IPCDN
Internet Draft Eugene Nechamkin
Document: draft-ietf-ipcdn-pktc-mtamib-01.txt Broadcom Corp.
Jean-Francois Mule
Cablelabs
Expires: October 2003 May 2003
Multimedia Terminal Adapter (MTA) Management Information Base
for PacketCable/IPCablecom compliant devices
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC 2026 [RFC2026].
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract
This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols in the Internet community.
In particular, it defines a basic set of managed objects for SNMP-
based management of PacketCable/IPCablecom compliant Multimedia
Terminal Adapter devices.
Nechamkin/Mule Expires - November 2003 [Page 1]
PacketCable/IPCablecom MTA MIB May 2003
Table of Contents
1. The Internet-Standard Management Framework....................2
2. Terminology...................................................3
2.1 DOCSIS....................................................3
2.2 Cable Modem...............................................3
2.3 Multimedia Terminal Adapter...............................3
2.4 Endpoint..................................................3
2.5 X.509 Certificate.........................................4
2.6 Voice Over IP.............................................4
2.7 Public Key Certificate....................................4
2.8 DHCP......................................................4
2.9 Call Management Server....................................4
2.10 Voice Coder-Decoder......................................4
2.11 Operations Systems Support...............................4
2.12 Key Distribution Center..................................4
2.13 Fully Qualified Domain Name..............................5
2.14 Security Association.....................................5
3. Overview......................................................5
3.1 Structure of the MIB......................................5
3.2 pktcMtaDevBase............................................5
3.3 pktcMtaDevServer..........................................6
3.4 pktcMtaDevSecurity........................................6
3.5 Relationship between MIB Objects in MTA MIB...............7
4. Definitions...................................................8
5. Acknowledgments..............................................35
6. Normative References.........................................36
7. Informative References.......................................37
8. Security Considerations......................................37
9. Intellectual Property........................................40
10. Authors' Addresses..........................................40
11. Full Copyright Statement....................................40
1. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of
RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in STD 58,
RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
[RFC2580].
Nechamkin/Mule Expires - November 2003 [Page 2]
PacketCable/IPCablecom MTA MIB May 2003
2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL", when used in the guidelines in this memo, are to be
interpreted as described in RFC 2119 [RFC2119].
The terms "MIB module" and "information module" are used
interchangeably in this memo. As used here, both terms refer to any
of the three types of information modules defined in Section 3 of
RFC 2578 [RFC2578].
The terms in this document are derived from the documents associated
with the PacketCable Provisioning Specification [PKT-SP-PROV-IO6-
030415] and Security Specification [PKT-SP-SEC-I08-030415].
2.1 DOCSIS
"Data Over Cable Service Interface Specification". A term referring
to the ITU-T J.112 Annex B standard for cable modem systems
[ITU-T-J112].
2.2 Cable Modem
A Cable Modem (CM) acts as a data transport agent used to transfer
call management and voice data packets over the DOCSIS compliant
cable systems.
2.3 Multimedia Terminal Adapter
Multimedia Terminal Adapter (MTA) is used to refer to any
PacketCable/IPCablecom compliant device providing telephony services
over the cable or hybrid system used to deliver video signals to a
community. MTA can be Embedded (E-MTA) or Standalone (S-MTA). E-MTA
contains both an MTA and a CM. S-MTA does not contain the CM part
relying on the presence of some external DOCSIS agent to provide the
data transport over the cable. MTA Contains the interface(s) to a
physical voice device, a network interface, CODECs, and all
signaling and encapsulation functions required for VoIP transport,
class feature signaling and QoS signaling.
2.4 Endpoint
A standard RJ-11 telephony physical port located on the MTA and used
for attaching the telephone device to the MTA.
Nechamkin/Mule Expires - November 2003 [Page 3]
PacketCable/IPCablecom MTA MIB May 2003
2.5 X.509 Certificate
A public key certificate specification developed as part of the ITU-
T X.500 standards directory.
2.6 Voice Over IP
Voice Over IP (VoIP) is a technology providing the means to transfer
the digitized packets with the voice information over the IP
networks.
2.7 Public Key Certificate
Public Key Certificate (also Digital Certificate) - a binding
between an entity's public key and one or more attributes relating
to its identity.
2.8 DHCP
Dynamic Host Configuration Protocol as defined in [RFC2131].
2.9 Call Management Server
Call Management Server (CMS) - the element of the PacketCable
infrastructure which controls the audio connections between
different MTAs.
2.10 Voice Coder-Decoder
Voice COder-DECoder (CODEC) - is an algorithm used to transform the
audio information to the packets of digitized Data being transferred
over the IP networks.
2.11 Operations Systems Support
Operations Systems Support (OSS) - system of the back office
software components used for configuration, performance, fault,
accounting and security management working in interaction with each
other and providing the operations support in deployed PacketCable
systems.
2.12 Key Distribution Center
Key Distribution Center (KDC) - is an element of the OSS functioning
as a Kerberos Security Server providing mutual authentication of the
various components of the PacketCable system (e.g. MTA and CMS, or
MTA and the Provisioning Server).
Nechamkin/Mule Expires - November 2003 [Page 4]
PacketCable/IPCablecom MTA MIB May 2003
2.13 Fully Qualified Domain Name
Fully Qualified Domain Name (FQDN) - refer to [RFC1034] and
[RFC1035] for definition and details.
2.14 Security Association
Security Association (SA) - is a one-way relationship between sender
and receiver offering security services on the communication flow.
3. Overview
This MIB provides a set of objects required for the management of
PacketCable/IPCablecom compliant MTA Devices. The MTA Module MIB is
derived in part from the parameters described in PacketCable 1.0 MTA
MIB Specification [PKT-SP-MIB-MTA-IO6-030415].
3.1 Structure of the MIB
This MIB is identified by pktcMtaMib and is structured in three
groups:
- Management information pertinent to MTA Device Itself
(pktcMtaDevBase)
- Management information pertinent to the Provisioning back office
Servers (pktcMtaDevServer)
- Management information pertinent to elements of and logic
providing the PacketCable Security mechanisms (pktcMtaDevSecurity)
First two groups contain only scalar information describing the
corresponding characteristics of the MTA device and back office
servers.
Third group contains two tables controlling the necessary logical
associations between KDC realms and back office servers (CMS and
provisioning).
Rows in the tables can be created automatically (e.g. by the device
according to the current state information) or can be created by the
management station depending on the operational situation. Tables
may and generally will have a mixture of both types of rows.
3.2 pktcMtaDevBase
Contains management information describing the parameters of the MTA
device itself. Also, this group contains some objects controlling
the MTA state. Some of the MIB objects are as follows:
Nechamkin/Mule Expires - November 2003 [Page 5]
PacketCable/IPCablecom MTA MIB May 2003
- pktcMtaDevSerialNumber - Contains the MTA Serial Number,
- pktcMtaDevEndPntCount - Contains the number of End Points present
in MTA,
- pktcMtaDevProvisioningState - This object contains the information
describing the completion state of the initialization process,
- pktcMtaDevEnabled - Controls the state of the MTA enabling or
disabling telephony services on the device,
- pktcMtaDevResetNow - This object is used to instruct the MTA to
reset itself.
3.3 pktcMtaDevServer
Contains management information describing the back office servers
and the parameters assigned to the communication timeouts. Also,
this group contains some objects controlling the initial MTA
interaction with the Provisioning Server.
Some of the MIB objects are as follows:
- pktcMtaDevServerDhcp1 - This object contains the IP Address of the
Primary DHCP server designated for MTA provisioning,
- pktcMtaDevServerDhcp2 - This object contains the IP Address of the
Secondary DHCP server designated for MTA provisioning,
- pktcMtaDevServerDns1 - This object contains the IP Address of the
Primary DNS used by MTA to resolve the FQDN and IP Addresses,
- pktcMtaDevServerDns2 - This object contains the IP Address of the
Secondary DNS used by MTA to resolve the FQDN and IP Addresses,
- pktcMtaDevConfigFile - This object contains the name of the
provisioning configuration file to download from the Provisioning
Server by the MTA,
- pktcMtaDevProvConfigHash - This object is used to supply the hash
value of MTA Configuration File calculated over its content.
3.4 pktcMtaDevSecurity
Contains management information describing the security related
characteristics of the MTA.
