDrByEndRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically largest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    DEFVAL   { 'FF'h }
    ::= { t11FcSpSaTSelDrByEntry 9 }

t11FcSpSaTSelDrByStartType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically smallest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    DEFVAL   { '0000'h }
    ::= { t11FcSpSaTSelDrByEntry 10 }

t11FcSpSaTSelDrByEndType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The numerically largest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    DEFVAL   { 'FFFF'h }



De Santi, et al.            Standards Track                   [Page 177]
^L
RFC 5324                     MIB for FC-SP                September 2008


    ::= { t11FcSpSaTSelDrByEntry 11 }

t11FcSpSaTSelDrByMatches OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of frames for which the action specified by
           the corresponding instance of t11FcSpSaTSelDrByAction was
           taken because of a match with this Traffic Selector.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaTSelDrByEntry 12 }

t11FcSpSaTSelDrByRowStatus OBJECT-TYPE
    SYNTAX       RowStatus
    MAX-ACCESS   read-create
    STATUS       current
    DESCRIPTION
           "The status of this row.  Values of object instances
           within the row can be modified at any time."
    ::= { t11FcSpSaTSelDrByEntry 13 }

--
--  Active Security Associations
--

t11FcSpSaPairTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaPairEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing information about active
           bidirectional pairs of Security Associations."
    ::= { t11FcSpSaActive 1 }

t11FcSpSaPairEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaPairEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one active
           bidirectional pair of Security Associations on an
           interface to a particular Fabric (identified by
           t11FcSpSaIfFabricIndex), managed as part of the Fibre
           Channel management instance identified by
           fcmInstanceIndex."



De Santi, et al.            Standards Track                   [Page 178]
^L
RFC 5324                     MIB for FC-SP                September 2008


    INDEX  { fcmInstanceIndex, t11FcSpSaPairIfIndex,
             t11FcSpSaIfFabricIndex, t11FcSpSaPairInboundSpi }
    ::= { t11FcSpSaPairTable 1 }

T11FcSpSaPairEntry ::= SEQUENCE {
    t11FcSpSaPairIfIndex           InterfaceIndex,
    t11FcSpSaPairInboundSpi        T11FcSpiIndex,
    t11FcSpSaPairSecurityProt      T11FcSpSecurityProtocolId,
    t11FcSpSaPairTransListIndex    Unsigned32,
    t11FcSpSaPairTransIndex        Unsigned32,
    t11FcSpSaPairLifetimeLeft      T11FcSpLifetimeLeft,
    t11FcSpSaPairLifetimeLeftUnits T11FcSpLifetimeLeftUnits,
    t11FcSpSaPairTerminate         INTEGER,
    t11FcSpSaPairInProtUnMatchs    Counter64,
    t11FcSpSaPairInDetReplays      Counter64,
    t11FcSpSaPairInBadXforms       Counter64,
    t11FcSpSaPairInGoodXforms      Counter64
}

t11FcSpSaPairIfIndex OBJECT-TYPE
    SYNTAX       InterfaceIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "This object identifies the interface to the particular
           Fabric on which this SA pair is active."
    ::= { t11FcSpSaPairEntry 1 }

t11FcSpSaPairInboundSpi OBJECT-TYPE
    SYNTAX       T11FcSpiIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The SPI value that is used to indicate that an incoming
           frame was received on the ingress SA of this SA pair."
    ::= { t11FcSpSaPairEntry 2 }

t11FcSpSaPairSecurityProt OBJECT-TYPE
    SYNTAX       T11FcSpSecurityProtocolId
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The object indicates whether this SA uses ESP_Header to
           protect FC-2 frames, or CT_Authentication to protect Common
           Transport Information Units (CT_IUs)."
    ::= { t11FcSpSaPairEntry 3 }

t11FcSpSaPairTransListIndex OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 179]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The combination of this value and the value of the
           corresponding instance of t11FcSpSaPairTransIndex
           identify the row in the t11FcSpSaTransTable that
           contains the transforms that are in use on this SA pair."
    ::= { t11FcSpSaPairEntry 4 }

t11FcSpSaPairTransIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The combination of this value and the value of the
           corresponding instance of t11FcSpSaPairTransListIndex
           identify the row in the t11FcSpSaTransTable that
           contains the transforms that are in use on this SA pair."
    ::= { t11FcSpSaPairEntry 5 }

t11FcSpSaPairLifetimeLeft OBJECT-TYPE
    SYNTAX       T11FcSpLifetimeLeft
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The remaining lifetime of this SA pair, given in the
           units specified by the value of the corresponding
           instance of t11FcSpSaPairLifetimeLeft."
    ::= { t11FcSpSaPairEntry 6 }

t11FcSpSaPairLifetimeLeftUnits OBJECT-TYPE
    SYNTAX       T11FcSpLifetimeLeftUnits
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The units in which the value of the corresponding
           instance of t11FcSpSaPairLifetimeLeft specifies the
           remaining lifetime of this SA pair."
    ::= { t11FcSpSaPairEntry 7 }

t11FcSpSaPairTerminate OBJECT-TYPE
    SYNTAX       INTEGER { noop(1), terminate(2) }
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "Setting this object to 'terminate' is a request
           to terminate this pair of Security Associations.



De Santi, et al.            Standards Track                   [Page 180]
^L
RFC 5324                     MIB for FC-SP                September 2008


           When read, the value of this object is always 'noop'.
           Setting this object to 'noop' has no effect."
    ::= { t11FcSpSaPairEntry 8 }

t11FcSpSaPairInProtUnMatchs OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of frames received on this SA for which the
           SA's transforms were successfully applied to the frame,
           but the frame was still dropped because it did not match
           any of the SA's ingress Traffic Selectors.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaPairEntry 9 }

t11FcSpSaPairInDetReplays OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that a replay has been detected on
           this Security Association.  Note that a frame that is
           discarded because it is 'behind' the window, i.e., too old,
           is counted as a replay.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaPairEntry 10 }

t11FcSpSaPairInBadXforms OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that a received frame was dropped
           because one of the transforms negotiated for this Security
           Association failed.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaPairEntry 11 }

t11FcSpSaPairInGoodXforms OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only



De Santi, et al.            Standards Track                   [Page 181]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS       current
    DESCRIPTION
           "The number of received frames for which the transforms
           negotiated for this Security Association, were
           successfully applied.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaPairEntry 12 }

--
--  Negotiated Ingress Traffic Selectors
--

t11FcSpSaTSelNegInTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaTSelNegInEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing information about ingress Traffic
           Selectors that are in use on active Security
           Associations."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 4.6, 4.7, and 6.4.5.
            - Use of IKEv2 in FC-SP, RFC 4595,
              July 2006, section 4.4."
    ::= { t11FcSpSaActive 2 }

t11FcSpSaTSelNegInEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaTSelNegInEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one ingress Traffic
           Selector that is in use on an active Security Association
           on an interface (identified by t11FcSpSaPairIfIndex) to
           a particular Fabric (identified by t11FcSpSaIfFabricIndex),
           managed as part of the Fibre Channel management instance
           identified by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpSaPairIfIndex,
             t11FcSpSaIfFabricIndex, t11FcSpSaTSelNegInIndex }
    ::= { t11FcSpSaTSelNegInTable 1 }

T11FcSpSaTSelNegInEntry ::= SEQUENCE {
    t11FcSpSaTSelNegInIndex         Unsigned32,
    t11FcSpSaTSelNegInInboundSpi    T11FcSpiIndex,



De Santi, et al.            Standards Track                   [Page 182]
^L
RFC 5324                     MIB for FC-SP                September 2008


    t11FcSpSaTSelNegInStartSrcAddr  FcAddressIdOrZero,
    t11FcSpSaTSelNegInEndSrcAddr    FcAddressIdOrZero,
    t11FcSpSaTSelNegInStartDstAddr  FcAddressIdOrZero,
    t11FcSpSaTSelNegInEndDstAddr    FcAddressIdOrZero,
    t11FcSpSaTSelNegInStartRCtl     T11FcRoutingControl,
    t11FcSpSaTSelNegInEndRCtl       T11FcRoutingControl,
    t11FcSpSaTSelNegInStartType     T11FcSpType,
    t11FcSpSaTSelNegInEndType       T11FcSpType,
    t11FcSpSaTSelNegInUnpMtchDrops  Counter64
}

t11FcSpSaTSelNegInIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value to distinguish an ingress Traffic Selector
           from all others currently in use by Security Associations
           on the same interface to a particular Fabric."
    ::= { t11FcSpSaTSelNegInEntry 1 }

t11FcSpSaTSelNegInInboundSpi OBJECT-TYPE
    SYNTAX       T11FcSpiIndex
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The SPI of the ingress SA on which this Traffic Selector
           is in use.

           This value can be used to find the SA pair's row in the
           t11FcSpSaPairTable."
    ::= { t11FcSpSaTSelNegInEntry 2 }

t11FcSpSaTSelNegInStartSrcAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegInEntry 3 }

t11FcSpSaTSelNegInEndSrcAddr  OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION



De Santi, et al.            Standards Track                   [Page 183]
^L
RFC 5324                     MIB for FC-SP                September 2008


           "The numerically largest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegInEntry 4 }

t11FcSpSaTSelNegInStartDstAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    ::= { t11FcSpSaTSelNegInEntry 5 }

t11FcSpSaTSelNegInEndDstAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically largest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    ::= { t11FcSpSaTSelNegInEntry 6 }

t11FcSpSaTSelNegInStartRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically smallest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    ::= { t11FcSpSaTSelNegInEntry 7 }

t11FcSpSaTSelNegInEndRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically largest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    ::= { t11FcSpSaTSelNegInEntry 8 }

t11FcSpSaTSelNegInStartType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-only



De Santi, et al.            Standards Track                   [Page 184]
^L
RFC 5324                     MIB for FC-SP                September 2008


    STATUS       current
    DESCRIPTION
           "The numerically smallest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegInEntry 9 }

t11FcSpSaTSelNegInEndType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically largest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegInEntry 10 }

t11FcSpSaTSelNegInUnpMtchDrops OBJECT-TYPE
    SYNTAX       Counter64
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of times that a received frame was dropped
           because it matched with this Traffic Selector but the
           frame was not protected as negotiated for the Security
           Association identified by t11FcSpSaTSelNegInInboundSpi.

           This counter has no discontinuities other than those
           that all Counter64's have when sysUpTime=0."
    ::= { t11FcSpSaTSelNegInEntry 11 }

--
--  Negotiated Egress Traffic Selectors
--

t11FcSpSaTSelNegOutTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaTSelNegOutEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table containing information about egress Traffic
           Selectors that are in use on active Security
           Associations."
    REFERENCE
           "- ANSI INCITS 426-2007, T11/Project 1570-D,
              Fibre Channel - Security Protocols (FC-SP),
              February 2007, sections 4.6, 4.7, and 6.4.5.
            - Use of IKEv2 in FC-SP, RFC 4595,



De Santi, et al.            Standards Track                   [Page 185]
^L
RFC 5324                     MIB for FC-SP                September 2008


              July 2006, section 4.4."
    ::= { t11FcSpSaActive 3 }

t11FcSpSaTSelNegOutEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaTSelNegOutEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry contains information about one egress Traffic
           Selector that is in use on an active Security Association
           on an interface (identified by t11FcSpSaPairIfIndex) to
           a particular Fabric (identified by t11FcSpSaIfFabricIndex),
           managed as part of the Fibre Channel management instance
           identified by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpSaPairIfIndex,
             t11FcSpSaIfFabricIndex, t11FcSpSaTSelNegOutPrecedence }
    ::= { t11FcSpSaTSelNegOutTable 1 }

T11FcSpSaTSelNegOutEntry ::= SEQUENCE {
    t11FcSpSaTSelNegOutPrecedence     T11FcSpPrecedence,
    t11FcSpSaTSelNegOutInboundSpi     T11FcSpiIndex,
    t11FcSpSaTSelNegOutStartSrcAddr   FcAddressIdOrZero,
    t11FcSpSaTSelNegOutEndSrcAddr     FcAddressIdOrZero,
    t11FcSpSaTSelNegOutStartDstAddr   FcAddressIdOrZero,
    t11FcSpSaTSelNegOutEndDstAddr     FcAddressIdOrZero,
    t11FcSpSaTSelNegOutStartRCtl      T11FcRoutingControl,
    t11FcSpSaTSelNegOutEndRCtl        T11FcRoutingControl,
    t11FcSpSaTSelNegOutStartType      T11FcSpType,
    t11FcSpSaTSelNegOutEndType        T11FcSpType
}

t11FcSpSaTSelNegOutPrecedence OBJECT-TYPE
    SYNTAX       T11FcSpPrecedence
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "The precedence of this Traffic Selector.  If and when a
           frame is compared against multiple Traffic Selectors, and
           multiple of them have a match with the frame, the security
           action to be taken for the frame is that specified for the
           matching Traffic Selector having the numerically smallest
           precedence value."
    ::= { t11FcSpSaTSelNegOutEntry 1 }

t11FcSpSaTSelNegOutInboundSpi OBJECT-TYPE
    SYNTAX       T11FcSpiIndex
    MAX-ACCESS   read-only
    STATUS       current



De Santi, et al.            Standards Track                   [Page 186]
^L
RFC 5324                     MIB for FC-SP                September 2008


    DESCRIPTION
           "The SPI of the ingress SA of the SA pair for which this
           Traffic Selector is in use on the egress SA.

           This value can be used to find the SA pair's row in the
           t11FcSpSaPairTable."
    ::= { t11FcSpSaTSelNegOutEntry 2 }

t11FcSpSaTSelNegOutStartSrcAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegOutEntry 3 }

t11FcSpSaTSelNegOutEndSrcAddr  OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically largest 24-bit value of a source address
           (S_ID) of a frame that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegOutEntry 4 }

t11FcSpSaTSelNegOutStartDstAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically smallest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    ::= { t11FcSpSaTSelNegOutEntry 5 }

t11FcSpSaTSelNegOutEndDstAddr OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero (SIZE (3))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically largest 24-bit value of a destination
           address (D_ID) of a frame that will match with this
           Traffic Selector."
    ::= { t11FcSpSaTSelNegOutEntry 6 }




De Santi, et al.            Standards Track                   [Page 187]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpSaTSelNegOutStartRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically smallest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    ::= { t11FcSpSaTSelNegOutEntry 7 }

t11FcSpSaTSelNegOutEndRCtl OBJECT-TYPE
    SYNTAX       T11FcRoutingControl
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically largest 8-bit value contained within a
           Routing Control (R_CTL) field of a frame that will match
           with this Traffic Selector."
    ::= { t11FcSpSaTSelNegOutEntry 8 }

t11FcSpSaTSelNegOutStartType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically smallest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegOutEntry 9 }

t11FcSpSaTSelNegOutEndType OBJECT-TYPE
    SYNTAX       T11FcSpType
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The numerically largest of a range of possible 'type'
           values of frames that will match with this Traffic
           Selector."
    ::= { t11FcSpSaTSelNegOutEntry 10 }

--
--  Traffic Selectors index-ed by SPI
--

t11FcSpSaTSelSpiTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaTSelSpiEntry
    MAX-ACCESS   not-accessible
    STATUS       current



De Santi, et al.            Standards Track                   [Page 188]
^L
RFC 5324                     MIB for FC-SP                September 2008


