-- *****************************************************************
-- CISCO-TRUSTSEC-POLICY-MIB.my
--   
-- November 2009, Edward Pham 
--   
-- Copyright (c) 2009 by cisco Systems Inc.
-- All rights reserved.
--   
-- *****************************************************************

CISCO-TRUSTSEC-POLICY-MIB DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY,
    OBJECT-TYPE,
    Unsigned32,
    Counter64
        FROM SNMPv2-SMI

    MODULE-COMPLIANCE,
    OBJECT-GROUP
        FROM SNMPv2-CONF
    
    TruthValue,
    DateAndTime,
    StorageType,
    RowStatus
        FROM SNMPv2-TC

    ifIndex
        FROM IF-MIB

    CtsSecurityGroupTag,
    CtsGenerationId,
    CtsAclName,
    CtsAclList,
    CtsAclListOrEmpty, 
    CtsAclNameOrEmpty
        FROM CISCO-TRUSTSEC-TC-MIB

    InetAddressType,
    InetAddress,
    InetAddressPrefixLength
        FROM INET-ADDRESS-MIB

    SnmpAdminString
        FROM SNMP-FRAMEWORK-MIB

    VlanIndex
        FROM Q-BRIDGE-MIB

    CiscoVrfName 
        FROM CISCO-TC 

    ciscoMgmt
        FROM CISCO-SMI;

ciscoTrustSecPolicyMIB MODULE-IDENTITY
    LAST-UPDATED    "200911060000Z"
    ORGANIZATION    "Cisco Systems, Inc."
    CONTACT-INFO
            "Cisco Systems
            Customer Service

            Postal: 170 W Tasman Drive
            San Jose, CA  95134
            USA

            Tel: +1 800 553-NETS

            E-mail: cs-lan-switch-snmp@cisco.com"
    DESCRIPTION
        "This MIB module defines managed objects that facilitate the
        management of various policies within the Cisco Trusted Security
        (TrustSec) infrastructure. 

        The information available through this MIB includes:

        o Device and interface level configuration for enabling
          SGACL (Security Group Access Control List) enforcement
          on Layer2/3 traffic. 

        o Administrative and operational SGACL mapping to Security
          Group Tag (SGT). 

        o Various statistics counters for traffic subject to SGACL
          enforcement. 

        o TrustSec policies with respect to peer device. 

        o Interface level configuration for enabling the propagation
          of SGT along with the Layer 3 traffic in portions of network
          which does not have the capability to support TrustSec 
          feature. 
          
        o TrustSec policies with respect to SGT propagation with
          Layer 3 traffic. 
        
        The following terms are used throughout this MIB:

        VRF:   Virtual Routing and Forwarding.
   
        SGACL: Security Group Access Control List.

        SXP: SGT Propagation Protocol.

        SVI: Switch Virtual Interface.

        SGT (Security Group Tag) is a unique 16 bits value assigned
        to every security group and used by network devices to
        enforce SGACL.

        Peer is another device connected to the local device on the
        other side of a TrustSec link.

        Default Policy:  Policy applied to traffic when there is 
        no explicit policy between the SGT associated with the 
        originator of the traffic and the SGT associated with 
        the destination of the traffic." 
    REVISION        "200911060000Z"
    DESCRIPTION
        "Initial version of this MIB module."
    ::= { ciscoMgmt 713 }


ciscoTrustSecPolicyMIBNotifs  OBJECT IDENTIFIER
    ::= { ciscoTrustSecPolicyMIB 0 }

ciscoTrustSecPolicyMIBObjects  OBJECT IDENTIFIER
    ::= { ciscoTrustSecPolicyMIB 1 }

ciscoTrustSecPolicyMIBConformance  OBJECT IDENTIFIER
    ::= { ciscoTrustSecPolicyMIB 2 }


ctspSgacl
    OBJECT IDENTIFIER ::= { ciscoTrustSecPolicyMIBObjects 1 }
ctspPeerPolicy
    OBJECT IDENTIFIER ::= { ciscoTrustSecPolicyMIBObjects 2 }
ctspLayer3Transport
    OBJECT IDENTIFIER ::= { ciscoTrustSecPolicyMIBObjects 3 }
ctspIpSgtMappings
    OBJECT IDENTIFIER ::= { ciscoTrustSecPolicyMIBObjects 4 }
ctspSgtPolicy
    OBJECT IDENTIFIER ::= { ciscoTrustSecPolicyMIBObjects 5 }

ctspSgaclGlobals
    OBJECT IDENTIFIER ::= { ctspSgacl 1 }
ctspSgaclMappings
    OBJECT IDENTIFIER ::= { ctspSgacl 2 }
ctspSgaclStatistics
    OBJECT IDENTIFIER ::= { ctspSgacl 3 }

--
--  ctspSgaclGlobals
--

ctspSgaclEnforcementEnable OBJECT-TYPE
    SYNTAX        INTEGER {
                      none(1),
                      l3Only(2)
                  } 
    MAX-ACCESS    read-write
    STATUS        current
    DESCRIPTION
        "This object specifies whether SGACL enforcement for all 
         Layer 3 interfaces (excluding SVIs) is enabled at the 
         managed system. 

         'none' indicates that SGACL enforcement for all Layer 3
         interfaces (excluding SVIs) is disabled.
         
         'l3Only' indicates that SGACL enforcement is enabled on
         every TrustSec capable Layer3 interface (excluding SVIs)
         in the device." 
    ::= { ctspSgaclGlobals 1 } 

ctspSgaclIpv4DropNetflowMonitor OBJECT-TYPE
    SYNTAX        SnmpAdminString 
    MAX-ACCESS    read-write
    STATUS        current
    DESCRIPTION
        "This object specifies an existing flexible netflow monitor
        name used to collect and export the IPv4 traffic dropped
        packets statistics due to SGACL enforcement. The zero-length
        string indicates that no such netflow monitor is configured
        in the device." 
    ::= { ctspSgaclGlobals 2 } 

ctspSgaclIpv6DropNetflowMonitor OBJECT-TYPE
    SYNTAX        SnmpAdminString 
    MAX-ACCESS    read-write
    STATUS        current
    DESCRIPTION
        "This object specifies an existing flexible netflow monitor
        name used to collect and export the IPv6 traffic dropped
        packets statistics due to SGACL enforcement. The zero-length
        string indicates that no such netflow monitor is configured
        in the device." 
    ::= { ctspSgaclGlobals 3 } 


ctspVlanConfigTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspVlanConfigEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table lists the SGACL enforcement for Layer 2 and 
         Layer 3 switched packet in a VLAN as well as VRF information
         for VLANs in the device." 
    ::= { ctspSgaclGlobals 4 }

ctspVlanConfigEntry OBJECT-TYPE
    SYNTAX        CtspVlanConfigEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the SGACL enforcement information 
         for Layer 2 and Layer 3 switched packets in a VLAN 
         identified by its VlanIndex value. Entry in this
         table is populated for VLANs which contains SGACL
         enforcement or VRF configuration."
    INDEX { ctspVlanConfigIndex }
    ::= { ctspVlanConfigTable 1 }

CtspVlanConfigEntry ::= SEQUENCE {
    ctspVlanConfigIndex            VlanIndex,
    ctspVlanConfigSgaclEnforcement TruthValue,
    ctspVlanSviActive              TruthValue,
    ctspVlanConfigVrfName          CiscoVrfName,
    ctspVlanConfigStorageType      StorageType,
    ctspVlanConfigRowStatus        RowStatus 
}

ctspVlanConfigIndex OBJECT-TYPE
    SYNTAX          VlanIndex 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the VLAN-ID of this VLAN." 
    ::= { ctspVlanConfigEntry 1 }

ctspVlanConfigSgaclEnforcement OBJECT-TYPE
    SYNTAX          TruthValue 
    MAX-ACCESS      read-create
    STATUS          current
    DESCRIPTION
        "This object specifies the configured SGACL enforcement
        status for this VLAN i.e., 'true' = enabled and 
        'false' = disabled." 
    ::= { ctspVlanConfigEntry 2 }

ctspVlanSviActive OBJECT-TYPE
    SYNTAX          TruthValue 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates if there is an active SVI
        associated with this VLAN.
        