Nechamkin/Mule Expires - November 2003 [Page 6]
PacketCable/IPCablecom MTA MIB May 2003
Also, this group contains two tables containing logical dependencies
and parameters necessary to establish security association between
the MTA and other components of the back office.
- pktcMtaDevRealmTable - This table is used in conjunction with any
server which needs a Security Association with an MTA (CMS or
Provisioning Sever),
- pktcMtaDevCmsTable - This table contains the parameters describing
the SA establishment between an MTA and a CMS.
3.5 Relationship between MIB Objects in MTA MIB
This section clarifies the relationship between various MIB Objects
in MTA MIB in respect to the role these objects are playing in the
process of the Security Association establishment.
Relationships between the MTA MIB Objects are defined by process of
the establishment of the Security Association which is described in
the PacketCable Security Specification [PKT-SP-SEC-I08-030415].
The SA establishment process between the MTA and other back office
Application Servers (CMS or Provisioning Server) consists of two
steps:
- AS-exchange providing mutual authentication of the parties (MTA
and the Application Server),
- AP-exchange providing the Key Distribution between the parties
(MTA and the Application Server).
Each Server-MTA Security Association has a one-to-one correspondence
to a single Realm.
The process of AS-exchange is defined by the number of parameters
grouped per each Realm. These parameters are collected in the Realm
Table. Realm Table is indexed by the Index Counter and contains
conceptual column with the Kerberos Realm Name.
CMS Table contains the parameters defining the process of the AP-
exchange between the MTA and the CMS when MTA is exchanging the keys
for SA with CMS. CMS Table is indexed by the Index Counter and
contains conceptual column with CMS FQDN. Each row of the Table also
contains the Realm Name corresponding to each CMS FQDN in the row.
This allows for multiple realms, each with its own Security
Association.
MTA MIB also contains the group of the scalar MIB Objects which
define the Parameters for AP-exchange process between the MTA and
the Provisioning Server. These objects are:
- pktcMtaDevProvUnsolicitedKeyMaxTimeout,
- pktcMtaDevProvUnsolicitedKeyNomTimeout,
- pktcMtaDevProvUnsolicitedKeyMaxRetries,
- pktcMtaDevProvSolicitedKeyTimeout.
Nechamkin/Mule Expires - November 2003 [Page 7]
PacketCable/IPCablecom MTA MIB May 2003
4. Definitions
PKTC-IETF-MTA-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY,
OBJECT-TYPE,
Unsigned32,
NOTIFICATION-TYPE,
mib-2
FROM SNMPv2-SMI
RowStatus,
TruthValue,
TEXTUAL-CONVENTION
FROM SNMPv2-TC
OBJECT-GROUP,
MODULE-COMPLIANCE,
NOTIFICATION-GROUP
FROM SNMPv2-CONF
InetAddressType,
InetAddress
FROM INET-ADDRESS-MIB
sysDescr
FROM SNMPv2-MIB
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB
ifPhysAddress
FROM IF-MIB;
pktcMtaMib MODULE-IDENTITY
LAST-UPDATED "200305070000Z" -- May 07, 2003
ORGANIZATION "IETF IPCDN Working Group "
CONTACT-INFO
"Eugene Nechamkin
Broadcom Corporation,
200-13711 International Place,
Richmond, BC, V6V 2Z8
CANADA
Phone: +1 604 233 8500
Fax: +1 604 233 8501
Email: enechamkin@broadcom.com
Jean-Francois Mule
Cable Television Laboratories, Inc.
400 Centennial Parkway,
Louisville, CO 80027-1266
U.S.A.
Phone: +1 303 661 9100
Nechamkin/Mule Expires - November 2003 [Page 8]
PacketCable/IPCablecom MTA MIB May 2003
Fax: +1 303 661 9199
Email: jf.mule@ cablelabs.com
IETF IPCDN Working Group
General Discussion: ipcdn@ietf.org
Subscribe: http://www.ietf.org/mailman/listinfo/ipcdn
Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn
Co-Chair: Jean-Francois Mule, jf.mule@cablelabs.com
Co-Chair: Richard Woundy, Richard_Woundy@cable.comcast.com"
DESCRIPTION
"This MIB module supplies the basic management object
for the Multimedia Terminal Adapter Devices compliant
with PacketCable/IPCablecom set if requirements.
Copyright (C) The Internet Society (2003). This version of
this MIB module is part of RFC yyyy; see the RFC itself for
full legal notices."
-- RFC Ed: replace yyyy with actual RFC number and remove this note
REVISION "200305070000Z"
DESCRIPTION
"Initial version, published as RFC yyyy."
-- RFC Ed: replace yyyy with actual RFC number and remove this note
::= { mib-2 XXX }
-- RFC Ed: replace XXX with IANA-assigned number and remove this
-- note
-- Textual Conventions
--
-- The following textual convention will be imported from BPI+ RFC
-- when introduced there.
--
DocsX509ASN1DEREncodedCertificate ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
" An X509 digital certificate encoded as an ASN.1 DER
object."
SYNTAX OCTET STRING (SIZE (0..4096))
--=================================================================
-- The MTA MIB only supports a single provisioning server.
Nechamkin/Mule Expires - November 2003 [Page 9]
PacketCable/IPCablecom MTA MIB May 2003
--=================================================================
pktcMtaMibObjects OBJECT IDENTIFIER ::= { pktcMtaMib 1 }
pktcMtaDevBase OBJECT IDENTIFIER ::= { pktcMtaMibObjects 1 }
pktcMtaDevServer OBJECT IDENTIFIER ::= { pktcMtaMibObjects 2 }
pktcMtaDevSecurity OBJECT IDENTIFIER ::= { pktcMtaMibObjects 3 }
--
-- The following group describes the base objects in the MTA
--
pktcMtaDevResetNow OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" Setting this object to true(1) causes the device to reset.
Reading this object always returns false(2). When
pktcMtaDevResetNow is set to true, the following actions
occur:
1. All connections (if present) are flushed locally.
2. All current actions such as ringing immediately
terminate.
3. Requests for notifications such as notification
based on digit map recognition are flushed.
4. All endpoints are disabled.
5. The provisioning flow is started at step MTA-1."
REFERENCE
" PacketCable Provisioning Specification."
::= { pktcMtaDevBase 1 }
pktcMtaDevSerialNumber OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE (1..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The manufacturer's serial number for this MTA."
::= { pktcMtaDevBase 2 }
pktcMtaDevSwCurrentVers OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The version of the software currently operating in MTA.
Any MTA MUST return a string descriptive of the current
software load. This object should use the syntax
defined by the individual vendor to identify the software
Nechamkin/Mule Expires - November 2003 [Page 10]
PacketCable/IPCablecom MTA MIB May 2003
version. The data presented in this object MUST be
consistent with the software version information embedded
in the 'sysDecr' MIB Object for the MTA."
::= { pktcMtaDevBase 3 }
pktcMtaDevFQDN OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The Fully Qualified Domain Name for this MTA."
::= { pktcMtaDevBase 4 }
pktcMtaDevEndPntCount OBJECT-TYPE
SYNTAX Unsigned32 (1..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The physical end points for this MTA."
::= { pktcMtaDevBase 5 }
pktcMtaDevEnabled OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" The MTA Admin Status of this device, where true(1) means
the voice feature is enabled and false(2) indicates that
it is disabled."
::= { pktcMtaDevBase 6 }
pktcMtaDevTypeIdentifier OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" This is a copy of the device type identifier used in the
DHCP option 60 exchanged between the MTA and the DHCP
server."
::= { pktcMtaDevBase 7 }
pktcMtaDevProvisioningState OBJECT-TYPE
SYNTAX INTEGER {
pass (1),
inProgress (2),
failConfigFileError (3),
passWithWarning (4),
passWithIncompleteParsing (5),
Nechamkin/Mule Expires - November 2003 [Page 11]
PacketCable/IPCablecom MTA MIB May 2003
failureInternalError (6),
failOtherReason (7)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" This parameter indicates the completion state of the MTA
Device provisioning process. This parameter is sent as
part of the final INFORM (step 25 of the MTA provisioning
process). Refer to the MTA Device provisioning spec for
explanation on how an MTA chooses a particular state to
report."
