Subject: BPI Plus - bare mib

From: "Mike StJohns" <[email-masked]>
Date: Fri, 24 Sep 1999 10:41:00 -0700

Attached is the first draft of a BPI plus mib.  This will eventually replace 
the BPI mib (which will hopefully be published in the near future as an 
informational RFC).    This compiles cleanly and will give you some idea of 
the final form, but should not be considered immutable - in particular, final 
assignment of the individual object OIDs is subject to change, but the root 
assignment of docsIfMib 6 is stable.  Also, the header has not been updated 
and reflects an incorrect modification date.

Mike

DOCS-BPI-MIB DEFINITIONS ::= BEGIN

IMPORTS
	MODULE-IDENTITY, OBJECT-TYPE,
	Counter32, 
	IpAddress, 
	Integer32
		FROM SNMPv2-SMI
	SnmpAdminString
		FROM SNMP-FRAMEWORK-MIB
	TEXTUAL-CONVENTION,
	DisplayString, 
	MacAddress, 
	RowStatus, 
	RowPointer,
	TruthValue, 
	DateAndTime
		FROM SNMPv2-TC
	OBJECT-GROUP, 
	MODULE-COMPLIANCE
		FROM SNMPv2-CONF
	ifIndex
		FROM IF-MIB
	docsIfMib,
	docsIfCmtsCmStatusEntry
		FROM DOCS-IF-MIB
;

docsBpi2MIB	MODULE-IDENTITY
	LAST-UPDATED "9812071930Z"
	ORGANIZATION "IETF IPCDN Working Group"
	CONTACT-INFO "Rich Woundy
		      Postal: Cisco Systems
		      300 Apollo Drive
		      Chelmsford, MA 01824
		      U.S.A.
		      Tel:    +1 978 244 8545
		      Fax:    +1 978 244 8917
		      E-mail: [email-masked]"
	DESCRIPTION
		"This is the MIB Module for the DOCSIS Baseline Privacy
	Interface (BPI) at cable modems (CMs) and cable modem
	termination systems (CMTSs)."
	::= { docsIfMib 6 }

-- Textual conventions

X509Certificate ::= TEXTUAL-CONVENTION
	STATUS	current
	DESCRIPTION
	    "An X509 digital certificate encoded as an ASN.1 DER object."
	SYNTAX	OCTET STRING (SIZE (0..4096))

docsBpi2MIBObjects  OBJECT IDENTIFIER ::= { docsBpi2MIB 1 }

-- Cable Modem Group

docsBpi2CmObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 1 }

--
-- The BPI base and authorization table for CMs, indexed by ifIndex
--

docsBpi2CmBaseTable	OBJECT-TYPE
	SYNTAX			SEQUENCE OF	DocsBpi2CmBaseEntry
	MAX-ACCESS		not-accessible
	STATUS			current
	DESCRIPTION
		"This table describes the basic and
        authorization-related Baseline Privacy attributes of each CM
        MAC interface." 
	::= { docsBpi2CmObjects 1 }

docsBpi2CmBaseEntry	OBJECT-TYPE
	SYNTAX			DocsBpi2CmBaseEntry
	MAX-ACCESS		not-accessible
	STATUS			current
	DESCRIPTION
		"Each entry contains objects describing attributes of
	one CM MAC interface. An entry in this table exists for each
	ifEntry with an ifType of docsCableMaclayer(127)."
	INDEX			{ ifIndex }
::= { docsBpi2CmBaseTable 1 }

DocsBpi2CmBaseEntry ::= SEQUENCE {
	docsBpi2CmPrivacyEnable			TruthValue,
	docsBpi2CmPublicKey			OCTET STRING,
	docsBpi2CmAuthState			INTEGER,
	docsBpi2CmAuthKeySequenceNumber		Integer32,
	docsBpi2CmAuthExpires			DateAndTime,
	docsBpi2CmAuthReset			TruthValue,
	docsBpi2CmAuthGraceTime			Integer32,
	docsBpi2CmTEKGraceTime			Integer32,
	docsBpi2CmAuthWaitTimeout		Integer32,
	docsBpi2CmReauthWaitTimeout		Integer32,
	docsBpi2CmOpWaitTimeout			Integer32,
	docsBpi2CmRekeyWaitTimeout		Integer32,
	docsBpi2CmAuthRejectWaitTimeout		Integer32,
	docsBpi2CmAuthRequests			Counter32,
	docsBpi2CmAuthReplies			Counter32,
	docsBpi2CmAuthRejects			Counter32,
	docsBpi2CmAuthInvalids			Counter32,
	docsBpi2CmAuthRejectErrorCode		INTEGER,
	docsBpi2CmAuthRejectErrorString		DisplayString,
	docsBpi2CmAuthInvalidErrorCode		INTEGER,
	docsBpi2CmAuthInvalidErrorString	DisplayString
}

docsBpi2CmPrivacyEnable	OBJECT-TYPE
	SYNTAX		TruthValue
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"This object identifies whether this CM is provisioned
	to run Baseline Privacy. This is analogous to the presence (or
	absence) of the Baseline Privacy Configuration Setting
	option. The status of each individual SID with respect to
	Baseline Privacy is captured in the docsBpi2CmTEKPrivacyEnable
	object.  Note: this object will be read-write accessible only
	after the ability to start and stop the authorization state
	machine is understood."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1." 
	::= { docsBpi2CmBaseEntry 1 }

docsBpi2CmPublicKey	OBJECT-TYPE
	SYNTAX		OCTET STRING (SIZE (74 | 106 | 140 | 270))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is a DER-encoded
	RSAPublicKey ASN.1 type string, as defined in the RSA
	Encryption Standard (PKCS #1) [10], corresponding to the
	public key of the CM. The 74, 106, 140, and 270 byte key
	encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and
	2048 public moduli respectively."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.2.4." 
	::= { docsBpi2CmBaseEntry 2 }

docsBpi2CmAuthState	OBJECT-TYPE
	SYNTAX		INTEGER	{
				start(1),
				authWait(2),
				authorized(3),
				reauthWait(4),
				authRejectWait(5)
			}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the state of the CM
	authorization FSM.  The start state indicates that FSM is in
	its initial state."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.1.2.1." 
	::= { docsBpi2CmBaseEntry 3 }

docsBpi2CmAuthKeySequenceNumber	OBJECT-TYPE
	SYNTAX			Integer32 (0..15)
	MAX-ACCESS		read-only
	STATUS			current
	DESCRIPTION
		"The value of this object is the authorization key
	sequence number for this FSM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2
	and 4.2.2.10."
	::= { docsBpi2CmBaseEntry 4 }

docsBpi2CmAuthExpires	OBJECT-TYPE
	SYNTAX		DateAndTime
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the actual clock time
	when the current authorization for this FSM expires. If the CM
	does not have an active authorization, then the value is of
	the expiration date and time of the last active
	authorization."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.2 and 4.2.2.9."
	::= { docsBpi2CmBaseEntry 5 }

docsBpi2CmAuthReset	OBJECT-TYPE
	SYNTAX		TruthValue
	MAX-ACCESS	read-write
	STATUS		current
	DESCRIPTION
		"Setting this object to TRUE generates a Reauthorize
	event in the authorization FSM. Reading this object always
	returns FALSE."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.1.2.3.4." 
	::= { docsBpi2CmBaseEntry 6 }

docsBpi2CmAuthGraceTime	OBJECT-TYPE
	SYNTAX		Integer32 (1..1800)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the grace time for an
	authorization key.  A CM is expected to start trying to get a
	new authorization key beginning AuthGraceTime seconds before
	the authorization key actually expires. The value of this
	object cannot be changed while the authorization state machine
	is running.  Note: this object will be read-write accessible
	only after the ability to start and stop the authorization
	state machine is understood."
	REFERENCE
	"DOCSIS Baseline Privacy Interface Specification, Appendix
	A.1.1.1.3." 
	::= { docsBpi2CmBaseEntry 7 }

docsBpi2CmTEKGraceTime	OBJECT-TYPE
	SYNTAX		Integer32 (1..1800)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the grace time for a TEK.
	A CM is expected to start trying to get a new TEK beginning
	TEKGraceTime seconds before the TEK actually expires. The
	value of this object cannot be changed while the authorization
	state machine is running.  Note: this object will be
	read-write accessible only after the ability to start and stop
	the authorization state machine is understood."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.6." 
	::= { docsBpi2CmBaseEntry 8 }

docsBpi2CmAuthWaitTimeout	OBJECT-TYPE
	SYNTAX		Integer32 (1..30)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Authorize Wait
	Timeout. The value of this object cannot be changed while the
	authorization state machine is running.  Note: this object
	will be read-write accessible only after the ability to start
	and stop the authorization state machine is understood."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.1." 
	::= { docsBpi2CmBaseEntry 9 }

docsBpi2CmReauthWaitTimeout	OBJECT-TYPE
	SYNTAX		Integer32 (1..30)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Reauthorize Wait
	Timeout in seconds.  The value of this object cannot be
	changed while the authorization state machine is running.
	Note: this object will be read-write accessible only after the
	ability to start and stop the authorization state machine is
	understood."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.2." 
	::= { docsBpi2CmBaseEntry 10 }

docsBpi2CmOpWaitTimeout	OBJECT-TYPE
	SYNTAX		Integer32 (1..10)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Operational Wait
	Timeout in seconds.  The value of this object cannot be
	changed while the authorization state machine is running.
	Note: this object will be read-write accessible only after the
	ability to start and stop the authorization state machine is
	understood."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.4." 
	::= { docsBpi2CmBaseEntry 11 }

docsBpi2CmRekeyWaitTimeout	OBJECT-TYPE
	SYNTAX		Integer32 (1..10)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Rekey Wait Timeout in
	seconds. The value of this object cannot be changed while the
	authorization state machine is running.  Note: this object
	will be read-write accessible only after the ability to start
	and stop the authorization state machine is understood."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.5." 
	::= { docsBpi2CmBaseEntry 12 }

docsBpi2CmAuthRejectWaitTimeout	OBJECT-TYPE
	SYNTAX		Integer32 (1..600)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Authorization Reject
	Wait Timeout in seconds. The value of this object cannot be
	changed while the authorization state machine is running.
	Note: this object will be read-write accessible only after the
	ability to start and stop the authorization state machine is
	understood."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.7." 
	::= { docsBpi2CmBaseEntry 13 }

docsBpi2CmAuthRequests	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has transmitted an Authorization Request message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.1." 
	::= { docsBpi2CmBaseEntry 14 }

docsBpi2CmAuthReplies	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has received an Authorization Reply message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.2." 
	::= { docsBpi2CmBaseEntry 15 }

docsBpi2CmAuthRejects	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has received an Authorization Reject message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.3."
	::= { docsBpi2CmBaseEntry 16 }

docsBpi2CmAuthInvalids	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has received an Authorization Invalid message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.7." 
	::= { docsBpi2CmBaseEntry 17 }

docsBpi2CmAuthRejectErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				unauthorizedCm(3),
				unauthorizedSid(4)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in most recent Authorization
	Reject message received by the CM.  This has value unknown(2)
	if the last Error-Code value was 0, and none(1) if no
	Authorization Reject message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.3 and 4.2.2.16."
	::= { docsBpi2CmBaseEntry 18 }

docsBpi2CmAuthRejectErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in
	most recent Authorization Reject message received by the CM.
	This is a zero length string if no Authorization Reject
	message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.3 and 4.2.2.6."
	::= { docsBpi2CmBaseEntry 19 }

docsBpi2CmAuthInvalidErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				unauthorizedCm(3),
				unsolicited(5),
				invalidKeySequence(6),
                                keyRequestAuthenticationFailure(7)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in most recent Authorization
	Invalid message received by the CM.  This has value unknown(2)
	if the last Error-Code value was 0, and none(1) if no
	Authorization Invalid message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.7 and 4.2.2.16."
	::= { docsBpi2CmBaseEntry 20 }

docsBpi2CmAuthInvalidErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in
	most recent Authorization Invalid message received by the CM.
	This is a zero length string if no Authorization Invalid
	message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.7 and 4.2.2.6."
	::= { docsBpi2CmBaseEntry 21 }

--
-- The CM TEK Table, indexed by ifIndex and BPI SID
--

docsBpi2CmTEKTable	OBJECT-TYPE
	SYNTAX		SEQUENCE OF	DocsBpi2CmTEKEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This table describes the attributes of each CM
	Traffic Encryption Key(TEK) association. The CM maintains (no
	more than) one TEK association per BPI SID per CM MAC interface."
	::= { docsBpi2CmObjects 2 }

docsBpi2CmTEKEntry	OBJECT-TYPE
	SYNTAX		DocsBpi2CmTEKEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"Each entry contains objects describing the TEK
	association attributes of one BPI SID. The CM MUST create one
	entry per unicast or multicast BPI SID, regardless of whether
	the BPI SID was obtained from a Registration Response message,
	from an Authorization Reply message, or from any future
	dynamic BPI SID establishment mechanisms. "
-- INDEX			{ ifIndex, docsIfCmServiceId }
	INDEX	{ ifIndex, docsBpi2CmTEKServiceId }
	::= { docsBpi2CmTEKTable 1 }

DocsBpi2CmTEKEntry ::= SEQUENCE {
	docsBpi2CmTEKServiceId		Integer32,
	docsBpi2CmTEKPrivacyEnable	TruthValue,
	docsBpi2CmTEKState		INTEGER,
	docsBpi2CmTEKExpiresOld		DateAndTime,
	docsBpi2CmTEKExpiresNew		DateAndTime,
	docsBpi2CmTEKKeyRequests		Counter32,
	docsBpi2CmTEKKeyReplies		Counter32,
	docsBpi2CmTEKKeyRejects		Counter32,
	docsBpi2CmTEKInvalids		Counter32,
	docsBpi2CmTEKAuthPends		Counter32,
	docsBpi2CmTEKKeyRejectErrorCode	INTEGER,
	docsBpi2CmTEKKeyRejectErrorString	 DisplayString,
	docsBpi2CmTEKInvalidErrorCode	INTEGER,
	docsBpi2CmTEKInvalidErrorString	DisplayString
	}

docsBpi2CmTEKServiceId	OBJECT-TYPE
	SYNTAX		Integer32 (1..16383)
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"The value of this object is the DOCSIS Service ID
	(SID), as extended by Baseline Privacy. There is a one-to-one
	correspondence between this object and the docsIfCmServiceId
	object in the Radio Frequency Interface MIB [5] for unicast SIDs."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.2.12." 
-- Should I renumber this table for this new object???
::= { docsBpi2CmTEKEntry 14 }

docsBpi2CmTEKPrivacyEnable	OBJECT-TYPE
	SYNTAX		TruthValue
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
	"This object identifies whether this BPI SID is provisioned to
	run Baseline Privacy. This is analogous to enabling Baseline
	Privacy on a provisioned SID using the Class-of-Service
	Privacy Enable option.  Baseline Privacy is not effectively
	enabled for any BPI SID unless Baseline Privacy is enabled for
	the CM, which is managed via the docsBpi2CmPrivacyEnable
	object.  Note: this object will be read-write accessible only
	after the CMTS has the capability to authorize the starting or
	stopping of a particular TEK state machine."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification, Appendix A.1.2."
	::= { docsBpi2CmTEKEntry 1 }

docsBpi2CmTEKState	OBJECT-TYPE
	SYNTAX		INTEGER {
				start(1),
				opWait(2),
				opReauthWait(3),
				operational(4),
				rekeyWait(5),
				rekeyReauthWait(6)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the state of the
	indicated TEK FSM.  The start(1) state indicates that FSM is
	in its initial state." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.1.3.1." 
	::= { docsBpi2CmTEKEntry 2 }

docsBpi2CmTEKExpiresOld	OBJECT-TYPE
	SYNTAX		DateAndTime
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the actual clock time for
	expiration of the immediate predecessor of the most recent TEK
	for this FSM.  If this FSM has only one TEK, then the value is
	the time of activation of this FSM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.5 and 4.2.2.9."
	::= { docsBpi2CmTEKEntry 3 }

docsBpi2CmTEKExpiresNew	OBJECT-TYPE
	SYNTAX		DateAndTime
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the actual clock time for
	expiration of the most recent TEK for this FSM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.5 and 4.2.2.9."
	::= { docsBpi2CmTEKEntry 4 }

docsBpi2CmTEKKeyRequests	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has transmitted a Key Request message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.4." 
	::= { docsBpi2CmTEKEntry 5 }

docsBpi2CmTEKKeyReplies	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has received a Key Reply message, including a message whose
	authentication failed." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.5." 
	::= { docsBpi2CmTEKEntry 6 }

docsBpi2CmTEKKeyRejects	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has received a Key Reject message, including a message whose
	authentication failed." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.6." 
	::= { docsBpi2CmTEKEntry 7 }

	docsBpi2CmTEKInvalids	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the CM
	has received a TEK Invalid message, including a message whose
	authentication failed." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.8." 
	::= { docsBpi2CmTEKEntry 8 }

docsBpi2CmTEKAuthPends	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times an
	Authorization Pending (Auth Pend) event occurred in this FSM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.1.3.3.3."
	::= { docsBpi2CmTEKEntry 9 }

docsBpi2CmTEKKeyRejectErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				unauthorizedSid(4)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in most recent Key Reject
	message received by the CM. This has value unknown(2) if the
	last Error-Code value was 0, and none(1) if no Key Reject
	message has been received since reboot." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.1.2.6 and 4.2.2.16."
	::= { docsBpi2CmTEKEntry 10 }

docsBpi2CmTEKKeyRejectErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in
	most recent Key Reject message received by the CM. This is a
	zero length string if no Key Reject message has been received
	since reboot." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.1.2.6 and 4.2.2.6."
	::= { docsBpi2CmTEKEntry 11 }

docsBpi2CmTEKInvalidErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				invalidKeySequence(6)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in most recent TEK Invalid
	message received by the CM.  This has value unknown(2) if the
	last Error-Code value was 0, and  none(1) if no TEK Invalid
	message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.1.2.8 and 4.2.2.16."
	::= { docsBpi2CmTEKEntry 12 }

docsBpi2CmTEKInvalidErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in
	most recent TEK Invalid message received by the CM. This is a
	zero length string if no TEK Invalid message has been received
	since reboot." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.1.2.8 and 4.2.2.6."
	::= { docsBpi2CmTEKEntry 13 }

-- