-- *******************************************************************
-- CISCO-LWAPP-WLAN-SECURITY-MIB.my
-- December 2005, Bharat Biswal, Prasanna Viswakumar
--   
-- Copyright (c) 2005-2015 by Cisco Systems Inc.
-- All rights reserved.
-- *******************************************************************

CISCO-LWAPP-WLAN-SECURITY-MIB DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY,
    OBJECT-TYPE,
    Unsigned32
        FROM SNMPv2-SMI
    MODULE-COMPLIANCE,
    OBJECT-GROUP
        FROM SNMPv2-CONF
    TruthValue
        FROM SNMPv2-TC
    CLSecEncryptType,
    CLSecKeyFormat
        FROM CISCO-LWAPP-TC-MIB
    cLWlanIndex
        FROM CISCO-LWAPP-WLAN-MIB
    ciscoMgmt
        FROM CISCO-SMI;


ciscoLwappWlanSecurityMIB MODULE-IDENTITY
    LAST-UPDATED    "201506030000Z"
    ORGANIZATION    "Cisco Systems, Inc."
    CONTACT-INFO
            "Cisco Systems,
            Customer Service
            Postal: 170 West Tasman Drive
            San Jose, CA  95134
            USA
            Tel: +1 800 553-NETS

            Email: cs-wnbu-snmp@cisco.com"
    DESCRIPTION
        "This MIB is intended to be implemented on all those
        devices operating as Central controllers, that
        terminate the Light Weight Access Point Protocol
        tunnel from Cisco Light-weight LWAPP Access Points.

        Information provided by this MIB is for WLAN security
        related features as specified in the CCKM, CKIP 
        specifications. 

        The relationship between the controller and the 
        LWAPP APs is depicted as follows:

              +......+     +......+     +......+ 
              +      +     +      +     +      +
              +  CC  +     +  CC  +     +  CC  +
              +      +     +      +     +      +
              +......+     +......+     +......+
                ..            .             .   
                ..            .             .   
               .  .            .             .  
              .    .            .             . 
             .      .            .             .
            .        .            .             .
        +......+ +......+     +......+      +......+
        +      + +      +     +      +      +      +
        +  AP  + +  AP  +     +  AP  +      +  AP  +
        +      + +      +     +      +      +      +
        +......+ +......+     +......+      +......+
                   .              .             .
                 .  .              .             .
                .    .              .             .
               .      .              .             .
              .        .              .             .
           +......+ +......+     +......+      +......+
           +      + +      +     +      +      +      +
           +  MN  + +  MN  +     +  MN  +      +  MN  +
           +      + +      +     +      +      +      +
           +......+ +......+     +......+      +......+


        The LWAPP tunnel exists between the controller and
        the APs.  The MNs communicate with the APs through
        the protocol defined by the 802.11 standard.

        LWAPP APs, upon bootup, discover and join one of the
        controllers and the controller pushes the configuration,
        that includes the WLAN parameters, to the LWAPP APs.
        The APs then encapsulate all the 802.11 frames from
        wireless clients inside LWAPP frames and forward
        the LWAPP frames to the controller.

                           GLOSSARY

        802.1x

        The IEEE ratified standard for enforcing port based
        access control.  This was originally intended for
        use on wired LANs and later extended for use in
        802.11 WLAN environments.  This defines an
        architecture with three main parts - a supplicant
        (Ex. an 802.11 wireless client), an authenticator
        (the AP) and an authentication server(a Radius
        server).  The authenticator passes messages back
        and forth between the supplicant and the
        authentication server to enable the supplicant
        get authenticated to the network.

        Access Point ( AP )

        An entity that contains an 802.11 medium access
        control ( MAC ) and physical layer ( PHY ) interface
        and provides access to the distribution services via
        the wireless medium for associated clients.

        LWAPP APs encapsulate all the 802.11 frames in
        LWAPP frames and sends them to the controller to which
        it is logically connected.

        Advanced Encryption Standard ( AES )

        In cryptography, the Advanced Encryption Standard
        (AES), also known as Rijndael, is a block cipher
        adopted as an encryption standard by the US
        government. It is expected to be used worldwide
        and analysed extensively, as was the case with its
        predecessor, the Data Encryption Standard (DES).
        AES was adopted by National Institute of Standards
        and Technology (NIST) as US FIPS PUB 197 in
        November 2001 after a 5-year standardisation
        process.

