A nice one to have, on the Cisco NX-OS platform, and maybe on others as well. I do not have insights in other vendors at the moment.
I want to be able to see the ethernet port status if it is secured or not. A policy applied means it should or must be secured. The macsec interfaces are discovered by LibreNMS (with -Controlled in the ifDescr) but thats all.
There are some OID tree’s that help identify and monitor the state:
1.0.8802.1.1.3 / IEEE8021-SECY-MIB | SNMP objects, OIDs and tables
As far as my knowledge goes, we can say that .1.0.8802.1.1.3.1.1.2.1.2 defines the SecureChannel state
Some snmpwalks for the ifIndex and so on:
IF-MIB::ifDescr.436207616 = STRING: Ethernet1/1
IF-MIB::ifDescr.436208128 = STRING: Ethernet1/2
IF-MIB::ifDescr.436208640 = STRING: Ethernet1/3
IF-MIB::ifDescr.436209152 = STRING: Ethernet1/4
IF-MIB::ifDescr.1509949440 = STRING: Ethernet1/1-Controlled
IF-MIB::ifDescr.1509949444 = STRING: Ethernet1/2-Controlled
IF-MIB::ifDescr.1509949448 = STRING: Ethernet1/3-Controlled
IF-MIB::ifDescr.1509949452 = STRING: Ethernet1/4-Controlled
IF-MIB::ifType.1509949440 = INTEGER: macSecControlledIF(231)
IF-MIB::ifType.1509949444 = INTEGER: macSecControlledIF(231)
IF-MIB::ifType.1509949448 = INTEGER: macSecControlledIF(231)
IF-MIB::ifType.1509949452 = INTEGER: macSecControlledIF(231)
The secy walks:
secyTxSCI (matches the output on the Cisco NX-OS device)
1.0.8802.1.1.3.1.1.2.1.1.1509949440 = Hex-STRING: FC 72 88 27 02 98 00 01
1.0.8802.1.1.3.1.1.2.1.1.1509949444 = Hex-STRING: FC 72 88 27 02 9C 00 01
1.0.8802.1.1.3.1.1.2.1.1.1509949448 = Hex-STRING: 00 00 00 00 00 00 00 00
1.0.8802.1.1.3.1.1.2.1.1.1509949452 = Hex-STRING: 00 00 00 00 00 00 00 00
SecureChannel (TX) state:
1.0.8802.1.1.3.1.1.2.1.2.1509949440 = INTEGER: 1
1.0.8802.1.1.3.1.1.2.1.2.1509949444 = INTEGER: 1
1.0.8802.1.1.3.1.1.2.1.2.1509949448 = INTEGER: 2
1.0.8802.1.1.3.1.1.2.1.2.1509949452 = INTEGER: 2
switch# show macsec mka session
Interface Local-TxSCI # Peers Status Key-Server Auth Mode
------------------ -------------------------------- ------------------ ------------------ ------------------ ------------------
Ethernet1/1 fc72.8827.0298/0001 1 Secured Yes PRIMARY-PSK
Ethernet1/2 fc72.8827.029c/0001 1 Secured Yes PRIMARY-PSK
So, if the 1.0.8802.1.1.3.1.1.2.1.1. has an empty hex-string (e.g.: 00 00 00 etc) than no policy is applied. Otherwise if a policy is applied and than the state should be 1 (secured).
This could be a very welcome and probably desired sensor. The custom-oid part of Libre does not fulfil the needs (change state/alert when not secured while it should be).