REFERENCE
" PacketCable Provisioning Specification."
::= { pktcMtaDevBase 8 }
pktcMtaDevHttpAccess OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" This indicates whether HTTP file access is supported for
MTA configuration file transfer."
::= { pktcMtaDevBase 9 }
pktcMtaDevProvisioningTimer OBJECT-TYPE
SYNTAX Unsigned32 (0..30)
UNITS "minutes"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" This object enables setting the duration of the
provisioning timeout timer. The timer covers the
provisioning sequence from step MTA-1 to step MTA-23.
The value is in minutes and setting the timer to 0
disables this timer."
REFERENCE
" PacketCable Provisioning Specification."
DEFVAL {10}
::= {pktcMtaDevBase 10}
pktcMtaDevErrorOidsTable OBJECT-TYPE
SYNTAX SEQUENCE OF PktcMtaDevErrorOidsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" Parsing of the MTA Configuration File might result error
situation due to various reasons, e.g. wrong OIDs of the
Configuration File Objects, wrong values of the Objects,
Nechamkin/Mule Expires - November 2003 [Page 12]
PacketCable/IPCablecom MTA MIB May 2003
wrong (unrecognizable)OIDs, etc. If
pktcMtaDevProvisioningState reported anything other than
'pass(1)' then this table must be populated with the
corresponding information, pertaining to the details of
each instance of an error. Even if different parameters
share the same error type (e.g., all Realm Names are
invalid), all observed errors must be reported as
different instances. Errors are placed into the table in
no particular order."
::= {pktcMtaDevBase 11 }
pktcMtaDevErrorOidsEntry OBJECT-TYPE
SYNTAX PktcMtaDevErrorOidsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" This contains the necessary information an MTA must
attempt to provide in case the configuration file
not parsed and/or accepted in its entirety."
INDEX { pktcMtaDevErrorOidIndex }
::= {pktcMtaDevErrorOidsTable 1}
PktcMtaDevErrorOidsEntry ::= SEQUENCE {
pktcMtaDevErrorOidIndex Unsigned32,
pktcMtaDevErrorOid OBJECT IDENTIFIER,
pktcMtaDevErrorValue SnmpAdminString,
pktcMtaDevErrorReason SnmpAdminString
}
pktcMtaDevErrorOidIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..1024)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" This is the index to pktcMtaDevErrorOidsEntry: an integer
an integer value which starts from the value of 1 and is
incremented for each error encountered in the
configuration file."
::= {pktcMtaDevErrorOidsEntry 1}
pktcMtaDevErrorOid OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The OID of the Configuration File Parameter, which caused
the particular error, is placed into this MIB Object. If
the error was due to a reason which cannot be associated
Nechamkin/Mule Expires - November 2003 [Page 13]
PacketCable/IPCablecom MTA MIB May 2003
with 'recognizable' OID of the parameter, then this MIB
object must contain an empty value."
::= {pktcMtaDevErrorOidsEntry 2}
pktcMtaDevErrorValue OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" If the error was due to unrecognizable OID of the
parameter in the Configuration File, then this MIB
Object contains the value of the OID as interpreted
MTA. Otherwise (the error happens due to a wrong value
of the parameter) - the MIB Object contains the value
from the Configuration File converted to SnmpAdminString."
::= {pktcMtaDevErrorOidsEntry 3}
pktcMtaDevErrorReason OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" This indicates the reason for the error, as per the MTA's
interpretation, in human readable form. E.g.:
'VALUE NOT IN RANGE', 'VALUE DOES NOT MATCH TYPE',
'UNSUPPORTED VALUE', 'LAST 4 BITS MUST BE SET TO ZERO',
'OUT OF MEMORY - CANNOT STORE', etc. This may also contain
vendor specific errors for vendor specific OIDs and any
proprietary error codes/messages which can help diagnose
errors better, in a manner the vendor deems fit."
::= {pktcMtaDevErrorOidsEntry 4}
--
-- The following group describes server access and parameters used
-- for initial provisioning and bootstrapping.
--
pktcMtaDevServerAddressType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" The type of Internet address used in MIB Objects
describing PacketCable servers in MTA MIB. This object
defines the address type for the following servers:
pktcMtaDevServerDhcp1, pktcMtaDevServerDhcp2,
Nechamkin/Mule Expires - November 2003 [Page 14]
PacketCable/IPCablecom MTA MIB May 2003
pktcMtaDevServerDns1, pktcMtaDevServerDns2,
pktcMtaDevTimeServer."
DEFVAL { ipv4 }
::= { pktcMtaDevServer 1}
pktcMtaDevServerDhcp1 OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The IP address of the primary DHCP server which would
cater to the MTA during its provisioning. Contains
255.255.255.255 if there was no preference given with
respect to the DHCP servers for MTA provisioning.
PacketCable compliant DHCP Servers and MTAs must
support DHCP Option for CableLabs Client Configuration."
REFERENCE
" PacketCable Provisioning Specification. RFC 3495."
::= { pktcMtaDevServer 2 }
pktcMtaDevServerDhcp2 OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The IP address of the Secondary DHCP server which
could cater to the MTA during its provisioning.
Contains 0.0.0.0 if there is no specific secondary DHCP
server to be considered during MTA provisioning.
PacketCable compliant DHCP Servers and MTAs must support
DHCP Option for CableLabs Client Configuration."
REFERENCE
" PacketCable Provisioning Specification. RFC 3495."
::= { pktcMtaDevServer 3 }
pktcMtaDevServerDns1 OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" The IP address of the primary DNS server to be used by the
MTA to resolve the FQDNs. As defined in
RFC-3495, PacketCable compliant MTAs receive the IP
Address of the primary DNS Server in the DHCP Option-6."
REFERENCE
" PacketCable Provisioning Specification. RFC 3495."
::= { pktcMtaDevServer 4 }
pktcMtaDevServerDns2 OBJECT-TYPE
Nechamkin/Mule Expires - November 2003 [Page 15]
PacketCable/IPCablecom MTA MIB May 2003
SYNTAX InetAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" The IP address of the Secondary DNS server to be usaed by
the MTA to resolve the FQDNs. Contains
0.0.0.0 if there is no Secondary DNS server specified for
the MTA under consideration. As defined in RFC-3495,
PacketCable compliant MTAs receive the IP Address of the
secondary DNS Server in the DHCP Option-6."
REFERENCE
" PacketCable Provisioning Specification. RFC 3495."
::= { pktcMtaDevServer 5 }
pktcMtaDevTimeServer OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" This holds the IP address of the Time Server used for Time
Synchronization and must be populated in the case of SMTA.
Contains 0.0.0.0 if the Time Protocol is not used for
time synchronization."
::= { pktcMtaDevServer 6}
pktcMtaDevConfigFile OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" The Configuration File Name set by Provisioning
Application. MTA MUST support TFTP access method, and MAY
support HTTP access method. In the case of the TFTP access
method, the filename MUST encoded in the following format:
tftp://[IPv4] or FQDN of access server/mta-configfilename
In the case of HTTP access method, the filename MUST be
URL-encoded in the following format:
http://[IPv4] or FQDN of access server/ mta-configfilename
The object returns NULL if the server address is unknown."
::= { pktcMtaDevServer 7 }
pktcMtaDevSnmpEntity OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" The FQDN of the SNMPv3 entity of the Provisioning
Nechamkin/Mule Expires - November 2003 [Page 16]
PacketCable/IPCablecom MTA MIB May 2003
Server to which the MTA has to communicate in order to
receive the access method, location and the name of the
Configuration file during MTA provisioning. This would
also be the entity which caters to the end-point
provisioning needs of the MTA and is the
destination for all provisioning informs. It may be
also used for post-provisioning SNMP operations. FQDN of
the SNMP V3 entity of the Provisioning Server is supplied
to the MTA via suboption-3 of the DHCP Option CCC as
defined in RFC-3495."
REFERENCE
"RFC-3495"
::= { pktcMtaDevServer 8 }
pktcMtaDevProvConfigHash OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(16|20))
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" Hash of the contents of the config file, calculated and
sent to the MTA prior to sending the config file. If the
authenthenication algorithm is MD5, the length is 128
bits. If the authentication algorithm is SHA-1, the length
is 160 bits."