        'true' indicates that there is an active SVI associated
        with this VLAN. and SGACL is enforced for both Layer 2 and 
        Layer 3 switched packets within that VLAN. 

        'false' indicates that there is no active SVI associated
        with this VLAN, and SGACL is only enforced for Layer 2 
        switched packets within that VLAN." 
    ::= { ctspVlanConfigEntry 3 }

ctspVlanConfigVrfName OBJECT-TYPE
    SYNTAX          CiscoVrfName 
    MAX-ACCESS      read-create
    STATUS          current
    DESCRIPTION
        "This object specifies an existing VRF where this VLAN 
         belongs to. The zero length value indicates this VLAN
         belongs to the default VRF."
    ::= { ctspVlanConfigEntry 4 }

ctspVlanConfigStorageType OBJECT-TYPE
    SYNTAX          StorageType
    MAX-ACCESS      read-create
    STATUS          current
    DESCRIPTION
        "The objects specifies the storage type for this conceptual
        row."
    DEFVAL          { volatile }
    ::= { ctspVlanConfigEntry 5 }

ctspVlanConfigRowStatus OBJECT-TYPE
    SYNTAX          RowStatus 
    MAX-ACCESS      read-create
    STATUS          current
    DESCRIPTION
        "The status of this conceptual row entry. This object
        is used to manage creation and deletion of rows in this
        table. When this object value is 'active', other
        writable objects in the same row cannot be modified."
    ::= { ctspVlanConfigEntry 6 }

--
--  ctspSgaclMappings
--

ctspConfigSgaclMappingTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspConfigSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table contains the SGACLs information which is
         applied to unicast IP traffic which carries a source SGT
         and travels to a destination SGT."
    ::= { ctspSgaclMappings 1 }

ctspConfigSgaclMappingEntry OBJECT-TYPE
    SYNTAX        CtspConfigSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the SGACL mapping to source and destination SGT
         for a certain traffic type as well as status of this instance. 
         A row instance can be created or removed by setting the appropriate
         value of its RowStatus object."
    INDEX { ctspConfigSgaclMappingIpTrafficType,
            ctspConfigSgaclMappingDestSgt,
            ctspConfigSgaclMappingSourceSgt }
    ::= { ctspConfigSgaclMappingTable 1 }

CtspConfigSgaclMappingEntry ::= SEQUENCE {
    ctspConfigSgaclMappingIpTrafficType  INTEGER,
    ctspConfigSgaclMappingDestSgt        CtsSecurityGroupTag, 
    ctspConfigSgaclMappingSourceSgt      CtsSecurityGroupTag, 
    ctspConfigSgaclMappingSgaclName      CtsAclList, 
    ctspConfigSgaclMappingStorageType    StorageType, 
    ctspConfigSgaclMappingRowStatus      RowStatus
}

ctspConfigSgaclMappingIpTrafficType OBJECT-TYPE
    SYNTAX          INTEGER { ipv4(1), ipv6(2) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the unicast IP traffic
         carrying the source SGT and travelling to destination
         SGT and subjected to SGACL enforcement." 
    ::= { ctspConfigSgaclMappingEntry 1 }

ctspConfigSgaclMappingDestSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the destination SGT value. Value of
         zero indicates that the destination SGT is unknown." 
    ::= { ctspConfigSgaclMappingEntry 2 }

ctspConfigSgaclMappingSourceSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the source SGT value. Value of zero
        indicates that the source SGT is unknown."
    ::= { ctspConfigSgaclMappingEntry 3 }

ctspConfigSgaclMappingSgaclName OBJECT-TYPE
    SYNTAX          CtsAclList
    MAX-ACCESS      read-create 
    STATUS          current
    DESCRIPTION
        "This object specifies the list of existing SGACLs which is 
         administratively configured to apply to unicast IP traffic
         carrying the source SGT to the destination SGT." 
    ::= { ctspConfigSgaclMappingEntry 4 }

ctspConfigSgaclMappingStorageType OBJECT-TYPE
    SYNTAX          StorageType
    MAX-ACCESS      read-create
    STATUS          current
    DESCRIPTION
        "The storage type for this conceptual row."
    DEFVAL          { volatile }
    ::= { ctspConfigSgaclMappingEntry 5 }

ctspConfigSgaclMappingRowStatus OBJECT-TYPE
    SYNTAX          RowStatus 
    MAX-ACCESS      read-create 
    STATUS          current
    DESCRIPTION
        "This object is used to manage the creation and deletion
         of rows in this table. ctspConfigSgaclName may be modified
         at any time." 
    ::= { ctspConfigSgaclMappingEntry 6 }

ctspDefConfigIpv4Sgacls OBJECT-TYPE
    SYNTAX        CtsAclListOrEmpty 
    MAX-ACCESS    read-write
    STATUS        current
    DESCRIPTION
        "This object specifies the SGACLs of the unicast default 
        policy for IPv4 traffic. If there is no SGACL configured
        for unicast default policy for IPv4 traffic, the value of
        this object is the zero-length string." 
    ::= { ctspSgaclMappings 2 } 

ctspDefConfigIpv6Sgacls OBJECT-TYPE
    SYNTAX        CtsAclListOrEmpty 
    MAX-ACCESS    read-write
    STATUS        current
    DESCRIPTION
        "This object specifies the SGACLs of the unicast default 
        policy for IPv6 traffic. If there is no SGACL configured
        for unicast default policy for IPv6 traffic, the value of
        this object is the zero-length string." 
    ::= { ctspSgaclMappings 3 } 


--
--  The ctspDownloadedSgaclMappingTable
--

ctspDownloadedSgaclMappingTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspDownloadedSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table contains the downloaded SGACLs information
         applied to unicast IP traffic which carries a source SGT 
         and travels to a destination SGT."
    ::= { ctspSgaclMappings 4 }

ctspDownloadedSgaclMappingEntry OBJECT-TYPE
    SYNTAX        CtspDownloadedSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the downloaded SGACLs mapping.
         A row instance is added for each pair of <source SGT,
         destination SGT> which contains SGACL that 
         is dynamically downloaded from ACS server." 
    INDEX { ctspDownloadedSgaclDestSgt, 
            ctspDownloadedSgaclSourceSgt,
            ctspDownloadedSgaclIndex }
    ::= { ctspDownloadedSgaclMappingTable 1 }