    DESCRIPTION
           "A table identifying the Traffic Selectors in use on
           particular Security Associations, INDEX-ed by their
           (ingress) SPI values."
    ::= { t11FcSpSaActive 4 }

t11FcSpSaTSelSpiEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaTSelSpiEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry identifies one Traffic Selector in use on an SA
           pair on the interface (identified by t11FcSpSaPairIfIndex)
           to a particular Fabric (identified by
           t11FcSpSaIfFabricIndex), and managed as part of the Fibre
           Channel management instance identified by fcmInstanceIndex."
    INDEX  { fcmInstanceIndex, t11FcSpSaPairIfIndex,
             t11FcSpSaIfFabricIndex,
             t11FcSpSaTSelSpiInboundSpi, t11FcSpSaTSelSpiTrafSelIndex }
    ::= { t11FcSpSaTSelSpiTable 1 }

T11FcSpSaTSelSpiEntry ::= SEQUENCE {
    t11FcSpSaTSelSpiInboundSpi     T11FcSpiIndex,
    t11FcSpSaTSelSpiTrafSelIndex   Unsigned32,
    t11FcSpSaTSelSpiDirection      T11FcSaDirection,
    t11FcSpSaTSelSpiTrafSelPtr     Unsigned32
}

t11FcSpSaTSelSpiInboundSpi OBJECT-TYPE
    SYNTAX       T11FcSpiIndex
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An SPI value that identifies the ingress Security
           Association of a particular SA pair."
    ::= { t11FcSpSaTSelSpiEntry 1 }

t11FcSpSaTSelSpiTrafSelIndex OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "An index value that distinguishes between the
           (potentially multiple) Traffic Selectors in use on
           this Security Association pair."
    ::= { t11FcSpSaTSelSpiEntry 2 }

t11FcSpSaTSelSpiDirection OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 189]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       T11FcSaDirection
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "This object indicates whether this Traffic Selector
           is being used for ingress or for egress traffic."
    ::= { t11FcSpSaTSelSpiEntry 3 }

t11FcSpSaTSelSpiTrafSelPtr OBJECT-TYPE
    SYNTAX       Unsigned32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "This object contains a pointer into another table that
           can be used to obtain more information about this Traffic
           Selector.

           If the corresponding instance of t11FcSpSaTSelSpiDirection
           has the value 'egress', then this object contains the
           value of t11FcSpSaTSelNegOutPrecedence in the row of
           t11FcSpSaTSelNegOutTable, which contains more information.

           If the corresponding instance of t11FcSpSaTSelSpiDirection
           has the value 'ingress', then this object contains the
           value of t11FcSpSaTSelNegInIndex that identifies the row
           in t11FcSpSaTSelNegInTable containing more information."
    ::= { t11FcSpSaTSelSpiEntry 4 }

--
-- Notification information & control
--

t11FcSpSaControlTable OBJECT-TYPE
    SYNTAX       SEQUENCE OF T11FcSpSaControlEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "A table of control and other information concerning
           the generation of notifications for events related
           to FC-SP Security Associations."
    ::= { t11FcSpSaControl 1 }

t11FcSpSaControlEntry OBJECT-TYPE
    SYNTAX       T11FcSpSaControlEntry
    MAX-ACCESS   not-accessible
    STATUS       current
    DESCRIPTION
           "Each entry identifies information for the one or more



De Santi, et al.            Standards Track                   [Page 190]
^L
RFC 5324                     MIB for FC-SP                September 2008


           interfaces (identified by t11FcSpSaIfIndex) to a
           particular Fabric (identified by t11FcSpSaIfFabricIndex),
           and managed as part of the Fibre Channel management
           instance identified by fcmInstanceIndex.

           The StorageType of a row in this table is specified by
           the instance of t11FcSpSaIfStorageType that is INDEX-ed
           by the same values of fcmInstanceIndex, t11FcSpSaIfIndex,
           and t11FcSpSaIfFabricIndex."
    INDEX  { fcmInstanceIndex, t11FcSpSaIfIndex,
             t11FcSpSaIfFabricIndex }
    ::= { t11FcSpSaControlTable 1 }

T11FcSpSaControlEntry ::= SEQUENCE {
    t11FcSpSaControlAuthFailEnable  TruthValue,
    t11FcSpSaControlInboundSpi      T11FcSpiIndex,
    t11FcSpSaControlSource          FcAddressIdOrZero,
    t11FcSpSaControlDestination     FcAddressIdOrZero,
    t11FcSpSaControlFrame           OCTET STRING,
    t11FcSpSaControlElapsed         TimeTicks,
    t11FcSpSaControlSuppressed      Gauge32,
    t11FcSpSaControlWindow          Unsigned32,
    t11FcSpSaControlMaxNotifs       Unsigned32,
    t11FcSpSaControlLifeExcdEnable  TruthValue,
    t11FcSpSaControlLifeExcdSpi     T11FcSpiIndex,
    t11FcSpSaControlLifeExcdDir     T11FcSaDirection,
    t11FcSpSaControlLifeExcdTime    TimeStamp
}

t11FcSpSaControlAuthFailEnable OBJECT-TYPE
    SYNTAX       TruthValue
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object specifies whether a t11FcSpSaNotifyAuthFailure
           notification should be generated for the first occurrence
           of an Authentication failure within a time window for this
           Fabric."
    ::= { t11FcSpSaControlEntry 1 }

t11FcSpSaControlInboundSpi OBJECT-TYPE
    SYNTAX       T11FcSpiIndex
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The SPI value of the ingress Security Association on
           which was received the last frame for which a
           t11FcSpSaNotifyAuthFailure was generated.



De Santi, et al.            Standards Track                   [Page 191]
^L
RFC 5324                     MIB for FC-SP                September 2008


           If no t11FcSpSaNotifyAuthFailure notifications have
           been generated, the value of this object is zero."
    ::= { t11FcSpSaControlEntry 2 }

t11FcSpSaControlSource OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The S_ID contained in the last frame for which a
           t11FcSpSaNotifyAuthFailure was generated.

           If no t11FcSpSaNotifyAuthFailure notifications have
           been generated, the value of this object is the
           zero-length string."
    ::= { t11FcSpSaControlEntry 3 }

t11FcSpSaControlDestination OBJECT-TYPE
    SYNTAX       FcAddressIdOrZero
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The D_ID contained in the last frame for which a
           t11FcSpSaNotifyAuthFailure was generated.

           If no t11FcSpSaNotifyAuthFailure notifications have
           been generated, the value of this object is the
           zero-length string."
    ::= { t11FcSpSaControlEntry 4 }

t11FcSpSaControlFrame OBJECT-TYPE
    SYNTAX       OCTET STRING (SIZE (0..256))
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The binary content of the last frame for which a
           t11FcSpSaNotifyAuthFailure was generated.  If more than
           256 bytes of the frame are available, then this object
           contains the first 256 bytes.  If less than 256 bytes of
           the frame are available, then this object contains the
           first N bytes, where N is greater or equal to zero.

           If no t11FcSpSaNotifyAuthFailure notifications have
           been generated, the value of this object is the
           zero-length string."
    ::= { t11FcSpSaControlEntry 5 }

t11FcSpSaControlElapsed OBJECT-TYPE



De Santi, et al.            Standards Track                   [Page 192]
^L
RFC 5324                     MIB for FC-SP                September 2008


    SYNTAX       TimeTicks
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The elapsed time since the last generation of a
           t11FcSpSaNotifyAuthFailure notification on the same
           Fabric, or the value of sysUpTime if no
           t11FcSpSaNotifyAuthFailure notifications have been
           generated since the last restart."
    ::= { t11FcSpSaControlEntry 6 }

t11FcSpSaControlSuppressed OBJECT-TYPE
    SYNTAX       Gauge32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The number of occurrences of an Authentication failure
           on a Fabric that were suppressed because they occurred
           on the same Fabric within the same time window as a
           previous Authentication failure for which a
           t11FcSpSaNotifyAuthFailure notification was generated.