        Central Controller ( CC )

        The central entity that terminates the LWAPP protocol
        tunnel from the LWAPP APs.  Throughout this MIB,
        this entity also referred to as 'controller'. 

        Cisco Centralized Key Management ( CCKM )

        Client and AP exchange several EAPOL packets in the
        process of EAP authenticaton to determine dynamic
        session key (NSK), which is used for encrypting
        packets between them.

        When client moves to new-AP, it has to mutually
        authenticate with the new-AP and derive new NSK. This
        is being done by using complete EAP authentication
        (which is time consuming and causes noticeable delay
        in the voice application). Till that time, no data
        packets are being transmitted between new-AP and
        client.

        CCKM implementation in first controller caches
        client's credentials like session, vlanid, ssid, etc.
        and propagates the same to other controllers in
        mobility group.

        Currently a set of controller can be configured as
        part of a mobility group. If client roams across
        access points associated to this set of controllers,
        then with CCKM implementation in place, the L2
        authentication will not happen. To make this happen
        a CCKM cache is maintained on each controller and the
        first controller where client gets associated update
        rest of the controllers in mobility group. On later
        reassociations, controller validates the CCKM specific
        IE present and allow associations.

        Wireless LAN Access Points (APs) manufactured by Cisco
        Systems have features and capabilities beyond those in
        related standards (e.g., IEEE 802.11 suite of
        standards, Wi-Fi recommendations by WECA, 802.1X
        security suite, etc). A number of features provide
        higher performance. For example, Cisco AP transmits a
        specific Information Element, which the clients adapt
        to for enhanced performance. Similarly, a number of
        features are implemented by means of proprietary
        Information Elements, which Cisco clients use in
        specific ways to carry out tasks above and beyond the
        standard.

        Other examples of feature categories are roaming and
        power saving.

        Cisco Key Integrity Protocol ( CKIP )

        A proprietary implementation similar to TKIP.  CKIP
        implements key permutation for protecting the CKIP
        key against attacks.  Other features of CKIP include
        expansion of encryption key to 16 bytes of length for
        key protection and MIC to ensure data integrity.

        Light Weight Access Point Protocol ( LWAPP )

        This is a generic protocol that defines the
        communication between the Access Points and the
        Central Controller.

        Mobile Node ( MN )

        A roaming 802.11 wireless device in a wireless
        network associated with an access point. Mobile Node
        and client are used interchangeably.

        Multilinear Modular Hash ( MMH )

        This is a message authentication code. The original
        message is run through the hash (with a secret key),
        and the code is the result.  The code is sent along
        with the original message.  The receiver of the
        message calculates the hash over the original message
        (also with the secret key) and compares the final
        message authentication code with the code sent with
        the message. If the two codes match, the receiver can
        be assured that the original message is authentic.

        Pre-Shared Key ( PSK )

        Pre-shared keys are normally used for
        interoperability purposes.  The basic idea is that
        two parties sharing a common secret can communicate
        securely.  This idea has been used since cryptography
        first sprung onto the scene.

        Temporal Key Integrity Protocol ( TKIP )

        A security protocol defined to enhance the limitations
        of WEP.  Message Integrity Check and per-packet keying
        on all WEP-encrypted frames are two significant
        enhancements provided by TKIP to WEP.

        Wired Equivalent Privacy ( WEP )

        A security method defined by 802.11. WEP uses a
        symmetric key stream cipher called RC4 to encrypt the
        data packets.

        Wi-Fi Protected Access ( WPA )

        Wi-Fi Protected Access (WPA and WPA2) are security
        systems created in response to several serious
        weaknesses found in Wired Equivalent Privacy (WEP).
        WPA implements the majority of the IEEE 802.11i
        standard, and was intended as an intermediate
        measure to take the place of WEP while 802.11i was
        prepared. WPA is designed to work with all wireless
        network interface cards, but not necessarily with
        first generation wireless access points.