::= { pktcMtaDevServer 9 }
pktcMtaDevProvConfigKey OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0|8))
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" Key used to encrypt/decrypt the config file, sent to the
MTA prior to sending the config file. If the privacy
algorithm is null, the length is 0. If the privacy
algorithm is DES, the length is 64 bits."
::= { pktcMtaDevServer 10 }
pktcMtaDevProvSolicitedKeyTimeout OBJECT-TYPE
SYNTAX Unsigned32 (15..600)
UNITS "seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" This timeout applies only when the Provisioning Sever
initiated key management (with a Wake Up message) for
SNMPv3. It is the period during which the MTA will save a
nonce (inside the sequence number field) from the sent out
AP Request and wait for the matching AP Reply from the
Provisioning Server."
Nechamkin/Mule Expires - November 2003 [Page 17]
PacketCable/IPCablecom MTA MIB May 2003
DEFVAL { 120 }
::= { pktcMtaDevServer 11 }
--=================================================================
--
-- Unsolicited Key Updates are based on an exponential backoff
-- mechanism with two timers for AS replies. The fast timers
-- has a maximum timer (pktcMtaDevProvUnsolicitedKeyMaxTimeout
-- seconds and a nominal timer
-- pktcMtaDevProvUnsolicitedKeyNomTimeout seconds) from which the
-- backoff timer determinations are made.
--
--=================================================================
--=================================================================
--
-- Timeouts for unsolicited key management updates are only
-- pertinent before the first SNMP message is sent between the MTA
-- and the CMS and before the configuration file is loaded. No
-- SNMP communications can exist under PacketCable without the
-- security association existing. The following object is provided
-- only for diagnosistic purposes and are only useful if the MTA
-- can be brought up without any security.
--
--=================================================================
pktcMtaDevProvUnsolicitedKeyMaxTimeout OBJECT-TYPE
SYNTAX Unsigned32 (15..600)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" This timeout applies to MTA initiated AP-REQ/REP key
management exchange with Provisioning Server. The maximum
timeout is the value which may not be exceeded in the
exponential backoff algorithm. If provided, DHCP-Option-
122-Sub-option 5 overrides this value."
REFERENCE
" PacketCable Security Specification"
DEFVAL {600}
::= { pktcMtaDevServer 12 }
pktcMtaDevProvUnsolicitedKeyNomTimeout OBJECT-TYPE
SYNTAX Unsigned32 (15..600)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" Defines the starting value of the timeout for the
Nechamkin/Mule Expires - November 2003 [Page 18]
PacketCable/IPCablecom MTA MIB May 2003
AP-REQ/REP Backoff and Retry mechanism with exponential
timeout. If provided, DHCP-Option-122-Sub-option 5
override this value."
REFERENCE
" PacketCable Security Specification"
DEFVAL {30}
::= { pktcMtaDevServer 13}
pktcMtaDevProvUnsolicitedKeyMaxRetries OBJECT-TYPE
SYNTAX Unsigned32 (1..32)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" This retries number applies to MTA initiated AP-REQ/REP
key management exchange with Provisioning Server. This is
the maximum number of retries before the MTA gives up
attempting to establish an SNMPv3 security association
with Provisioning Server. If provided, DHCP-Option-122-
Sub-option 5 overrides this value."
REFERENCE
" PacketCable Security Specification "
DEFVAL {8}
::= { pktcMtaDevServer 14 }
pktcMtaDevProvKerbRealmName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..255))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The name of the associated Provisioning Kerberos Realm
acquired during MTA4 (DHCP Ack). This is used as an
index into the pktcMtaDevRealmTable. The upper case ASCII
representation of the associated Kerberos Realm name MUST
be used by both the Manager(SNMPv3 Entity) and the MTA.
Kerberos Name for the Provisioning Application is supplied
to the MTA via suboption-6 of the DHCP Option 122 as
defined in RFC-3495. Value of the Kerberos Name for the
Provisioning Application supplied in the MTA Configuration
file must match a value supplied in the suboption-6."
REFERENCE
" PacketCable Provisioning Specification, RFC 3495"
::= { pktcMtaDevServer 15 }
pktcMtaDevProvState OBJECT-TYPE
SYNTAX INTEGER {
operational (1),
waitingForSnmpSetInfo (2),
waitingForTftpAddrResponse (3),
Nechamkin/Mule Expires - November 2003 [Page 19]
PacketCable/IPCablecom MTA MIB May 2003
waitingForConfigFile (4)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" If operational(1), the device has completed loading and
processing of initialization parameters.
If waitingForSnmpSetInfo(2) then the device is waiting on
config file download access information.
If waitingForTftpAddrResponse(3) then a DNS request has
been transmitted and no reply has yet been received.
If waitingForConfigFile(4) then a TFTP request has been
transmitted and no reply has yet been received or a
download is in progress."
REFERENCE
" PacketCable Provisioning Specification,
PacketCable Security Specification "
::= { pktcMtaDevServer 16 }
--
-- The following group describes the security objects in the
-- MTA.
--
pktcMtaDevManufacturerCertificate OBJECT-TYPE
SYNTAX DocsX509ASN1DEREncodedCertificate
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" ASN.1 DER encoding of the MTA Manufacturer's X.509
public-key certificate, called MTA Manufacturer
Certificate. It is issued to each MTA manufacturer and is
installed into each MTA either in the factory or with a
code download. The provisioning server cannot update this
certificate. Specific requirements to certificate are per
corresponding PacketCable/IPCablecom specification."
REFERENCE
" PacketCable Security Specification."
::= {pktcMtaDevSecurity 1}
pktcMtaDevCertificate OBJECT-TYPE
SYNTAX DocsX509ASN1DEREncodedCertificate
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" ASN.1 DER encoding of the MTA's X.509 public-key
certificate issued by the manufacturer and installed into
the embedded-MTA in the factory. This certificate, called
Nechamkin/Mule Expires - November 2003 [Page 20]
PacketCable/IPCablecom MTA MIB May 2003
MTA Device Certificate, contains the MTA's MAC address. It
cannot be updated by the provisioning server. Specific
requirements to certificate are per corresponding
PacketCable/IPCablecom specification."
REFERENCE
" PacketCable Security Specification."
::= { pktcMtaDevSecurity 2 }
pktcMtaDevCorrelationId OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" Random value generated by the MTA for use in registration
authorization. It is for use only in the MTA
initialization messages and for MTA configuration file
download."
::= { pktcMtaDevSecurity 3 }
pktcMtaDevTelephonyRootCertificate OBJECT-TYPE
SYNTAX DocsX509ASN1DEREncodedCertificate
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" ASN.1 DER encoding of the IP Telephony Root X.509
public-key certificate stored in the MTA non-volatile
memory and updateable with a code download. This
certificate is used to validate the initial AS Reply from
the KDC received during the MTA initialization. Specific
requirements to certificate are per corresponding
PacketCable/IPCablecom specification."
REFERENCE
" PacketCable Security Specification."
::= { pktcMtaDevSecurity 4 }
--=================================================================
--
-- Procedures for setting up security associations:
--
-- A security association may be setup either via configuration or
-- via NCS signaling.
--
-- I. Security association setup via configuration.
--
-- The realm must be configured first. Associated with the realm
-- is a KDC. The realm table (pktcMtaDevRealmTable) indicates
-- information about realm (e.g., name, organization name) and
Nechamkin/Mule Expires - November 2003 [Page 21]
PacketCable/IPCablecom MTA MIB May 2003
-- parameters associated with KDC communications (e.g., grace
-- periods, AS request/AS reply adaptive backoff parameters).
--
-- Once the realm is established, one or more servers may be
-- defined in the realm. For PacketCable 1.0, these are Call
-- Management Servers (CMSs). Associated with each CMS
-- entry in the pktcMtaDevCmsTable is an explicit reference
-- to a Realm via the realm ( pktcMtaDevCmsKerbRealmName),
-- the FQDN of the CMS, and parameters associated with IPSec
-- key management with the CMS (e.g., clock skew, AP request/
-- AP reply adaptive backoff parameters).
--
-- II. Security association setup via NCS signaling.
--
-- The procedure of establishing of the Security Association
-- for NCS Signaling is described in the PacketCable Security
-- Specification.