           The value of this object is reset to zero on a restart
           of the network management subsystem, and whenever a
           t11FcSpSaNotifyAuthFailure notification is generated.
           In the event that the value of this object reaches its
           maximum value, it remains at that value until it is
           reset on the generation of the next
           t11FcSpSaNotifyAuthFailure notification."
    ::= { t11FcSpSaControlEntry 7 }

t11FcSpSaControlWindow OBJECT-TYPE
    SYNTAX       Unsigned32 (1..4294967295)
    UNITS        "seconds"
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "The length of a time window that begins when a
           t11FcSpSaNotifyAuthFailure notification is generated for
           any Security Association on a particular Fabric.  For the
           duration of the time window, further Authentication failures
           occurring for the same Security Association are counted but
           no t11FcSpSaNotifyAuthFailure notification is generated.

           When this object is modified before the end of a time
           window, that time window is immediately terminated, i.e.,
           the next Authentication failure on the relevant Fabric
           after the modification will cause a new time window to



De Santi, et al.            Standards Track                   [Page 193]
^L
RFC 5324                     MIB for FC-SP                September 2008


           begin with the new length."
    DEFVAL   { 300 }
    ::= { t11FcSpSaControlEntry 8 }

t11FcSpSaControlMaxNotifs OBJECT-TYPE
    SYNTAX       Unsigned32
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "The maximum number of t11FcSpSaNotifyAuthFailure
           notifications to be generated per Fabric within a
           t11FcSpSaControlWindow time window.  Subsequent
           Authentication failures occurring on the same Fabric
           in the same time window are counted, but no
           t11FcSpSaNotifyAuthFailure notification is generated.

           When this object is modified before the end of a time
           window, that time window is immediately terminated, i.e.,
           the next Authentication failure on the relevant Fabric
           after the modification will cause a new time window to
           begin with the new length."
    DEFVAL   { 16 }
    ::= { t11FcSpSaControlEntry 9 }

t11FcSpSaControlLifeExcdEnable OBJECT-TYPE
    SYNTAX       TruthValue
    MAX-ACCESS   read-write
    STATUS       current
    DESCRIPTION
           "This object specifies whether t11FcSpSaNotifyLifeExceeded
           notifications should be generated for this Fabric."
    DEFVAL   { true }
    ::= { t11FcSpSaControlEntry 10 }

t11FcSpSaControlLifeExcdSpi OBJECT-TYPE
    SYNTAX       T11FcSpiIndex
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The SPI of the SA that was most recently terminated
           because its lifetime (in seconds or in passed bytes)
           was exceeded.  Such terminations include those due to
           a failed attempt to renew an SA after its lifetime was
           exceeded."
    ::= { t11FcSpSaControlEntry 11 }

t11FcSpSaControlLifeExcdDir OBJECT-TYPE
    SYNTAX       T11FcSaDirection



De Santi, et al.            Standards Track                   [Page 194]
^L
RFC 5324                     MIB for FC-SP                September 2008


    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The direction of frame transmission on the SA that was
           most recently terminated because its lifetime (in seconds
           or in passed bytes) was exceeded."
    ::= { t11FcSpSaControlEntry 12 }

t11FcSpSaControlLifeExcdTime OBJECT-TYPE
    SYNTAX       TimeStamp
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION
           "The time of the most recent termination of an SA
           due to its lifetime (in seconds or in passed bytes)
           being exceeded.  Such terminations include those
           due to a failed attempt to renew an SA after its
           lifetime was exceeded."
    ::= { t11FcSpSaControlEntry 13 }

--
-- Notification definitions
--

t11FcSpSaNotifyAuthFailure NOTIFICATION-TYPE
    OBJECTS      { t11FcSpSaControlInboundSpi,
                   t11FcSpSaControlSource,
                   t11FcSpSaControlDestination,
                   t11FcSpSaControlFrame,
                   t11FcSpSaControlElapsed,
                   t11FcSpSaControlSuppressed }
    STATUS       current
    DESCRIPTION
           "When this notification is generated, it indicates the
           occurrence of an Authentication failure for a received
           FC-2 or CT_IU frame.  The t11FcSpSaControlInboundSpi,
           t11FcSpSaControlSource, and t11FcSpSaControlDestination
           objects in the varbindlist are the frame's SPI, source and
           destination addresses, respectively.  t11FcSpSaControlFrame
           provides the (beginning of the) frame's content if such is
           available.

           This notification is generated only for the first
           occurrence of an Authentication failure on a Fabric within
           a time window.  Subsequent occurrences of an Authentication
           Failure on the same Fabric within the same time window
           are counted but suppressed.




De Santi, et al.            Standards Track                   [Page 195]
^L
RFC 5324                     MIB for FC-SP                September 2008


           The value of t11FcSpSaControlElapsed contains (a lower bound
           on) the elapsed time since the last generation of this
           notification for the same Fabric.  The value of
           t11FcSpSaControlSuppressed contains the number of
           generations which were suppressed in the time window after
           that last generation, or zero if unknown."
    ::= { t11FcSpSaMIBNotifications 1 }

t11FcSpSaNotifyLifeExceeded NOTIFICATION-TYPE
    OBJECTS      { t11FcSpSaControlLifeExcdSpi,
                   t11FcSpSaControlLifeExcdDir }
    STATUS       current
    DESCRIPTION
           "This notification is generated when the lifetime (in
           seconds or in passed bytes) of an SA is exceeded, and the
           SA is either immediately terminated or is terminated
           because an attempt to renew the SA fails.  The values of
           t11FcSpSaControlLifeExcdSpi and t11FcSpSaControlLifeExcdDir
           contain the SPI and direction of the terminated SA."
    ::= { t11FcSpSaMIBNotifications 2 }

--
-- Conformance
--

t11FcSpSaMIBCompliances
                    OBJECT IDENTIFIER ::= { t11FcSpSaMIBConformance 1 }
t11FcSpSaMIBGroups  OBJECT IDENTIFIER ::= { t11FcSpSaMIBConformance 2 }

t11FcSpSaMIBCompliance MODULE-COMPLIANCE
    STATUS       current
    DESCRIPTION
           "The compliance statement for entities that implement
           FC-SP Security Associations."

    MODULE  -- this module
        MANDATORY-GROUPS
            { t11FcSpSaCapabilityGroup,
              t11FcSpSaParamStatusGroup,
              t11FcSpSaSummaryCountGroup,
              t11FcSpSaProposalGroup,
              t11FcSpSaDropBypassGroup,
              t11FcSpSaActiveGroup,
              t11FcSpSaNotifInfoGroup,
              t11FcSpSaNotificationGroup
            }

       -- The following is an auxiliary (listed in an INDEX clause)



De Santi, et al.            Standards Track                   [Page 196]
^L
RFC 5324                     MIB for FC-SP                September 2008


       -- object for which the SMIv2 does not allow an OBJECT clause
       -- to be specified, but for which this MIB has the following
       -- compliance requirement:
       --      OBJECT        t11FcSpSaIfIndex
       --      DESCRIPTION
       --          Compliance requires support for either one of:
       --          - individual interfaces using ifIndex values, or
       --          - the use of the zero value.