        Protected Management Frame (PFM)

        Authentication, Authorization, and Accounting (AAA)

        Remote Authentication Dial In User Service (RADIUS)

        REFERENCE

        [1] Wireless LAN Medium Access Control ( MAC ) and
        Physical Layer ( PHY ) Specifications,
        Amendment 6, MAC Security Enhancements.

        [2] draft-obara-capwap-lwapp-00.txt, IETF Light 
        Weight Access Point Protocol"
    REVISION        "201506030000Z"
    DESCRIPTION
        "Added following OBJECT-GROUP:
        - ciscoLwappWlanSecurityAaaConfigGroup
        - ciscoLwappWlanSecurityFtConfigGroup
        - ciscoLwappWlanSecurityPfmConfigGroup
        - ciscoLwappWlanSecurityCckmConfigGroup1
        Added new compliance
        - ciscoLwappWlanSecurityMIBComplianceRev2."
    REVISION        "200801150000Z"
    DESCRIPTION
        "Added new cLWSecDot11EssWebPolicyTable and
        ciscoLwappWlanSecurityMIBComplianceRev1"
    REVISION        "200711080000Z"
    DESCRIPTION
        "Initial version of this MIB module."
    ::= { ciscoMgmt 521 }


ciscoLwappWlanSecurityMIBNotifs  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIB 0 }

ciscoLwappWlanSecurityMIBObjects  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIB 1 }

ciscoLwappWlanSecurityMIBConform  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIB 2 }

clwsCckmConfig  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIBObjects 1 }

clwsCkipConfig  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIBObjects 2 }

clwsWebPolicyConfig  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIBObjects 3 }

clwsAaaConfig  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIBObjects 4 }

-- ********************************************************************
-- Table to represent CISCO CCKM parameters
-- per each WLAN.
-- ********************************************************************

cLWSecDot11EssCckmTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CLWSecDot11EssCckmEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "This table represents the CCKM configuration
        for the WLANs configured on this controller.  

        There exist a row in this table corresponding to each
        row representing a WLAN in cLWlanConfigTable.  The
        controller adds or deletes a row to this table
        whenever a WLAN is added or deleted."
    ::= { clwsCckmConfig 1 }

cLWSecDot11EssCckmEntry OBJECT-TYPE
    SYNTAX          CLWSecDot11EssCckmEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "Each entry represents a conceptual row in
        cLWSecDot11EssCckmTable and uniquely identified
        by cLWlanIndex."
    INDEX           { cLWlanIndex } 
    ::= { cLWSecDot11EssCckmTable 1 }

CLWSecDot11EssCckmEntry ::= SEQUENCE {
        cLWSecDot11EssCckmWpaSupport   TruthValue,
        cLWSecDot11EssCckmWpa1Security TruthValue,
        cLWSecDot11EssCckmWpa1EncType  CLSecEncryptType,
        cLWSecDot11EssCckmWpa2Security TruthValue,
        cLWSecDot11EssCckmWpa2EncType  CLSecEncryptType,
        cLWSecDot11EssCckmKeyMgmtMode  BITS,
        cLWSecDot11EssPskFmt           CLSecKeyFormat,
        cLWSecDot11EssPsk              OCTET STRING,
        cLWSecDot11EssCckmGtkRandomize TruthValue,
        cLWSecDot11EssFtEnable         TruthValue,
        cLWSecDot11EssFtReassocTime    Unsigned32,
        cLWSecDot11EssFtOverDs         TruthValue,
        cLWSecDot11Ess11wPfm           INTEGER,
        cLWSecDot11EssRetryTime        Unsigned32,
        cLWSecDot11EssComebackTime     Unsigned32
}

cLWSecDot11EssCckmWpaSupport OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object is used to enable or disable layer-2
        security using WPA1 or WPA2.  When this 
        object is set to 'true'  layer-2 security is enabled.
        When this object is set to 'false' layer-2 security
        is disabled.

        When layer-2 security is enabled, the following objects 
        are only applied to environment and can be set.

          cLWSecDot11EssCckmWpa1Security
          cLWSecDot11EssCckmWpa1EncType
          cLWSecDot11EssCckmWpa2Security
          cLWSecDot11EssCckmWpa2EncType
          cLWSecDot11EssCckmKeyMgmtMode
          cLWSecDot11EssCckmGtkRandomize."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssCckmEntry 1 }

cLWSecDot11EssCckmWpa1Security OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies cckmwpa1 security is enabled or not.
        A value of 'true' indicates that WPA1 security
        is enabled on the controller.  A value of 'false'
        disables WPA1 security."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssCckmEntry 2 }

cLWSecDot11EssCckmWpa1EncType OBJECT-TYPE
    SYNTAX          CLSecEncryptType
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the type of WPA1 encryption
        configured on this WLAN.