-- It involves the analysis of the EndPointNcsTable row
-- for the corresponding end-point number and correlating
-- the CMS FQDN from this row with the CMS Table and
-- consequently - with the Realm Table. Both of these tables
-- are defined below.
--
-- III. When the MTA receives wake-up or re-key messages from a
-- CMS, it performs key management based on the corresponding
-- entry in the CMS table. If the matching CMS entry does not
-- exist, it must ignore the wake-up or re-key messages.
--
--=================================================================
--=================================================================
--
-- pktcMtaDevRealmTable
--
-- The pktcMtaDevRealmTable shows the KDC realms. The table is
-- indexed with pktcMtaDevRealmIndex. The Realm Table contains the
-- pktcMtaDevRealmName in conjunction with any server which needs
-- a security association with an MTA. Upper case must be use to
-- compare the pktcMtaDevRealmName content.
-- The server table (today the CMS) has a security association.
-- Each server-MTA security association is associated with a
-- single Realm. This allows for multiple realms, each with its
-- own security association.
--
--=================================================================
pktcMtaDevRealmAvailSlot OBJECT-TYPE
SYNTAX Unsigned32 (0..64)
MAX-ACCESS read-only
STATUS current
Nechamkin/Mule Expires - November 2003 [Page 22]
PacketCable/IPCablecom MTA MIB May 2003
DESCRIPTION
" The index number of the first available entry in the
pktcMtaDevRealmTable table, or the value of zero
indicating that all entries are assigned.
A management station should create new entries in the
pktcMtaDevRealmTable table using this algorithm:
first, issue a management protocol retrieval operation
to determine the value of pktcMtaDevRealmSlot;
and, second, issue a management protocol set operation
to create an instance of the pktcMtaDevRealmAvailSlot
object setting its value to createAndWait(5). If the
operation succeeds, then the management station may
continue modifying theinstances corresponding to the newly
created conceptual row, without fear of collision with
othermanagement stations. When all necessary conceptual
columns of the table are properly set or get their default
values, the management station may set the
pktcMtaDevRealmStatus to active."
::= { pktcMtaDevSecurity 5 }
pktcMtaDevRealmTable OBJECT-TYPE
SYNTAX SEQUENCE OF PktcMtaDevRealmEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" Contains per Kerberos realm security parameters."
::= { pktcMtaDevSecurity 6 }
pktcMtaDevRealmEntry OBJECT-TYPE
SYNTAX PktcMtaDevRealmEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" List of security parameters for a single Kerberos realm."
INDEX { pktcMtaDevRealmIndex }
::= { pktcMtaDevRealmTable 1 }
PktcMtaDevRealmEntry ::= SEQUENCE {
pktcMtaDevRealmIndex Unsigned32,
pktcMtaDevRealmName SnmpAdminString,
pktcMtaDevRealmPkinitGracePeriod Unsigned32,
pktcMtaDevRealmTgsGracePeriod Unsigned32,
pktcMtaDevRealmOrgName SnmpAdminString,
pktcMtaDevRealmUnsolicitedKeyMaxTimeout Unsigned32,
pktcMtaDevRealmUnsolicitedKeyNomTimeout Unsigned32,
pktcMtaDevRealmUnsolicitedKeyMaxRetries Unsigned32,
pktcMtaDevRealmStatus RowStatus
}
Nechamkin/Mule Expires - November 2003 [Page 23]
PacketCable/IPCablecom MTA MIB May 2003
pktcMtaDevRealmIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..32)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" The index into the pktcMtaDevRealmTable."
::= { pktcMtaDevRealmEntry 1}
pktcMtaDevRealmName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..255))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" Kerberos Realm name in upper case characters. Each MTA
MUST prohibit the instantiation of any two rows with
identical Kerberos Realm Name. Each MTA MUST also verify
that any search operations involving Kerberos Realm Name
are done using the upper case ASCII representation of the
characters."
::= { pktcMtaDevRealmEntry 2 }
pktcMtaDevRealmPkinitGracePeriod OBJECT-TYPE
SYNTAX Unsigned32 (15..600)
UNITS "minutes"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" For the purposes of the key management with an Application
Server (CMS or Provisioning Server), the MTA MUST obtain
a new Kerberos ticket (with a PKINIT exchange) this many
minutes before the old ticket expires. This MIB Object MAY
also be used with other Kerberized applications."
DEFVAL { 30 }
::= { pktcMtaDevRealmEntry 3 }
pktcMtaDevRealmTgsGracePeriod OBJECT-TYPE
SYNTAX Unsigned32 (1..600)
UNITS "minutes"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" When the MTA implementation uses TGS Request/TGS Reply
Kerbersos messages for the purpose of the key management
with an Application Server (CMS or Provisioning Server),
the MTA MUST obtain a new service ticket for the
Application Server (with a TGS Request) this many minutes
before the old ticket expires. This parameter MAY also
be used with other Kerberized applications."
DEFVAL { 10 }
Nechamkin/Mule Expires - November 2003 [Page 24]
PacketCable/IPCablecom MTA MIB May 2003
::= { pktcMtaDevRealmEntry 4 }
pktcMtaDevRealmOrgName OBJECT-TYPE
SYNTAX SnmpAdminString(SIZE (1..64))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" The value of the X.500 organization name attribute in the
subject name of the Service provider certificate. The
value of the organization name is encoded with the prefix
'O=' in the Subject field of the Certificate."
REFERENCE
" PacketCable Security Specification"
::= { pktcMtaDevRealmEntry 5 }
--=================================================================
--
-- Unsolicited Key Updates are based on an exponential backoff
-- mechanism with two timers for AS replies. The backoff timers
-- has a maximum value of pktcMtaDevRealmUnsolicitedKeyMaxTimeout
-- seconds and a nominal timer has a
-- pktcMtaDevRealmUnsolicitedKeyNomTimeout seconds from which
-- the backoff timer determinations are made. After
-- pktcMatDevRealmUnsolicitedMaxRetries have occurred no more
-- attempts are made.
--
--=================================================================
pktcMtaDevRealmUnsolicitedKeyMaxTimeout OBJECT-TYPE
SYNTAX Unsigned32 (1..600)
UNITS "seconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" This timeout applies only when the MTA initiated key
management. The maximum timeout is the value which may not
be exceeded in the exponential backoff algorithm."
REFERENCE
" PacketCable Security Specification"
DEFVAL { 30 }
::= { pktcMtaDevRealmEntry 6 }
pktcMtaDevRealmUnsolicitedKeyNomTimeout OBJECT-TYPE
SYNTAX Unsigned32 (100..600000)
UNITS "milliseconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
Nechamkin/Mule Expires - November 2003 [Page 25]
PacketCable/IPCablecom MTA MIB May 2003
" This timeout applies only when the MTA initiated key
management. This value should account for the average
roundtrip time between the MTA and the KDC as well as for
the processing delay on the KDC."
REFERENCE
" PacketCable Security Specification"
DEFVAL { 10000 }
::= { pktcMtaDevRealmEntry 7 }
pktcMtaDevRealmUnsolicitedKeyMaxRetries OBJECT-TYPE
SYNTAX Unsigned32 (0..1024)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" This is the maximum number of retries before the
MTA gives up attempting to establish a security
association."
REFERENCE
" PacketCable Security Specification"
DEFVAL { 5 }
::= { pktcMtaDevRealmEntry 8 }
pktcMtaDevRealmStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" The status of this conceptual row in the
pktcMtaDevRealmTable. An entry in this table is not
qualified for activation until instances of all
corresponding columns have been initialized, either
through default values, or through Set operations. The
pktcMtaDevRealmName object must be explicitly set. Until
that time, the value of the pktcMtaDevRealmStatus must be
'notReady'.
There is no restriction on setting columns in this table
when the value of pktcMtaDevRealmStatus is active(1).
The RowStatus TC [RFC2579] requires that this DESCRIPTION
clause states under which circumstances other objects in
this row can be modified:
The value of this object has no effect on whether other
objects in this conceptual row can be modified."
::= { pktcMtaDevRealmEntry 9 }
--=================================================================
Nechamkin/Mule Expires - November 2003 [Page 26]
PacketCable/IPCablecom MTA MIB May 2003
--
-- pktcMtaDevCmsTable
--
-- The pktcMtaDevCmsTable shows the IPSec key management policy
-- relating to a particular CMS. The table is indexed with
-- pktcMtaDevCmsIndex. The table contains the pktcMtaDevCmsFQDN
-- and pktcMtaDevCmsKerbRealmName. The latter is a reference
-- point for the MTA to find the corresponding Kerberos realm
-- Name in the pktcMtaDevRealmTable.