-- Write access is not required for any objects in this MIB module:

        OBJECT       t11FcSpSaIfStorageType
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropStorageType
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTransStorageType
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaIfReplayPrevention
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaIfReplayWindowSize
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaIfTerminateAllSas
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaPropSecurityProt
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaPropTSelListIndex
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaPropTransListIndex
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaPropAcceptAlgorithm



De Santi, et al.            Standards Track                   [Page 197]
^L
RFC 5324                     MIB for FC-SP                September 2008


        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaPropRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropDirection
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropStartSrcAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropEndSrcAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropStartDstAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropEndDstAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropStartRCtl
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropEndRCtl
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropStartType
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropEndType
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelPropRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTransSecurityProt



De Santi, et al.            Standards Track                   [Page 198]
^L
RFC 5324                     MIB for FC-SP                September 2008


        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTransEncryptAlg
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTransEncryptKeyLen
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTransIntegrityAlg
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTransRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByAction
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByStartSrcAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByEndSrcAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByStartDstAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByEndDstAddr
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByStartRCtl
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByEndRCtl
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByStartType



De Santi, et al.            Standards Track                   [Page 199]
^L
RFC 5324                     MIB for FC-SP                September 2008


        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByEndType
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaTSelDrByRowStatus
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaPairTerminate
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaControlAuthFailEnable
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaControlWindow
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaControlMaxNotifs
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

        OBJECT       t11FcSpSaControlLifeExcdEnable
        MIN-ACCESS   read-only
        DESCRIPTION  "Write access is not required."

    ::= { t11FcSpSaMIBCompliances 1 }

-- Units of Conformance

t11FcSpSaCapabilityGroup OBJECT-GROUP
    OBJECTS  { t11FcSpSaIfEspHeaderCapab,
               t11FcSpSaIfCTAuthCapab,
               t11FcSpSaIfIKEv2Capab,
               t11FcSpSaIfIkev2AuthCapab
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects containing information
           related to capabilities of FC-SP entities."
    ::= { t11FcSpSaMIBGroups 1 }

t11FcSpSaParamStatusGroup OBJECT-GROUP



De Santi, et al.            Standards Track                   [Page 200]
^L
RFC 5324                     MIB for FC-SP                September 2008


    OBJECTS  { t11FcSpSaIfStorageType,
               t11FcSpSaIfReplayPrevention,
               t11FcSpSaIfReplayWindowSize,
               t11FcSpSaIfDeadPeerDetections,
               t11FcSpSaIfTerminateAllSas
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects containing parameters
           and status information related to FC-SP entities."
    ::= { t11FcSpSaMIBGroups 2 }

t11FcSpSaSummaryCountGroup OBJECT-GROUP
    OBJECTS  { t11FcSpSaIfOutDrops,
               t11FcSpSaIfOutBypasses,
               t11FcSpSaIfOutProcesses,
               t11FcSpSaIfOutUnMatcheds,
               t11FcSpSaIfInUnprotUnmtchDrops,
               t11FcSpSaIfInDetReplays,
               t11FcSpSaIfInUnprotMtchDrops,
               t11FcSpSaIfInBadXforms,
               t11FcSpSaIfInGoodXforms,
               t11FcSpSaIfInProtUnmtchs
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects containing summary
           counters for FC-SP Security Associations."
    ::= { t11FcSpSaMIBGroups 3 }

t11FcSpSaProposalGroup OBJECT-GROUP
    OBJECTS  { t11FcSpSaPropSecurityProt,
               t11FcSpSaPropTSelListIndex,
               t11FcSpSaPropTransListIndex,
               t11FcSpSaPropAcceptAlgorithm,
               t11FcSpSaPropOutMatchSucceeds,
               t11FcSpSaPropRowStatus,
               t11FcSpSaTSelPropDirection,
               t11FcSpSaTSelPropStartSrcAddr,
               t11FcSpSaTSelPropEndSrcAddr,
               t11FcSpSaTSelPropStartDstAddr,
               t11FcSpSaTSelPropEndDstAddr,
               t11FcSpSaTSelPropStartRCtl,
               t11FcSpSaTSelPropEndRCtl,
               t11FcSpSaTSelPropStartType,
               t11FcSpSaTSelPropEndType,
               t11FcSpSaTSelPropStorageType,
               t11FcSpSaTSelPropRowStatus



De Santi, et al.            Standards Track                   [Page 201]
^L
RFC 5324                     MIB for FC-SP                September 2008


             }
    STATUS   current
    DESCRIPTION
           "A collection of objects containing information
           related to making and accepting proposals for
           FC-SP Security Associations."
    ::= { t11FcSpSaMIBGroups 4 }

t11FcSpSaDropBypassGroup OBJECT-GROUP
    OBJECTS  { t11FcSpSaTSelDrByAction,
               t11FcSpSaTSelDrByStartSrcAddr,
               t11FcSpSaTSelDrByEndSrcAddr,
               t11FcSpSaTSelDrByStartDstAddr,
               t11FcSpSaTSelDrByEndDstAddr,
               t11FcSpSaTSelDrByStartRCtl,
               t11FcSpSaTSelDrByEndRCtl,
               t11FcSpSaTSelDrByStartType,
               t11FcSpSaTSelDrByEndType,
               t11FcSpSaTSelDrByMatches,
               t11FcSpSaTSelDrByRowStatus
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects containing information
           about Traffic Selectors of traffic to drop or bypass
           for FC-SP Security."
    ::= { t11FcSpSaMIBGroups 5 }

t11FcSpSaActiveGroup OBJECT-GROUP
    OBJECTS  { t11FcSpSaPairSecurityProt,
               t11FcSpSaPairTransListIndex,
               t11FcSpSaPairTransIndex,
               t11FcSpSaPairLifetimeLeft,
               t11FcSpSaPairLifetimeLeftUnits,
               t11FcSpSaPairTerminate,
               t11FcSpSaPairInProtUnMatchs,
               t11FcSpSaPairInDetReplays,
               t11FcSpSaPairInBadXforms,
               t11FcSpSaPairInGoodXforms,
               t11FcSpSaTransSecurityProt,
               t11FcSpSaTransEncryptAlg,
               t11FcSpSaTransEncryptKeyLen,
               t11FcSpSaTransIntegrityAlg,
               t11FcSpSaTransStorageType,
               t11FcSpSaTransRowStatus,
               t11FcSpSaTSelNegInInboundSpi,
               t11FcSpSaTSelNegInStartSrcAddr,
               t11FcSpSaTSelNegInEndSrcAddr,



De Santi, et al.            Standards Track                   [Page 202]
^L
RFC 5324                     MIB for FC-SP                September 2008


               t11FcSpSaTSelNegInStartDstAddr,
               t11FcSpSaTSelNegInEndDstAddr,
               t11FcSpSaTSelNegInStartRCtl,
               t11FcSpSaTSelNegInEndRCtl,
               t11FcSpSaTSelNegInStartType,
               t11FcSpSaTSelNegInEndType,
               t11FcSpSaTSelNegInUnpMtchDrops,
               t11FcSpSaTSelNegOutInboundSpi,
               t11FcSpSaTSelNegOutStartSrcAddr,
               t11FcSpSaTSelNegOutEndSrcAddr,
               t11FcSpSaTSelNegOutStartDstAddr,
               t11FcSpSaTSelNegOutEndDstAddr,
               t11FcSpSaTSelNegOutStartRCtl,
               t11FcSpSaTSelNegOutEndRCtl,
               t11FcSpSaTSelNegOutStartType,
               t11FcSpSaTSelNegOutEndType,
               t11FcSpSaTSelSpiDirection,
               t11FcSpSaTSelSpiTrafSelPtr
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects containing information related
           to currently active FC-SP Security Associations."
    ::= { t11FcSpSaMIBGroups 6 }

t11FcSpSaNotifInfoGroup OBJECT-GROUP
    OBJECTS  { t11FcSpSaControlAuthFailEnable,
               t11FcSpSaControlInboundSpi,
               t11FcSpSaControlSource,
               t11FcSpSaControlDestination,
               t11FcSpSaControlFrame,
               t11FcSpSaControlElapsed,
               t11FcSpSaControlSuppressed,
               t11FcSpSaControlWindow,
               t11FcSpSaControlMaxNotifs,
               t11FcSpSaControlLifeExcdEnable,
               t11FcSpSaControlLifeExcdSpi,
               t11FcSpSaControlLifeExcdDir,
               t11FcSpSaControlLifeExcdTime
             }
    STATUS   current
    DESCRIPTION
           "A collection of objects containing information
           related to notifications of events concerning
           FC-SP Security Associations."
    ::= { t11FcSpSaMIBGroups 7 }