        The value populated by this object is applicable
        only when cLWSecDot11EssCckmWpa1Security populates
        a value of 'true'."
    DEFVAL          { {  } } 
    ::= { cLWSecDot11EssCckmEntry 3 }

cLWSecDot11EssCckmWpa2Security OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies cckmwpa2 security is enabled or not.
        A value of 'true' indicates that WPA2 security
        is enabled on the controller.  A value of 'false'
        disables WPA2 security."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssCckmEntry 4 }

cLWSecDot11EssCckmWpa2EncType OBJECT-TYPE
    SYNTAX          CLSecEncryptType
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the type of WPA2 encryption
        configured on this WLAN.

        The value populated by this object is applicable
        only when cLWSecDot11EssCckmWpa2Security populates
        a value of 'true'."
    DEFVAL          { {  } } 
    ::= { cLWSecDot11EssCckmEntry 5 }

cLWSecDot11EssCckmKeyMgmtMode OBJECT-TYPE
    SYNTAX          BITS {
                        dot1x(0),
                        cckm(1),
                        psk(2),
                        ftDot1x(3),
                        ftPsk(4),
                        pfmDot1x(5),
                        pfmPsk(6)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the type of authentication
        key management that is applicable only when
        cLWSecDot11EssCckmWpaSupport is set to a value of
        'true'.

        The following are the possible key management
        configurations allowed and accepted by the system.

        dot1x(0) + cckm(1) 
        dot1x(0) only
        cckm(1)  only
        psk(2)   only
        ftDot1x(3) only
        ftPsk(4) only
        psk(2) + ftPsk(4)
        dot1x(0) + ftDot1x(3)
        dot1x(0) + cckm(1) + ftDot1x(3)
        dot1x(0) + cckm(1) + pfmDot1x(5)
        dot1x(0) + pfmDot1x(5)
        cckm(1) + pfmDot1x(5)
        psk(2) + pfmPsk(6)"
    DEFVAL          { { dot1x } } 
    ::= { cLWSecDot11EssCckmEntry 6 }

cLWSecDot11EssPskFmt OBJECT-TYPE
    SYNTAX          CLSecKeyFormat
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the type of the
        authentication preshared key configured through
        the object cLWSecDot11EssCckmPsk.  Note
        that the key configuration is applicable only
        when psk is configured as the key management
        mechanism through the 
        cLWSecDot11EssCckmKeyMgmtMode object."
    DEFVAL          { default } 
    ::= { cLWSecDot11EssCckmEntry 7 }

cLWSecDot11EssPsk OBJECT-TYPE
    SYNTAX          OCTET STRING (SIZE  (8..64))
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the authentication pre-shared
        key in the hex format that is applicable only when
        the 'psk' bit is specified in the 
        cLWSecDot11EssCckmKeyMgmtMode object.

        The length of the key that can be specified for
        the cLWSecDot11EssPsk object depends on the
        value of the cLWSecDot11EssPskFmt object as  
        follows.

        'ascii'    8-63 octets
        'hex'      32 octets." 
    ::= { cLWSecDot11EssCckmEntry 8 }

cLWSecDot11EssCckmGtkRandomize OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies whether the Group Temporal
        Key(GTK) randomization is enabled for a WLAN.

        A value of 'true' indicates that GTK randomization
        is enabled.  A value of 'false' indicates that GTK
        randomization is disabled." 
    ::= { cLWSecDot11EssCckmEntry 9 }

cLWSecDot11EssFtEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies whether fast transition is enabled
        for particular WLAN.

        A value of 'true' means that fast transition is enabled and
        a value of 'false' means that
        fast transition is disabled." 
    ::= { cLWSecDot11EssCckmEntry 10 }

cLWSecDot11EssFtReassocTime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "seconds"
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the fast transition
        re-association time." 
    ::= { cLWSecDot11EssCckmEntry 11 }

cLWSecDot11EssFtOverDs OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies whether fast transition over
        distributed system is enabled.

