-- *********************************************************************
-- Copyright (c)2010-2011, 2010, 2015 by Cisco Systems Inc.
-- All rights reserved.
--   
-- CISCO-GDOI-MIB: MIB for Group Domain of Interpretation (GDOI)
-- July 2010 - Preethi Sundaradevan, Manoj Vellala,
-- Mike Hamada, Tanya Roosta
-- February 2015 - Rohini Kamath, Yogesh Sharma
-- *********************************************************************

CISCO-GDOI-MIB DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-COMPLIANCE,
    NOTIFICATION-GROUP,
    OBJECT-GROUP
        FROM SNMPv2-CONF
    MODULE-IDENTITY,
    NOTIFICATION-TYPE,
    OBJECT-TYPE,
    Counter32,
    Unsigned32
        FROM SNMPv2-SMI
    TEXTUAL-CONVENTION,
    DisplayString,
    TruthValue
        FROM SNMPv2-TC
    CiscoMilliSeconds
        FROM CISCO-TC
    ciscoMgmt
        FROM CISCO-SMI;


-- ------------------------------------------------------------------ --
-- GDOI MIB Module Identity
-- ------------------------------------------------------------------ --

ciscoGdoiMIB MODULE-IDENTITY
    LAST-UPDATED    "201507170000Z"
    ORGANIZATION    "cisco Systems, Inc."
    CONTACT-INFO
            "Cisco Systems
            Enterprise Business Management Unit

            Postal: 170 W Tasman Drive
            San Jose, CA  95134
            USA

               Tel: +1 800 553-NETS

            E-mail: cs-ipsecurity@cisco.com"
    DESCRIPTION
        "This MIB module defines objects for managing the GDOI protocol.

        Copyright (c) The IETF Trust (2010).  This version of this MIB
        module is based on RFC 6407; see the RFC itself for full legal
        notices."
    REVISION        "201507170000Z"
    DESCRIPTION
        "Added the following textual conventions:
        - CgmGdoiKsStatus
        - CgmGdoiKsRole
        Added the following objects to cgmGdoiGroupTable:
        - cgmGdoiGroupMemberCount
        - cgmGdoiGroupActivePeerKeyServerCount
        - cgmGdoiGroupLastRekeyRetransmits
        - cgmGdoiGroupLastRekeyTimeTaken
        Added the following objects to cgmGdoiKeyServerTable:
        - cgmGdoiKeyServerRole
        - cgmGdoiKeyServerRegisteredGMs
        Added the following objects to cgmGdoiGmTable:
        - cgmGdoiGmActiveTEKNum
        Added the following objects to cgmGdoiNotifCntl:
        - cgmGdoiKsRoleChangeNotifEnable
        - cgmGdoiKsGmDeletedNotifEnable
        - cgmGdoiKsPeerReachNotifEnable
        - cgmGdoiKsPeerUnreachNotifEnable
        Added the following tables:
        - cgmGdoiNotifVars
        - cgmGdoiCoopPeerTable
        Added the following notifications:
        - cgmGdoiKeyServerRoleChange
        - cgmGdoiKeyServerGmDeleted
        - cgmGdoiKeyServerPeerReachable
        - cgmGdoiKeyServerPeerUnreachable
        Added new MIB Groups (for conformance)
        - cgmGdoiGroupIdGroupRev1
        - cgmGdoiKeyServerGroupRev1
        - cgmGdoiGmGroupRev1
        - cgmGdoiNotificationControlGroupRev1
        - cgmGdoiKeyServerNotificationGroupRev1
        - cgmGdoiCoopPeerGroup
        - cgmGdoiNotificationVariablesGroup
        Added a new compliance group:
        - cgmGdoiMIBComplianceRev1
        Deprecated an old compliance group:
        - cgmGdoiMIBCompliance"
    REVISION        "201008310000Z"
    DESCRIPTION
        "Final Ciscoized version of the MIB draft after review comments"
    REVISION        "201007201240Z"
    DESCRIPTION
        "Ciscoized version of the MIB draft after review comments"
    REVISION        "201006021245Z"
    DESCRIPTION
        "Ciscoized version of the initial MIB draft"
    REVISION        "201002250545Z"
    DESCRIPTION
        "Initial version, published as RFC ????"
    ::= { ciscoMgmt 759 }



-- ------------------------------------------------------------------ --
-- GDOI MIB Textual Conventions
-- ------------------------------------------------------------------ --

CgmGdoiKsStatus ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention identifying the status of Key Server in
        the COOP/Stand-alone scenario.

        Following are the possible values:

          ID Type              Value
          -------              -----
          Alive                  1  -- Key Server is perceived as Alive
          Dead                   2  -- Key Server is perceived as Dead
          Unknown                3  -- Failed to determine the status;
                                       or, the status of a secondary 
                                       peer when seen from a Secondary 
                                       Key Server."
    SYNTAX          INTEGER  {
                        keyServerAlive(1),
                        keyServerDead(2),
                        keyServerUnknown(3)
                    }

CgmGdoiKsRole ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention identifying the role of Key Server in the
        COOP/Stand-alone scenario.

        Following are the possible values:

          ID Type              Value
          -------              -----
          Primary                1  -- Role is Primary
          Secondary              2  -- Role is Secondary
          Unknown                3  -- Failed to determine the role"
    SYNTAX          INTEGER  {
                        keyServerPrimary(1),
                        keyServerSecondary(2),
                        keyServerUnknown(3)
                    }

CgmGdoiIdentificationType ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the type of value used to
        identify a GDOI entity (i.e. Group, Key Server, or Group
        Member).

        Following are the Identification Type Values:

          ID Type              Value
          -------              -----
          RESERVED               0  -- Not Used
          ID_IPV4_ADDR           1  -- ipv4Address
          ID_FQDN                2  -- domainName

          ID_RFC822_ADDR         3  -- userName
          (ID_USER_FQDN)

          ID_IPV4_ADDR_SUBNET    4  -- ipv4Subnet - Not in RFC 4306
          ID_IPV6_ADDR           5  -- ipv6Address
          ID_IPV6_ADDR_SUBNET    6  -- ipv6Subnet - Not in RFC 4306
          ID_IPV4_ADDR_RANGE     7  -- ipv4Range  - Not in RFC 4306
          ID_IPV6_ADDR_RANGE     8  -- ipv6Range  - Not in RFC 4306
          ID_DER_ASN1_DN         9  -- caDistinguishedName
          ID_DER_ASN1_GN         10 -- caGeneralName
          ID_KEY_ID              11 -- groupNumber

        Following are the mappings to the type values above:

          'ipv4Address' : a single four (4) octet IPv4 address.

          'domainName'  : a fully-qualified domain name string.  An
               example is, 'example.com'.  The string MUST not
               contain any terminators (e.g., NULL, CR, etc.).

          'userName'    : a fully-qualified RFC 822 username or email
               address string. An example is, 'jsmith@example.com'.
               The string MUST not contain any terminators.

          'ipv4Subnet'  : a range of IPv4 addresses, represented by
               two four (4) octet values concatenated together.  The
               first value is an IPv4 address.  The second is an
               IPv4 network mask.  Note that ones (1s) in the network
               mask indicate that the corresponding bit in the address
               is fixed, while zeros (0s) indicate a 'wildcard' bit.

          'ipv6Address' : a single sixteen (16) octet IPv6 address.

          'ipv6Subnet'  : a range of IPv6 addresses, represented by
               two sixteen (16) octet values concatenated together. 
               The first value is an IPv6 address.  The second is an
               IPv network mask.  Note that ones (1s) in the network
               mask indicate that the corresponding bit in the address
               is fixed, while zeros (0s) indicate a 'wildcard' bit.

          'ipv4Range'   : a range of IPv4 addresses, represented by
               two four (4) octet values.  The first value is the
               beginning IPv4 address (inclusive) and the second 
               value is the ending IPv4 address (inclusive).  All
               addresses falling between the two specified addresses
               are considered to be within the list.

          'ipv6Range'   : a range of IPv6 addresses, represented by
               two sixteen (16) octet values.  The first value is the
               beginning IPv6 address (inclusive) and the second 
               value is the ending IPv6 address (inclusive).  All
               addresses falling between the two specified addresses
               are considered to be within the list.

          'caDistinguishedName' : the binary DER encoding of an ASN.1
               X.500 Distinguished Name [X.501]. 

          'caGeneralName' : the binary DER encoding of an ASN.1
               X.500 GeneralName [X.509].

          'groupNumber' : a four (4) octet group identifier."

    REFERENCE
        "IANA ISAKMP Registry - 'Magic Numbers' for ISAKMP Protocol
         Section: IPSEC Identification Type
         http://www.iana.org/assignments/isakmp-registry
         
         RFC 4306 - Section: 3.5. Identification Payloads"
    SYNTAX          INTEGER  {
                        ipv4Address(1),
                        domainName(2),
                        userName(3),
                        ipv4Subnet(4),
                        ipv6Address(5),
                        ipv6Subnet(6),
                        ipv4Range(7),
                        ipv6Range(8),
                        caDistinguishedName(9),
                        caGeneralName(10),
                        groupNumber(11)
                    }

CgmGdoiIdentificationValue ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "255d"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the actual value of used to
        identify a GDOI entity (i.e. Group, Key Server, or Group
        Member).  The value of the CgmGdoiIdentificationValue object can
        be parsed based on the value of the associated
        CgmGdoiIdentificationType object.

        The following CgmGdoiIdentificationType values indicate that the
         CgmGdoiIdentificationValue object should be parsed as a binary
        string of octets with the given lengths if a length is not
        associated with the object:

          ipv4Address(1)   -- 4 octets
          ipv4Subnet(4)    -- 8 octets
          ipv6Address(5)   -- 16 octets
          ipv6Subnet(6)    -- 32 octets
          ipv4Range(7)     -- 8 octets
          ipv6Range(8)     -- 32 octets
          groupNumber(11)  -- 4 octets

        The following  CgmGdoiIdentificationType values indicate that
        the CgmGdoiIdentificationValue object should be parsed as an 
        ASCII string of characters. Note that a length MUST be 
        associated with the object in these cases:

          domainName(2)
          userName(3)
          caDistinguishedName(9)
          caGeneralName(10)

        Note that the length of 48 octets was chosen because the
        gdoiKsKekEntry, gdoiGmKekEntry, gdoiKsTekEntry, &
        gdoiGmTekEntry will exceed the OID size limit of 255 octets
        if this size is any larger than 48 octets."

    REFERENCE
        "IANA ISAKMP Registry - 'Magic Numbers' for ISAKMP Protocol
         Section: IPSEC Identification Type
         http://www.iana.org/assignments/isakmp-registry
         
         RFC 4306 - Section: 3.5. Identification Payloads"
    SYNTAX          OCTET STRING (SIZE (0..48))

CgmGdoiKekSPI ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "16x"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating a SPI (Security Parameter
        Index) of sixteen (16) octets for a KEK.  The SPI must be the
        ISAKMP Header cookie pair where the first 8 octets become the
        'Initiator Cookie' field of the GROUPKEY-PUSH message ISAKMP
        HDR, and the second 8 octets become the 'Responder Cookie' in
        the same HDR.  These cookies are assigned by the Key Server."

    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK Payload"
    SYNTAX          OCTET STRING (SIZE (16))

CgmGdoiIpProtocolId ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the IP
        Protocol being used for the rekey datagram.  Some possible
        values are:

          ID Value  ID Type
          --------  -------
             06       TCP    -- ipProtocolTCP
             17       UDP    -- ipProtocolUDP"

    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK Payload"
    SYNTAX          INTEGER  {
                        ipProtocolUnknown(0),
                        ipProtocolTCP(1),
                        ipProtocolUDP(2)
                    }

CgmGdoiKeyManagementAlgorithm ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the key/KEK
        management algorithm being used to provide forward or
        backward access control (i.e. used to exclude group
        members).

        Following are the possible KEK management algorithm values &
        CgmGdoiKeyManagementAlgorithm mappings:

          KEK Management Type  Value
          -------------------  -----
           LKH                   1  -- keyMgmtLkh"

    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK Payload"
    SYNTAX          INTEGER  {
                        keyMgmtNone(0),
                        keyMgmtLkh(1)
                    }

CgmGdoiEncryptionAlgorithm ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        encryption algorithm being used.

        Following are the possible updated encryption algorithm
        values & CgmGdoiEncryptionAlgorithm mappings after RFC 4306:

          Encryption Algorithm Type          Value
          ---------------------------------  -----
           ENCR_DES_IV64                       1  -- encrAlgDes64
           ENCR_DES                            2  -- encrAlgDes
           ENCR_3DES                           3  -- encrAlg3Des
           ENCR_RC5                            4  -- encrAlgRc5
           ENCR_IDEA                           5  -- encrAlgIdea
           ENCR_CAST                           6  -- encrAlgCast
           ENCR_BLOWFISH                       7  -- encrAlgBlowfish
           ENCR_3IDEA                          8  -- encrAlg3Idea
           ENCR_DES_IV32                       9  -- encrAlgDes32
           ENCR_NULL                           11 -- encrAlgNull
           ENCR_AES_CBC                        12 -- encrAlgAesCbc
           ENCR_AES_CTR                        13 -- encrAlgAesCtr
           ENCR_AES-CCM_8                      14 -- encrAlgAesCcm8
           ENCR_AES-CCM_12                     15 -- encrAlgAesCcm12
           ENCR_AES-CCM_16                     16 -- encrAlgAesCcm16
           AES-GCM (8-octet ICV)               18 -- encrAlgAesGcm8
           AES-GCM (12-octet ICV)              19 -- encrAlgAesGcm12
           AES-GCM (16-octet ICV)              20 -- encrAlgAesGcm16
           ENCR_NULL_AUTH_AES_GMAC             21 
               -- encrAlgNullAuthAesGmac
           ENCR_CAMELLIA_CBC                   23
               -- encrAlgCamelliaCbc
           ENCR_CAMELLIA_CTR                   24
               -- encrAlgCamelliaCtr
           ENCR_CAMELLIA_CCM (8-octet ICV)     25
               -- encrAlgCamelliaCcm8
           ENCR_CAMELLIA_CCM (12-octet ICV)    26
               -- encrAlgCamelliaCcm12
           ENCR_CAMELLIA_CCM (16-octet ICV)    27
               -- encrAlgCamelliaCcm16

        Following are the possible ESP transform identifiers &
        CgmGdoiEncryptionAlgorithm mappings from RFC 2407:

          IPsec ESP Transform ID    Value
          ------------------------  -----
           ESP_DES_IV64               1  -- encrAlgDes64
           ESP_DES                    2  -- encrAlgDes
           ESP_3DES                   3  -- encrAlg3Des
           ESP_RC5                    4  -- encrAlgRc5
           ESP_IDEA                   5  -- encrAlgIdea
           ESP_CAST                   6  -- encrAlgCast
           ESP_BLOWFISH               7  -- encrAlgBlowfish
           ESP_3IDEA                  8  -- encrAlg3Idea
           ESP_DES_IV32               9  -- encrAlgDes32
           ESP_RC4                    10 -- encrAlgRc4
           ESP_NULL                   11 -- encrAlgNull
           ESP_AES-CBC                12 -- encrAlgAesCbc
           ESP_AES-CTR                13 -- encrAlgAesCtr
           ESP_AES-CCM_8              14 -- encrAlgAesCcm8
           ESP_AES-CCM_12             15 -- encrAlgAesCcm12
           ESP_AES-CCM_16             16 -- encrAlgAesCcm16
           ESP_AES-GCM_8              18 -- encrAlgAesGcm8
           ESP_AES-GCM_12             19 -- encrAlgAesGcm12
           ESP_AES-GCM_16             20 -- encrAlgAesGcm16
           ESP_SEED_CBC               21 -- encrAlgSeedCbc
           ESP_CAMELLIA               22
               -- encrAlgCamelliaCbc, Ctr, Ccm8, Ccm12, Ccm16
           ESP_NULL_AUTH_AES-GMAC     23
               -- encrAlgNullAuthAesGmac

        Following are the possible KEK_ALGORITHM values specifying
        the encryption algorithm used with a KEK &
        CgmGdoiEncryptionAlgorithm mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           KEK_ALG_DES      1  -- encrAlgDes
           KEK_ALG_3DES     2  -- encrAlg3Des
           KEK_ALG_AES      3  -- encrAlgAesCbc"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Encryption Algorithm Transform IDs
         http://www.iana.org/assignments/ikev2-parameters

         IANA 'Magic Numbers' for ISAMP Protocol
         Section: IPSEC ESP Transform Identifiers
         http://www.iana.org/assignments/isakmp-registry
          
         RFC 2407 - Section: 4.4.4. IPSEC ESP Transform Identifiers
         RFC 3547 - Section: 5.3.3. KEK_ALGORITHM
         RFC 4306 - Section: 3.3.2. Transform Substructure
         RFC 4106, 4309, 4543, 5282, 5529"
    SYNTAX          INTEGER  {
                        encrAlgNone(0),
                        encrAlgDes64(1),
                        encrAlgDes(2),
                        encrAlg3Des(3),
                        encrAlgRc5(4),
                        encrAlgIdea(5),
                        encrAlgCast(6),
                        encrAlgBlowfish(7),
                        encrAlg3Idea(8),
                        encrAlgDes32(9),
                        encrAlgRc4(10),
                        encrAlgNull(11),
                        encrAlgAesCbc(12),
                        encrAlgAesCtr(13),
                        encrAlgAesCcm8(14),
                        encrAlgAesCcm12(15),
                        encrAlgAesCcm16(16),
                        encrAlgAesGcm8(18),
                        encrAlgAesGcm12(19),
                        encrAlgAesGcm16(20),
                        encrAlgNullAuthAesGmac(21),
                        encrAlgCamelliaCbc(23),
                        encrAlgCamelliaCtr(24),
                        encrAlgCamelliaCcm8(25),
                        encrAlgCamelliaCcm12(26),
                        encrAlgCamelliaCcm1(27),
                        encrAlgSeedCbc(28)
                    }

CgmGdoiPseudoRandomFunction ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        pseudo-random function (PRF) being used.

        Following are the possible updated PRF values &
        CgmGdoiPseudoRandomFunction mappings after RFC 4306:

          Pseudo-Random Function Type        Value
          ---------------------------------  -----
           PRF_HMAC_MD5                        1  -- prfMd5Hmac
           PRF_HMAC_SHA1                       2  -- prfSha1Hmac
           PRF_HMAC_TIGER                      3  -- prfTigerHmac
           PRF_AES128_XCBC                     4  -- prfAes128Xcbc
           PRF_HMAC_SHA2_256                   5  -- prfSha2Hmac256
           PRF_HMAC_SHA2_384                   6  -- prfSha2Hmac384
           PRF_HMAC_SHA2_512                   7  -- prfSha2Hmac512
           PRF_AES128_CMAC                     8  -- prfAes128Cmac

        Following are the possible SIG_HASH_ALGORITHM values &
        CgmGdoiPseudoRandomFunction mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           SIG_HASH_MD5     1  -- prfMd5Hmac
           SIG_HASH_SHA1    2  -- prfSha1Hmac"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Pseudo-random Function Transform IDs
         http://www.iana.org/assignments/ikev2-parameters

         RFC 3547 - Section: 5.3.6. SIG_HASH_ALGORITHM
         RFC 4306 - Section: 3.3.2. Transform Substructure
         RFC 4615, 4868"
    SYNTAX          INTEGER  {
                        prfNone(0),
                        prfMd5Hmac(1),
                        prfSha1Hmac(2),
                        prfTigerHmac(3),
                        prfAes128Xcbc(4),
                        prfSha2Hmac256(5),
                        prfSha2Hmac384(6),
                        prfSha2Hmac512(7),
                        prfAes128Cmac(8)
                    }

CgmGdoiIntegrityAlgorithm ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        integirty algorithm being used.

        Following are the possible updated integrity algorithm
        values & CgmGdoiIntegrityAlgorithm mappings after RFC 4306:

          Integrity Algorithm Type  Value
          ------------------------  -----
           AUTH_HMAC_MD5_96           1  -- authAlgMd5Hmac96
           AUTH_HMAC_SHA1_96          2  -- authAlgSha1Hmac96
           AUTH_DES_MAC               3  -- authAlgDesMac
           AUTH_KPDK_MD5              4  -- authAlgMd5Kpdk
           AUTH_AES_XCBC_96           5  -- authAlgAesXcbc96
           AUTH_HMAC_MD5_128          6  -- authAlgMd5Hmac128
           AUTH_HMAC_SHA1_160         7  -- authAlgSha1Hmac160
           AUTH_AES_CMAC_96           8  -- authAlgAesCmac96
           AUTH_AES_128_GMAC          9  -- authAlgAes128Gmac
           AUTH_AES_192_GMAC          10 -- authAlgAes192Gmac
           AUTH_AES_256_GMAC          11 -- authAlgAes256Gmac
           AUTH_HMAC_SHA2_256_128     12 -- authAlgSha2Hmac256to128
           AUTH_HMAC_SHA2_384_192     13 -- authAlgSha2Hmac384to192
           AUTH_HMAC_SHA2_512_256     14 -- authAlgSha2Hmac512to256

        Following are the possible legacy authentication algorithm
        values & CgmGdoIntegrityAlgorithm mappings from RFC 2407:

          Algorithm Type  Value
          --------------  -----
           HMAC-MD5         1  -- authAlgMd5Hmac96
           HMAC-SHA         2  -- authAlgSha1Hmac96
           DES-MAC          3  -- authAlgDesMac
           KPDK             4  -- authAlgMd5Kpdk"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Integrity Algorithm Transform IDs
         http://www.iana.org/assignments/ikev2-parameters
          
         RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.3.6. SIG_HASH_ALGORITHM
         RFC 4306 - Section: 3.3.2. Transform Substructure
         RFC 4494, 4543, 4595, 4868"
    SYNTAX          INTEGER  {
                        authAlgNone(0),
                        authAlgMd5Hmac96(1),
                        authAlgSha1Hmac96(2),
                        authAlgDesMac(3),
                        authAlgMd5Kpdk(4),
                        authAlgAesXcbc96(5),
                        authAlgMd5Hmac128(6),
                        authAlgSha1Hmac160(7),
                        authAlgAesCmac96(8),
                        authAlgAes128Gmac(9),
                        authAlgAes192Gmac(10),
                        authAlgAes256Gmac(11),
                        authAlgSha2Hmac256to128(12),
                        authAlgSha2Hmac384to192(13),
                        authAlgSha2Hmac512to256(14)
                    }

CgmGdoiSignatureMethod ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        integirty algorithm being used.

        Following are the possible updated authentication method
        values & CgmGdoiSignatureMethod mappings after RFC 4306:

          Authentication Method                Value
          -----------------------------------  -----
           RSA Digital Signature                 1  -- sigRsa
           Shared Key Message Integrity Code     2  -- sigSharedKey
           DSS Digital Signature                 3  -- sigDss
           ECDSA w/ SHA-256 (P-256 curve)        9  -- sigEcdsa256
           ECDSA w/ SHA-384 (P-384 curve)        10 -- sigEcdsa384
           ECDSA w/ SHA-512 (P-521 curve)        11 -- sigEcdsa512

        Following are the possible legacy IPsec authentication method
        values & CgmGdoiSignatureMethod mappings from RFC 2409:

          Authentication Method             Value
          --------------------------------  -----
           Pre-Shared Key                     1  -- sigSharedKey
           DSS Signature                      2  -- sigDss
           RSA Signature                      3  -- sigRsa
           Encryption w/ RSA                  4  -- sigEncryptRsa
           Revised Encryption w/ RSA          5  -- sigRevEncryptRsa
           ECDSA w/ SHA-256 (P-256 curve)     9  -- sigEcdsa256
           ECDSA w/ SHA-384 (P-384 curve)     10 -- sigEcdsa384
           ECDSA w/ SHA-512 (P-521 curve)     11 -- sigEcdsa512

        Following are the possible POP algorithm values &
        CgmGdoiSignatureMethod mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           POP_ALG_RSA      1  -- sigRsa
           POP_ALG_DSS      2  -- sigDss
           POP_ALG_ECDSS    3  -- sigEcdsa256, 384, 512

        Following are the possible SIG_ALGORITHM values &
        CgmGdoiSignatureMethod mappings from the GDOI RFC 3547:

          Algorithm Type  Value
          --------------  -----
           SIG_ALG_RSA      1  -- sigRsa
           SIG_ALG_DSS      2  -- sigDss
           SIG_ALG_ECDSS    3  -- sigEcdsa256, 384, 512"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Integrity Algorithm Transform IDs
         http://www.iana.org/assignments/ikev2-parameters
          
         RFC 2409 - Section:  Appendix A. Authentication Method
         RFC 3547 - Sections: 5.3.SA KEK payload
              5.3.7.      SIG_ALGORITHM
         RFC 4306 - Section:  3.8.Authentication Payload
         RFC 4754"
    SYNTAX          INTEGER  {
                        sigNone(0),
                        sigRsa(1),
                        sigSharedKey(2),
                        sigDss(3),
                        sigEncryptRsa(4),
                        sigRevEncryptRsa(5),
                        sigEcdsa256(9),
                        sigEcdsa384(10),
                        sigEcdsa512(11)
                    }

CgmGdoiDiffieHellmanGroup ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        Diffie-Hellman Group being used.

        Following are the possible updated Diffie-Hellman Group
        values & CgmGdoiDiffieHellmanGroup mappings after RFC 4306:

          Diffie-Hellman Group Type  Value
          -------------------------  -----
           NONE                        0  -- dhNone
           Group 1 - 768 Bit MODP      1  -- dhGroup1
           Group 2 - 1024 Bit MODP     2  -- dhGroup2
           1536-bit MODP Group         5  -- dh1536Modp
           2048-bit MODP Group         14 -- dh2048Modp
           3072-bit MODP Group         15 -- dh3072Modp
           4096-bit MODP Group         16 -- dh4096Modp
           6144-bit MODP Group         17 -- dh6144Modp
           8192-bit MODP Group         18 -- dh8192Modp
           256-bit random ECP group    19 -- dhEcp256
           84-bit random ECP group     20 -- dhEcp84
           521-bit random ECP group    21 -- dhEcp521
           1024-bit MODP w/ 160-bit    22 -- dh1024Modp160
             Prime Order Subgroup
           2048-bit MODP w/ 224-bit    23 -- dh2048Modp224
             Prime Order Subgroup
           2048-bit MODP w/ 256-bit    24 -- dh2048Modp256
             Prime Order Subgroup
           192-bit Random ECP Group    25 -- dhEcp192
           224-bit Random ECP Group    26 -- dhEcp224

        Following are the possible legacy Diffie-Hellman Group
        values & CgmGdoiDiffieHellmanGroup mappings from RFC 2409:

          Diffie-Hellman Group Type  Value
          -------------------------  -----
           Group 1 - 768 Bit MODP      1  -- dhGroup1 
           Group 2 - 1024 Bit MODP     2  -- dhGroup2
           EC2N group on GP[2^155]     3  -- dhEc2nGp155
           EC2N group on GP[2^185]     4  -- dhEc2nGp185"

    REFERENCE
        "IANA IKEv2 Parameters
         Section: Diffie-Hellman Group Transform IDs
         http://www.iana.org/assignments/ikev2-parameters
         
         RFC 2409 - Sections: 6.1. First Oakley Default Group
              6.2. Second Oakley Default Group
              6.3. Third Oakley Default Group
              6.4. Fourth Oakley Default Group"
    SYNTAX          INTEGER  {
                        dhNone(0),
                        dhGroup1(1),
                        dhGroup2(2),
                        dhEc2nGp155(3),
                        dhEc2nGp185(4),
                        dh1536Modp(5),
                        dh2048Modp(14),
                        dh3072Modp(15),
                        dh4096Modp(16),
                        dh6144Modp(17),
                        dh8192Modp(18),
                        dhEcp256(19),
                        dhEcp84(20),
                        dhEcp521(21),
                        dh1024Modp160(22),
                        dh2048Modp224(23),
                        dh2048Modp256(24),
                        dhEcp192(25),
                        dhEcp224(26)
                    }

CgmGdoiEncapsulationMode ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        Encapsulation Mode being used.

        Following are the possible Encapsulation Mode
        values & CgmGdoiEncapsulationMode mappings from RFC 2407:

          Encapsulation Mode            Value
          ----------------------------  -----
           Tunnel                         1  -- encapTunnel
           Transport                      2  -- encapTransport
           UDP-Encapsulated-Tunnel        3  -- encapUdpTunnel
           UDP-Encapsulated-Transport     4  -- encapUdpTransport"

    REFERENCE
        "IANA 'Magic Numbers' for ISAKMP Protocol
         Section: Encapsulation Mode
         http://www.iana.org/assignments/isakmp-registry

         RFC 2407 - Section: 4.5. IPSEC Security Assoc. Attributes
         RFC 3947"
    SYNTAX          INTEGER  {
                        encapUnknown(0),
                        encapTunnel(1),
                        encapTransport(2),
                        encapUdpTunnel(3),
                        encapUdpTransport(4)
                    }

CgmGdoiSecurityProtocol ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the identifier of the
        Security Protocol being used.

        Following are the possible Security Protocol ID
        values & CgmGdoiSecurityProtocol mappings from the
        GDOI RFC 3547:

          Security Protocol ID    Value
          ----------------------  -----
           GDOI_PROTO_IPSEC_ESP     1  -- secProtocolIpsecEsp"

    REFERENCE       "RFC 3547 - Section: 5.4. SA TEK Payload"
    SYNTAX          INTEGER  {
                        secProtocolUnknown(0),
                        secProtocolIpsecEsp(1)
                    }

CgmGdoiTekSPI ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "4x"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating a SPI (Security Parameter
        Index) of four (4) octets for a TEK using ESP."

    REFERENCE       "RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP"
    SYNTAX          OCTET STRING (SIZE (4))

CgmGdoiKekStatus ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the status of a GDOI KEK and
        its corresponding Security Association (SA).

        'inUse' : KEK currently being used to encrypt new KEK/TEKs
        'new'   : KEK currently being sent to all peers
        'old'   : KEK that has expired and is no longer being used"
    SYNTAX          INTEGER  {
                        inUse(1),
                        new(2),
                        old(3)
                    }

CgmGdoiTekStatus ::= TEXTUAL-CONVENTION
    STATUS          current
    DESCRIPTION
        "A textual convention indicating the status of a GDOI TEK and
        its corresponding Security Association (SA).