CtspDownloadedSgaclMappingEntry ::= SEQUENCE {
    ctspDownloadedSgaclDestSgt   CtsSecurityGroupTag, 
    ctspDownloadedSgaclSourceSgt CtsSecurityGroupTag, 
    ctspDownloadedSgaclIndex     Unsigned32,
    ctspDownloadedSgaclName      CtsAclName,
    ctspDownloadedSgaclGenId     CtsGenerationId,
    ctspDownloadedIpTrafficType  BITS
}

ctspDownloadedSgaclDestSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the destination SGT value. Value of
         zero indicates that the destination SGT is unknown." 
    ::= { ctspDownloadedSgaclMappingEntry 1 }

ctspDownloadedSgaclSourceSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the source SGT value. Value of
         zero indicates that the source SGT is unknown." 
    ::= { ctspDownloadedSgaclMappingEntry 2 }

ctspDownloadedSgaclIndex OBJECT-TYPE
    SYNTAX          Unsigned32 (1..65535) 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object identifies the downloaded SGACL which is 
         applied to unicast IP traffic carrying the source SGT 
         to the destination SGT."
    ::= { ctspDownloadedSgaclMappingEntry 3 }

ctspDownloadedSgaclName OBJECT-TYPE
    SYNTAX          CtsAclName
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the name of downloaded SGACL
         which is applied to unicast IP traffic carrying the source
         SGT to the destination SGT."
    ::= { ctspDownloadedSgaclMappingEntry 4 }

ctspDownloadedSgaclGenId OBJECT-TYPE
    SYNTAX          CtsGenerationId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the generation identification of 
         downloaded SGACL which is applied to unicast IP traffic 
         carrying the source SGT to the destination SGT."
    ::= { ctspDownloadedSgaclMappingEntry 5 }

ctspDownloadedIpTrafficType OBJECT-TYPE
    SYNTAX          BITS { ipv4(0), ipv6(1) } 
    MAX-ACCESS      read-only 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the unicast IP traffic
         carrying the source SGT and travelling to destination
         SGT and subjected to SGACL enforcement by this downloaded
         default policy."
    ::= { ctspDownloadedSgaclMappingEntry 6 }

--
--  The ctspDefDownloadedSgaclMappingTable
--

ctspDefDownloadedSgaclMappingTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspDefDownloadedSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table contains the downloaded SGACLs information
         of the default policy applied to unicast IP traffic." 
    ::= { ctspSgaclMappings 5 }

ctspDefDownloadedSgaclMappingEntry OBJECT-TYPE
    SYNTAX        CtspDefDownloadedSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the downloaded SGACLs mapping.
         A row instance contains the SGACL information of the default
         policy dynamically downloaded from ACS server for unicast
         IP traffic." 
    INDEX { ctspDefDownloadedSgaclIndex }
    ::= { ctspDefDownloadedSgaclMappingTable 1 }

CtspDefDownloadedSgaclMappingEntry ::= SEQUENCE {
    ctspDefDownloadedSgaclIndex     Unsigned32,
    ctspDefDownloadedSgaclName      CtsAclName,
    ctspDefDownloadedSgaclGenId     CtsGenerationId,
    ctspDefDownloadedIpTrafficType  BITS
}

ctspDefDownloadedSgaclIndex OBJECT-TYPE
    SYNTAX          Unsigned32 (1..65535) 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object identifies the SGACL of downloaded default 
         policy applied to unicast IP traffic."
    ::= { ctspDefDownloadedSgaclMappingEntry 1 }

ctspDefDownloadedSgaclName OBJECT-TYPE
    SYNTAX          CtsAclName
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the name of the SGACL of downloaded
        default policy applied to unicast IP traffic."
    ::= { ctspDefDownloadedSgaclMappingEntry 2 }

ctspDefDownloadedSgaclGenId OBJECT-TYPE
    SYNTAX          CtsGenerationId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the generation identification 
        of the SGACL of downloaded default policy applied to
        unicast IP traffic." 
    ::= { ctspDefDownloadedSgaclMappingEntry 3 }

ctspDefDownloadedIpTrafficType OBJECT-TYPE
    SYNTAX          BITS { ipv4(0), ipv6(1) } 
    MAX-ACCESS      read-only 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the IP traffic
         subjected to SGACL enforcement by this downloaded 
         default policy."
    ::= { ctspDefDownloadedSgaclMappingEntry 4 }

--
--  The ctspOperSgaclMappingTable
--

ctspOperSgaclMappingTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspOperSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table contains the operational SGACLs information
         applied to unicast IP traffic which carries a source SGT
         and travels to a destination SGT."
    ::= { ctspSgaclMappings 6 }

ctspOperSgaclMappingEntry OBJECT-TYPE
    SYNTAX        CtspOperSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the operational SGACLs mapping.
         A row instance is added for each pair of <source SGT,
         destination SGT> which contains the SGACL that 
         either statically configured at the device or dynamically
         downloaded from ACS server." 
    INDEX { ctspOperIpTrafficType,
            ctspOperSgaclDestSgt,
            ctspOperSgaclSourceSgt, 
            ctspOperSgaclIndex }
    ::= { ctspOperSgaclMappingTable 1 }

CtspOperSgaclMappingEntry ::= SEQUENCE {
    ctspOperIpTrafficType         INTEGER,
    ctspOperSgaclDestSgt          CtsSecurityGroupTag, 
    ctspOperSgaclSourceSgt        CtsSecurityGroupTag, 
    ctspOperSgaclIndex            Unsigned32,
    ctspOperationalSgaclName      CtsAclName,
    ctspOperationalSgaclGenId     CtsGenerationId,
    ctspOperSgaclMappingSource    INTEGER,
    ctspOperSgaclConfigSource     INTEGER 
}

ctspOperIpTrafficType OBJECT-TYPE
    SYNTAX          INTEGER { ipv4(1), ipv6(2) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the unicast IP traffic
         carrying the source SGT and travelling to destination
         SGT and subjected to SGACL enforcement." 
    ::= { ctspOperSgaclMappingEntry 1 }

ctspOperSgaclDestSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the destination SGT value. Value of
         zero indicates that the destination SGT is unknown." 
    ::= { ctspOperSgaclMappingEntry 2 }

ctspOperSgaclSourceSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the source SGT value. Value of
         zero indicates that the source SGT is unknown." 
    ::= { ctspOperSgaclMappingEntry 3 }

ctspOperSgaclIndex OBJECT-TYPE
    SYNTAX          Unsigned32 (1..65535) 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object identifies the SGACL operationally
         applied to unicast IP traffic carrying the source SGT 
         to the destination SGT."
    ::= { ctspOperSgaclMappingEntry 4 }

ctspOperationalSgaclName OBJECT-TYPE
    SYNTAX          CtsAclName
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the name of the SGACL operationally
         applied to unicast IP traffic carrying the source SGT to the 
         destination SGT."
    ::= { ctspOperSgaclMappingEntry 5 }

ctspOperationalSgaclGenId OBJECT-TYPE
    SYNTAX          CtsGenerationId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the generation identification 
        of the SGACL operationally applied to unicast IP traffic 
        carrying the source SGT to the destination SGT."
    ::= { ctspOperSgaclMappingEntry 6 }

ctspOperSgaclMappingSource OBJECT-TYPE
    SYNTAX          INTEGER { configured(1), downloaded(2) } 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the source of SGACL mapping
        for the SGACL operationally applied to unicast IP traffic 
        carrying the source SGT to the destination SGT.

        'downloaded' indicates that the mapping is downloaded
        from ACS server.

        'configured' indicates that the mapping is locally
        configured in the device."
    ::= { ctspOperSgaclMappingEntry 7 }

ctspOperSgaclConfigSource OBJECT-TYPE
    SYNTAX          INTEGER { configured(1), downloaded(2) } 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the source of SGACL creation 
        for this SGACL.