De Santi, et al.            Standards Track                   [Page 203]
^L
RFC 5324                     MIB for FC-SP                September 2008


t11FcSpSaNotificationGroup NOTIFICATION-GROUP
    NOTIFICATIONS  { t11FcSpSaNotifyAuthFailure,
                     t11FcSpSaNotifyLifeExceeded
                   }
    STATUS         current
    DESCRIPTION
           "A collection of notifications of events concerning
           FC-SP Security Associations."
    ::= { t11FcSpSaMIBGroups 8 }

END

7.  IANA Considerations

   IANA has made one MIB OID assignment, under the appropriate subtree,
   for each of the five MIB modules defined in this document.

8.  Security Considerations

   In this section, the first sub-section explains why this document
   does not define MIB objects for particular items of (management)
   information.  This is followed by one sub-section for each of the MIB
   modules defined in section 6, listing their individual Security
   Considerations.  The section concludes with Security Considerations
   common to all of these MIB modules.

   The key word "RECOMMENDED" contained in this section is to be
   interpreted as described in BCP 14 [RFC2119].

8.1.  Information Not Defined in This Document

   This document doesn't define any MIB objects for the secrets that
   need to be known/determined by FC-SP entities in order to use DH-CHAP
   to authenticate each other.  Such secrets are "highly sensitive" and
   need to be "strong secrets" (e.g., randomly generated and/or from an
   external source, see section 5.4.8 of [FC-SP]) rather than just
   passwords.  Thus, such secrets need to be managed by mechanisms other
   than the MIB modules defined here.

8.2.  The T11-FC-SP-TC-MIB Module

   This MIB module defines some data types and assigns some Object
   Identifiers, for use as the syntax and as values of MIB objects,
   respectively, but it itself defines no MIB objects.  Thus, there is
   no direct read or write access via a management protocol, such as
   SNMP, to these definitions.  Nevertheless, it does include the
   assignment of enumerations and OIDs to represent cryptographic
   algorithms/transforms, and it is appropriate for such assignments to



De Santi, et al.            Standards Track                   [Page 204]
^L
RFC 5324                     MIB for FC-SP                September 2008


   be augmented with new assignments as and when new
   algorithms/transforms are available.

8.3.  The T11-FC-SP-AUTHENTICATION-MIB Module

   There are several management objects defined in this MIB module with
   a MAX-ACCESS clause of read-write.  Such objects may be considered
   sensitive or vulnerable in some network environments.  The support
   for SET operations in a non-secure environment without proper
   protection can have a negative effect on network operations.  These
   objects and their sensitivity/vulnerability are:

      t11FcSpAuStorageType
         - could cause changes in the configuration to be retained or
           not retained over restarts, against the wishes of management.

      t11FcSpAuSendRejNotifyEnable
      t11FcSpAuRcvRejNotifyEnable
         - could cause the suppression of SNMP notifications (e.g., of
           authentication failures or protocol failures), or the
           disruption of network operations due to the generation of
           unwanted notifications.

      t11FcSpAuDefaultLifetime
      t11FcSpAuDefaultLifetimeUnits
         - could cause the lifetimes of Security Associations to be
           extended longer than might be secure, or shortened to cause
           an increase in the overhead of using security.

      t11FcSpAuRejectMaxRows
         - could cause a smaller audit trail of Authentication rejects,
           thereby hiding the tracks of an attacker, or a larger audit
           trail of Authentication rejects causing resources to be
           wasted.

   Some of the readable objects in this MIB module (i.e., objects with a
   MAX-ACCESS other than not-accessible) may be considered sensitive or
   vulnerable in some network environments.  It is thus important to
   control even GET and/or NOTIFY access to these objects and possibly
   to even encrypt the values of these objects when sending them over
   the network via SNMP.  These are the tables and objects and their
   sensitivity/vulnerability:

      t11FcSpAuEntityTable
         - the capabilities of FC-SP Authentication entities in terms of
           what cryptographic algorithms they support, and various
           configuration parameters of FC-SP Authentication entities.




De Santi, et al.            Standards Track                   [Page 205]
^L
RFC 5324                     MIB for FC-SP                September 2008


      t11FcSpAuIfStatTable
         - the mapping of which FC-SP Authentication entities operate on
           which interfaces.

      t11FcSpAuRejectTable
         - an audit trail of authentication failures and other
           Authentication Protocol failures.

8.4.  The T11-FC-SP-ZONING-MIB Module

   There are several management objects defined in this MIB module with
   a MAX-ACCESS clause of read-write and/or read-create.  Such objects
   may be considered sensitive or vulnerable in some network
   environments.  The support for SET operations in a non-secure
   environment without proper protection can have a negative effect on
   network operations.  These objects and their
   sensitivity/vulnerability are:

      t11FcSpZsServerEnabled
         - could cause FC-SP Zoning mode to be enabled or not enabled,
           against the wishes of management.

      t11FcSpZoneSetHashStatus
         - could cause an FC-SP implementation to recalculate the values
           of the Active Zone Set Hash and the Zone Set Database Hash
           more frequently than is required by management.

      t11FcSpZsNotifyJoinSuccessEnable
      t11FcSpZsNotifyJoinFailureEnable
         - could cause the suppression of SNMP notifications that a
           Switch in one Fabric has successfully joined/failed to join
           with a Switch in another Fabric, or the disruption of network
           operations due to the generation of unwanted notifications.

   Some of the readable objects in this MIB module (i.e., objects with a
   MAX-ACCESS other than not-accessible) may be considered sensitive or
   vulnerable in some network environments.  It is thus important to
   control even GET and/or NOTIFY access to these objects and possibly
   to even encrypt the values of these objects when sending them over
   the network via SNMP.  These are the objects and their
   sensitivity/vulnerability:

      t11FcSpZsServerCapabilityObject
      t11FcSpZsServerEnabled
         - the FC-SP Zoning capabilities and status of the FC-SP
           implementation.





De Santi, et al.            Standards Track                   [Page 206]
^L
RFC 5324                     MIB for FC-SP                September 2008


      t11FcSpZoneSetHashStatus
      t11FcSpActiveZoneSetHashType
      t11FcSpActiveZoneSetHash
      t11FcSpZoneSetDatabaseHashType
      t11FcSpZoneSetDatabaseHash
         - the current values of the Active Zone Set Hash and the Zone
           Set Database Hash.

8.5.  The T11-FC-SP-POLICY-MIB Module

   There are many management objects defined in this MIB module with a
   MAX-ACCESS clause of read-write and/or read-create.  Such objects may
   be considered sensitive or vulnerable in some network environments.
   The support for SET operations in a non-secure environment without
   proper protection can have a negative effect on network operations.
   The objects and tables and their sensitivity/vulnerability are:

      t11FcSpPoNaSummaryTable
      t11FcSpPoNaSwListTable
      t11FcSpPoNaSwMembTable
      t11FcSpPoNaNoMembTable
      t11FcSpPoNaCtDescrTable
      t11FcSpPoNaSwConnTable
      t11FcSpPoNaIpMgmtTable
         - could change the currently inactive FC-SP Fabric Policies, so
           as to allow unauthorized connectivity of Switches and/or
           Nodes to the network, or between Switches in the network, or,
           to prohibit such connectivity even when authorized.

      t11FcSpPoNaIpMgmtTable
      t11FcSpPoNaWkpDescrTable
         - could change the currently inactive FC-SP Fabric Policies, so
           as to allow unauthorized management access to Switches, or
           prohibit authorized management access to Switches.

      t11FcSpPoNaSummaryTable
      t11FcSpPoNaSwMembTable
      t11FcSpPoNaNoMembTable
      t11FcSpPoNaAttribTable
      t11FcSpPoNaAuthProtTable
         - could change the currently inactive FC-SP Fabric Policies, so
           as to allow Security Associations with reduced security or
           require Security Associations that are unnecessarily secure.