--
--=================================================================
pktcMtaDevCmsAvailSlot OBJECT-TYPE
SYNTAX Unsigned32 (0..128)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" The index number of the first available entry in the
pktcMtaDevCmsTable table, or the value of zero indicating
that all entries are assigned.
A management station should create new entries in the
pktcMtaDevCmsTable table using this algorithm:
first, issue a management protocol retrieval operation
to determine the value of pktcMtaDevCmsAvailSlot;
and, second, issue a management protocol set operation
to create an instance of the pktcMtaDevCmsAvailSlot
object setting its value to createAndWait(5).
If this latter operation succeeds, then the management
station may continue modifying the instances corresponding
to the newly created conceptual row, without fear of
collision with other management stations. When all
necessary conceptual columns of the table are properly set
or get their default values, the management station may
set the pktcMtaDevCmsStatus to active."
::= { pktcMtaDevSecurity 7 }
pktcMtaDevCmsTable OBJECT-TYPE
SYNTAX SEQUENCE OF PktcMtaDevCmsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" Contains per CMS key management policy."
::= { pktcMtaDevSecurity 8 }
pktcMtaDevCmsEntry OBJECT-TYPE
SYNTAX PktcMtaDevCmsEntry
MAX-ACCESS not-accessible
STATUS current
Nechamkin/Mule Expires - November 2003 [Page 27]
PacketCable/IPCablecom MTA MIB May 2003
DESCRIPTION
" List of key management parameters for a single MTA-CMS
interface."
INDEX { pktcMtaDevCmsIndex }
::= { pktcMtaDevCmsTable 1 }
PktcMtaDevCmsEntry ::= SEQUENCE {
pktcMtaDevCmsIndex Unsigned32,
pktcMtaDevCmsFqdn SnmpAdminString,
pktcMtaDevCmsKerbRealmName SnmpAdminString,
pktcMtaDevCmsSolicitedKeyTimeout Unsigned32,
pktcMtaDevCmsMaxClockSkew Unsigned32,
pktcMtaDevCmsUnsolicitedKeyMaxTimeout Unsigned32,
pktcMtaDevCmsUnsolicitedKeyNomTimeout Unsigned32,
pktcMtaDevCmsUnsolicitedKeyMaxRetries Unsigned32,
pktcMtaDevCmsIpsecCtrl TruthValue,
pktcMtaDevCmsStatus RowStatus
}
pktcMtaDevCmsIndex OBJECT-TYPE
SYNTAX Unsigned32 (1..64)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
" The index into the pktcMtaDevCmsTable."
::= { pktcMtaDevCmsEntry 1 }
pktcMtaDevCmsFqdn OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..255))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" The Fully Qualified Domain Name of the CMS. Each MTA must
prohibit the instantiation of any two rows with identical
FQDNs. Each MTA must also verify that any search and/or
comparison operations involving CMS FQDN are case
insensitive."
::= { pktcMtaDevCmsEntry 2 }
pktcMtaDevCmsKerbRealmName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..255))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" The Kerberos Realm Name in upper case characters for the
CMS in the same conceptual row. The value in this object
is a reference point to the corresponding Kerberos Realm
Name in the pktcMtaDevRealmtable."
::= { pktcMtaDevCmsEntry 3 }
Nechamkin/Mule Expires - November 2003 [Page 28]
PacketCable/IPCablecom MTA MIB May 2003
pktcMtaDevCmsMaxClockSkew OBJECT-TYPE
SYNTAX Unsigned32 (1..1800)
UNITS "seconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" This is the maximum allowable clock skew between the MTA
and CMS."
DEFVAL { 300 }
::= { pktcMtaDevCmsEntry 4 }
pktcMtaDevCmsSolicitedKeyTimeout OBJECT-TYPE
SYNTAX Unsigned32 (100..30000)
UNITS "milliseconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" This timeout applies only when the CMS initiated key
management (with a Wake Up or Rekey message). It is the
period during which the MTA will save a nonce (inside the
sequence number field) from the sent out AP Request and
wait for the matching AP Reply from the CMS."
REFERENCE
" PacketCable Security Specification"
DEFVAL { 1000 }
::= { pktcMtaDevCmsEntry 5 }
--=================================================================
--
-- Unsolicited Key Updates are based on an exponential backoff
-- mechanism with two timers for AP replies. The backoff timers
-- has a maximum value of pktcMtaDevCmsUnsolicitedKeyMaxTimeout
-- seconds and a nominal timer has a
-- pktcMtaDevCmsUnsolicitedKeyNomTimeout seconds from which the
-- backoff timer determinations are made. After
-- pktcMatDevCmsUnsolicitedMaxRetries have occurred no more
-- attempts are made.
--
--=================================================================
pktcMtaDevCmsUnsolicitedKeyMaxTimeout OBJECT-TYPE
SYNTAX Unsigned32 (1..600)
UNITS "seconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" This timeout applies only when the MTA initiated key
Nechamkin/Mule Expires - November 2003 [Page 29]
PacketCable/IPCablecom MTA MIB May 2003
management. The maximum timeout is the value which may not
be exceeded in the exponential backoff algorithm."
REFERENCE
" PacketCable Security Specification"
DEFVAL { 8 }
::= { pktcMtaDevCmsEntry 6 }
pktcMtaDevCmsUnsolicitedKeyNomTimeout OBJECT-TYPE
SYNTAX Unsigned32 (100..30000)
UNITS "milliseconds"
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" This timeout applies only when the MTA initiated key
management. Typically this is the average roundtrip time
between the MTA and the CMS."
REFERENCE
" PacketCable Security Specification"
DEFVAL { 500 }
::= { pktcMtaDevCmsEntry 7 }
pktcMtaDevCmsUnsolicitedKeyMaxRetries OBJECT-TYPE
SYNTAX Unsigned32 (0..1024)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" This is the maximum number of retries before the MTA gives
up attempting to establish a security association."
REFERENCE
" PacketCable Security Specification"
DEFVAL { 5 }
::= { pktcMtaDevCmsEntry 8 }
pktcMtaDevCmsIpsecCtrl OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-only
STATUS current
DESCRIPTION
" This value of 'true(1)' indicates that IPSec and IPSec key
Management MUST be used to communicate with the CMS. The
value of 'fales(2)' indicates that IPSec Signaling
Security is disabled for both IPSec Key Management and
IPSec protocol (for the specific CMS)."
DEFVAL { true }
::= { pktcMtaDevCmsEntry 9 }
pktcMtaDevCmsStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
Nechamkin/Mule Expires - November 2003 [Page 30]
PacketCable/IPCablecom MTA MIB May 2003
STATUS current
DESCRIPTION
" This object contains the Row Status associated with the
pktcMtaDevCmsTable. An entry in this table is not
qualified for activation until instances of all
corresponding columns have been initialized, either
through default values, or through Set operations. The
pktcMtaDevCmsFqdn and pktcMtaDevKerbRealmName objects
must be explicitly set. Until that time, the value of the
pktcMtaDevCmsStatus must be 'notReady'.
There is no restriction on setting columns in this table
when the value of pktcMtaDevCmsStatus is active(1).
The RowStatus TC [RFC2579] requires that this DESCRIPTION
clause states under which circumstances other objects in
this row can be modified:
The value of this object has no effect on whether other
objects in this conceptual row can be modified."
::= { pktcMtaDevCmsEntry 10 }
pktcMtaDevResetKrbTickets OBJECT-TYPE
SYNTAX BITS {
invalidateProvOnReboot (0),
invalidateAllCmsOnReboot (1)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
" The object defines a Kerberos Ticket Control Mask that
instructs an MTA to invalidate the specific application
server Kerberos Tickets which are locally persisted in
MTA's NVRAM. If an MTA does not persist the Kerberos
Tickets, it MUST ignore setting of this object, and MUST
report value 0 when the object is read. The object value
is encoded as follows:
- setting invalidateProvOnReboot (0) bit to 1 means that
an MTA MUST invalidate a Kerberos Application Ticket for
the Provisioning Application at the next MTA reboot,
- setting invalidateAllCmsOnReboot (1) bit to 1 means that
an that an MTA MUST invalidate a Kerberos Application
Tickets for all CMS(s) currently assigned To the end-
points."