        'configured' indicates that the SGACL is locally
        configured in the local device.

        'downloaded' indicates that the SGACL is created at
        ACS server and downloaded to the local device."
    ::= { ctspOperSgaclMappingEntry 8 }

--
--  The ctspDefOperSgaclMappingTable
--

ctspDefOperSgaclMappingTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspDefOperSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table contains the operational SGACLs information
         of the default policy applied to unicast IP traffic." 
    ::= { ctspSgaclMappings 7 }

ctspDefOperSgaclMappingEntry OBJECT-TYPE
    SYNTAX        CtspDefOperSgaclMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
         "A row instance contains the SGACL information of the default
         policy which is either statically configured at the device 
         or dynamically downloaded from ACS server for unicast
         IP traffic." 
    INDEX { ctspDefOperIpTrafficType,
            ctspDefOperSgaclIndex }
    ::= { ctspDefOperSgaclMappingTable 1 }

CtspDefOperSgaclMappingEntry ::= SEQUENCE {
    ctspDefOperIpTrafficType         INTEGER,
    ctspDefOperSgaclIndex            Unsigned32,
    ctspDefOperationalSgaclName      CtsAclName,
    ctspDefOperationalSgaclGenId     CtsGenerationId,
    ctspDefOperSgaclMappingSource    INTEGER,
    ctspDefOperSgaclConfigSource     INTEGER 
}

ctspDefOperIpTrafficType OBJECT-TYPE
    SYNTAX          INTEGER { ipv4(1), ipv6(2) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the unicast IP
         traffic subjected to default policy enforcement." 
    ::= { ctspDefOperSgaclMappingEntry 1 }

ctspDefOperSgaclIndex OBJECT-TYPE
    SYNTAX          Unsigned32 (1..65535) 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object identifies the SGACL of default policy
         operationally applied to unicast IP traffic."
    ::= { ctspDefOperSgaclMappingEntry 2 }

ctspDefOperationalSgaclName OBJECT-TYPE
    SYNTAX          CtsAclName
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the name of the SGACL of default 
        policy operationally applied to unicast IP traffic."
    ::= { ctspDefOperSgaclMappingEntry 3 }

ctspDefOperationalSgaclGenId OBJECT-TYPE
    SYNTAX          CtsGenerationId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the generation identification 
        of the SGACL of default policy operationally 
        applied to unicast IP traffic." 
    ::= { ctspDefOperSgaclMappingEntry 4 }

ctspDefOperSgaclMappingSource OBJECT-TYPE
    SYNTAX          INTEGER { configured(1), downloaded(2) } 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the source of SGACL mapping
        for the SGACL of default policy operationally 
        applied to unicast IP traffic.  

        'downloaded' indicates that the mapping is downloaded
        from ACS server.

        'configured' indicates that the mapping is locally
        configured in the device."
    ::= { ctspDefOperSgaclMappingEntry 5 }

ctspDefOperSgaclConfigSource OBJECT-TYPE
    SYNTAX          INTEGER { configured(1), downloaded(2) } 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the source of SGACL creation 
        for the SGACL of default policy operationally 
        applied to unicast IP traffic.

        'downloaded' indicates that the SGACL is created at
        ACS server and downloaded to the local device.

        'configured' indicates that the SGACL is locally
        configured in the local device."
    ::= { ctspDefOperSgaclMappingEntry 6 }

--
--  ctspSgaclStatistics
--

ctspSgtStatsTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspSgtStatsEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table describes SGACL statistics counters per
         a pair of <source SGT, destination SGT> that is
         capable of providing this information." 
    ::= { ctspSgaclStatistics 1 }

ctspSgtStatsEntry OBJECT-TYPE
    SYNTAX        CtspSgtStatsEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the SGACL statistics related to 
         IPv4 or IPv6 packets carrying the source SGT travelling
         to the destination SGT and subjected to SGACL enforcement."
    INDEX { ctspStatsIpTrafficType, 
            ctspStatsDestSgt, 
            ctspStatsSourceSgt 
          }
    ::= { ctspSgtStatsTable 1 }

CtspSgtStatsEntry ::= SEQUENCE {
    ctspStatsIpTrafficType    INTEGER, 
    ctspStatsDestSgt          CtsSecurityGroupTag,
    ctspStatsSourceSgt        CtsSecurityGroupTag, 
    ctspStatsIpSwDropPkts     Counter64,
    ctspStatsIpHwDropPkts     Counter64,
    ctspStatsIpSwPermitPkts   Counter64,
    ctspStatsIpHwPermitPkts   Counter64
}

ctspStatsIpTrafficType OBJECT-TYPE
    SYNTAX          INTEGER { ipv4(1), ipv6(2) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the unicast IP traffic
         carrying the source SGT and travelling to destination
         SGT and subjected to SGACL enforcement." 
    ::= { ctspSgtStatsEntry 1 }

ctspStatsDestSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the destination SGT value. Value of
         zero indicates that the destination SGT is unknown." 
    ::= { ctspSgtStatsEntry 2 }

ctspStatsSourceSgt OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the source SGT value. Value of
         zero indicates that the source SGT is unknown." 
    ::= { ctspSgtStatsEntry 3 }

ctspStatsIpSwDropPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of software-forwarded
         IP packets which are dropped by SGACL." 
    ::= { ctspSgtStatsEntry 4 }

ctspStatsIpHwDropPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of hardware-forwarded
         IP packets which are dropped by SGACL." 
    ::= { ctspSgtStatsEntry 5 }

ctspStatsIpSwPermitPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of software-forwarded
         IP packets which are permitted by SGACL." 
    ::= { ctspSgtStatsEntry 6 }

ctspStatsIpHwPermitPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of hardware-forwarded
         IP packets which are permitted by SGACL." 
    ::= { ctspSgtStatsEntry 7 }

ctspDefStatsTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspDefStatsEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table describes statistics counters for unicast
         IP traffic subjected to default unicast policy." 
    ::= { ctspSgaclStatistics 2 }

ctspDefStatsEntry OBJECT-TYPE
    SYNTAX        CtspDefStatsEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the statistics counter for each IP
         traffic type." 
    INDEX { ctspDefIpTrafficType }
    ::= { ctspDefStatsTable 1 }

CtspDefStatsEntry ::= SEQUENCE {
    ctspDefIpTrafficType    INTEGER, 
    ctspDefIpSwDropPkts     Counter64,
    ctspDefIpHwDropPkts     Counter64,
    ctspDefIpSwPermitPkts   Counter64,
    ctspDefIpHwPermitPkts   Counter64
}

ctspDefIpTrafficType OBJECT-TYPE
    SYNTAX          INTEGER { ipv4(1), ipv6(2) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the IP traffic
         subjected to default unicast policy enforcement." 
    ::= { ctspDefStatsEntry 1 }

ctspDefIpSwDropPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of software-forwarded
         IP packets which are dropped by default unicast policy." 
    ::= { ctspDefStatsEntry 2 }

ctspDefIpHwDropPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of hardware-forwarded
         IP packets which are dropped by default unicast policy." 
    ::= { ctspDefStatsEntry 3 }

ctspDefIpSwPermitPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of software-forwarded
         IP packets which are permitted by default unicast policy." 
    ::= { ctspDefStatsEntry 4 }

ctspDefIpHwPermitPkts OBJECT-TYPE
    SYNTAX          Counter64 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the number of hardware-forwarded
         IP packets which are permitted by default unicast policy." 
    ::= { ctspDefStatsEntry 5 }

--
--  ctsPeerPolicy group
--

ctspAllPeerPolicyAction OBJECT-TYPE
    SYNTAX          INTEGER  {
                        none(1),
                        refresh(2)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object allows user to specify the action to be taken 
        with respect to all peer policies in the device.