        A value of 'true' means that fast transition over the
        distributed system is enabled and a value of 'false' means
        fast transition over the distributed system is disabled." 
    ::= { cLWSecDot11EssCckmEntry 12 }

cLWSecDot11Ess11wPfm OBJECT-TYPE
    SYNTAX          INTEGER  {
                        disabled(1),
                        optional(2),
                        required(3)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the 802.11w PFM configuration for a
        particular WLAN." 
    ::= { cLWSecDot11EssCckmEntry 13 }

cLWSecDot11EssRetryTime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "milliseconds"
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the 802.11w Security Association(SA)
        query retry timeout." 
    ::= { cLWSecDot11EssCckmEntry 14 }

cLWSecDot11EssComebackTime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "seconds"
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the 802.11w association comeback time." 
    ::= { cLWSecDot11EssCckmEntry 15 }
 

-- ********************************************************************
-- Table to represent CKIP parameters
-- per each WLAN.
-- ********************************************************************

cLWSecDot11EssCkipTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CLWSecDot11EssCkipEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "This table represents the CKIP parameters of a
        WLAN.

        This is a new layer-2 security policy similar to 
        static WEP.  User can select this policy on a WLAN.  
        This policy will be allowed to be configured only when 
        Aironet Extensions are enabled on the WLAN.

        Once user has selected CKIP he will be given an option 
        to : 
            1> configure key 
            2> select  MMH 

        There exist a row in this table corresponding to each
        row representing a WLAN in cLWlanConfigTable.  The
        controller adds or deletes a row to this table
        whenever a WLAN is added or deleted."
    ::= { clwsCckmConfig 2 }

cLWSecDot11EssCkipEntry OBJECT-TYPE
    SYNTAX          CLWSecDot11EssCkipEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "Each entry represents a conceptual row in
        cLWSecDot11EssCkipTable and uniquely identified
        by cLWlanIndex."
    INDEX           { cLWlanIndex } 
    ::= { cLWSecDot11EssCkipTable 1 }

CLWSecDot11EssCkipEntry ::= SEQUENCE {
        cLWSecDot11EssCkipSecurity  TruthValue,
        cLWSecDot11EssCkipKeyIndex  Unsigned32,
        cLWSecDot11EssCkipKeyLength INTEGER,
        cLWSecDot11EssCkipKeyFmt    CLSecKeyFormat,
        cLWSecDot11EssCkipKey       OCTET STRING,
        cLWSecDot11EssCkipMMHMode   TruthValue,
        cLWSecDot11EssCkipKPEnable  TruthValue
}

cLWSecDot11EssCkipSecurity OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object is used to enable to disable layer-2
        CKIP as security policy for this WLAN.  When this 
        object is set to 'true', layer-2 CKIP security is
        enabled.  When this object is set to 'false',
        layer-2 CKIP security is disabled."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssCkipEntry 1 }

cLWSecDot11EssCkipKeyIndex OBJECT-TYPE
    SYNTAX          Unsigned32 (0..4)
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the key index corresponding
        to the key being configured.  A value of 0 indicates
        that the CKIP key hasn't been configured."
    DEFVAL          { 0 } 
    ::= { cLWSecDot11EssCkipEntry 2 }

cLWSecDot11EssCkipKeyLength OBJECT-TYPE
    SYNTAX          INTEGER  {
                        none(1),
                        len40(2),
                        len104(3)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the length of CKIP key in bits
        that is applicable only when cLWSecDot11EssCkipSecurity
        is set as 'true'."
    DEFVAL          { none } 
    ::= { cLWSecDot11EssCkipEntry 3 }

cLWSecDot11EssCkipKeyFmt OBJECT-TYPE
    SYNTAX          CLSecKeyFormat
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the type of the key
        configured through the object
        cLWSecDot11EssCkipKey."
    DEFVAL          { default } 
    ::= { cLWSecDot11EssCkipEntry 4 }

cLWSecDot11EssCkipKey OBJECT-TYPE
    SYNTAX          OCTET STRING (SIZE  (5..26))
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the CKIP key that is
        applicable only when cLWSecDot11EssCkipSecurity
        is set as 'true'.