REFERENCE
"PacketCable Security Specification"
DEFVAL { { } }
::= { pktcMtaDevSecurity 9 }
Nechamkin/Mule Expires - November 2003 [Page 31]
PacketCable/IPCablecom MTA MIB May 2003
--
-- notification group is for future extension.
--
pktcMtaNotificationPrefix OBJECT IDENTIFIER ::= { pktcMtaMib 2 }
pktcMtaNotification OBJECT IDENTIFIER ::= {
pktcMtaNotificationPrefix 0 }
pktcMtaConformance OBJECT IDENTIFIER ::= { pktcMtaMib 3 }
pktcMtaCompliances OBJECT IDENTIFIER ::= { pktcMtaConformance 1 }
pktcMtaGroups OBJECT IDENTIFIER ::= { pktcMtaConformance 2 }
pktcMtaDevProvisioningEnrollment NOTIFICATION-TYPE
OBJECTS {
sysDescr,
pktcMtaDevSwCurrentVers,
pktcMtaDevTypeIdentifier,
ifPhysAddress,
pktcMtaDevCorrelationId
}
STATUS current
DESCRIPTION
" This inform is issued to initiate the PacketCable process
provisioning. MAC Address of the MTA is contained in the
MTA's ifTable, ifPhysAddress column corresponding to the
ifIndex=1"
REFERENCE
" Inform as defined in RFC 1902"
::= { pktcMtaNotification 1 }
pktcMtaDevProvisioningStatus NOTIFICATION-TYPE
OBJECTS {
ifPhysAddress,
pktcMtaDevCorrelationId,
pktcMtaDevProvisioningState
}
STATUS current
DESCRIPTION
" This inform is issued to confirm completion of the
PacketCable provisioning process, and indicate the
completion state."
REFERENCE
" Inform as defined in RFC 1902"
::= { pktcMtaNotification 2 }
--
-- compliance statements
--
Nechamkin/Mule Expires - November 2003 [Page 32]
PacketCable/IPCablecom MTA MIB May 2003
pktcMtaBasicCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
" The compliance statement for devices that implement
PacketCable/IPCablecom MTA. It is left to manufacturers to
determine whether to support both PacketCable and
IPCablecom objects in the same MTA."
MODULE
MANDATORY-GROUPS {
pktcMtaGroup
}
OBJECT pktcMtaDevSnmpEntity
MIN-ACCESS read-only
DESCRIPTION
" The behavior of the SNMP Agent when the object is
set is currently undefined. Object should be
implemented as read-only."
OBJECT pktcMtaDevRealmName
MIN-ACCESS read-only
DESCRIPTION
" The behavior of the SNMP Agent when the object is
set is currently undefined. Object should be
implemented as read-only after the conceptual
row is created."
OBJECT pktcMtaDevRealmOrgName
MIN-ACCESS read-only
DESCRIPTION
" The behavior of the SNMP Agent when the object is
set is currently undefined. Object should be
implemented as read-only after the conceptual
row is created."
OBJECT pktcMtaDevCmsFqdn
MIN-ACCESS read-only
DESCRIPTION
" The behavior of the SNMP Agent when the object is
set is currently undefined. Object should be
implemented as read-only after the conceptual
row is created."
OBJECT pktcMtaDevCmsKerbRealmName
MIN-ACCESS read-only
DESCRIPTION
" The behavior of the SNMP Agent when the object is
set is currently undefined. Object should be
Nechamkin/Mule Expires - November 2003 [Page 33]
PacketCable/IPCablecom MTA MIB May 2003
implemented as read-only after the conceptual
row is created."
::= { pktcMtaCompliances 1 }
pktcMtaGroup OBJECT-GROUP
OBJECTS {
pktcMtaDevResetNow,
pktcMtaDevSerialNumber,
pktcMtaDevSwCurrentVers,
pktcMtaDevFQDN,
pktcMtaDevEndPntCount,
pktcMtaDevEnabled,
pktcMtaDevErrorOid,
pktcMtaDevErrorValue,
pktcMtaDevErrorReason,
pktcMtaDevTypeIdentifier,
pktcMtaDevProvisioningState,
pktcMtaDevHttpAccess,
pktcMtaDevCertificate,
pktcMtaDevCorrelationId,
pktcMtaDevManufacturerCertificate,
pktcMtaDevServerAddressType,
pktcMtaDevServerDhcp1,
pktcMtaDevServerDhcp2,
pktcMtaDevServerDns1,
pktcMtaDevServerDns2,
pktcMtaDevTimeServer,
pktcMtaDevConfigFile,
pktcMtaDevSnmpEntity,
pktcMtaDevRealmPkinitGracePeriod,
pktcMtaDevRealmTgsGracePeriod,
pktcMtaDevRealmAvailSlot,
pktcMtaDevRealmName,
pktcMtaDevRealmOrgName,
pktcMtaDevRealmUnsolicitedKeyMaxTimeout,
pktcMtaDevRealmUnsolicitedKeyNomTimeout,
pktcMtaDevRealmUnsolicitedKeyMaxRetries,
pktcMtaDevRealmStatus,
pktcMtaDevCmsAvailSlot,
pktcMtaDevCmsFqdn,
pktcMtaDevCmsKerbRealmName,
pktcMtaDevCmsUnsolicitedKeyMaxTimeout,
pktcMtaDevCmsUnsolicitedKeyNomTimeout,
pktcMtaDevCmsUnsolicitedKeyMaxRetries,
pktcMtaDevCmsSolicitedKeyTimeout,
pktcMtaDevCmsMaxClockSkew,
pktcMtaDevCmsIpsecCtrl,
Nechamkin/Mule Expires - November 2003 [Page 34]
PacketCable/IPCablecom MTA MIB May 2003
pktcMtaDevCmsStatus,
pktcMtaDevResetKrbTickets,
pktcMtaDevProvUnsolicitedKeyMaxTimeout,
pktcMtaDevProvUnsolicitedKeyNomTimeout,
pktcMtaDevProvUnsolicitedKeyMaxRetries,
pktcMtaDevProvKerbRealmName,
pktcMtaDevProvSolicitedKeyTimeout,
pktcMtaDevProvConfigHash,
pktcMtaDevProvConfigKey,
pktcMtaDevProvState,
pktcMtaDevProvisioningTimer,
pktcMtaDevTelephonyRootCertificate
}
STATUS current
DESCRIPTION
" Group of objects for PacketCable MTA MIB."
::= { pktcMtaGroups 1 }
pktcMtaNotificationGroup NOTIFICATION-GROUP
NOTIFICATIONS {
pktcMtaDevProvisioningStatus,
pktcMtaDevProvisioningEnrollment
}
STATUS current
DESCRIPTION
" These notifications deal with change in status of MTA
Device."
::= { pktcMtaGroups 2 }
END
5. Acknowledgments
This document is a production of the PacketCable Working Group.
The current editors wish to express their gratitude to:
Angela Lyda Arris Interactive
Sumanth Channabasappa Alopa Networks,
Matt A. Osman CableLabs
Klaus Hermanns Cisco Systems
Rick Vetter, Sasha Medvinsky Motorola
Roy Spitzer Telogy Networks, Inc.
Itay Sherman, Satish Kumar Texas Instruments,
Nechamkin/Mule Expires - November 2003 [Page 35]
PacketCable/IPCablecom MTA MIB May 2003
6. Normative References
[RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Structure of Management
Information Version 2 (SMIv2)", STD 58, RFC 2578, April
1999.
[RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Textual Conventions for
SMIv2", STD 58, RFC 2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Conformance Statements for
SMIv2", STD 58, RFC 2580, April 1999.
[RFC3289] Baker, F., Chan, K., Smith, A., "Management Information
Base for the Differentiated Services Architecture", RFC
3289, May 2002.
[RFC2131] R. Droms, "Dynamic Host Configuration Protocol", March
1997.
[RFC2132] S. Alexander, R. Droms, "DHCP Options and BOOTP Vendor
Extensions", March 1997.