        When read, this object always returns the value 'none'.
    
        'none'    - No operation.
        'refresh' - Refresh all peer policies in the device."
    ::= { ctspPeerPolicy 1 }

ctspPeerPolicyTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspPeerPolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table lists the peer policy information for each peer
         device." 
    ::= { ctspPeerPolicy 2 }

ctspPeerPolicyEntry OBJECT-TYPE
    SYNTAX        CtspPeerPolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the managed objects for peer policies
         for each peer device based on its name."
    INDEX { IMPLIED ctspPeerName }
    ::= { ctspPeerPolicyTable 1 }

CtspPeerPolicyEntry ::= SEQUENCE {
    ctspPeerName                  SnmpAdminString,
    ctspPeerSgt                   CtsSecurityGroupTag,
    ctspPeerSgtGenId              CtsGenerationId,
    ctspPeerTrustState            INTEGER,
    ctspPeerPolicyLifeTime        Unsigned32,
    ctspPeerPolicyLastUpdate      DateAndTime,
    ctspPeerPolicyAction          INTEGER
}

ctspPeerName        OBJECT-TYPE
    SYNTAX          SnmpAdminString (SIZE(1..128)) 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object uniquely identifies a peer device." 
    ::= { ctspPeerPolicyEntry 1 }

ctspPeerSgt         OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      read-only 
    STATUS          current
    DESCRIPTION
        "This object indicates the SGT value of this peer device." 
    ::= { ctspPeerPolicyEntry 2 }

ctspPeerSgtGenId OBJECT-TYPE
    SYNTAX          CtsGenerationId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the generation identification of 
         the SGT value assigned to this peer device." 
    ::= { ctspPeerPolicyEntry 3 }

ctspPeerTrustState  OBJECT-TYPE
    SYNTAX          INTEGER { trusted(1), noTrust(2) } 
    MAX-ACCESS      read-only 
    STATUS          current
    DESCRIPTION
        "This object indicates the TrustSec trust state of this
         peer device.

         'trusted' indicates that this is a trusted peer device.
     
         'noTrust' indicates that this peer device is not trusted." 
    ::= { ctspPeerPolicyEntry 4 }

ctspPeerPolicyLifeTime OBJECT-TYPE
    SYNTAX          Unsigned32 
    UNITS           "seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the policy life time which
         provides the time interval during which the peer
         policy is valid."
    ::= { ctspPeerPolicyEntry 5 }

ctspPeerPolicyLastUpdate OBJECT-TYPE
    SYNTAX          DateAndTime 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the time when this peer policy
         is last updated." 
    ::= { ctspPeerPolicyEntry 6 }

ctspPeerPolicyAction OBJECT-TYPE
    SYNTAX          INTEGER  {
                        none(1),
                        refresh(2)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object allows user to specify the action to be taken 
        with this peer policy.

        When read, this object always returns the value 'none'.
    
        'none'    - No operation.
        'refresh' - Refresh this peer policy."
    ::= { ctspPeerPolicyEntry 7 }

--
--  ctspLayer3Transport
--

ctspLayer3PolicyTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspLayer3PolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table describes Layer 3 transport policy for 
        IP traffic regarding SGT propagation." 
    ::= { ctspLayer3Transport 1 }

ctspLayer3PolicyEntry OBJECT-TYPE
    SYNTAX        CtspLayer3PolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the Layer 3 transport policies per 
         IP traffic type per policy type." 
    INDEX { ctspLayer3PolicyIpTrafficType, ctspLayer3PolicyType }
    ::= { ctspLayer3PolicyTable 1 }

CtspLayer3PolicyEntry ::= SEQUENCE {
    ctspLayer3PolicyIpTrafficType INTEGER, 
    ctspLayer3PolicyType          INTEGER,
    ctspLayer3PolicyLocalConfig   CtsAclNameOrEmpty, 
    ctspLayer3PolicyDownloaded    CtsAclNameOrEmpty, 
    ctspLayer3PolicyOperational   CtsAclNameOrEmpty
}

ctspLayer3PolicyIpTrafficType OBJECT-TYPE
    SYNTAX          INTEGER { ipv4(1), ipv6(2) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the IP traffic
         affected by Layer-3 transport policy.

         'ipv4' indicates that the affected traffic is IPv4
         traffic.

         'ipv6' indicates that the affected traffic is IPv6
         traffic." 
    ::= { ctspLayer3PolicyEntry 1 }

ctspLayer3PolicyType OBJECT-TYPE
    SYNTAX          INTEGER { permit(1), exception(2) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of the Layer-3 
        transport policy affecting IP traffic regarding 
        SGT propagation.

        'permit' indicates that the transport policy is used 
        to classify Layer-3 traffic which is subject to
        SGT propagation.

        'exception' indicates that the transport policy is used 
        to classify Layer-3 traffic which is NOT subject to
        SGT propagation." 
    ::= { ctspLayer3PolicyEntry 2 }

ctspLayer3PolicyLocalConfig OBJECT-TYPE
    SYNTAX          CtsAclNameOrEmpty
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies the name of an ACL that is  
         administratively configured to classify Layer3 
         traffic. Zero-length string indicates there is no 
         such configured policy." 
    ::= { ctspLayer3PolicyEntry 3 }

ctspLayer3PolicyDownloaded OBJECT-TYPE
    SYNTAX          CtsAclNameOrEmpty
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object specifies the name of an ACL that is  
         downloaded from policy server to classify Layer3 
         traffic. Zero-length string indicates there is no 
         such downloaded policy." 
    ::= { ctspLayer3PolicyEntry 4 }

ctspLayer3PolicyOperational OBJECT-TYPE
    SYNTAX          CtsAclNameOrEmpty
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object specifies the name of an operational ACL 
         currently used to classify Layer3 traffic. Zero-length
         string indicates there is no such policy in effect." 
    ::= { ctspLayer3PolicyEntry 5 }


ctspIfL3PolicyConfigTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CtspIfL3PolicyConfigEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "This table lists the interfaces which support Layer3
        Transport policy."
    ::= { ctspLayer3Transport 2 }

ctspIfL3PolicyConfigEntry OBJECT-TYPE
    SYNTAX          CtspIfL3PolicyConfigEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "Each row contains managed objects for Layer3 Transport 
         on interface capable of providing this information."
    INDEX           { ifIndex }
    ::= { ctspIfL3PolicyConfigTable 1 }

CtspIfL3PolicyConfigEntry ::= SEQUENCE {
        ctspIfL3Ipv4PolicyEnabled           TruthValue,
        ctspIfL3Ipv6PolicyEnabled           TruthValue
}

ctspIfL3Ipv4PolicyEnabled OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies whether the Layer3 Transport
        policies will be applied on this interface for egress 
        IPv4 traffic.

        'true' indicates that Layer3 permit and exception policy
        will be applied at this interface for egress IPv4 traffic. 

        'false' indicates that Layer3 permit and exception policy
        will not be applied at this interface for egress IPv4
        traffic." 
    ::= { ctspIfL3PolicyConfigEntry 1 }

ctspIfL3Ipv6PolicyEnabled OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object specifies whether the Layer3 Transport
        policies will be applied on this interface for egress 
        IPv6 traffic.