        The number of characters to be configured depends
        on the key length and the key type configured through
        the objects cLWSecDot11EssCkipKeyLength and
        cLWSecDot11EssCkipKeyFmt respectively.

        The combinations are as follows.

        Key Type          Number of characters

         hex         10/26 hex characters for 40/104 bits
         ascii       5/13  ascii characters for 40/104 bits.

         When cLWSecDot11EssCkipKeyFmt is set to 'hex',
         cLWSecDot11EssCkipKey can only be set to 
         hexadecimal characters.

         To ensure consistency the following objects must be
         set together.
            cLWSecDot11EssCkipKeyFmt
            cLWSecDot11EssCkipKeyIndex
            cLWSecDot11EssCkipKeyLength 
            cLWSecDot11EssCkipKey." 
    ::= { cLWSecDot11EssCkipEntry 5 }

cLWSecDot11EssCkipMMHMode OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object is used to enable or disable MMH MIC
        mode for the CKIP for this WLAN. 

        'true' -  MMH MIC mode is enabled
        'false' -  MMH MIC mode is disabled."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssCkipEntry 6 }

cLWSecDot11EssCkipKPEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies whether CKIP is enabled.
        When the value is set to 'true', the encryption
        keys will be generated by permuting the static CKIP
        key configured through cLWSecDot11EssCkipKey."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssCkipEntry 7 }
 

-- ********************************************************************
-- Table to represent CISCO WEB-CONDITIONAL-REDIRECT parameters
-- per each WLAN.
-- ********************************************************************

cLWSecDot11EssWebPolicyTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CLWSecDot11EssWebPolicyEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "This table represents the conditional web-redirect
        parameters for the WLANs configured on this controller.  

        There exist a row in this table corresponding to each
        row representing a WLAN in cLWlanConfigTable.  The
        controller adds or deletes a row to this table
        whenever a WLAN is added or deleted."
    ::= { clwsWebPolicyConfig 1 }

cLWSecDot11EssWebPolicyEntry OBJECT-TYPE
    SYNTAX          CLWSecDot11EssWebPolicyEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "Each entry represents a conceptual row in
        cLWSecDot11EssWebPolicyTable and uniquely identified
        by cLWlanIndex."
    INDEX           { cLWlanIndex } 
    ::= { cLWSecDot11EssWebPolicyTable 1 }

CLWSecDot11EssWebPolicyEntry ::= SEQUENCE {
        cLWSecDot11EssWebPolicyCondRedirect          TruthValue,
        cLWSecDot11EssWebPolicySplashPageWebRedirect TruthValue
}

cLWSecDot11EssWebPolicyCondRedirect OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object is used to enable or disable conditional redirect.

        When this attribute is 'true', it signifies that conditional 
        redirect is enabled and redirection of the client is done
        based on the url-redirect attribute provided by radius server.

        When this attribute is 'false', it signifies that conditional 
        redirect is disabled and redirection of the client is not 
        done, even if the url-redirect attribute is provided by the 
        radius server.

        This attribute can be enabled only when 802.1x has been configured
        as layer-2 security the wlan and web policy is enabled on the wlan."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssWebPolicyEntry 1 }

cLWSecDot11EssWebPolicySplashPageWebRedirect OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object is used to enable or disable splash page web
        redirect.

        When this attribute is 'true', it signifies that splash page 
        redirect is enabled and redirection of the client is done
        based on the url-redirect attribute provided by radius server.
        The redirect function works only for HTTP traffic.
        HTTPS redirect is not supported for any of the Web Policies.

        When this attribute is 'false', it signifies that splash page 
        redirect is disabled and redirection of the client is not 
        done.