        'inbound'  : TEK is being used as inbound (receive) SA
        'outbound' : TEK is being used as outbound (transmit) SA
        'notInUse' : TEK is no longer being used"
    SYNTAX          INTEGER  {
                        inbound(1),
                        outbound(2),
                        notInUse(3)
                    }

CgmGdoiUnsigned16 ::= TEXTUAL-CONVENTION
    DISPLAY-HINT    "2d"
    STATUS          current
    DESCRIPTION
        "A textual convention indicating a 16-bit unsigned integer
        value."
    SYNTAX          OCTET STRING (SIZE (2))
-- ------------------------------------------------------------------ --
-- GDOI MIB Groups
-- ------------------------------------------------------------------ --

cgmGdoiMIBNotifications  OBJECT IDENTIFIER
    ::= { ciscoGdoiMIB 0 }

cgmGdoiMIBObjects  OBJECT IDENTIFIER
    ::= { ciscoGdoiMIB 1 }

cgmGdoiMIBConformance  OBJECT IDENTIFIER
    ::= { ciscoGdoiMIB 2 }


-- ------------------------------------------------------------------ --
-- GDOI MIB Notifications
-- ------------------------------------------------------------------ --
--   
-- *---------------------------------------------------------------- --
-- * GDOI Key Server (KS) Notifications
-- *---------------------------------------------------------------- --

cgmGdoiKeyServerNewRegistration NOTIFICATION-TYPE
    STATUS          current
    DESCRIPTION
        "A notification from a Key Server sent when a new Group
        Member registers to a GDOI Group.  This is equivalent to a
        Key Server receiving the first message of a GROUPKEY-PULL
        exchange from a Group Member."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.4. Receiver Operations"
   ::= { cgmGdoiMIBNotifications 1 }

cgmGdoiKeyServerRegistrationComplete NOTIFICATION-TYPE
    STATUS          current
    DESCRIPTION
        "A notification from a Key Server sent when a Group Member
        has successfully registered to itself.  This is equivalent
        to a Key Server sending the last message of a GROUPKEY-PULL
        exchange to the Group Member currently registering
        containing KEKs, TEKs, and their associated policies."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.4. Receiver Operations"
   ::= { cgmGdoiMIBNotifications 2 }

cgmGdoiKeyServerRekeyPushed NOTIFICATION-TYPE
    OBJECTS         { cgmGdoiKeyServerRekeysPushed }
    STATUS          current
    DESCRIPTION
        "A notification from a Key Server sent when a GROUPKEY-PUSH
        message is sent to refresh KEK(s) and or TEK(s).  A rekey
        is sent  periodically by a Key Server based on a configured
        time to the Group Members registered to its GDOI Group."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              4.   GROUPKEY-PUSH Message
              4.7. GCKS Operations"
   ::= { cgmGdoiMIBNotifications 3 }

cgmGdoiKeyServerNoRsaKeys NOTIFICATION-TYPE
    STATUS          current
    DESCRIPTION
        "An error notification from a Key Server sent when an RSA key
        is not setup.  Each Key Server and Group Member needs to have
        an RSA key established. The Key Server signs the TEK rekeys
        using this RSA key, also called a Key Encryption Key (KEK).
        The Group Member verifies the authenticity of the TEK rekey
        using this RSA key."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              4.7. GCKS Operations"
   ::= { cgmGdoiMIBNotifications 4 }

-- *---------------------------------------------------------------- --
-- * GDOI Group Member (GM) Notifications
-- *---------------------------------------------------------------- --

cgmGdoiGmRegister NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiGmRegKeyServerIdType,
                        cgmGdoiGmRegKeyServerIdValue
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it is starting to
        register with its GDOI Group's Key Server.  Registration
        includes downloading keying & security association material.
        This is equivalent to a Group Member or Initiator sending the
        first message of a GROUPKEY-PULL exchange to its Group's Key
        Server."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.3. Initiator Operations"
   ::= { cgmGdoiMIBNotifications 5 }

cgmGdoiGmRegistrationComplete NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiGmRegKeyServerIdType,
                        cgmGdoiGmRegKeyServerIdValue
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it has successfully
        registered with a Key Server in its GDOI Group.  This is
        equivalent to a Group Member receiving the last message of
        a GROUPKEY-PULL exchange from the Key Server containing
        KEKs, TEKs, and their associated policies."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.3. Initiator Operations"
   ::= { cgmGdoiMIBNotifications 6 }

cgmGdoiGmReRegister NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiGmRegKeyServerIdType,
                        cgmGdoiGmRegKeyServerIdValue
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it is starting to
        re-register with a Key Server in its GDOI Group.  A Group
        Member needs to re-register to the key server if its keying & 
        security association material has expired and it has not
        received a rekey from the key server to refresh the material.
        This is equivalent to a Group Member sending the first
        message of a GROUPKEY-PULL exchange to the Key Server of a
        Group it is already registered with."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.3. Initiator Operations"
   ::= { cgmGdoiMIBNotifications 7 }

cgmGdoiGmRekeyReceived NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiGmRegKeyServerIdType,
                        cgmGdoiGmRegKeyServerIdValue,
                        cgmGdoiGmRekeysReceived
                    }
    STATUS          current
    DESCRIPTION
        "A notification from a Group Member when it has successfully
        received and processed a rekey from a Key Server in its GDOI
        Group.  Periodically the key server sends a rekey to refresh
        the keying & security association material.  This is
        equivalent to a Group Member receiving a GROUPKEY-PUSH
        message from the Key Server of the Group it is already
        registered with."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              4.   GROUPKEY-PUSH Message
              4.8. Group Member Operations"
   ::= { cgmGdoiMIBNotifications 8 }

cgmGdoiGmIncompleteCfg NOTIFICATION-TYPE
    STATUS          current
    DESCRIPTION
        "An error notification from a Group Member when there is
        necessary information missing from the policy/configuration
        of a Group Member on an interface when it tries to register
        with a Key Server in its GDOI Group.  If the GDOI Group
        configuration is not complete on a Group Member, it will not
        be able to  register to the Key Server."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.   GROUPKEY-PULL Exchange
              3.3. Initiator Operations"
   ::= { cgmGdoiMIBNotifications 9 }

cgmGdoiGmNoIpSecFlows NOTIFICATION-TYPE
    STATUS          current
    DESCRIPTION
        "An error notification from a Group Member when no more
        security associations can be installed after receiving its
        keying & security association material.  When the Group
        Member receives the security association materials, it has
        to install the cryptographic keys and policies.  If there
        is not enough memory to install these materials, there will
        be an error thrown."
   ::= { cgmGdoiMIBNotifications 10 }

cgmGdoiGmRekeyFailure NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiGmRegKeyServerIdType,
                        cgmGdoiGmRegKeyServerIdValue,
                        cgmGdoiGmRekeysReceived
                    }
    STATUS          current
    DESCRIPTION
        "An error notification from a Group Member when it is unable
        to successfully process and install a rekey (GROUPKEY-PUSH
        message) sent by the Key Server in its Group that it is
        registered with."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              4.   GROUPKEY-PUSH Message
              4.8. Group Member Operations"
   ::= { cgmGdoiMIBNotifications 11 }

-- *---------------------------------------------------------------- --
-- * GDOI Key Server (KS) Notifications
-- *---------------------------------------------------------------- --

cgmGdoiKeyServerRoleChange NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiNotifGroupIdType,
                        cgmGdoiNotifGroupIdValue,
                        cgmGdoiNotifGroupName,
                        cgmGdoiNotifKeyServerIdType,
                        cgmGdoiNotifKeyServerIdValue,
                        cgmGdoiNotifKeyServerRole
                    }
    STATUS          current
    DESCRIPTION
        "This notification is generated when a Key Server changes it's
        role from Primary to Secondary or vice-versa. The varbinds
        encapsulate the Group information, the Key Server identifier and
        the role it has moved to."
   ::= { cgmGdoiMIBNotifications 12 }

cgmGdoiKeyServerGmDeleted NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiNotifGroupIdType,
                        cgmGdoiNotifGroupIdValue,
                        cgmGdoiNotifGroupName,
                        cgmGdoiNotifKeyServerIdType,
                        cgmGdoiNotifKeyServerIdValue,
                        cgmGdoiNotifGmIdType,
                        cgmGdoiNotifGmIdValue
                    }
    STATUS          current
    DESCRIPTION
        "This notification is generated when a Group Member is deleted
        from a Key Server. The varbinds encapsulate the Group
        information, the Key Server identifier and the Group Member
        identifier which is deleted."
   ::= { cgmGdoiMIBNotifications 13 }

cgmGdoiKeyServerPeerReachable NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiNotifGroupIdType,
                        cgmGdoiNotifGroupIdValue,
                        cgmGdoiNotifGroupName,
                        cgmGdoiNotifKeyServerIdType,
                        cgmGdoiNotifKeyServerIdValue,
                        cgmGdoiNotifPeerKsIdType,
                        cgmGdoiNotifPeerKsIdValue
                    }
    STATUS          current
    DESCRIPTION
        "This notification is generated from a Key Server when an
        unreachable peer Key Server becomes reachable. The varbinds
        encapsulate the Group information, the Key Server identifier and
        the peer Key Server identifier."
   ::= { cgmGdoiMIBNotifications 14 }

cgmGdoiKeyServerPeerUnreachable NOTIFICATION-TYPE
    OBJECTS         {
                        cgmGdoiNotifGroupIdType,
                        cgmGdoiNotifGroupIdValue,
                        cgmGdoiNotifGroupName,
                        cgmGdoiNotifKeyServerIdType,
                        cgmGdoiNotifKeyServerIdValue,
                        cgmGdoiNotifPeerKsIdType,
                        cgmGdoiNotifPeerKsIdValue
                    }
    STATUS          current
    DESCRIPTION
        "This notification is generated from a Key Server when a
        reachable peer Key Server becomes unreachable. The varbinds
        encapsulate the Group information, the Key Server identifier and
        the peer Key Server identifier."
   ::= { cgmGdoiMIBNotifications 15 }
-- ------------------------------------------------------------------ --
-- GDOI MIB Management Objects
-- ------------------------------------------------------------------ --
--   
-- *---------------------------------------------------------------- --
-- * The GDOI "Group" Table
-- *---------------------------------------------------------------- --

cgmGdoiGroupTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiGroupEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Groups in use on
        the network device being queried."
    ::= { cgmGdoiMIBObjects 1 }

cgmGdoiGroupEntry OBJECT-TYPE
    SYNTAX          CgmGdoiGroupEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing GDOI Group information, uniquely
        identified by the GDOI Group ID."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue
                    } 
    ::= { cgmGdoiGroupTable 1 }

CgmGdoiGroupEntry ::= SEQUENCE {
        cgmGdoiGroupIdType                   CgmGdoiIdentificationType,
        cgmGdoiGroupIdLength                 Unsigned32,
        cgmGdoiGroupIdValue                  CgmGdoiIdentificationValue,
        cgmGdoiGroupName                     DisplayString,
        cgmGdoiGroupMemberCount              Unsigned32,
        cgmGdoiGroupActivePeerKeyServerCount Unsigned32,
        cgmGdoiGroupLastRekeyRetransmits     Unsigned32,
        cgmGdoiGroupLastRekeyTimeTaken       CiscoMilliSeconds
}

cgmGdoiGroupIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse a GDOI Group ID.
        The GDOI RFC 3547 defines the types that can be used as a
        GDOI Group ID, and RFC 4306 defines all valid types that can
        be used as an identifier.  This Group ID type is sent as the
        'ID Type' field of the Identification Payload for a GDOI
        GROUPKEY-PULL exchange."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads" 
    ::= { cgmGdoiGroupEntry 1 }

cgmGdoiGroupIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of a Group ID.  If no
        length is given (i.e. it has a value of 0), the default
        length of its cgmGdoiGroupIdType should be used as long as it
        is not reprsented by an ASCII string.  If the value has a
        type that is represented by an ASCII string, a length MUST
        be included.  If the length given is not 0, it should match
        the 'Payload Length' (subtracting the generic header length)
        of the Identification Payload for a GDOI GROUPKEY-PULL
        exchange."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads" 
    ::= { cgmGdoiGroupEntry 2 }

cgmGdoiGroupIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The value of a Group ID with its type indicated by the
        cgmGdoiGroupIdType.  Use the cgmGdoiGroupIdType to parse the 
        Group ID correctly.  This Group ID value is sent as the 
        'Identification Data' field of the Identification Payload
        for a GDOI GROUPKEY-PULL exchange."
    REFERENCE
        "RFC 3547 - Sections: 5.1.1.   Identification Type Values
              5.1.1.1. ID_KEY_ID
         RFC 4306 - Section:  3.5.     Identification Payloads" 
    ::= { cgmGdoiGroupEntry 3 }

cgmGdoiGroupName OBJECT-TYPE
    SYNTAX          DisplayString
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The string-readable name configured for or given to a GDOI
        Group." 
    ::= { cgmGdoiGroupEntry 4 }

cgmGdoiGroupMemberCount OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The count of registered Group Members to this group, on a Key
        Server." 
    ::= { cgmGdoiGroupEntry 5 }

cgmGdoiGroupActivePeerKeyServerCount OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The count of the active Key Server sessions between the local
        Key Server and peer Key Servers for this group." 
    ::= { cgmGdoiGroupEntry 6 }

cgmGdoiGroupLastRekeyRetransmits OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This variable returns the cummulative count of number of rekey
        messages and retransmits during the last cycle of rekey. This
        count displays the information pertaining to Group Members only
        (and is not related to any sync operation pertaining to peer Key
        Servers). This information is a reflection of rekey operation on
        a Primary Key Server, and is not available for Secondary Key
        Server(s), because they do not perform rekeys and do not receive
        any ACKs. While a rekey is in progress, this variable will give
        information of the last rekey operation." 
    ::= { cgmGdoiGroupEntry 7 }

cgmGdoiGroupLastRekeyTimeTaken OBJECT-TYPE
    SYNTAX          CiscoMilliSeconds
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "This variable returns the duration (in milliseconds) of the
        last rekey operation. This information is valid for a Primary
        Key Server, and is not available with Secondary Key Server(s),
        because they do not perform rekeys and do not receive any ACKs.
        While a rekey is in progress, this variable will give
        information of the last rekey operation." 
    ::= { cgmGdoiGroupEntry 8 }
 

-- *---------------------------------------------------------------- --
-- * GDOI MIB Management Object Groups
-- *---------------------------------------------------------------- --

cgmGdoiPeers  OBJECT IDENTIFIER
    ::= { cgmGdoiMIBObjects 2 }

cgmGdoiSecAssociations  OBJECT IDENTIFIER
    ::= { cgmGdoiMIBObjects 3 }

cgmGdoiNotifCntl  OBJECT IDENTIFIER
    ::= { cgmGdoiMIBObjects 4 }

-- #-------------------------------------------------------------- --
-- # The GDOI Notification Variables Table
-- #-------------------------------------------------------------- --

cgmGdoiNotifVars  OBJECT IDENTIFIER
    ::= { cgmGdoiMIBObjects 5 }

-- *---------------------------------------------------------------- --
-- * The GDOI "Peers" Group
-- *---------------------------------------------------------------- --
--   
-- #-------------------------------------------------------------- --
-- # The GDOI "Key Server (KS)" Table
-- #-------------------------------------------------------------- --

cgmGdoiKeyServerTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiKeyServerEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information for the GDOI group from the perspective
        of the Key Servers (GCKSs) on the network device being
        queried."
    ::= { cgmGdoiPeers 1 }

cgmGdoiKeyServerEntry OBJECT-TYPE
    SYNTAX          CgmGdoiKeyServerEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing GDOI Key Server (KS) information,
        uniquely identified by the Group & Key Server IDs."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.4. Receiver Operations
              4.7. GCKS Operations"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiKeyServerIdType,
                        cgmGdoiKeyServerIdValue
                    } 
    ::= { cgmGdoiKeyServerTable 1 }

CgmGdoiKeyServerEntry ::= SEQUENCE {
        cgmGdoiKeyServerIdType        CgmGdoiIdentificationType,
        cgmGdoiKeyServerIdLength      Unsigned32,
        cgmGdoiKeyServerIdValue       CgmGdoiIdentificationValue,
        cgmGdoiKeyServerActiveKEK     CgmGdoiKekSPI,
        cgmGdoiKeyServerRekeysPushed  Counter32,
        cgmGdoiKeyServerRole          CgmGdoiKsRole,
        cgmGdoiKeyServerRegisteredGMs Unsigned32
}

cgmGdoiKeyServerIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for a Key Server.  RFC 4306 defines all valid
        types that can be used as an identifier.  These
        identification types are sent as the 'SRC ID Type' and 'DST
        ID Type' of the KEK and TEK payloads for GDOI GROUPKEY-PULL
        and GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads" 
    ::= { cgmGdoiKeyServerEntry 1 }

cgmGdoiKeyServerIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of a Key Server ID.  If no
        length is given (i.e. it has a value of 0), the default
        length of its cgmGdoiKeyServerIdType should be used as long as
        it is not reprsented by an ASCII string.  If the value has a
        type that is represented by an ASCII string, a length MUST
        be included.  If the length given is not 0, it should match
        the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in
        the KEK and TEK payloads for GDOI GROUPKEY-PULL and
        GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKeyServerEntry 2 }

cgmGdoiKeyServerIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The value of the identity information for a Key Server with
        its type indicated by the cgmGdoiKeyServerIdType.  Use the
        cgmGdoiKeyServerIdType to parse the Key Server ID correctly.
        This Key Server ID value is sent as the 'SRC
        Identification Data' and 'DST Identification Data' of the
        KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
        exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKeyServerEntry 3 }

cgmGdoiKeyServerActiveKEK OBJECT-TYPE
    SYNTAX          CgmGdoiKekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The SPI of the Key Encryption Key (KEK) that is currently
        being used by the Key Server to encrypt the GROUPKEY-PUSH
        keying & security association material sent to the Key
        Server's registered Group Members."
    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK payload" 
    ::= { cgmGdoiKeyServerEntry 4 }

cgmGdoiKeyServerRekeysPushed OBJECT-TYPE
    SYNTAX          Counter32
    UNITS           "GROUPKEY-PUSH Messages"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The sequence number of the last rekey sent from the Key
        Server to its registered Group Members for this GDOI group."
    REFERENCE
        "RFC 3547 - Sections: 3.2. Messages
              3.4. Receiver Operations
              4.   GROUPKEY-PUSH Message
              4.7. GCKS Operations
              5.6. Sequence Number Payload" 
    ::= { cgmGdoiKeyServerEntry 5 }

cgmGdoiKeyServerRole OBJECT-TYPE
    SYNTAX          CgmGdoiKsRole
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The current role of the queried Key Server for the Group." 
    ::= { cgmGdoiKeyServerEntry 6 }

cgmGdoiKeyServerRegisteredGMs OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The count of registered Group Members to the Key Server
        identified by the index." 
    ::= { cgmGdoiKeyServerEntry 7 }
 

-- #-------------------------------------------------------------- --
-- # The GDOI "Group Members" Table
-- #-------------------------------------------------------------- --

cgmGdoiGmTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiGmEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Group Members (GMs)
        locally configured on the network device being queried.  Note
        that Local Group Members may or may not be registered to a
        Key Server in its GDOI Group on the same network device being
        queried."
    ::= { cgmGdoiPeers 2 }

cgmGdoiGmEntry OBJECT-TYPE
    SYNTAX          CgmGdoiGmEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing Local GDOI Group Member information,
        uniquely identified by Group & GM IDs. Because the Group
        Member is Local to the network device being queried, TEKs
        installed for this Group Member can be queried as well."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
              3.3. Initiator Operations
              4.8. Group Member Operations"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiGmIdType,
                        cgmGdoiGmIdValue
                    } 
    ::= { cgmGdoiGmTable 1 }

CgmGdoiGmEntry ::= SEQUENCE {
        cgmGdoiGmIdType               CgmGdoiIdentificationType,
        cgmGdoiGmIdLength             Unsigned32,
        cgmGdoiGmIdValue              CgmGdoiIdentificationValue,
        cgmGdoiGmRegKeyServerIdType   CgmGdoiIdentificationType,
        cgmGdoiGmRegKeyServerIdLength Unsigned32,
        cgmGdoiGmRegKeyServerIdValue  CgmGdoiIdentificationValue,
        cgmGdoiGmActiveKEK            CgmGdoiKekSPI,
        cgmGdoiGmRekeysReceived       Counter32,
        cgmGdoiGmActiveTEKNum         Counter32
}

cgmGdoiGmIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for a Initiator or Group Member.  RFC 4306
        defines all valid types that can be used as an identifier.
        These identification types are sent as the 'SRC ID Type' and
        'DST ID Type' of the KEK and TEK payloads for GDOI
        GROUPKEY-PULL and GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads" 
    ::= { cgmGdoiGmEntry 1 }

cgmGdoiGmIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of a Group Member ID.  If
        no length is given (i.e. it has a value of 0), the default
        length of its cgmGdoiGmIdType should be used as long as
        it is not reprsented by an ASCII string.  If the value has a
        type that is represented by an ASCII string, a length MUST
        be included.  If the length given is not 0, it should match
        the 'SRC ID Data Len' and 'DST ID Data Len' fields sent in
        the KEK and TEK payloads for GDOI GROUPKEY-PULL and
        GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmEntry 2 }

cgmGdoiGmIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The value of the identity information for a Group Member with
        its type indicated by the cgmGdoiGmIdType.  Use the
        cgmGdoiGmIdType to parse the Group Member ID correctly.
        This Group Member ID value is sent as the 'SRC
        Identification Data' and 'DST Identification Data' of the
        KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
        exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmEntry 3 }

cgmGdoiGmRegKeyServerIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information of this Group Member's registered Key Server.
        RFC 4306 defines all valid types that can be used as an
        identifier.  These identification types are sent as the 'SRC
        ID Type' and 'DST ID Type' of the KEK and TEK payloads for
        GDOI GROUPKEY-PULL and GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads" 
    ::= { cgmGdoiGmEntry 4 }

cgmGdoiGmRegKeyServerIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the registered Key
        Server's ID.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiGmRegKeyServerIdType
        should be used as long as it is not reprsented by an ASCII
        string.  If the value has a type that is represented by an
        ASCII string, a length MUST be included.  If the length given
        is not 0, it should match the 'SRC ID Data Len' and 'DST ID
        Data Len' fields sent in the KEK and TEK payloads for GDOI
        GROUPKEY-PULL and GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmEntry 5 }

cgmGdoiGmRegKeyServerIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for this Group Member's
        registered Key Server with its type indicated by the
        cgmGdoiGmRegKeyServerIdType.  Use the
        cgmGdoiGmRegKeyServerIdType to parse the registered Key
        Server's ID correctly.  This Key Server ID value is sent as
        the 'SRC Identification Data' and 'DST Identification Data'
        of the KEK and TEK payloads for GDOI GROUPKEY-PULL and
        GROUPKEY-PUSH exchanges."
    REFERENCE
        "RFC 3547 - Sections: 5.3.   SA KEK payload
              5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmEntry 6 }

cgmGdoiGmActiveKEK OBJECT-TYPE
    SYNTAX          CgmGdoiKekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The SPI of the Key Encryption Key (KEK) that is currently
        being used by the Group Member to authenticate & decrypt a
        rekey from a GROUPKEY-PUSH message." 
    ::= { cgmGdoiGmEntry 7 }

cgmGdoiGmRekeysReceived OBJECT-TYPE
    SYNTAX          Counter32
    UNITS           "GROUPKEY-PUSH Messages"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The sequence number of the last rekey successfully received
        from this Group Member's registered Key Server."
    REFERENCE
        "RFC 3547 - Sections: 3.2. Messages
              3.3. Initiator Operations
              4.   GROUPKEY-PUSH Message
              4.8. Group Member Operations
              5.6. Sequence Number Payload" 
    ::= { cgmGdoiGmEntry 8 }

cgmGdoiGmActiveTEKNum OBJECT-TYPE
    SYNTAX          Counter32
    UNITS           "Number of traffic encryption keys"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The number of active traffic encryption keys (TEKS) currently
        being used by the Group Member to encrypt/decrypt/authenticate
        dataplane traffic." 
    ::= { cgmGdoiGmEntry 9 }
 

-- #-------------------------------------------------------------- --
-- # The COOP Peer Table
-- #-------------------------------------------------------------- --

cgmGdoiCoopPeerTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiCoopPeerEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information for the COOP peer(s). The information
        populated in this table, is extracted from the COOP messages
        exchanged between the local KS (device being queried) and the
        COOP Peer(s)."
    ::= { cgmGdoiPeers 3 }

cgmGdoiCoopPeerEntry OBJECT-TYPE
    SYNTAX          CgmGdoiCoopPeerEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing COOP Peer Key Server's (KS) information,
        uniquely identified by the Group & Peer Key Server IDs."
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiCoopPeerIdType,
                        cgmGdoiCoopPeerIdValue
                    } 
    ::= { cgmGdoiCoopPeerTable 1 }

CgmGdoiCoopPeerEntry ::= SEQUENCE {
        cgmGdoiCoopPeerIdType        CgmGdoiIdentificationType,
        cgmGdoiCoopPeerIdLength      Unsigned32,
        cgmGdoiCoopPeerIdValue       CgmGdoiIdentificationValue,
        cgmGdoiCoopPeerRole          CgmGdoiKsRole,
        cgmGdoiCoopPeerStatus        CgmGdoiKsStatus,
        cgmGdoiCoopPeerRegisteredGMs Unsigned32
}

cgmGdoiCoopPeerIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for a Key Server.  RFC 4306 defines all valid types
        that can be used as an identifier.  These identification types
        are sent as the 'SRC ID Type' and 'DST ID Type' of the KEK and
        TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
        exchanges." 
    ::= { cgmGdoiCoopPeerEntry 1 }

cgmGdoiCoopPeerIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of a Peer (Key Server) ID.
        If no length is given (i.e. it has a value of 0), the default
        length of its cgmGdoiCoopPeerIdType should be used as long as it
        is not reprsented by an ASCII string.  If the value has a type
        that is represented by an ASCII string, a length MUST be
        included.  If the length given is not 0, it should match the
        'SRC ID Data Len' and 'DST ID Data Len' fields sent in the KEK
        and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
        exchanges." 
    ::= { cgmGdoiCoopPeerEntry 2 }

cgmGdoiCoopPeerIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The value of the identity information for a COOP Key Server
        with its type indicated by the cgmGdoiCoopPeerIdType. Use the
        cgmGdoiCoopPeerIdType to parse the COOP Peer (Key Server) ID
        correctly. This COOP Peer (Key Server) ID value is sent as the
        'SRC Identification Data' and 'DST Identification Data' of the
        KEK and TEK payloads for GDOI GROUPKEY-PULL and GROUPKEY-PUSH
        exchanges." 
    ::= { cgmGdoiCoopPeerEntry 3 }

cgmGdoiCoopPeerRole OBJECT-TYPE
    SYNTAX          CgmGdoiKsRole
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The current role of the COOP Peer (Key Server) for the Group." 
    ::= { cgmGdoiCoopPeerEntry 4 }

cgmGdoiCoopPeerStatus OBJECT-TYPE
    SYNTAX          CgmGdoiKsStatus
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The current status of the COOP Peer (Key Server) as seen from
        the local Key Server." 
    ::= { cgmGdoiCoopPeerEntry 5 }

cgmGdoiCoopPeerRegisteredGMs OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The count of registered Group Members to the COOP Peer (Key
        Server) identified by the index." 
    ::= { cgmGdoiCoopPeerEntry 6 }
 

-- *---------------------------------------------------------------- --
-- * The GDOI "Security Associations (SA)" Group
-- *---------------------------------------------------------------- --
--   
-- #-------------------------------------------------------------- --
-- # The GDOI "Key Server (KS) KEK Policy/SA" Table
-- #-------------------------------------------------------------- --

cgmGdoiKsKekTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiKsKekEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Key Encryption Key
        (KEK) Policies & Security Associations (SAs) currently
        configured/installed for GDOI entities acting as Key Servers
        on the network device being queried.  There is one entry in
        this table for each KEK Policy/SA that has been
        configured/installed.  Each KEK Policy/SA is uniquely
        identified by a SPI at any given time."
    ::= { cgmGdoiSecAssociations 1 }

cgmGdoiKsKekEntry OBJECT-TYPE
    SYNTAX          CgmGdoiKsKekEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI KEK
        Policy/SA, uniquely identified by the Group ID, Key Server
        ID, & SPI value assigned by the given Key Server to the KEK.
        There will be at least one KEK Policy/SA entry for each Key
        Server & two KEK Policy/SA entries for a given Key Server 
        only during a KEK rekey when a new KEK is created/installed.
        The KEK SPI is unique for every KEK for a given Key Server."
    REFERENCE
        "RFC 3547 - Sections: 1.     Introduction
          3.2.   Messages
          4.     GROUPKEY-PUSH Message
               5.3.   SA KEK Payload
               5.3.1. KEK Attributes
               5.5.   Key Download Payload"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiKeyServerIdType,
                        cgmGdoiKeyServerIdValue,
                        cgmGdoiKsKekIndex
                    } 
    ::= { cgmGdoiKsKekTable 1 }

CgmGdoiKsKekEntry ::= SEQUENCE {
        cgmGdoiKsKekIndex             Unsigned32,
        cgmGdoiKsKekSPI               CgmGdoiKekSPI,
        cgmGdoiKsKekSrcIdType         CgmGdoiIdentificationType,
        cgmGdoiKsKekSrcIdLength       Unsigned32,
        cgmGdoiKsKekSrcIdValue        CgmGdoiIdentificationValue,
        cgmGdoiKsKekSrcIdPort         CgmGdoiUnsigned16,
        cgmGdoiKsKekDstIdType         CgmGdoiIdentificationType,
        cgmGdoiKsKekDstIdLength       Unsigned32,
        cgmGdoiKsKekDstIdValue        CgmGdoiIdentificationValue,
        cgmGdoiKsKekDstIdPort         CgmGdoiUnsigned16,
        cgmGdoiKsKekIpProtocol        CgmGdoiIpProtocolId,
        cgmGdoiKsKekMgmtAlg           CgmGdoiKeyManagementAlgorithm,
        cgmGdoiKsKekEncryptAlg        CgmGdoiEncryptionAlgorithm,
        cgmGdoiKsKekEncryptKeyLength  Unsigned32,
        cgmGdoiKsKekSigHashAlg        CgmGdoiPseudoRandomFunction,
        cgmGdoiKsKekSigAlg            CgmGdoiSignatureMethod,
        cgmGdoiKsKekSigKeyLength      Unsigned32,
        cgmGdoiKsKekOakleyGroup       CgmGdoiDiffieHellmanGroup,
        cgmGdoiKsKekOriginalLifetime  Unsigned32,
        cgmGdoiKsKekRemainingLifetime Unsigned32,
        cgmGdoiKsKekStatus            CgmGdoiKekStatus
}

cgmGdoiKsKekIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the KS KEK.The value of the index is a number
        which begins at one and is incremented with each KS KEK that 
        is to be created by the KS for that GDOI group." 
    ::= { cgmGdoiKsKekEntry 1 }

cgmGdoiKsKekSPI OBJECT-TYPE
    SYNTAX          CgmGdoiKekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Security Parameter Index (SPI) of a KEK
        Policy/SA.  The SPI must be the ISAKMP Header cookie pair
        where the first 8 octets become the 'Initiator Cookie' field
        of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8
        octets become the 'Responder Cookie' in the same HDR.  As
        described above, these cookies are assigned by the GCKS." 
    ::= { cgmGdoiKsKekEntry 2 }

cgmGdoiKsKekSrcIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the source of a KEK Policy/SA.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'SRC ID Type' of
        the KEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.3. SA KEK payload
         RFC 4306 - Section:  3.5. Identification Payloads" 
    ::= { cgmGdoiKsKekEntry 3 }

cgmGdoiKsKekSrcIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the source ID of
        a KEK Policy/SA.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiKsKekSrcIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'SRC ID Data Len' field sent in the KEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiKsKekEntry 4 }

cgmGdoiKsKekSrcIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the source of
        a KEK Policy/SA with its type indicated by the
        cgmGdoiKsKekSrcIdType.  Use the cgmGdoiKsKekSrcIdType to parse 
        the KEK Source ID correctly.  This ID value is sent as the 'SRC
        Identification Data' of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiKsKekEntry 5 }

cgmGdoiKsKekSrcIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the source ID of
        a KEK Policy/SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `SRC ID Port`
        field of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiKsKekEntry 6 }

cgmGdoiKsKekDstIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the dest. of a KEK Policy/SA (multicast 
        rekey address).  RFC 4306 defines all valid types that can 
        be used as an identifier. This identification type is sent as 
        the 'DST ID Type' of the KEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.3. SA KEK payload
         RFC 4306 - Section:  3.5. Identification Payloads" 
    ::= { cgmGdoiKsKekEntry 7 }

cgmGdoiKsKekDstIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the destination ID of
        a KEK Policy/SA (multicast rekey address).  If no length is 
        given (i.e. it has a valueof 0), the default length of its 
        cgmGdoiKsKekDstIdType should be used as long as it is not 
        reprsented by an ASCII string.  If the value has a type that 
        is represented by an ASCII string, a length MUST be included.  
        If the length given is not 0, it should match the 'DST ID Data 
        Len' field sent in the KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiKsKekEntry 8 }

cgmGdoiKsKekDstIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the destination of
        a KEK Policy/SA (multicast rekey address) with its type 
        indicated by the cgmGdoiKsKekDstIdType.  Use the 
        cgmGdoiKsKekDstIdType to parse the KEK Dest. ID correctly.  
        This ID value is sent as the 'DST Identification Data' of a 
        KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiKsKekEntry 9 }

cgmGdoiKsKekDstIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the dest. ID of
        a KEK Policy/SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `DST ID Port`
        field of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiKsKekEntry 10 }

cgmGdoiKsKekIpProtocol OBJECT-TYPE
    SYNTAX          CgmGdoiIpProtocolId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the IP protocol ID (e.g. UDP/TCP) being used
        for the rekey datagram."
    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK payload" 
    ::= { cgmGdoiKsKekEntry 11 }

cgmGdoiKsKekMgmtAlg OBJECT-TYPE
    SYNTAX          CgmGdoiKeyManagementAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_MANAGEMENT_ALGORITHM which specifies
        the group KEK management algorithm used to provide forward
        or backward access control (i.e. used to exclude group
        members).