        'true' indicates that Layer3 permit and exception policy
        will be applied at this interface for egress IPv6 traffic. 

        'false' indicates that Layer3 permit and exception policy
        will not be applied at this interface for egress IPv6
        traffic." 
    ::= { ctspIfL3PolicyConfigEntry 2 }

--
-- ctspIpSgtMappingTable
--

ctspIpSgtMappingTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspIpSgtMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table contains the IP-to-SGT mapping information
         in the device."  
    ::= { ctspIpSgtMappings 1 }

ctspIpSgtMappingEntry OBJECT-TYPE
    SYNTAX        CtspIpSgtMappingEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the IP-to-SGT mapping and status of
         this instance. Entry in this table is either populated 
         automatically by the device or manually configured by
         a user. A manually configured row instance can be created
         or removed by setting the appropriate value of its 
         RowStatus object."
    INDEX { ctspIpSgtVrfName, 
            ctspIpSgtAddressType, 
            ctspIpSgtIpAddress, 
            ctspIpSgtAddressLength }
    ::= { ctspIpSgtMappingTable 1 }

CtspIpSgtMappingEntry ::= SEQUENCE {
    ctspIpSgtVrfName          CiscoVrfName, 
    ctspIpSgtAddressType      InetAddressType, 
    ctspIpSgtIpAddress        InetAddress, 
    ctspIpSgtAddressLength    InetAddressPrefixLength, 
    ctspIpSgtValue            CtsSecurityGroupTag,
    ctspIpSgtSource           INTEGER,
    ctspIpSgtStorageType      StorageType,
    ctspIpSgtRowStatus        RowStatus
}

ctspIpSgtVrfName OBJECT-TYPE
    SYNTAX          CiscoVrfName 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the VRF where IP-SGT mapping 
        belongs to. The zero length value indicates the default
        VRF." 
    ::= { ctspIpSgtMappingEntry 1 }

ctspIpSgtAddressType OBJECT-TYPE
    SYNTAX          InetAddressType 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the type of Internet address." 
    ::= { ctspIpSgtMappingEntry 2 }

ctspIpSgtIpAddress OBJECT-TYPE
    SYNTAX          InetAddress 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates an Internet address. The type
         of this address is determined by the value of
         ctspIpSgtAddressType object." 
    ::= { ctspIpSgtMappingEntry 3 }

ctspIpSgtAddressLength OBJECT-TYPE
    SYNTAX          InetAddressPrefixLength 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the length of an Internet address
         prefix." 
    ::= { ctspIpSgtMappingEntry 4 }

ctspIpSgtValue OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      read-create 
    STATUS          current
    DESCRIPTION
        "This object specifies the SGT value assigned to 
         an Internet address." 
    ::= { ctspIpSgtMappingEntry 5 }

ctspIpSgtSource OBJECT-TYPE
    SYNTAX          INTEGER {
                        configured(1),
                        arp(2),
                        localAuthenticated(3),
                        sxp(4),
                        internal(5)
                    } 
    MAX-ACCESS      read-create 
    STATUS          current
    DESCRIPTION
        "This object indicates the source of the mapping. 

        'configured' indicates that the mapping is manually 
        configured by user.

        'arp' indicates that the mapping is dynamically learnt
        from tagged ARP replies.

        'localAuthenticated' indicates that the mapping is 
        dynamically learnt from the device authentication of
        a host.

        'sxp' indicates that the mapping is dynamically learnt
        from SXP (SGT Propagation Protocol).

        'internal' indicates that the mapping is automatically 
        created by the device between the device IP addresses
        and the device own SGT. 

        Only 'configured' value is accepted when setting this
        object."
    ::= { ctspIpSgtMappingEntry 6 }

ctspIpSgtStorageType OBJECT-TYPE
    SYNTAX          StorageType
    MAX-ACCESS      read-create
    STATUS          current
    DESCRIPTION
        "The storage type for this conceptual row."
    DEFVAL          { volatile }
    ::= { ctspIpSgtMappingEntry 7 }

ctspIpSgtRowStatus OBJECT-TYPE
    SYNTAX          RowStatus 
    MAX-ACCESS      read-create 
    STATUS          current
    DESCRIPTION
        "This object is used to manage the creation and deletion
         of rows in this table. If this object value is 'active',
         user cannot modify any writable object in this row.

         If value of ctspIpSgtSource object in an entry is not 
         'configured', user cannot change the value of this object." 
    ::= { ctspIpSgtMappingEntry 8 }


--
--  ctsSgtPolicy group
--

ctspAllSgtPolicyAction OBJECT-TYPE
    SYNTAX          INTEGER  {
                        none(1),
                        refresh(2)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object allows user to specify the action to be taken 
        with respect to all SGT policies in the device.

        When read, this object always returns the value 'none'.
    
        'none'    - No operation.
        'refresh' - Refresh all SGT policies in the device."
    ::= { ctspSgtPolicy 1 }

ctspDownloadedSgtPolicyTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspDownloadedSgtPolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table lists the SGT policy information downloaded 
         by the device." 
    ::= { ctspSgtPolicy 2 }

ctspDownloadedSgtPolicyEntry OBJECT-TYPE
    SYNTAX        CtspDownloadedSgtPolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the managed objects for SGT policies
         downloaded by the device."
    INDEX { ctspDownloadedSgtPolicySgt }
    ::= { ctspDownloadedSgtPolicyTable 1 }

CtspDownloadedSgtPolicyEntry ::= SEQUENCE {
    ctspDownloadedSgtPolicySgt             CtsSecurityGroupTag, 
    ctspDownloadedSgtPolicySgtGenId        CtsGenerationId,
    ctspDownloadedSgtPolicyLifeTime        Unsigned32,
    ctspDownloadedSgtPolicyLastUpdate      DateAndTime,
    ctspDownloadedSgtPolicyAction          INTEGER
}

ctspDownloadedSgtPolicySgt    OBJECT-TYPE
    SYNTAX          CtsSecurityGroupTag 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the SGT value for which
        the downloaded policy is applied to. Value of
        zero indicates that the SGT is unknown." 
    ::= { ctspDownloadedSgtPolicyEntry 1 }

ctspDownloadedSgtPolicySgtGenId OBJECT-TYPE
    SYNTAX          CtsGenerationId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the generation identification of 
         the SGT value denoted by ctspDownloadedSgtPolicySgt object." 
    ::= { ctspDownloadedSgtPolicyEntry 2 }

ctspDownloadedSgtPolicyLifeTime OBJECT-TYPE
    SYNTAX          Unsigned32 
    UNITS           "seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the policy life time which
         provides the time interval during which this downloaded
         policy is valid."
    ::= { ctspDownloadedSgtPolicyEntry 3 }

ctspDownloadedSgtPolicyLastUpdate OBJECT-TYPE
    SYNTAX          DateAndTime 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the time when this downloaded 
         SGT policy is last updated." 
    ::= { ctspDownloadedSgtPolicyEntry 4 }

ctspDownloadedSgtPolicyAction OBJECT-TYPE
    SYNTAX          INTEGER  {
                        none(1),
                        refresh(2)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object allows user to specify the action to be taken 
        with this downloaded SGT policy.

        When read, this object always returns the value 'none'.
    