        This attribute can be enabled only when 802.1x or WPA1+WPA2
        has been configured as layer-2 security on the wlan."
    DEFVAL          { false } 
    ::= { cLWSecDot11EssWebPolicyEntry 2 }
 


cLWSecAaaRadiusAuthCallStationIdType OBJECT-TYPE
    SYNTAX          INTEGER  {
                        ipAddr(1),
                        macAddr(2),
                        apMacAddress(3),
                        apMacAddressSsid(4),
                        apNameSsid(5),
                        apName(6),
                        apGroupName(7),
                        apLocation(8),
                        apVlanId(9),
                        apMacEthAddress(10),
                        apMacEthAddressSsid(11),
                        apLabelAddress(12),
                        apLabelAddressSsid(13)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the configured the call station ID
        information sent in RADIUS authentication messages." 
    ::= { clwsAaaConfig 1 }

cLWSecAaaRadiusAccUsernameDelimiter OBJECT-TYPE
    SYNTAX          INTEGER  {
                        noDelimiter(1),
                        hyphen(2),
                        colon(3),
                        singleHyphen(4)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the delimiter to be used when
        displaying the username for accounting request.

        For example, if the value of the username for accounting
        request is 1234567890ab.

        noDelimiter  - display it as 1234567890ab.
        hyphen       - display it as 12-34-56-78-90-ab
        colon        - display it as 12:34:56:78:90:ab
        singleHyphen - display it as 123456-7890ab" 
    ::= { clwsAaaConfig 2 }
-- ********************************************************************
-- *    Compliance statements
-- ********************************************************************

ciscoLwappWlanSecurityMIBCompliances  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIBConform 1 }

ciscoLwappWlanSecurityMIBGroups  OBJECT IDENTIFIER
    ::= { ciscoLwappWlanSecurityMIBConform 2 }


ciscoLwappWlanSecurityMIBCompliance MODULE-COMPLIANCE
    STATUS          deprecated
    DESCRIPTION
        "The compliance statement for the SNMP entities that
        implement the ciscoLwappWlanSecurityMIB module."
    MODULE          -- this module
    MANDATORY-GROUPS {
                        ciscoLwappWlanSecurityCckmConfigGroup,
                        ciscoLwappWlanSecurityCkipConfigGroup
                    }
    ::= { ciscoLwappWlanSecurityMIBCompliances 1 }

ciscoLwappWlanSecurityMIBComplianceRev1 MODULE-COMPLIANCE
    STATUS          deprecated
    DESCRIPTION
        "The compliance statement for the SNMP entities that
        implement the ciscoLwappWlanSecurityMIB module."
    MODULE          -- this module
    MANDATORY-GROUPS {
                        ciscoLwappWlanSecurityCckmConfigGroup,
                        ciscoLwappWlanSecurityCkipConfigGroup,
                        ciscoLwappWlanSecurityWebPolicyConfigGroup
                    }
    ::= { ciscoLwappWlanSecurityMIBCompliances 2 }

ciscoLwappWlanSecurityMIBComplianceRev2 MODULE-COMPLIANCE
    STATUS          current
    DESCRIPTION
        "The compliance statement for the SNMP entities that
        implement the ciscoLwappWlanSecurityMIB module."
    MODULE          -- this module
    MANDATORY-GROUPS {
                        ciscoLwappWlanSecurityCckmConfigGroup,
                        ciscoLwappWlanSecurityCkipConfigGroup,
                        ciscoLwappWlanSecurityWebPolicyConfigGroup
                    }

    GROUP           ciscoLwappWlanSecurityAaaConfigGroup
    DESCRIPTION
        "This group is mandatory for platforms which support
        AAA related security parameters on a WLAN."

    GROUP           ciscoLwappWlanSecurityFtConfigGroup
    DESCRIPTION
        "This group is mandatory for platforms which support
        fast transition on a WLAN."

    GROUP           ciscoLwappWlanSecurityPfmConfigGroup
    DESCRIPTION
        "This group is mandatory for platforms which support
        PFM related security parameters on a WLAN."

    GROUP           ciscoLwappWlanSecurityCckmConfigGroup1
    DESCRIPTION
        "This group is mandatory for platforms which support
        GTK randomization information."

    OBJECT          cLWSecDot11EssCckmWpaSupport
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCckmWpa1Security
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCckmWpa1EncType
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCckmWpa2Security
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCckmWpa2EncType
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCckmKeyMgmtMode
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssPskFmt
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssPsk
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCckmGtkRandomize
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssFtEnable
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssFtReassocTime
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssFtOverDs
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11Ess11wPfm
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssRetryTime
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssComebackTime
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCkipSecurity
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCkipKeyIndex
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCkipKeyLength
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCkipKeyFmt
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCkipKey
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCkipMMHMode
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssCkipKPEnable
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssWebPolicyCondRedirect
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecDot11EssWebPolicySplashPageWebRedirect
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecAaaRadiusAuthCallStationIdType
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cLWSecAaaRadiusAccUsernameDelimiter
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."
    ::= { ciscoLwappWlanSecurityMIBCompliances 3 }

-- ********************************************************************
-- *    Units of conformance
-- ********************************************************************

ciscoLwappWlanSecurityCckmConfigGroup OBJECT-GROUP
    OBJECTS         {
                        cLWSecDot11EssCckmWpaSupport,
                        cLWSecDot11EssCckmWpa1Security,
                        cLWSecDot11EssCckmWpa1EncType,
                        cLWSecDot11EssCckmWpa2Security,
                        cLWSecDot11EssCckmWpa2EncType,
                        cLWSecDot11EssCckmKeyMgmtMode,
                        cLWSecDot11EssPskFmt,
                        cLWSecDot11EssPsk
                    }
    STATUS          current
    DESCRIPTION
        "This collection of objects represents CCKM
        related security parameters on a WLAN.  The
        collection also configures the pre-shared keys
        when PSK is configured as the key management
        type."
    ::= { ciscoLwappWlanSecurityMIBGroups 1 }

ciscoLwappWlanSecurityCkipConfigGroup OBJECT-GROUP
    OBJECTS         {
                        cLWSecDot11EssCkipSecurity,
                        cLWSecDot11EssCkipKeyIndex,
                        cLWSecDot11EssCkipKeyLength,
                        cLWSecDot11EssCkipKeyFmt,
                        cLWSecDot11EssCkipKey,
                        cLWSecDot11EssCkipMMHMode,
                        cLWSecDot11EssCkipKPEnable
                    }
    STATUS          current
    DESCRIPTION
        "This collection of objects represents CKIP
        related security parameters on a WLAN."
    ::= { ciscoLwappWlanSecurityMIBGroups 2 }

ciscoLwappWlanSecurityWebPolicyConfigGroup OBJECT-GROUP
    OBJECTS         {
                        cLWSecDot11EssWebPolicyCondRedirect,
                        cLWSecDot11EssWebPolicySplashPageWebRedirect
                    }
    STATUS          current
    DESCRIPTION
        "This collection of objects represents
        conditional redirect parameters on a WLAN."
    ::= { ciscoLwappWlanSecurityMIBGroups 3 }

ciscoLwappWlanSecurityAaaConfigGroup OBJECT-GROUP
    OBJECTS         {
                        cLWSecAaaRadiusAuthCallStationIdType,
                        cLWSecAaaRadiusAccUsernameDelimiter
                    }
    STATUS          current
    DESCRIPTION
        "This collection of objects represents AAA
        related security parameters on a WLAN."
    ::= { ciscoLwappWlanSecurityMIBGroups 4 }

ciscoLwappWlanSecurityFtConfigGroup OBJECT-GROUP
    OBJECTS         {
                        cLWSecDot11EssFtEnable,
                        cLWSecDot11EssFtReassocTime,
                        cLWSecDot11EssFtOverDs
                    }
    STATUS          current
    DESCRIPTION
        "This collection of objects represents fast transition
        related security parameters on a WLAN."
    ::= { ciscoLwappWlanSecurityMIBGroups 5 }

ciscoLwappWlanSecurityPfmConfigGroup OBJECT-GROUP
    OBJECTS         {
                        cLWSecDot11Ess11wPfm,
                        cLWSecDot11EssRetryTime,
                        cLWSecDot11EssComebackTime
                    }
    STATUS          current
    DESCRIPTION
        "This collection of objects represents PFM
        related security parameters on a WLAN."
    ::= { ciscoLwappWlanSecurityMIBGroups 6 }

ciscoLwappWlanSecurityCckmConfigGroup1 OBJECT-GROUP
    OBJECTS         { cLWSecDot11EssCckmGtkRandomize }
    STATUS          current
    DESCRIPTION
        "This collection of objects represents GTK
        randomization information."
    ::= { ciscoLwappWlanSecurityMIBGroups 7 }

END












































