[RFC1034] P. Mockapetris, "DOMAIN NAMES - CONCEPTS AND FACILITIES",
November 1987.
[RFC1035] P. Mockapetris, "DOMAIN NAMES - IMPLEMENTATION AND
SPECIFICATION", November 1987.
[RFC3291] Daniele, M., Haberman, B., Routhier, S., Schoenwaelder,
J., "Textual Conventions for Internet Network Addresses",
RFC 3291, May 2002.
[RFC3495] B. Beser, P. Duffy, Ed., "Dynamic Host Configuration
Protocol (DHCP) Option for CableLabs Client
Configuration.", RFC-3495, March 2003.
[PKT-SP-PROV-IO6-030415] Packetcable MTA Device Provisioning
Specification PKT-SP-PROV-IO6-030415.
[PKT-SP-SEC-I08-030415] PacketCable Security Specification, Issued,
PKT-SP-SEC-I08-030415.
[ITU-T-J112] Transmission Systems for Interactive Cable Television
Services, Annex B, J.112, ITU-T, March, 1998.
Nechamkin/Mule Expires - November 2003 [Page 36]
PacketCable/IPCablecom MTA MIB May 2003
7. Informative References
[RFC2026] Bradner, S., "The Internet Standards Process, Revision 3",
RFC 2026, October 1996.
[RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
[PKT-SP-MIB-MTA-I06-030415] Packetcable MTA MIB Specification PKT-
SP-MIB-MTA-I06-030415.
[ETSI TS 101 909-4] ETSI TS 101 909-4:"Access and Terminals (AT);
Digital Broadband Cable Access to the Public
Telecommunications Network; IP Multimedia Time
Critical Services; Part 4: Network Call
Signaling Protocol".
[ETSI TS 101 909-9] ETSI TS 101 909-9:"Access and Terminals (AT);
Digital Broadband Cable Access to the Public
Telecommunications Network; IP Multimedia Time
Critical Services; Part 9: IPCablecom Network
Call Signalling (NCS) MIB Requirements".
[EN 300 001] EN 300 001 V1.5.1 (1998-10):"European Standard
(Telecommunications series) Attachments to Public
Switched Telephone Network (PSTN); General technical
requirements for equipment connected to an analogue
subscriber interface in the PSTN; Chapter 3: Ringing
signal characteristics (national deviations are in
Table 3.1.1)".
[EN 300 659-1] EN 300 659-1: ôPublic Switched Telephone Network
(PSTN); Subscriber line protocol over the local loop
for display (and related) services; Part 1: On hook
data transmissionö.
8. Security Considerations
There are a number of management objects defined in this MIB module
with a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations. Improper manipulation of the objects defined in
this MIB may result in random behavior of MTA devices and may result
in service disruption. These are the tables and objects and their
sensitivity/vulnerability:
Nechamkin/Mule Expires - November 2003 [Page 37]
PacketCable/IPCablecom MTA MIB May 2003
- The following objects, if SET maliciously would cause the MTA
device to reset and/or stop its service:
pktcMtaDevResetNow,
pktcMtaDevEnabled.
- All writable objects in the pktcMtaDevServer and
pktcMtaDevRealmTable groups share the potential, if SET maliciously,
to prevent an MTA from provisioning properly, hence there are
considered very sensitive for service delivery, in particular:
pktcMtaDevProvisioningTimer,
pktcMtaDevServerAddressType,
pktcMtaDevServerDns1,
pktcMtaDevServerDns2 - these two objects, if SET maliciously,
will prevent the MTA from being authenticated and consequently from
getting the telephony services.
pktcMtaDevSnmpEntity,
pktcMtaDevProvConfigHash,
pktcMtaDevProvConfigKey,
pktcMtaDevProvSolicitedKeyTimeout,
pktcMtaDevRealmName,
pktcMtaDevRealmOrgName,
pktcMtaDevRealmStatus - this object, if SET maliciously, would
cause the whole row of the table to be deleted which will deny the
prevent the MTA from getting the telephony services.
- All writable objects in the pktcMtaDevCmsTable table share the
potentional, if SET maliciously, to disrupt the telephony service by
altering which Call Management Server the MTA must send signaling
registration to, in particular:
pktcMtaDevCmsFqdn,
pktcMtaDevCmsKerbRealmName,
pktcMtaDevCmsMaxClockSkew,
pktcMtaDevCmsSolicitedKeyTimeout,
pktcMtaDevCmsUnsolicitedKeyMaxTimeout,
pktcMtaDevCmsUnsolicitedKeyNomTimeout,
pktcMtaDevRealmUnsolicitedKeyMaxRetries - this object, if set to
a zero value '0', may prevent an MTA from retry its attempt to
establish a security association with the CMS,
pktcMtaDevCmsStatus.
- The following objects, if SET maliciously will not have an
immediate effect on service but they may impact the service
performace and may cause avalanche attacks on provisioning servers
including Kerberos KDC servers on massive device reboots:
pktcMtaDevResetKrbTickets - if set to true, will cause an MTA to
request a new Kerberos ticket at reboot.
pktcMtaDevRealmPkinitGracePeriod - if set to short periods, will
cause MTA to renew its tickets more frequently,
pktcMtaDevRealmTgsGracePeriod (same as above),
Nechamkin/Mule Expires - November 2003 [Page 38]
PacketCable/IPCablecom MTA MIB May 2003
pktcMtaDevRealmUnsolicitedKeyMaxTimeout,
pktcMtaDevRealmUnsolicitedKeyNomTimeout.
Some of the readable objects in this MIB module may be considered
sensitive or vulnerable in some network environments. Some of these
objects may contain information that may be sensitive from a
business or customer perspective. It is thus important to control
even GET and/or NOTIFY access to these objects and possibly to even
encrypt the values of these objects when sending them over the
network via SNMP. These are the tables and objects and their
sensitivity/vulnerability:
- pktcMtaDevFQDN - "man-in-the-middle" type of security thread can
be posed by allowing an authorized access to the object,
- pktcMtaDevEndPntCount - object value may be used by attackers to
guess the endpoint names and maliciously ring any or all phones
attached to an MTA,
- pktcMtaDevHttpAccess - object value may be used by attackers to
block HTTP traffic, hence prevent configuration file download,
- pktcMtaDevServerDhcp1,
- pktcMtaDevServerDhcp2 - Values of these objects may be used by
attackers to launch Denial-of-Service attacks on the Telephony
Service Provider DHCP servers,
- pktcMtaDevProvKerbRealmName,
- pktcMtaDevManufacturerCertificate,
- pktcMtaDevCertificate,
- pktcMtaDevTelephonyRootCertificate - Values of these objects may
be used by attackers to launch Denial-of-Service attacks against
Kerberos servers.
SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPSec),
even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the
objects in this MIB module.
It is RECOMMENDED that implementers consider the security features
as provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for
authentication and privacy).
Further, deployment of SNMP versions prior to SNMPv3 is NOT
RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to
enable cryptographic security. It is then a customer/operator
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module is properly configured to give access to
the objects only to those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
Nechamkin/Mule Expires - November 2003 [Page 39]
PacketCable/IPCablecom MTA MIB May 2003
9. Intellectual Property
The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
document or the extent to which any license under such rights might
or might not be available; neither does it represent that it has
made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances
of licenses to be made available, or the result of an attempt made
to obtain a general license or permission for the use of such
proprietary rights by implementers or users of this specification
can be obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.
10. Authors' Addresses
Eugene Nechamkin
Broadcom Corporation,
200 - 13711 International Place
Richmond, BC, V6V 2Z8
CANADA
Phone: +1 604 233 8500
E-mail: enechamkin@broadcom.com
Jean-Francois Mule
Cable Television Laboratories, Inc.
400 Centennial Parkway Louisville
Colorado 80027-1266
U.S.A.
Phone: +1 303-661-9100
E-mail: jfm@cablelabs.com
11. Full Copyright Statement
The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the
Nechamkin/Mule Expires - November 2003 [Page 40]
PacketCable/IPCablecom MTA MIB May 2003
IETF's procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances
of licenses to be made available, or the result of an attempt made
to obtain a general license or permission for the use of such
proprietary rights by implementers or users of this specification
can be obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph
are included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Nechamkin/Mule Expires - November 2003 [Page 41]