        'none'    - No operation.
        'refresh' - Refresh this SGT policy."
    ::= { ctspDownloadedSgtPolicyEntry 5 }

--
--  ctspDownloadedDefSgtPolicyTable
--

ctspDownloadedDefSgtPolicyTable OBJECT-TYPE
    SYNTAX        SEQUENCE OF CtspDownloadedDefSgtPolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "This table lists the default SGT policy information 
         downloaded by the device." 
    ::= { ctspSgtPolicy 3 }

ctspDownloadedDefSgtPolicyEntry OBJECT-TYPE
    SYNTAX        CtspDownloadedDefSgtPolicyEntry
    MAX-ACCESS    not-accessible
    STATUS        current
    DESCRIPTION
        "Each row contains the managed objects for default SGT 
         policies downloaded by the device."
    INDEX { ctspDownloadedDefSgtPolicyType }
    ::= { ctspDownloadedDefSgtPolicyTable 1 }

CtspDownloadedDefSgtPolicyEntry ::= SEQUENCE {
    ctspDownloadedDefSgtPolicyType            INTEGER, 
    ctspDownloadedDefSgtPolicySgtGenId        CtsGenerationId,
    ctspDownloadedDefSgtPolicyLifeTime        Unsigned32,
    ctspDownloadedDefSgtPolicyLastUpdate      DateAndTime,
    ctspDownloadedDefSgtPolicyAction          INTEGER
}

ctspDownloadedDefSgtPolicyType    OBJECT-TYPE
    SYNTAX          INTEGER { unicastDefault(1) } 
    MAX-ACCESS      not-accessible 
    STATUS          current
    DESCRIPTION
        "This object indicates the downloaded default SGT
        policy type.
        
        'unicastDefault' indicates the SGT policy applied to 
        traffic which carries the default unicast SGT." 
    ::= { ctspDownloadedDefSgtPolicyEntry 1 }

ctspDownloadedDefSgtPolicySgtGenId OBJECT-TYPE
    SYNTAX          CtsGenerationId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the generation identification of
         the downloaded default SGT policy."
    ::= { ctspDownloadedDefSgtPolicyEntry 2 }

ctspDownloadedDefSgtPolicyLifeTime OBJECT-TYPE
    SYNTAX          Unsigned32 
    UNITS           "seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the policy life time which
         provides the time interval during which this
         download default policy is valid."
    ::= { ctspDownloadedDefSgtPolicyEntry 3 }

ctspDownloadedDefSgtPolicyLastUpdate OBJECT-TYPE
    SYNTAX          DateAndTime 
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This object indicates the time when this downloaded
         SGT policy is last updated." 
    ::= { ctspDownloadedDefSgtPolicyEntry 4 }

ctspDownloadedDefSgtPolicyAction OBJECT-TYPE
    SYNTAX          INTEGER  {
                        none(1),
                        refresh(2)
                    }
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "This object allows user to specify the action to be taken 
        with this default downloaded SGT policy.

        When read, this object always returns the value 'none'.
    
        'none'    - No operation.
        'refresh' - Refresh this default SGT policy."
    ::= { ctspDownloadedDefSgtPolicyEntry 5 }

--
-- Conformance
--

ciscoTrustSecPolicyMIBCompliances
    OBJECT IDENTIFIER ::= { ciscoTrustSecPolicyMIBConformance 1 }

ciscoTrustSecPolicyMIBGroups
    OBJECT IDENTIFIER ::= { ciscoTrustSecPolicyMIBConformance 2 }

ciscoTrustSecPolicyMIBCompliance MODULE-COMPLIANCE
    STATUS  current
    DESCRIPTION
        "The compliance statement for the CISCO-TRUSTSEC-POLICY-MIB"
    MODULE
    MANDATORY-GROUPS { 
         ctspGlobalSgaclEnforcementGroup,
         ctspOperSgaclMappingGroup,
         ctspDownloadedSgaclMappingGroup,
         ctspIpSwStatisticsGroup,
         ctspDefSwStatisticsGroup
    }

    GROUP ctspVlanConfigGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         SGACL enforcement for VLAN." 

    GROUP ctspConfigSgaclMappingGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         statically configured SGACLs in the device." 

    GROUP ctspIpHwStatisticsGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         hardware statistics counters for unicast IP traffic 
         subjected to SGACL enforcement." 

    GROUP ctspDefHwStatisticsGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         hardware statistics counters for unicast IP traffic 
         subjected to default unicast policy enforcement." 

    GROUP ctspSgaclIpv4DropNetflowMonitorGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         netflow monitor for IPv4 traffic drop packet due to SGACL
         enforcement information in the device." 

    GROUP ctspSgaclIpv6DropNetflowMonitorGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         netflow monitor for IPv6 traffic drop packet due to SGACL
         enforcement information in the device." 

    GROUP ctspPeerPolicyGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         peer policies information in the device." 

    GROUP ctspPeerPolicyActionGroup
    DESCRIPTION
        "This group is mandatory only for platforms which support
         refresh of all peer policies information in the device."

    GROUP ctspLayer3TransportGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         SGT propagation along Layer 3 traffic to network that is
         not capable of TrustSec feature." 

    GROUP ctspIpSgtMappingGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         IP-to-SGT mapping information."

    GROUP ctspIfL3PolicyConfigGroup
    DESCRIPTION
        "This group is mandatory only for platforms which support
         Layer3 Transport policy enforcement on capable interface." 

    GROUP ctspSgtPolicyGroup 
    DESCRIPTION
        "This group is mandatory only for platforms which support
         SGT policies information in the device." 

    OBJECT          ctspVlanConfigSgaclEnforcement
    MIN-ACCESS      read-only
    DESCRIPTION
        "Support for read-create access is not required."

    OBJECT          ctspVlanConfigVrfName
    MIN-ACCESS      read-only
    DESCRIPTION
        "Support for read-create access is not required."

    OBJECT      ctspVlanConfigStorageType
    MIN-ACCESS      read-only
    DESCRIPTION
        "Support for read-create access is not required."

    OBJECT      ctspVlanConfigRowStatus 
    SYNTAX          INTEGER { active(1) }
    WRITE-SYNTAX    INTEGER { createAndGo(4), destroy(6) }
    MIN-ACCESS      read-only
    DESCRIPTION
        "Support for 'createAndWait' is not required."

    OBJECT      ctspConfigSgaclMappingStorageType
    MIN-ACCESS      read-only
    DESCRIPTION
        "Support for read-create access is not required."

    OBJECT      ctspConfigSgaclMappingRowStatus 
    SYNTAX          INTEGER { active(1) }
    WRITE-SYNTAX    INTEGER { createAndGo(4), destroy(6) }
    MIN-ACCESS      read-only
    DESCRIPTION
        "Support for 'createAndWait' is not required."

    OBJECT       ctspSgaclEnforcementEnable  
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspSgaclIpv4DropNetflowMonitor   
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspSgaclIpv6DropNetflowMonitor 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspConfigSgaclMappingSgaclName 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspDefConfigIpv4Sgacls 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspDefConfigIpv6Sgacls 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspLayer3PolicyLocalConfig
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT      ctspIpSgtStorageType
    MIN-ACCESS  read-only
    DESCRIPTION
        "Support for read-create access is not required."

    OBJECT      ctspIpSgtRowStatus 
    SYNTAX          INTEGER { active(1) }
    WRITE-SYNTAX    INTEGER { createAndGo(4), destroy(6) }
    MIN-ACCESS      read-only
    DESCRIPTION
        "Support for 'createAndWait' is not required."