          KEK Management Type  Value
          -------------------  -----
           RESERVED              0
           LKH                   1
           RESERVED              2-127
           Private Use           128-255"
    REFERENCE
        "RFC 3547 - Section: 5.3.2. KEK_MANAGEMENT_ALGORITHM" 
    ::= { cgmGdoiKsKekEntry 12 }

cgmGdoiKsKekEncryptAlg OBJECT-TYPE
    SYNTAX          CgmGdoiEncryptionAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_ALGORITHM which specifies the
        encryption algorithm used with the KEK Policy/SA.  A GDOI
        implementaiton must support KEK_ALG_3DES.

        Following are the KEK encryption algoritm values defined in
        the GDOI RFC 3547, however the CgmGdoiEncryptionAlgorithm TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           KEK_ALG_DES      1
           KEK_ALG_3DES     2
           KEK_ALG_AES      3
           RESERVED         4-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section 5.3.3. KEK_ALGORITHM" 
    ::= { cgmGdoiKsKekEntry 13 }

cgmGdoiKsKekEncryptKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_KEY_LENGTH which specifies the KEK
        Algorithm key length (in bits)."
    REFERENCE       "RFC 3547 - Section: 5.3.4. KEK_KEY_LENGTH" 
    ::= { cgmGdoiKsKekEntry 14 }

cgmGdoiKsKekSigHashAlg OBJECT-TYPE
    SYNTAX          CgmGdoiPseudoRandomFunction
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_HASH_ALGORITHM which specifies the SIG
        payload hash algorithm.  This is not required (i.e. could
        have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or
        SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a
        value of zero or SIG_HASH_SHA1).

        Following are the Signature Hash Algorithm values defined in
        the GDOI RFC 3547, however the CgmGdoiPseudoRandomFunction TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           SIG_HASH_MD5     1
           SIG_HASH_SHA1    2
           RESERVED         3-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section: 5.3.6. SIG_HASH_ALGORITHM" 
    ::= { cgmGdoiKsKekEntry 15 }

cgmGdoiKsKekSigAlg OBJECT-TYPE
    SYNTAX          CgmGdoiSignatureMethod
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_ALGORITHM which specifies the SIG
        payload signature algorithm.  A GDOI implementation must
        support SIG_ALG_RSA.

        Following are the Signature Algorithm values defined in
        the GDOI RFC 3547, however the CgmGdoiSignatureMethod TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           SIG_ALG_RSA      1
           SIG_ALG_DSS      2
           SIG_ALG_ECDSS    3
           RESERVED         4-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section: 5.3.7. SIG_ALGORITHM" 
    ::= { cgmGdoiKsKekEntry 16 }

cgmGdoiKsKekSigKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_KEY_LENGTH which specifies the length
        of the SIG payload key."
    REFERENCE       "RFC 3547 - Section 5.3.8. SIG_KEY_LENGTH" 
    ::= { cgmGdoiKsKekEntry 17 }

cgmGdoiKsKekOakleyGroup OBJECT-TYPE
    SYNTAX          CgmGdoiDiffieHellmanGroup
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KE_OAKLEY_GROUP which specifies the OAKLEY
        or Diffie-Hellman Group used to compute the PFS secret in the
        optional KE payload of the GDOI GROUPKEY-PULL exchange."
    REFERENCE       "RFC 3547 - Section 5.3.9. KE_OAKLEY_GROUP" 
    ::= { cgmGdoiKsKekEntry 18 }

cgmGdoiKsKekOriginalLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_KEY_LIFETIME which specifies the maximum
        time for which a KEK is valid.  The GCKS may refresh the KEK
        at any time before the end of the valid period.  The value is
        a four (4) octet (32-bit) number defining a valid time period
        in seconds."
    REFERENCE       "RFC 3547 - Section 5.3.5. KEK_KEY_LIFETIME" 
    ::= { cgmGdoiKsKekEntry 19 }

cgmGdoiKsKekRemainingLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the remaining time for which a KEK is valid.
        The value is a four (4) octet (32-bit) number which begins at
        the value of cgmGdoiKsKekOriginalLifetime when the KEK is sent
        and counts down to zero in seconds.  If the lifetime has
        already expired, this value should remain at zero (0) until
        the Key Server refreshes the KEK."
    REFERENCE       "RFC 3547 - Section 5.3.5. KEK_KEY_LIFETIME" 
    ::= { cgmGdoiKsKekEntry 20 }

cgmGdoiKsKekStatus OBJECT-TYPE
    SYNTAX          CgmGdoiKekStatus
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The status of the KEK Policy/SA.  When this status value is
        queried, one of the following is returned:
        inUse(1), new(2), old(3)." 
    ::= { cgmGdoiKsKekEntry 21 }
 

-- #-------------------------------------------------------------- --
-- # The GDOI "Group Member (GM) KEK SA" Table
-- #-------------------------------------------------------------- --

cgmGdoiGmKekTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiGmKekEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Key Encryption Key
        (KEK) Security Associations (SAs) currently installed for
        GDOI entities acting as Group Members on the network device
        being queried.  There is one entry in this table for each
        KEK SA that has been installed and not yet deleted.  Each
        KEK SA is uniquely identified by a SPI at any given time."
    ::= { cgmGdoiSecAssociations 2 }

cgmGdoiGmKekEntry OBJECT-TYPE
    SYNTAX          CgmGdoiGmKekEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI KEK
        SA, uniquely identified by the Group ID, Group Member (GM)
        ID, & SPI value assigned by the GM's registered Key Server to
        the KEK.  There will be at least one KEK SA entry for each GM
        & two KEK SA entries for a given GM only during a KEK rekey
        when a new KEK is received & installed.  The KEK SPI is
        unique for every KEK for a given Group Member."
    REFERENCE
        "RFC 3547 - Sections: 1.     Introduction
          3.2.   Messages
          4.     GROUPKEY-PUSH Message
          5.3.   SA KEK Payload
          5.3.1. KEK Attributes
          5.5.   Key Download Payload"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiGmIdType,
                        cgmGdoiGmIdValue,
                        cgmGdoiGmKekIndex
                    } 
    ::= { cgmGdoiGmKekTable 1 }

CgmGdoiGmKekEntry ::= SEQUENCE {
        cgmGdoiGmKekIndex             Unsigned32,
        cgmGdoiGmKekSPI               CgmGdoiKekSPI,
        cgmGdoiGmKekSrcIdType         CgmGdoiIdentificationType,
        cgmGdoiGmKekSrcIdLength       Unsigned32,
        cgmGdoiGmKekSrcIdValue        CgmGdoiIdentificationValue,
        cgmGdoiGmKekSrcIdPort         CgmGdoiUnsigned16,
        cgmGdoiGmKekDstIdType         CgmGdoiIdentificationType,
        cgmGdoiGmKekDstIdLength       Unsigned32,
        cgmGdoiGmKekDstIdValue        CgmGdoiIdentificationValue,
        cgmGdoiGmKekDstIdPort         CgmGdoiUnsigned16,
        cgmGdoiGmKekIpProtocol        CgmGdoiIpProtocolId,
        cgmGdoiGmKekMgmtAlg           CgmGdoiKeyManagementAlgorithm,
        cgmGdoiGmKekEncryptAlg        CgmGdoiEncryptionAlgorithm,
        cgmGdoiGmKekEncryptKeyLength  Unsigned32,
        cgmGdoiGmKekSigHashAlg        CgmGdoiPseudoRandomFunction,
        cgmGdoiGmKekSigAlg            CgmGdoiSignatureMethod,
        cgmGdoiGmKekSigKeyLength      Unsigned32,
        cgmGdoiGmKekOakleyGroup       CgmGdoiDiffieHellmanGroup,
        cgmGdoiGmKekOriginalLifetime  Unsigned32,
        cgmGdoiGmKekRemainingLifetime Unsigned32,
        cgmGdoiGmKekStatus            CgmGdoiKekStatus
}

cgmGdoiGmKekIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the GM KEK in table.The value of the index is a
        number which begins at one and is incremented with each 
        KEK that is used by the GM for that GDOI group." 
    ::= { cgmGdoiGmKekEntry 1 }

cgmGdoiGmKekSPI OBJECT-TYPE
    SYNTAX          CgmGdoiKekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Security Parameter Index (SPI) of a KEK
        SA.  The SPI must be the ISAKMP Header cookie pair
        where the first 8 octets become the 'Initiator Cookie' field
        of the GROUPKEY-PUSH message ISAKMP HDR, and the second 8
        octets become the 'Responder Cookie' in the same HDR.  As
        described above, these cookies are assigned by the GCKS." 
    ::= { cgmGdoiGmKekEntry 2 }

cgmGdoiGmKekSrcIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the source of a KEK SA.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'SRC ID Type' of
        the KEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.3. SA KEK payload
         RFC 4306 - Section:  3.5. Identification Payloads" 
    ::= { cgmGdoiGmKekEntry 3 }

cgmGdoiGmKekSrcIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the source ID of
        a KEK SA.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiGmKekSrcIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'SRC ID Data Len' field sent in the KEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiGmKekEntry 4 }

cgmGdoiGmKekSrcIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the source of
        a KEK SA with its type indicated by the
        cgmGdoiGmKekSrcIdType.  Use the cgmGdoiGmKekSrcIdType to parse 
        the KEK Source ID correctly.  This ID value is sent as the 'SRC
        Identification Data' of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiGmKekEntry 5 }

cgmGdoiGmKekSrcIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the source ID of
        a KEK SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `SRC ID Port`
        field of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiGmKekEntry 6 }

cgmGdoiGmKekDstIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the dest. (multicast rekey address) of a 
        KEK SA.  RFC 4306 defines all valid types that can be used 
        as an identifier. This identification type is sent as the 
        'DST ID Type' of the KEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.3. SA KEK payload
         RFC 4306 - Section:  3.5. Identification Payloads" 
    ::= { cgmGdoiGmKekEntry 7 }

cgmGdoiGmKekDstIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the destination ID of
        a KEK SA.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiGmKekDstIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'DST ID Data Len' field sent in the KEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiGmKekEntry 8 }

cgmGdoiGmKekDstIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the destination of
        a KEK SA (multicast rekey address) with its type indicated by 
        cgmGdoiGmKekDstIdType.  Use the cgmGdoiGmKekDstIdType to parse 
        the KEK Dest. ID correctly.  This ID value is sent as the 'DST
        Identification Data' of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiGmKekEntry 9 }

cgmGdoiGmKekDstIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the dest. ID of
        a KEK SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `DST ID Port`
        field of a KEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.3. SA KEK payload" 
    ::= { cgmGdoiGmKekEntry 10 }

cgmGdoiGmKekIpProtocol OBJECT-TYPE
    SYNTAX          CgmGdoiIpProtocolId
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the IP protocol ID (e.g. UDP/TCP) being used
        for the rekey datagram."
    REFERENCE       "RFC 3547 - Section: 5.3. SA KEK payload" 
    ::= { cgmGdoiGmKekEntry 11 }

cgmGdoiGmKekMgmtAlg OBJECT-TYPE
    SYNTAX          CgmGdoiKeyManagementAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_MANAGEMENT_ALGORITHM which specifies
        the group KEK management algorithm used to provide forward
        or backward access control (i.e. used to exclude group
        members).

          KEK Management Type  Value
          -------------------  -----
           RESERVED              0
           LKH                   1
           RESERVED              2-127
           Private Use           128-255"
    REFERENCE
        "RFC 3547 - Section: 5.3.2. KEK_MANAGEMENT_ALGORITHM" 
    ::= { cgmGdoiGmKekEntry 12 }

cgmGdoiGmKekEncryptAlg OBJECT-TYPE
    SYNTAX          CgmGdoiEncryptionAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_ALGORITHM which specifies the
        encryption algorithm used with the KEK SA.  A GDOI
        implementaiton must support KEK_ALG_3DES.

        Following are the KEK encryption algoritm values defined in
        the GDOI RFC 3547, however the CgmGdoiEncryptionAlgorithm TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           KEK_ALG_DES      1
           KEK_ALG_3DES     2
           KEK_ALG_AES      3
           RESERVED         4-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section 5.3.3. KEK_ALGORITHM" 
    ::= { cgmGdoiGmKekEntry 13 }

cgmGdoiGmKekEncryptKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_KEY_LENGTH which specifies the KEK
        Algorithm key length (in bits)."
    REFERENCE       "RFC 3547 - Section: 5.3.4. KEK_KEY_LENGTH" 
    ::= { cgmGdoiGmKekEntry 14 }

cgmGdoiGmKekSigHashAlg OBJECT-TYPE
    SYNTAX          CgmGdoiPseudoRandomFunction
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_HASH_ALGORITHM which specifies the SIG
        payload hash algorithm.  This is not required (i.e. could
        have a value of zero) if the SIG_ALGORITHM is SIG_ALG_DSS or
        SIG_ALG_ECDSS, which imply SIG_HASH_SHA1 (i.e. must have a
        value of zero or SIG_HASH_SHA1).

        Following are the Signature Hash Algorithm values defined in
        the GDOI RFC 3547, however the CgmGdoiPseudoRandomFunction TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           SIG_HASH_MD5     1
           SIG_HASH_SHA1    2
           RESERVED         3-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section: 5.3.6. SIG_HASH_ALGORITHM" 
    ::= { cgmGdoiGmKekEntry 15 }

cgmGdoiGmKekSigAlg OBJECT-TYPE
    SYNTAX          CgmGdoiSignatureMethod
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_ALGORITHM which specifies the SIG
        payload signature algorithm.  A GDOI implementation must
        support SIG_ALG_RSA.

        Following are the Signature Algorithm values defined in
        the GDOI RFC 3547, however the CgmGdoiSignatureMethod TC
        defines all possible values.

          Algorithm Type  Value
          --------------  -----
           RESERVED         0
           SIG_ALG_RSA      1
           SIG_ALG_DSS      2
           SIG_ALG_ECDSS    3
           RESERVED         4-127
           Private Use      128-255"
    REFERENCE       "RFC 3547 - Section: 5.3.7. SIG_ALGORITHM" 
    ::= { cgmGdoiGmKekEntry 16 }

cgmGdoiGmKekSigKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SIG_KEY_LENGTH which specifies the length
        of the SIG payload key."
    REFERENCE       "RFC 3547 - Section 5.3.8. SIG_KEY_LENGTH" 
    ::= { cgmGdoiGmKekEntry 17 }

cgmGdoiGmKekOakleyGroup OBJECT-TYPE
    SYNTAX          CgmGdoiDiffieHellmanGroup
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KE_OAKLEY_GROUP which specifies the OAKLEY
        or Diffie-Hellman Group used to compute the PFS secret in the
        optional KE payload of the GDOI GROUPKEY-PULL exchange."
    REFERENCE       "RFC 3547 - Section 5.3.9. KE_OAKLEY_GROUP" 
    ::= { cgmGdoiGmKekEntry 18 }

cgmGdoiGmKekOriginalLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the KEK_KEY_LIFETIME which specifies the maximum
        time for which a KEK is valid.  The GCKS may refresh the KEK
        at any time before the end of the valid period.  The value is
        a four (4) octet (32-bit) number defining a valid time period
        in seconds."
    REFERENCE       "RFC 3547 - Section 5.3.5. KEK_KEY_LIFETIME" 
    ::= { cgmGdoiGmKekEntry 19 }

cgmGdoiGmKekRemainingLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the remaining time for which a KEK is valid.
        The value is a four (4) octet (32-bit) number which begins at
        the value of cgmGdoiGmKekOriginalLifetime and counts down to 0
        in seconds.  If the lifetime has already expired, this value
        should remain at zero (0) until the GCKS refreshes the KEK."
    REFERENCE       "RFC 3547 - Section 5.3.5. KEK_KEY_LIFETIME" 
    ::= { cgmGdoiGmKekEntry 20 }

cgmGdoiGmKekStatus OBJECT-TYPE
    SYNTAX          CgmGdoiKekStatus
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The status of the KEK SA.  When this status value is
        queried, one of the following is returned:
        inUse(1), new(2), old(3)." 
    ::= { cgmGdoiGmKekEntry 21 }
 

-- #-------------------------------------------------------------- --
-- # The GDOI "Key Server (KS) TEK Selector" Table
-- #-------------------------------------------------------------- --

cgmGdoiKsTekSelectorTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiKsTekSelectorEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Traffic Encryption Key
        (TEK) Selectors (source, destination, protocol information) 
        that is currently configured/pushed for GDOI entities
        acting as Key Servers on the network device being queried.
        There is one entry in this table for each TEK that has been
        configured & pushed to Group Members registered to the given
        Key Server."
    ::= { cgmGdoiSecAssociations 3 }

cgmGdoiKsTekSelectorEntry OBJECT-TYPE
    SYNTAX          CgmGdoiKsTekSelectorEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the Source/Destination attributes
        associated with a GDOI TEK Policy, uniquely identified by the 
        Group ID, Key Server ID and TEK Selector index.  There will be
        one entry for each Source/Destination Policy sent by the given
        Key Server to its registered Group Members, each with
        a unique <SRC-ID, SRC-PORT, DST-ID, DST-PORT, SPI> 5-tuple.
        However, due to the 255-octet constraint placed on an OID,
        the <SRC-ID, SRC-PORT, DST-ID, DST-PORT> 4-tuple cannot be
        used to INDEX a TEK entry for a given Group ID & Key Server
        ID.  Therefore, the TEK Selector index for a given Group ID & 
        Key Server ID MUST be unique. The TEK SPI is part of the TEK 
        Policy Table."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
          3.2. Messages
          4.   GROUPKEY-PUSH Message
          5.4. SA TEK Payload"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiKeyServerIdType,
                        cgmGdoiKeyServerIdValue,
                        cgmGdoiKsTekSelectorIndex
                    } 
    ::= { cgmGdoiKsTekSelectorTable 1 }

CgmGdoiKsTekSelectorEntry ::= SEQUENCE {
        cgmGdoiKsTekSelectorIndex    Unsigned32,
        cgmGdoiKsTekSrcIdType        CgmGdoiIdentificationType,
        cgmGdoiKsTekSrcIdLength      Unsigned32,
        cgmGdoiKsTekSrcIdValue       CgmGdoiIdentificationValue,
        cgmGdoiKsTekSrcIdPort        CgmGdoiUnsigned16,
        cgmGdoiKsTekDstIdType        CgmGdoiIdentificationType,
        cgmGdoiKsTekDstIdLength      Unsigned32,
        cgmGdoiKsTekDstIdValue       CgmGdoiIdentificationValue,
        cgmGdoiKsTekDstIdPort        CgmGdoiUnsigned16,
        cgmGdoiKsTekSecurityProtocol CgmGdoiSecurityProtocol
}

cgmGdoiKsTekSelectorIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the Source/Destination tuple to be secured by the
        KS TEK.The value of the index is a number which begins at 
        one and is incremented with each Source/Destination pair that 
        is to be secured by the KS TEK policy for that GDOI group." 
    ::= { cgmGdoiKsTekSelectorEntry 1 }

cgmGdoiKsTekSrcIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the source of a TEK Policy.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'SRC ID Type' of
        the TEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads" 
    ::= { cgmGdoiKsTekSelectorEntry 2 }

cgmGdoiKsTekSrcIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the source ID of
        a TEK Policy.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiKsTekSrcIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'SRC ID Data Len' field sent in the TEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekSelectorEntry 3 }

cgmGdoiKsTekSrcIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the source of
        a TEK Policy with its type indicated by the
        cgmGdoiKsTekSrcIdType.  Use the cgmGdoiKsTekSrcIdType to parse 
        the TEK Source ID correctly.  This ID value is sent as the 'SRC
        Identification Data' of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekSelectorEntry 4 }

cgmGdoiKsTekSrcIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the source ID of
        a TEK Policy.  A value of zero means that the port should
        be ignored.  This port value is sent as the `SRC ID Port`
        field of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekSelectorEntry 5 }

cgmGdoiKsTekDstIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the dest. of a TEK Policy.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'DST ID Type' of
        the TEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5. Identification Payloads" 
    ::= { cgmGdoiKsTekSelectorEntry 6 }

cgmGdoiKsTekDstIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the destination ID of
        a TEK Policy.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiKsTekDstIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'DST ID Data Len' field sent in the TEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekSelectorEntry 7 }

cgmGdoiKsTekDstIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the destination of
        a TEK Policy with its type indicated by the
        cgmGdoiKsTekDstIdType.  Use the cgmGdoiKsTekDstIdType to parse 
        the TEK Dest. ID correctly.  This ID value is sent as the 'DST
        Identification Data' of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekSelectorEntry 8 }

cgmGdoiKsTekDstIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the dest. ID of
        a TEK Policy.  A value of zero means that the port should
        be ignored.  This port value is sent as the `DST ID Port`
        field of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekSelectorEntry 9 }

cgmGdoiKsTekSecurityProtocol OBJECT-TYPE
    SYNTAX          CgmGdoiSecurityProtocol
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Protocol-ID field of a SA TEK (SAT) payload
        which specifies the Security Protocol for a TEK.

        Following are the Security Protocol values defined in
        the GDOI RFC 3547, however the CgmGdoiSecurityProtocol TC
        defines all possible values.

          Protocol ID             Value
          ----------------------  -----
           RESERVED                 0
           GDOI_PROTO_IPSEC_ESP     1
           RESERVED                 2-127
           Private Use              128-255"
    REFERENCE       "RFC 3547 - Section: 5.4. SA TEK Payload" 
    ::= { cgmGdoiKsTekSelectorEntry 10 }
 

-- #-------------------------------------------------------------- --
-- # The GDOI "Key Server (KS) TEK Policy" Table
-- #-------------------------------------------------------------- --

cgmGdoiKsTekPolicyTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiKsTekPolicyEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Traffic Encryption Key
        (TEK) Policies currently configured/pushed for GDOI entities
        acting as Key Servers on the network device being queried.
        There is one entry in this table for each TEK that has been
        configured & pushed to Group Members registered to the given
        Key Server."
    ::= { cgmGdoiSecAssociations 4 }

cgmGdoiKsTekPolicyEntry OBJECT-TYPE
    SYNTAX          CgmGdoiKsTekPolicyEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI TEK
        Policy, uniquely identified by the Group ID, Key Server ID,
        TEK Selector Index (Source/Destination IDs & Ports), and TEK 
        Policy Index (TEK SPI and direction).  There will be one or 
        more TEK entries for each TEK Policy sent by the given Key 
        Server to its registered Group Members, each with a unique 
        <SRC-ID, SRC-PORT, DST-ID, DST-PORT, SPI> 5-tuple."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
          3.2. Messages
          4.   GROUPKEY-PUSH Message
          5.4. SA TEK Payload"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiKeyServerIdType,
                        cgmGdoiKeyServerIdValue,
                        cgmGdoiKsTekSelectorIndex,
                        cgmGdoiKsTekPolicyIndex
                    } 
    ::= { cgmGdoiKsTekPolicyTable 1 }

CgmGdoiKsTekPolicyEntry ::= SEQUENCE {
        cgmGdoiKsTekPolicyIndex         Unsigned32,
        cgmGdoiKsTekSPI                 CgmGdoiTekSPI,
        cgmGdoiKsTekEncapsulationMode   CgmGdoiEncapsulationMode,
        cgmGdoiKsTekEncryptionAlgorithm CgmGdoiEncryptionAlgorithm,
        cgmGdoiKsTekEncryptionKeyLength Unsigned32,
        cgmGdoiKsTekIntegrityAlgorithm  CgmGdoiIntegrityAlgorithm,
        cgmGdoiKsTekIntegrityKeyLength  Unsigned32,
        cgmGdoiKsTekWindowSize          Unsigned32,
        cgmGdoiKsTekOriginalLifetime    Unsigned32,
        cgmGdoiKsTekRemainingLifetime   Unsigned32,
        cgmGdoiKsTekStatus              CgmGdoiTekStatus
}

cgmGdoiKsTekPolicyIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the policy that is used to secure the KS TEK.
        The value of the index is a number which begins at 
        one and is incremented with each row in this table." 
    ::= { cgmGdoiKsTekPolicyEntry 1 }

cgmGdoiKsTekSPI OBJECT-TYPE
    SYNTAX          CgmGdoiTekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Security Parameter Index (SPI) of a TEK
        Policy.  The SPI must be the SPI for ESP."
    REFERENCE       "RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 2 }

cgmGdoiKsTekEncapsulationMode OBJECT-TYPE
    SYNTAX          CgmGdoiEncapsulationMode
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Encapsulation Mode of a TEK (IPsec SA).

        Following are the Encapsulation Mode values defined in
        RFC 2407, however the CgmGdoiEncapsulationMode TC defines all
        possible values.

          Encapsulation Mode  Value
          ------------------  -----
           RESERVED             0
           Tunnel               1
           Transport            2"
    REFERENCE
        "RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 3 }

cgmGdoiKsTekEncryptionAlgorithm OBJECT-TYPE
    SYNTAX          CgmGdoiEncryptionAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Transform ID field of a PROTO_IPSEC_ESP
        payload which specifies the ESP transform to be used.  If
        no encryption is used, this value will be zero (0).

        Following are the ESP Transform values defined in RFC 2407,
        however the CgmGdoiEncryptionAlgorithm TC defines all possible
        values.

          IPsec ESP Transform ID    Value
          ------------------------  -----
           RESERVED                   0
           ESP_DES_IV64               1
           ESP_DES                    2
           ESP_3DES                   3
           ESP_RC5                    4
           ESP_IDEA                   5
           ESP_CAST                   6
           ESP_BLOWFISH               7
           ESP_3IDEA                  8
           ESP_DES_IV32               9
           ESP_RC4                    10
           ESP_NULL                   11"
    REFERENCE
        "RFC 2407 - Section: 4.4.4. IPSEC ESP Transform Identifiers
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 4 }

cgmGdoiKsTekEncryptionKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length of the key used for encryption in a TEK
        (in bits)."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 5 }

cgmGdoiKsTekIntegrityAlgorithm OBJECT-TYPE
    SYNTAX          CgmGdoiIntegrityAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Authentication Algorithm for a TEK IPsec
        ESP SA.  If no authentication is used, this value will be
        zero (0).

        Following are the Authentication Algorithm values defined in
        RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all
        possible values.

          Algorithm Type  Value
          --------------  -----
           HMAC-MD5         1
           HMAC-SHA         2
           DES-MAC          3
           KPDK             4"
    REFERENCE
        "RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 6 }

cgmGdoiKsTekIntegrityKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length of the key used for integrity/authentication in a
        TEK (in bits)."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 7 }

cgmGdoiKsTekWindowSize OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "GROUPKEY-PUSH Messages"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The size of the Time Based Anti-Replay (TBAR) window used by
        this TEK Policy."
    REFERENCE
        "RFC 2407 - Section: 4.6.3.2. REPLAY-STATUS
         RFC 3547 - Section: 6.3.4.   Replay/Reflection Attack
              Protection" 
    ::= { cgmGdoiKsTekPolicyEntry 8 }

cgmGdoiKsTekOriginalLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SA Life Type defined in RFC 2407 which
        specifies the maximum time for which a TEK IPsec SA is valid.
        The GCKS may refresh the TEK at any time before the end of
        the valid period.  The value is a four (4) octet (32-bit)
        number defining a valid time period in seconds."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 9 }

cgmGdoiKsTekRemainingLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the remaining time for which a TEK is valid.
        The value is a four (4) octet (32-bit) number which begins at
        the value of cgmGdoiKsTekOriginalLifetime when the TEK is sent
        and counts down to zero in seconds.  If the lifetime has
        already expired, this value should remain at zero (0) until
        the Key Server refreshes the TEK."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiKsTekPolicyEntry 10 }

cgmGdoiKsTekStatus OBJECT-TYPE
    SYNTAX          CgmGdoiTekStatus
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The status of the TEK Policy.  When this status value is
        queried, one of the following is returned:
        inbound(1), outbound(2), notInUse(3)." 
    ::= { cgmGdoiKsTekPolicyEntry 11 }
 

-- #-------------------------------------------------------------- --
-- # The GDOI "Group Member (GM) TEK Selector" Table
-- #-------------------------------------------------------------- --

cgmGdoiGmTekSelectorTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiGmTekSelectorEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Traffic Encryption Key
        (TEK) Security Associations (SAs/Policies) pushed by a 
        Key Server & installed for GDOI entities acting as Group
        Members (GMs) on the network device being queried.  There is
        one entry in this table for each unique TEK traffic selector 
        (Source/Destination tuple) that has been downloaded from the 
        Key Server and installed on the Group Member."
    ::= { cgmGdoiSecAssociations 5 }

cgmGdoiGmTekSelectorEntry OBJECT-TYPE
    SYNTAX          CgmGdoiGmTekSelectorEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI TEK
        Policy/SA, uniquely identified by the Group ID, Group Member
        ID, Source/Destination IDs & Ports, and TEK SPI.  There will
        be one or more TEK entries for each TEK Policy/SA received
        and installed by the given Group Member from its registered
        Key Server, each with a unique <SRC-ID, SRC-PORT, DST-ID, 
        DST-PORT, SPI> 5-tuple. This table does not contain the SPI
        which is part of the TEK policy table."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
          3.2. Messages
          4.   GROUPKEY-PUSH Message
          5.4. SA TEK Payload"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiGmIdType,
                        cgmGdoiGmIdValue,
                        cgmGdoiGmTekSelectorIndex
                    } 
    ::= { cgmGdoiGmTekSelectorTable 1 }

CgmGdoiGmTekSelectorEntry ::= SEQUENCE {
        cgmGdoiGmTekSelectorIndex    Unsigned32,
        cgmGdoiGmTekSrcIdType        CgmGdoiIdentificationType,
        cgmGdoiGmTekSrcIdLength      Unsigned32,
        cgmGdoiGmTekSrcIdValue       CgmGdoiIdentificationValue,
        cgmGdoiGmTekSrcIdPort        CgmGdoiUnsigned16,
        cgmGdoiGmTekDstIdType        CgmGdoiIdentificationType,
        cgmGdoiGmTekDstIdLength      Unsigned32,
        cgmGdoiGmTekDstIdValue       CgmGdoiIdentificationValue,
        cgmGdoiGmTekDstIdPort        CgmGdoiUnsigned16,
        cgmGdoiGmTekSecurityProtocol CgmGdoiSecurityProtocol
}

cgmGdoiGmTekSelectorIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the Source/Destination pair secured by the
        GM TEK.The value of the index is a number which begins at 
        one and is incremented with each Source/Destination pair that 
        is secured by the GM TEK policy for that GDOI group." 
    ::= { cgmGdoiGmTekSelectorEntry 1 }

cgmGdoiGmTekSrcIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the source of a TEK Policy/SA.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'SRC ID Type' of
        the TEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5.   Identification Payloads" 
    ::= { cgmGdoiGmTekSelectorEntry 2 }

cgmGdoiGmTekSrcIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the source ID of
        a TEK Policy/SA.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiGmTekSrcIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'SRC ID Data Len' field sent in the TEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekSelectorEntry 3 }

cgmGdoiGmTekSrcIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the source of
        a TEK Policy/SA with its type indicated by the
        cgmGdoiGmTekSrcIdType.  Use the cgmGdoiGmTekSrcIdType to parse 
        the TEK Source ID correctly.  This ID value is sent as the 'SRC
        Identification Data' of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekSelectorEntry 4 }

cgmGdoiGmTekSrcIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the source ID of
        a TEK Policy/SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `SRC ID Port`
        field of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekSelectorEntry 5 }

cgmGdoiGmTekDstIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The Identification Type Value used to parse the identity
        information for the dest. of a TEK Policy/SA.  RFC 4306
        defines all valid types that can be used as an identifier.
        This identification type is sent as the 'DST ID Type' of
        the TEK payload."
    REFERENCE
        "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP
         RFC 4306 - Section:  3.5. Identification Payloads" 
    ::= { cgmGdoiGmTekSelectorEntry 6 }

cgmGdoiGmTekDstIdLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Octets"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length (i.e. number of octets) of the destination ID of
        a TEK Policy/SA.  If no length is given (i.e. it has a value
        of 0), the default length of its cgmGdoiGmTekDstIdType should be
        used as long as it is not reprsented by an ASCII string.  If
        the value has a type that is represented by an ASCII string,
        a length MUST be included.  If the length given is not 0, it
        should match the 'DST ID Data Len' field sent in the TEK
        payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekSelectorEntry 7 }

cgmGdoiGmTekDstIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the identity information for the destination of
        a TEK Policy/SA with its type indicated by the
        cgmGdoiGmTekDstIdType.  Use the cgmGdoiGmTekDstIdType to parse 
        the TEK Dest. ID correctly.  This ID value is sent as the 'DST
        Identification Data' of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekSelectorEntry 8 }

cgmGdoiGmTekDstIdPort OBJECT-TYPE
    SYNTAX          CgmGdoiUnsigned16
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value specifying a port associated with the dest. ID of
        a TEK Policy/SA.  A value of zero means that the port should
        be ignored.  This port value is sent as the `DST ID Port`
        field of a TEK payload."
    REFERENCE       "RFC 3547 - Sections: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekSelectorEntry 9 }

cgmGdoiGmTekSecurityProtocol OBJECT-TYPE
    SYNTAX          CgmGdoiSecurityProtocol
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Protocol-ID field of a SA TEK (SAT) payload
        which specifies the Security Protocol for a TEK.

        Following are the Security Protocol values defined in
        the GDOI RFC 3547, however the CgmGdoiSecurityProtocol TC
        defines all possible values.

          Protocol ID             Value
          ----------------------  -----
           RESERVED                 0
           GDOI_PROTO_IPSEC_ESP     1
           RESERVED                 2-127
           Private Use              128-255"
    REFERENCE       "RFC 3547 - Section: 5.4. SA TEK Payload" 
    ::= { cgmGdoiGmTekSelectorEntry 10 }
 

-- #-------------------------------------------------------------- --
-- # The GDOI "Group Member (GM) TEK Policy" Table
-- #-------------------------------------------------------------- --

cgmGdoiGmTekPolicyTable OBJECT-TYPE
    SYNTAX          SEQUENCE OF CgmGdoiGmTekPolicyEntry 
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "A table of information regarding GDOI Traffic Encryption Key
        (TEK) Security Associations (SAs/Policies) received by a 
        Key Server & installed for GDOI entities acting as Group
        Members (GMs) on the network device being queried.  There is
        one entry in this table for each TEK SA that has been
        installed on the Group Member."
    ::= { cgmGdoiSecAssociations 6 }

cgmGdoiGmTekPolicyEntry OBJECT-TYPE
    SYNTAX          CgmGdoiGmTekPolicyEntry
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "An entry containing the attributes associated with a GDOI TEK
        Policy/SA, uniquely identified by the Group ID, Group Member
        ID, TEK Selector (Source/Destination IDs & Ports), and TEK 
        Policy index (TEK SPI and direction).  There will be one or 
        more TEK entries for each TEK Policy/SA received and installed 
        by the given Group Member from its registered Key Server, each 
        with a unique <SRC-ID, SRC-PORT, DST-ID, DST-PORT, SPI> tuple. 
        This table contains the SPI information corresponding to a TEK 
        Selector index."
    REFERENCE
        "RFC 3547 - Sections: 1.   Introduction
          3.2. Messages
          4.   GROUPKEY-PUSH Message
          5.4. SA TEK Payload"
    INDEX           {
                        cgmGdoiGroupIdType,
                        cgmGdoiGroupIdValue,
                        cgmGdoiGmIdType,
                        cgmGdoiGmIdValue,
                        cgmGdoiGmTekSelectorIndex,
                        cgmGdoiGmTekPolicyIndex
                    } 
    ::= { cgmGdoiGmTekPolicyTable 1 }

CgmGdoiGmTekPolicyEntry ::= SEQUENCE {
        cgmGdoiGmTekPolicyIndex         Unsigned32,
        cgmGdoiGmTekSPI                 CgmGdoiTekSPI,
        cgmGdoiGmTekEncapsulationMode   CgmGdoiEncapsulationMode,
        cgmGdoiGmTekEncryptionAlgorithm CgmGdoiEncryptionAlgorithm,
        cgmGdoiGmTekEncryptionKeyLength Unsigned32,
        cgmGdoiGmTekIntegrityAlgorithm  CgmGdoiIntegrityAlgorithm,
        cgmGdoiGmTekIntegrityKeyLength  Unsigned32,
        cgmGdoiGmTekWindowSize          Unsigned32,
        cgmGdoiGmTekOriginalLifetime    Unsigned32,
        cgmGdoiGmTekRemainingLifetime   Unsigned32,
        cgmGdoiGmTekStatus              CgmGdoiTekStatus
}

cgmGdoiGmTekPolicyIndex OBJECT-TYPE
    SYNTAX          Unsigned32
    MAX-ACCESS      not-accessible
    STATUS          current
    DESCRIPTION
        "The index of the SPI used to secure the GM TEK.The value of
        the index is a number which begins at one and is incremented 
        with each row of the GM TEK SPI table." 
    ::= { cgmGdoiGmTekPolicyEntry 1 }

cgmGdoiGmTekSPI OBJECT-TYPE
    SYNTAX          CgmGdoiTekSPI
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Security Parameter Index (SPI) of a TEK
        Policy/SA.  The SPI must be the SPI for ESP."
    REFERENCE       "RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 2 }

cgmGdoiGmTekEncapsulationMode OBJECT-TYPE
    SYNTAX          CgmGdoiEncapsulationMode
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Encapsulation Mode of a TEK (IPsec SA).

        Following are the Encapsulation Mode values defined in
        RFC 2407, however the CgmGdoiEncapsulationMode TC defines all
        possible values.

          Encapsulation Mode  Value
          ------------------  -----
           RESERVED             0
           Tunnel               1
           Transport            2"
    REFERENCE
        "RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 3 }

cgmGdoiGmTekEncryptionAlgorithm OBJECT-TYPE
    SYNTAX          CgmGdoiEncryptionAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Transform ID field of a PROTO_IPSEC_ESP
        payload which specifies the ESP transform to be used.  If
        no encryption is used, this value will be zero (0).

        Following are the ESP Transform values defined in RFC 2407,
        however the CgmGdoiEncryptionAlgorithm TC defines all possible
        values.

          IPsec ESP Transform ID    Value
          ------------------------  -----
           RESERVED                   0
           ESP_DES_IV64               1
           ESP_DES                    2
           ESP_3DES                   3
           ESP_RC5                    4
           ESP_IDEA                   5
           ESP_CAST                   6
           ESP_BLOWFISH               7
           ESP_3IDEA                  8
           ESP_DES_IV32               9
           ESP_RC4                    10
           ESP_NULL                   11"
    REFERENCE
        "RFC 2407 - Section: 4.4.4. IPSEC ESP Transform Identifiers
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 4 }

cgmGdoiGmTekEncryptionKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length of the key used for encryption in a TEK
        (in bits)."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 5 }

cgmGdoiGmTekIntegrityAlgorithm OBJECT-TYPE
    SYNTAX          CgmGdoiIntegrityAlgorithm
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the Authentication Algorithm for a TEK IPsec
        ESP SA.  If no authentication is used, this value will be
        zero (0).

        Following are the Authentication Algorithm values defined in
        RFC 2407, however the CgmGdoiEncryptionAlgorithm TC defines all
        possible values.

          Algorithm Type  Value
          --------------  -----
           HMAC-MD5         1
           HMAC-SHA         2
           DES-MAC          3
           KPDK             4"
    REFERENCE
        "RFC 2407 - Section: 4.5.   IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 6 }

cgmGdoiGmTekIntegrityKeyLength OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Bits"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The length of the key used for integrity/authentication in a
        TEK (in bits)."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 7 }

cgmGdoiGmTekWindowSize OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "GROUPKEY-PUSH Messages"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The size of the Time Based Anti-Replay (TBAR) window used by
        this TEK Policy/SA."
    REFERENCE
        "RFC 2407 - Section: 4.6.3.2. REPLAY-STATUS
         RFC 3547 - Section: 6.3.4.   Replay/Reflection Attack
              Protection" 
    ::= { cgmGdoiGmTekPolicyEntry 8 }

cgmGdoiGmTekOriginalLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the SA Life Type defined in RFC 2407 which
        specifies the maximum time for which a TEK IPsec SA is valid.
        The GCKS may refresh the TEK at any time before the end of
        the valid period.  The value is a four (4) octet (32-bit)
        number defining a valid time period in seconds."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 9 }

cgmGdoiGmTekRemainingLifetime OBJECT-TYPE
    SYNTAX          Unsigned32
    UNITS           "Seconds"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The value of the remaining time for which a TEK is valid.
        The value is a four (4) octet (32-bit) number which begins at
        the value of cgmGdoiGmTekOriginalLifetime and counts down to 0
        in seconds.  If the lifetime has already expired, this value
        should remain at zero (0) until the GCKS refreshes the TEK."
    REFERENCE
        "RFC 2407 - Section: 4.5    IPSEC Security Assoc. Attributes
         RFC 3547 - Section: 5.4.1. PROTO_IPSEC_ESP" 
    ::= { cgmGdoiGmTekPolicyEntry 10 }

cgmGdoiGmTekStatus OBJECT-TYPE
    SYNTAX          CgmGdoiTekStatus
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The status of the TEK Policy/SA.  When this status value is
        queried, one of the following is returned:
        inbound(1), outbound(2), notInUse(3)." 
    ::= { cgmGdoiGmTekPolicyEntry 11 }
 


-- #-------------------------------------------------------------- --
-- # The GDOI Notification Control Table
-- #-------------------------------------------------------------- --

cgmGdoiKSNewRegNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "Indicates whether or not a notification should be
        generated on a Key Server when a new Group
        Member begins registration to a GDOI group." 
    ::= { cgmGdoiNotifCntl 1 }

cgmGdoiKSRegCompNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "Indicates whether or not a notification should be
        generated on a Key Server when a new Group
        Member successfully registers to a GDOI group." 
    ::= { cgmGdoiNotifCntl 2 }

cgmGdoiKSRekeyPushNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "Indicates whether or not a notification should be
        generated on a Key Server when a rekey is sent
        to a GDOI group." 
    ::= { cgmGdoiNotifCntl 3 }

cgmGdoiKSNoRSANotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-write
    STATUS          current
    DESCRIPTION
        "Indicates whether or not an error notification should
        be generated on a Key Server when an RSA 
        key is not set up." 
    ::= { cgmGdoiNotifCntl 4 }

cgmGdoiGMRegNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not a notification should be
        generated on a Group Member when it starts
        registration to a Key Server in a GDOI group." 
    ::= { cgmGdoiNotifCntl 5 }

cgmGdoiGmRegCompNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not a notification should be
        generated on a Group Member when it 
        successfully registers to a Key Server in 
        a GDOI group." 
    ::= { cgmGdoiNotifCntl 6 }

cgmGdoiGmReRegNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not a notification should be
        generated on a Group Member when it starts
        to re-register to a Key Server in a GDOI group." 
    ::= { cgmGdoiNotifCntl 7 }

cgmGdoiGmRekeyRecNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not a notification should be
        generated on a Group Member when it receives
        and processes a rekey sent by a Key Server in 
        a GDOI group." 
    ::= { cgmGdoiNotifCntl 8 }

cgmGdoiGmIncompCfgNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not an error notification should
        be generated on a Group Member when there is
        missing information for configuring a GDOI group." 
    ::= { cgmGdoiNotifCntl 9 }

cgmGdoiGmNoIpSecFlowsNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not an error notification should
        be generated on a Group Member when no more
        security associations can be installed after receiving
        a rekey from a Key Server in a GDOI group." 
    ::= { cgmGdoiNotifCntl 10 }

cgmGdoiGmRekeyFailNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not an error notification should
        be generated on a Group Member when it is unable
        to successfully process and install a rekey." 
    ::= { cgmGdoiNotifCntl 11 }

cgmGdoiKsRoleChangeNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not cgmGdoiKeyServerRoleChange
        notification should be generated on a Key Server when its role
        changes from Primary to Secondary or vice-versa." 
    ::= { cgmGdoiNotifCntl 12 }

cgmGdoiKsGmDeletedNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not cgmGdoiKeyServerGmDeleted notification
        should be generated on a Key Server when a Group Member is
        deleted from the group database." 
    ::= { cgmGdoiNotifCntl 13 }

cgmGdoiKsPeerReachNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not cgmGdoiKeyServerPeerReachable
        notification should be generated on a Key Server when
        unreachable peer Key Server becomes reachable." 
    ::= { cgmGdoiNotifCntl 14 }

cgmGdoiKsPeerUnreachNotifEnable OBJECT-TYPE
    SYNTAX          TruthValue
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "Indicates whether or not cgmGdoiKeyServerPeerUnreachable
        notification should be generated on a Key Server when reachable
        peer Key Server becomes unreachable." 
    ::= { cgmGdoiNotifCntl 15 }

cgmGdoiNotifGroupIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. This variable captures
        the identification type of the GDOI group." 
    ::= { cgmGdoiNotifVars 1 }

cgmGdoiNotifGroupIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The value of a Group ID
        with its type indicated by the cgmGdoiNotifGroupIdType. Use the
        cgmGdoiNotifGroupIdType to parse the value of this field
        correctly." 
    ::= { cgmGdoiNotifVars 2 }

cgmGdoiNotifGroupName OBJECT-TYPE
    SYNTAX          DisplayString
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The string-readable name
        configured for or given to a GDOI Group." 
    ::= { cgmGdoiNotifVars 3 }

cgmGdoiNotifKeyServerIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The Identification Type
        Value used to parse the identity information of a Key Server." 
    ::= { cgmGdoiNotifVars 4 }

cgmGdoiNotifKeyServerIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The value of the identity
        information for a Key Server with its type indicated by the
        cgmGdoiNotifKeyServerIdType. Use the cgmGdoiNotifKeyServerIdType
        to parse the Key Server ID correctly." 
    ::= { cgmGdoiNotifVars 5 }

cgmGdoiNotifKeyServerRole OBJECT-TYPE
    SYNTAX          CgmGdoiKsRole
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The current role of the
        Key Server for the Group." 
    ::= { cgmGdoiNotifVars 6 }

cgmGdoiNotifGmIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The Identification Type
        Value used to parse the identity information for a Initiator or
        Group Member." 
    ::= { cgmGdoiNotifVars 7 }

cgmGdoiNotifGmIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The value of the identity
        information for a Group Member with its type indicated by the
        cgmGdoiNotifGmIdType. Use the cgmGdoiNotifGmIdType to parse the
        Group Member ID's value correctly." 
    ::= { cgmGdoiNotifVars 8 }

cgmGdoiNotifPeerKsIdType OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationType
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The Identification Type
        Value used to parse the identity information of a Key Server." 
    ::= { cgmGdoiNotifVars 9 }

cgmGdoiNotifPeerKsIdValue OBJECT-TYPE
    SYNTAX          CgmGdoiIdentificationValue
    MAX-ACCESS      accessible-for-notify
    STATUS          current
    DESCRIPTION
        "Variable used only for notifications. The value of the identity
        information for a Peer Key Server with its type indicated by the
        cgmGdoiNotifPeerKsIdType. Use the cgmGdoiNotifPeerKsIdType to
        parse the Peer Key Server ID correctly." 
    ::= { cgmGdoiNotifVars 10 }
-- ------------------------------------------------------------------ --
-- GDOI MIB Conformance & Compliance Information
-- ------------------------------------------------------------------ --
--   
-- *---------------------------------------------------------------- --
-- * GDOI MIB Conformance Information
-- *---------------------------------------------------------------- --

cgmGdoiMIBGroups  OBJECT IDENTIFIER
    ::= { cgmGdoiMIBConformance 1 }

cgmGdoiMIBCompliances  OBJECT IDENTIFIER
    ::= { cgmGdoiMIBConformance 2 }


-- #-------------------------------------------------------------- --
-- # GDOI MIB Units/Groups of Conformance
-- #-------------------------------------------------------------- --

cgmGdoiGroupIdGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiGroupIdLength,
                        cgmGdoiGroupName
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI Group Table

        cgmGdoiGroupIdGroupRev1 is an extension to this group."
    ::= { cgmGdoiMIBGroups 1 }

cgmGdoiKeyServerGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiKeyServerIdLength,
                        cgmGdoiKeyServerActiveKEK,
                        cgmGdoiKeyServerRekeysPushed
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI Key Server Table

        cgmGdoiKeyServerGroupRev1 is an extension to this group."
    ::= { cgmGdoiMIBGroups 2 }

cgmGdoiGmGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiGmIdLength,
                        cgmGdoiGmRegKeyServerIdType,
                        cgmGdoiGmRegKeyServerIdLength,
                        cgmGdoiGmRegKeyServerIdValue,
                        cgmGdoiGmActiveKEK,
                        cgmGdoiGmRekeysReceived
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI GM Table

        cgmGdoiGmGroupRev1 is an extension to this group."
    ::= { cgmGdoiMIBGroups 3 }

cgmGdoiKsSecurityAssociationsGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiKsKekSPI,
                        cgmGdoiKsKekSrcIdType,
                        cgmGdoiKsKekSrcIdLength,
                        cgmGdoiKsKekSrcIdValue,
                        cgmGdoiKsKekSrcIdPort,
                        cgmGdoiKsKekDstIdType,
                        cgmGdoiKsKekDstIdLength,
                        cgmGdoiKsKekDstIdValue,
                        cgmGdoiKsKekDstIdPort,
                        cgmGdoiKsKekIpProtocol,
                        cgmGdoiKsKekMgmtAlg,
                        cgmGdoiKsKekEncryptAlg,
                        cgmGdoiKsKekEncryptKeyLength,
                        cgmGdoiKsKekSigHashAlg,
                        cgmGdoiKsKekSigAlg,
                        cgmGdoiKsKekSigKeyLength,
                        cgmGdoiKsKekOakleyGroup,
                        cgmGdoiKsKekOriginalLifetime,
                        cgmGdoiKsKekRemainingLifetime,
                        cgmGdoiKsKekStatus,
                        cgmGdoiKsTekSrcIdType,
                        cgmGdoiKsTekSrcIdLength,
                        cgmGdoiKsTekSrcIdValue,
                        cgmGdoiKsTekSrcIdPort,
                        cgmGdoiKsTekDstIdType,
                        cgmGdoiKsTekDstIdLength,
                        cgmGdoiKsTekDstIdValue,
                        cgmGdoiKsTekDstIdPort,
                        cgmGdoiKsTekSecurityProtocol,
                        cgmGdoiKsTekSPI,
                        cgmGdoiKsTekEncapsulationMode,
                        cgmGdoiKsTekEncryptionAlgorithm,
                        cgmGdoiKsTekEncryptionKeyLength,
                        cgmGdoiKsTekIntegrityAlgorithm,
                        cgmGdoiKsTekIntegrityKeyLength,
                        cgmGdoiKsTekWindowSize,
                        cgmGdoiKsTekOriginalLifetime,
                        cgmGdoiKsTekRemainingLifetime,
                        cgmGdoiKsTekStatus
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI Key Server KEK Policy/SA Table
        2) GDOI Key Server TEK Policy Table"
    ::= { cgmGdoiMIBGroups 4 }

cgmGdoiGmSecurityAssociationsGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiGmKekSPI,
                        cgmGdoiGmKekSrcIdType,
                        cgmGdoiGmKekSrcIdLength,
                        cgmGdoiGmKekSrcIdValue,
                        cgmGdoiGmKekSrcIdPort,
                        cgmGdoiGmKekDstIdType,
                        cgmGdoiGmKekDstIdLength,
                        cgmGdoiGmKekDstIdValue,
                        cgmGdoiGmKekDstIdPort,
                        cgmGdoiGmKekIpProtocol,
                        cgmGdoiGmKekMgmtAlg,
                        cgmGdoiGmKekEncryptAlg,
                        cgmGdoiGmKekEncryptKeyLength,
                        cgmGdoiGmKekSigHashAlg,
                        cgmGdoiGmKekSigAlg,
                        cgmGdoiGmKekSigKeyLength,
                        cgmGdoiGmKekOakleyGroup,
                        cgmGdoiGmKekOriginalLifetime,
                        cgmGdoiGmKekRemainingLifetime,
                        cgmGdoiGmKekStatus,
                        cgmGdoiGmTekSrcIdType,
                        cgmGdoiGmTekSrcIdLength,
                        cgmGdoiGmTekSrcIdValue,
                        cgmGdoiGmTekSrcIdPort,
                        cgmGdoiGmTekDstIdType,
                        cgmGdoiGmTekDstIdLength,
                        cgmGdoiGmTekDstIdValue,
                        cgmGdoiGmTekDstIdPort,
                        cgmGdoiGmTekSecurityProtocol,
                        cgmGdoiGmTekSPI,
                        cgmGdoiGmTekEncapsulationMode,
                        cgmGdoiGmTekEncryptionAlgorithm,
                        cgmGdoiGmTekEncryptionKeyLength,
                        cgmGdoiGmTekIntegrityAlgorithm,
                        cgmGdoiGmTekIntegrityKeyLength,
                        cgmGdoiGmTekWindowSize,
                        cgmGdoiGmTekOriginalLifetime,
                        cgmGdoiGmTekRemainingLifetime,
                        cgmGdoiGmTekStatus
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI Group Member KEK Policy/SA Table
        2) GDOI Group Member TEK Policy/SA Table"
    ::= { cgmGdoiMIBGroups 5 }

cgmGdoiKeyServerNotificationGroup NOTIFICATION-GROUP
   NOTIFICATIONS    {
                        cgmGdoiKeyServerNewRegistration,
                        cgmGdoiKeyServerRegistrationComplete,
                        cgmGdoiKeyServerRekeyPushed
                    }
    STATUS          current
    DESCRIPTION
        "This group contains the Key Server (GCKS) notifications
        for the GDOI MIB.

        cgmGdoiKeyServerNotificationGroupRev1 is an extension to this
        group."
    ::= { cgmGdoiMIBGroups 6 }

cgmGdoiKeyServerErrorNotificationGroup NOTIFICATION-GROUP
   NOTIFICATIONS    { cgmGdoiKeyServerNoRsaKeys }
    STATUS          current
    DESCRIPTION
        "This group contains the Key Server (GCKS) error notifications
        for the GDOI MIB."
    ::= { cgmGdoiMIBGroups 7 }

cgmGdoiGmNotificationGroup NOTIFICATION-GROUP
   NOTIFICATIONS    {
                        cgmGdoiGmRegister,
                        cgmGdoiGmRegistrationComplete,
                        cgmGdoiGmReRegister,
                        cgmGdoiGmRekeyReceived
                    }
    STATUS          current
    DESCRIPTION
        "This group contains the Group Member (GM) notifications
        for the GDOI MIB."
    ::= { cgmGdoiMIBGroups 8 }

cgmGdoiGmErrorNotificationGroup NOTIFICATION-GROUP
   NOTIFICATIONS    {
                        cgmGdoiGmIncompleteCfg,
                        cgmGdoiGmNoIpSecFlows,
                        cgmGdoiGmRekeyFailure
                    }
    STATUS          current
    DESCRIPTION
        "This group contains the Group Member (GM) error notifications
        for the GDOI MIB."
    ::= { cgmGdoiMIBGroups 9 }

cgmGdoiNotificationControlGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiKSNewRegNotifEnable,
                        cgmGdoiKSRegCompNotifEnable,
                        cgmGdoiKSRekeyPushNotifEnable,
                        cgmGdoiKSNoRSANotifEnable,
                        cgmGdoiGMRegNotifEnable,
                        cgmGdoiGmRegCompNotifEnable,
                        cgmGdoiGmReRegNotifEnable,
                        cgmGdoiGmRekeyRecNotifEnable,
                        cgmGdoiGmIncompCfgNotifEnable,
                        cgmGdoiGmNoIpSecFlowsNotifEnable,
                        cgmGdoiGmRekeyFailNotifEnable
                    }
    STATUS          current
    DESCRIPTION
        "This group contains the GDOI notification control objects
        for the GDOI MIB.

        cgmGdoiNotificationControlGroupRev1 is an extension to this
        group."
    ::= { cgmGdoiMIBGroups 10 }

cgmGdoiGroupIdGroupRev1 OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiGroupMemberCount,
                        cgmGdoiGroupActivePeerKeyServerCount,
                        cgmGdoiGroupLastRekeyRetransmits,
                        cgmGdoiGroupLastRekeyTimeTaken
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI Group Table

        This group is an extension to cgmGdoiGroupIdGroup."
    ::= { cgmGdoiMIBGroups 11 }

cgmGdoiKeyServerGroupRev1 OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiKeyServerRole,
                        cgmGdoiKeyServerRegisteredGMs
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI Key Server Table

        This group is an extension to cgmGdoiKeyServerGroup."
    ::= { cgmGdoiMIBGroups 12 }

cgmGdoiGmGroupRev1 OBJECT-GROUP
    OBJECTS         { cgmGdoiGmActiveTEKNum }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) GDOI GM Table

        This group is an extension to cgmGdoiGmGroup."
    ::= { cgmGdoiMIBGroups 13 }

cgmGdoiKeyServerNotificationGroupRev1 NOTIFICATION-GROUP
   NOTIFICATIONS    {
                        cgmGdoiKeyServerRoleChange,
                        cgmGdoiKeyServerGmDeleted,
                        cgmGdoiKeyServerPeerReachable,
                        cgmGdoiKeyServerPeerUnreachable
                    }
    STATUS          current
    DESCRIPTION
        "This group contains the Key Server (GCKS) notifications for the
        GDOI MIB.

        This group is an extension to
        cgmGdoiKeyServerNotificationGroup."
    ::= { cgmGdoiMIBGroups 14 }

cgmGdoiNotificationControlGroupRev1 OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiKsRoleChangeNotifEnable,
                        cgmGdoiKsGmDeletedNotifEnable,
                        cgmGdoiKsPeerReachNotifEnable,
                        cgmGdoiKsPeerUnreachNotifEnable
                    }
    STATUS          current
    DESCRIPTION
        "This group contains the GDOI notification control objects
        for the GDOI MIB.

        This group is an extension to cgmGdoiNotificationControlGroup."
    ::= { cgmGdoiMIBGroups 15 }

cgmGdoiCoopPeerGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiCoopPeerIdLength,
                        cgmGdoiCoopPeerRole,
                        cgmGdoiCoopPeerStatus,
                        cgmGdoiCoopPeerRegisteredGMs
                    }
    STATUS          current
    DESCRIPTION
        "This group consists of:
        1) COOP Peer Key Server Table"
    ::= { cgmGdoiMIBGroups 16 }

cgmGdoiNotificationVariablesGroup OBJECT-GROUP
    OBJECTS         {
                        cgmGdoiNotifGroupIdType,
                        cgmGdoiNotifGroupIdValue,
                        cgmGdoiNotifGroupName,
                        cgmGdoiNotifKeyServerIdType,
                        cgmGdoiNotifKeyServerIdValue,
                        cgmGdoiNotifKeyServerRole,
                        cgmGdoiNotifGmIdType,
                        cgmGdoiNotifGmIdValue,
                        cgmGdoiNotifPeerKsIdType,
                        cgmGdoiNotifPeerKsIdValue
                    }
    STATUS          current
    DESCRIPTION
        "This group contains the GDOI notification variables for the
        GDOI MIB."
    ::= { cgmGdoiMIBGroups 17 }

-- #-------------------------------------------------------------- --
-- # GDOI MIB Compliance Statements
-- #-------------------------------------------------------------- --

cgmGdoiMIBCompliance MODULE-COMPLIANCE
    STATUS          deprecated
    DESCRIPTION
        "At minimum, only GDOI Group Member functionality is required so
        only objects associated with and needed by Group Members are
        mandatory to implement.  If Key Server functionality is also
        implemented, all other objects will need to be implemented as
        well.

        This group is deprecated and is superseeded by
        cgmGdoiMIBCompliance1."
    MODULE          -- this module
    MANDATORY-GROUPS {
                        cgmGdoiGroupIdGroup,
                        cgmGdoiGmSecurityAssociationsGroup,
                        cgmGdoiGmGroup
                    }

    GROUP           cgmGdoiKeyServerGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports being the Group Controller Key Server (GCKS)."

    GROUP           cgmGdoiKsSecurityAssociationsGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports being the Group Controller Key Server (GCKS)."

    GROUP           cgmGdoiKeyServerNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications & being the GCKS."

    GROUP           cgmGdoiKeyServerErrorNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications & being the GCKS."

    GROUP           cgmGdoiGmNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications."

    GROUP           cgmGdoiGmErrorNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications."

    GROUP           cgmGdoiNotificationControlGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications."
    ::= { cgmGdoiMIBCompliances 1 }

cgmGdoiMIBComplianceRev1 MODULE-COMPLIANCE
    STATUS          current
    DESCRIPTION
        "At minimum, only GDOI Group Member functionality is required so
        only objects associated with and needed by Group Members are
        mandatory to implement. If Key Server functionality is also
        implemented, all other objects will need to be implemented as
        well.

        Updated the conformance group with new MIB Groups and objects
        with min-access as read-only."
    MODULE          -- this module
    MANDATORY-GROUPS {
                        cgmGdoiGroupIdGroup,
                        cgmGdoiGroupIdGroupRev1,
                        cgmGdoiGmSecurityAssociationsGroup,
                        cgmGdoiGmGroup,
                        cgmGdoiGmGroupRev1
                    }

    GROUP           cgmGdoiKeyServerGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports being the Group Controller Key Server (GCKS)."

    GROUP           cgmGdoiKeyServerGroupRev1
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports being the Group Controller Key Server (GCKS), this
        group is an extension of cgmGdoiKeyServerGroup."

    GROUP           cgmGdoiKsSecurityAssociationsGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports being the Group Controller Key Server (GCKS)."

    GROUP           cgmGdoiKeyServerNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device that
        supports the sending of notifications & being the GCKS."

    GROUP           cgmGdoiKeyServerNotificationGroupRev1
    DESCRIPTION
        "Implementation of this group is for any network device that
        supports the sending of notifications & being the GCKS, this
        group is an extension of cgmGdoiKeyServerNotificationGroup."

    GROUP           cgmGdoiKeyServerErrorNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications & being the GCKS."

    GROUP           cgmGdoiGmNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications."

    GROUP           cgmGdoiGmErrorNotificationGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications."

    GROUP           cgmGdoiNotificationControlGroup
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications."

    GROUP           cgmGdoiNotificationControlGroupRev1
    DESCRIPTION
        "Implementation of this group is for any network device
        that supports the sending of notifications, this group is an
        extension to cgmGdoiNotificationControlGroup."

    GROUP           cgmGdoiCoopPeerGroup
    DESCRIPTION
        "Implementation of this group is for any network device that
        supports the COOP."

    GROUP           cgmGdoiNotificationVariablesGroup
    DESCRIPTION
        "Implementation of this group is for any network device that
        supports the sending of notifications, packed with the
        variables defined as a part of the said table."

    OBJECT          cgmGdoiKSNewRegNotifEnable
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cgmGdoiKSRegCompNotifEnable
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cgmGdoiKSRekeyPushNotifEnable
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."

    OBJECT          cgmGdoiKSNoRSANotifEnable
    MIN-ACCESS      read-only
    DESCRIPTION
        "Write access is not required."
    ::= { cgmGdoiMIBCompliances 2 }

END


















































































































































































































































































































































































































































