De Santi, et al.            Standards Track                   [Page 207]
^L
RFC 5324                     MIB for FC-SP                September 2008


      t11FcSpPoOperActivate
      t11FcSpPoOperDeActivate
         - could cause the currently active FC-SP Fabric Policies to be
           de-activated and currently inactive FC-SP Fabric Policies
           (e.g., those modified as above) to be activated instead.

      t11FcSpPoStorageType
         - could cause changes in the configuration and/or in FC-SP
           Fabric Policies to be retained or not retained over restarts,
           against the wishes of management.

      t11FcSpPoNotificationEnable
         - could cause the suppression of SNMP notifications on the
           successful/unsuccessful activation/deactivation of Fabric
           Policies, and thereby hide successful/failed attempts to make
           unauthorized changes, or cause the disruption of network
           operations due to the generation of unwanted notifications.

   Some of the readable objects in this MIB module (i.e., objects with a
   MAX-ACCESS other than not-accessible) may be considered sensitive or
   vulnerable in some network environments.  It is thus important to
   control even GET and/or NOTIFY access to these objects and possibly
   to even encrypt the values of these objects when sending them over
   the network via SNMP.  These are the tables and their
   sensitivity/vulnerability:

      t11FcSpPoTable
      t11FcSpPoSummaryTable
      t11FcSpPoSwMembTable
      t11FcSpPoNoMembTable
      t11FcSpPoCtDescrTable
      t11FcSpPoSwConnTable
      t11FcSpPoIpMgmtTable
      t11FcSpPoWkpDescrTable
      t11FcSpPoAttribTable
      t11FcSpPoAuthProtTable
         - the currently active FC-SP Fabric Policies that can be
           examined by an attacker looking for possible security
           vulnerabilities in the active policies.












De Santi, et al.            Standards Track                   [Page 208]
^L
RFC 5324                     MIB for FC-SP                September 2008


8.6.  The T11-FC-SP-SA-MIB Module

   There are several management objects defined in this MIB module with
   a MAX-ACCESS clause of read-write and/or read-create.  Such objects
   may be considered sensitive or vulnerable in some network
   environments.  The support for SET operations in a non-secure
   environment without proper protection can have a negative effect on
   network operations.  These objects and their
   sensitivity/vulnerability are:

      t11FcSpSaIfStorageType
      t11FcSpSaTSelPropStorageType
      t11FcSpSaTransStorageType
         - could cause changes in configuration information related to
           FC-SP Security Associations to be retained or not retained
           over restarts, against the wishes of management.

      t11FcSpSaIfReplayPrevention
      t11FcSpSaIfReplayWindowSize
         - could cause changes in the operation of anti-replay
           protection, thereby permitting an attacker to conduct replay
           attacks, or requiring FC-SP implementations to engage in
           unnecessary protection against replay.

      t11FcSpSaIfTerminateAllSas
      t11FcSpSaPairTerminate
         - could cause FC-SP Security Associations to be aborted
           unnecessarily.

      t11FcSpSaControlAuthFailEnable
         - could cause the suppression of SNMP notifications on the
           occurrence of Authentication failures for received FC-2 or
           CT_IU frames, thereby hiding attempts to subvert security
           measures, or cause the disruption of network operations due
           to the generation of unwanted notifications.

      t11FcSpSaControlLifeExcdEnable
         - could cause the suppression of SNMP notifications on the
           occurrence of an FC-SP Security Association exceeding its
           lifetime, thereby possibly causing disruption to network
           usage due to a delay in determining the problem and/or re-
           establishing the Security Association.









De Santi, et al.            Standards Track                   [Page 209]
^L
RFC 5324                     MIB for FC-SP                September 2008


      t11FcSpSaControlWindow
         - could cause the suppression of second and subsequent SNMP
           notifications on the occurrence of Authentication failures
           for received FC-2 or CT_IU frames, thereby masking repeated
           attempts to subvert security measures, or cause the
           disruption of network operations due to the generation of
           unwanted notifications.

      t11FcSpSaControlMaxNotifs
         - could cause the suppression of all SNMP notifications on the
           occurrence of Authentication failures for received FC-2 or
           CT_IU frames, thereby masking attempts to subvert security
           measures, or cause the disruption of network operations due
           to the generation of unwanted notifications.

      t11FcSpSaPropTable
      t11FcSpSaTSelPropTable
      t11FcSpSaTransTable
         - could cause an FC-SP entity to propose the setup of Security
           Associations that apply to a different selection of traffic
           and/or using different security transforms, such that some
           traffic has a reduced level of security that might improve an
           attacker's chance of subverting security, or an increased
           level of security that would involve unnecessary security
           processing, or cause the negotiation of Security Associations
           to fail to find commonly acceptable parameters such that no
           Security Associations can be established.

      t11FcSpSaTSelDrByTable
         - could cause an FC-SP entity to select different sets of
           traffic which are: a) to be sent/received without being
           protected by FC-SP security, thereby providing an attacker
           with access to read authentic traffic or the ability to
           introduce unauthentic traffic; or b) to be dropped instead of
           being sent/after being received, thereby causing disruption
           to network usage.

   Some of the readable objects in this MIB module (i.e., objects with a
   MAX-ACCESS other than not-accessible) may be considered sensitive or
   vulnerable in some network environments.  It is thus important to
   control even GET and/or NOTIFY access to these objects and possibly
   to even encrypt the values of these objects when sending them over
   the network via SNMP.  These are the tables and objects and their
   sensitivity/vulnerability:







De Santi, et al.            Standards Track                   [Page 210]
^L
RFC 5324                     MIB for FC-SP                September 2008


      t11FcSpSaIfTable
         - information concerning the capabilities, parameters and
           status of an FC-SP entity's support for Security
           Associations.

      t11FcSpSaPropTable
      t11FcSpSaTSelPropTable
      t11FcSpSaTransTable
         - information on the proposals that will be used by an FC-SP
           entity to negotiate Security Associations.

      t11FcSpSaTSelDrByTable
         - information on which subsets of traffic an FC-SP entity will
           send or receive without being protected by FC-SP security, or
           will drop before sending/after receiving.

      t11FcSpSaPairTable
      t11FcSpSaTSelNegInTable
      t11FcSpSaTSelNegOutTable
      t11FcSpSaTSelSpiTable
         - information on which Security Associations are currently
           active, what subsets of traffic they are carrying, and what
           security protection is being given to them.

8.7.  Recommendations Common to All MIB Modules

   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example by using IPsec),
   even then, there is no control as to who on the secure network is
   allowed to access and GET/SET (read/change/create/delete) the objects
   in this MIB module.

   It is RECOMMENDED that implementors consider the security features as
   provided by the SNMPv3 framework (see [RFC3410], section 8),
   including full support for the SNMPv3 cryptographic mechanisms (for
   authentication and privacy).

   Further, deployment of SNMP versions prior to SNMPv3 is NOT
   RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
   enable cryptographic security.  It is then a customer/operator
   responsibility to ensure that the SNMP entity giving access to an
   instance of this MIB module is properly configured to give access to
   the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.

   Because the two algorithms currently specified for
   T11FcSpPolicyHashFormat are SHA-1 and SHA-256, the definition of
   T11FcSpHashCalculationStatus expresses a concern in regard to not



De Santi, et al.            Standards Track                   [Page 211]
^L
RFC 5324                     MIB for FC-SP                September 2008


   incrementally recomputing the hashes after each change when a series
   of multiple related changes are being made.  This method of reducing
   computation is intended as a responsiveness measure (i.e.,
   cooperating SNMP managers and agents can get things done faster), not
   as a Denial-of-Service (DoS) countermeasure.  Nevertheless,
   implementations should also consider the DoS possibilities in these
   scenarios; potential countermeasures include: requiring
   authentication for SETs and the rate-limiting of SET operations if
   they can cause significant computation.

9.  Normative References

   [RFC2578]  McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M. and S. Waldbusser, "Structure of Management
              Information Version 2 (SMIv2)", STD 58, RFC 2578, April
              1999.

   [RFC2579]  McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M. and S. Waldbusser, "Textual Conventions for
              SMIv2", STD 58, RFC 2579, April 1999.

   [RFC2580]  McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M. and S. Waldbusser, "Conformance Statements for
              SMIv2", STD 58, RFC 2580, April 1999.

   [RFC2863]  McCloghrie, K. and F. Kastenholz, "The Interfaces Group
              MIB", RFC 2863, June 2000.

   [RFC3411]  Harrington, D., Presuhn, R., and B. Wijnen, "An
              Architecture for Describing Simple Network Management
              Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
              December 2002.

   [RFC4001]  Daniele, M., Haberman, B., Routhier, S., and J.
              Schoenwaelder, "Textual Conventions for Internet Network
              Addresses", RFC 4001, February 2005.

   [RFC4044]  McCloghrie, K., "Fibre Channel Management MIB", RFC 4044,
              May 2005.

   [RFC4303]  Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
              4303, December 2005.

   [RFC4306]  Kaufman, C., Ed., "Internet Key Exchange (IKEv2)
              Protocol", RFC 4306, December 2005.






De Santi, et al.            Standards Track                   [Page 212]
^L
RFC 5324                     MIB for FC-SP                September 2008


   [RFC4438]  DeSanti, C., Gaonkar, V., Vivek, H., McCloghrie, K., and
              S. Gai, "Fibre-Channel Name Server MIB", RFC 4438, April
              2006.

   [RFC4439]  DeSanti, C., Gaonkar, V., McCloghrie, K., and S. Gai,
              "Fibre Channel Fabric Address Manager MIB", RFC 4439,
              March 2006.

   [RFC4936]  DeSanti, C., Vivek, H., McCloghrie, K., and S. Gai, "Fibre
              Channel Zone Server MIB", RFC 4936, August 2007.

   [FC-FS-2]  "Fibre Channel - Framing and Signaling-2 (FC-FS-2)",
              ANSI INCITS 424-2007, February 2007.

   [FC-GS-5]  "Fibre Channel - Generic Services-5 (FC-GS-5)",
              ANSI INCITS 427-2006, December 2006.

   [FC-SP]    "Fibre Channel - Security Protocols (FC-SP)",
              ANSI INCITS 426-2007, T11/Project 1570-D, February 2007.

   [FC-SW-4]  "Fibre Channel - Switch Fabric-4 (FC-SW-4)",
              ANSI INCITS 418-2006, April 2006.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

10.  Informative References

   [RFC1492]  Finseth, C., "An Access Control Protocol, Sometimes Called
              TACACS", RFC 1492, July 1993.

   [RFC2741]  Daniele, M., Wijnen, B., Ellison, M., and D. Francisco,
              "Agent Extensibility (AgentX) Protocol Version 1", RFC
              2741, January 2000.

   [RFC2837]  Teow, K., "Definitions of Managed Objects for the Fabric
              Element in Fibre Channel Standard", RFC 2837, May 2000.

   [RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
              "Remote Authentication Dial In User Service (RADIUS)", RFC
              2865, June 2000.

   [RFC3410]  Case, J., Mundy, R., Partain, D., and B. Stewart,
              "Introduction and Applicability Statements for Internet-
              Standard Management Framework", RFC 3410, December 2002.

   [RFC3588]  Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
              Arkko, "Diameter Base Protocol", RFC 3588, September 2003.



De Santi, et al.            Standards Track                   [Page 213]
^L
RFC 5324                     MIB for FC-SP                September 2008


   [RFC4595]  Maino, F. and D. Black, "Use of IKEv2 in the Fibre Channel
              Security Association Management Protocol", RFC 4595, July
              2006.

   [RFC4625]  DeSanti, C., McCloghrie, K., Kode, S., and S. Gai, "Fibre
              Channel Routing Information MIB", RFC 4625, September
              2006.

   [RFC4626]  DeSanti, C., Gaonkar, V., McCloghrie, K., and S. Gai, "MIB
              for Fibre Channel's Fabric Shortest Path First (FSPF)
              Protocol", RFC 4626, September 2006.

   [RFC4668]  Nelson, D., "RADIUS Authentication Client MIB for IPv6",
              RFC 4668, August 2006.

   [RFC4747]  Kipp, S., Ramkumar, G., and K. McCloghrie, "The Virtual
              Fabrics MIB", RFC 4747, November 2006.

   [RFC4935]  DeSanti, C., Vivek, H., McCloghrie, K., and S. Gai, "Fibre
              Channel Fabric Configuration Server MIB", RFC 4935, August
              2007.

   [RFC4983]  DeSanti, C., Vivek, H., McCloghrie, K., and S. Gai, "Fibre
              Channel Registered State Change Notification (RSCN) MIB",
              RFC 4983, August 2007.


























De Santi, et al.            Standards Track                   [Page 214]
^L
RFC 5324                     MIB for FC-SP                September 2008


11.  Acknowledgements

   This document was initially developed and approved by the INCITS Task
   Group T11.5 (http://www.t11.org) as the SM-FSM project.  We wish to
   acknowledge the contributions and comments from the INCITS Technical
   Committee T11, including the following:

      T11 Chair: Robert Snively, Brocade
      T11 Vice Chair: Claudio DeSanti, Cisco Systems
      T11.5 Chair: Roger Cummings, Symantec
      T11.5 members:
         David Black, EMC
         Don Fraser, HP
         Larry Hofer, Brocade
         Scott Kipp, Brocade
         Ralph Weber, ENDL

   The document was subsequently a work item of the IMSS Working Group
   (of the IETF), chaired by David Black (EMC Corporation).  Bert Wijnen
   (Alcatel-Lucent) deserves many thanks for his thorough review of all
   five MIB modules in this (large!) document.  We also wish to
   acknowledge Dan Romascanu (Avaya), the IETF Area Director, for his
   comments and assistance.

Authors' Addresses

   Claudio DeSanti
   Cisco Systems, Inc.
   170 West Tasman Drive
   San Jose, CA 95134 USA
   Phone: +1 408 853-9172
   EMail: cds@cisco.com

   Fabio Maino
   Cisco Systems, Inc.
   170 West Tasman Drive
   San Jose, CA 95134 USA
   Phone: +1 408 853-7530
   EMail: fmaino@cisco.com

   Keith McCloghrie
   Cisco Systems, Inc.
   170 West Tasman Drive
   San Jose, CA USA 95134
   Phone: +1 408-526-5260
   EMail: kzm@cisco.com





De Santi, et al.            Standards Track                   [Page 215]
^L
RFC 5324                     MIB for FC-SP                September 2008


Full Copyright Statement

   Copyright (C) The IETF Trust (2008).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.












De Santi, et al.            Standards Track                   [Page 216]
^L