    OBJECT       ctspIpSgtValue
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspIpSgtSource
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspIfL3Ipv4PolicyEnabled
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspIfL3Ipv6PolicyEnabled 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspAllPeerPolicyAction 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspPeerPolicyAction 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspAllSgtPolicyAction 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspDownloadedSgtPolicyAction 
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT       ctspDownloadedDefSgtPolicyAction
    MIN-ACCESS   read-only
    DESCRIPTION
        "Write access is not required."

    ::= { ciscoTrustSecPolicyMIBCompliances 1 }

--
-- Units of Conformance
--

ctspGlobalSgaclEnforcementGroup OBJECT-GROUP
    OBJECTS {
       ctspSgaclEnforcementEnable
    }
    STATUS current
    DESCRIPTION
        "A collection of object which provides the SGACL enforcement
         information for all TrustSec capable Layer 3 interfaces
         (excluding SVIs) at the device level."
    ::= { ciscoTrustSecPolicyMIBGroups 1 }

ctspSgaclIpv4DropNetflowMonitorGroup OBJECT-GROUP
    OBJECTS {
        ctspSgaclIpv4DropNetflowMonitor
    }
    STATUS current
    DESCRIPTION
        "A collection of object which provides netflow monitor 
        information for IPv4 traffic drop packet due to SGACL
        enforcement in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 2 }

ctspSgaclIpv6DropNetflowMonitorGroup OBJECT-GROUP
    OBJECTS {
        ctspSgaclIpv6DropNetflowMonitor
    }
    STATUS current
    DESCRIPTION
        "A collection of object which provides netflow monitor 
        information for IPv6 traffic drop packet due to SGACL
        enforcement in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 3 }

ctspVlanConfigGroup OBJECT-GROUP
    OBJECTS {
       ctspVlanConfigSgaclEnforcement,
       ctspVlanSviActive,
       ctspVlanConfigVrfName,
       ctspVlanConfigStorageType,
       ctspVlanConfigRowStatus 
    }
    STATUS current
    DESCRIPTION
        "A collection of object which provides the SGACL enforcement
         and VRF information for each VLAN." 
    ::= { ciscoTrustSecPolicyMIBGroups 4 }

ctspConfigSgaclMappingGroup OBJECT-GROUP
    OBJECTS {
       ctspConfigSgaclMappingSgaclName,
       ctspConfigSgaclMappingStorageType,
       ctspConfigSgaclMappingRowStatus,
       ctspDefConfigIpv4Sgacls,
       ctspDefConfigIpv6Sgacls
    } 
    STATUS current
    DESCRIPTION
        "A collection of objects which provides the administratively
         configured SGACL mapping information in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 5 }

ctspDownloadedSgaclMappingGroup OBJECT-GROUP
    OBJECTS {
        ctspDownloadedSgaclName,
        ctspDownloadedSgaclGenId,
        ctspDownloadedIpTrafficType,
        ctspDefDownloadedSgaclName,
        ctspDefDownloadedSgaclGenId,
        ctspDefDownloadedIpTrafficType
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides the downloaded 
         SGACL mapping information in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 6 }

ctspOperSgaclMappingGroup OBJECT-GROUP
    OBJECTS {
        ctspOperationalSgaclName,
        ctspOperationalSgaclGenId,
        ctspOperSgaclMappingSource,
        ctspOperSgaclConfigSource,
        ctspDefOperationalSgaclName,
        ctspDefOperationalSgaclGenId,
        ctspDefOperSgaclMappingSource,
        ctspDefOperSgaclConfigSource
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides the operational
         SGACL mapping information in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 7 }

ctspIpSwStatisticsGroup OBJECT-GROUP
    OBJECTS {
        ctspStatsIpSwDropPkts,
        ctspStatsIpSwPermitPkts
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides software statistics 
        counters for unicast IP traffic subjected to SGACL enforcement." 
    ::= { ciscoTrustSecPolicyMIBGroups 8 }

ctspIpHwStatisticsGroup OBJECT-GROUP
    OBJECTS {
        ctspStatsIpHwDropPkts,
        ctspStatsIpHwPermitPkts
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides hardware statistics
        counters for unicast IP traffic subjected to SGACL enforcement." 
    ::= { ciscoTrustSecPolicyMIBGroups 9 }

ctspDefSwStatisticsGroup OBJECT-GROUP
    OBJECTS {
        ctspDefIpSwDropPkts,
        ctspDefIpSwPermitPkts
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides software statistics 
        counters for unicast IP traffic subjected to unicast default
        policy enforcement." 
    ::= { ciscoTrustSecPolicyMIBGroups 10 }

ctspDefHwStatisticsGroup OBJECT-GROUP
    OBJECTS {
        ctspDefIpHwDropPkts,
        ctspDefIpHwPermitPkts 
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides hardware statistics 
        counters for unicast IP traffic subjected to unicast default
        policy enforcement." 
    ::= { ciscoTrustSecPolicyMIBGroups 11 }

ctspPeerPolicyActionGroup OBJECT-GROUP
    OBJECTS {
        ctspAllPeerPolicyAction
    }
    STATUS current
    DESCRIPTION
        "A collection of object which provides refreshing 
         of all peer policies in the device."
    ::= { ciscoTrustSecPolicyMIBGroups 12 }

ctspPeerPolicyGroup OBJECT-GROUP
    OBJECTS {
        ctspPeerSgt,
        ctspPeerSgtGenId,
        ctspPeerTrustState,
        ctspPeerPolicyLifeTime,
        ctspPeerPolicyLastUpdate,
        ctspPeerPolicyAction
    }
    STATUS current
    DESCRIPTION
        "A collection of object which provides peer policy
        information in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 13 }

ctspLayer3TransportGroup OBJECT-GROUP
    OBJECTS {
        ctspLayer3PolicyLocalConfig,
        ctspLayer3PolicyDownloaded,
        ctspLayer3PolicyOperational
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides managed information
         regarding the SGT propagation along with Layer 3 traffic in
         the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 14 }

ctspIfL3PolicyConfigGroup OBJECT-GROUP
    OBJECTS {
        ctspIfL3Ipv4PolicyEnabled,
        ctspIfL3Ipv6PolicyEnabled
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides managed information
         for Layer3 Tranport policy enforcement on capable interface 
         in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 15 }

ctspIpSgtMappingGroup OBJECT-GROUP
    OBJECTS {
        ctspIpSgtValue,
        ctspIpSgtSource,
        ctspIpSgtStorageType,
        ctspIpSgtRowStatus
    }
    STATUS current
    DESCRIPTION
        "A collection of objects which provides managed information
         regarding IP-to-Sgt mapping in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 16 }

ctspSgtPolicyGroup OBJECT-GROUP
    OBJECTS {
        ctspAllSgtPolicyAction,
        ctspDownloadedSgtPolicySgtGenId,
        ctspDownloadedSgtPolicyLifeTime,
        ctspDownloadedSgtPolicyLastUpdate,
        ctspDownloadedSgtPolicyAction,
        ctspDownloadedDefSgtPolicySgtGenId,
        ctspDownloadedDefSgtPolicyLifeTime,
        ctspDownloadedDefSgtPolicyLastUpdate,
        ctspDownloadedDefSgtPolicyAction
    }
    STATUS current
    DESCRIPTION
        "A collection of object which provides SGT policy
        information in the device." 
    ::= { ciscoTrustSecPolicyMIBGroups 17 }

END



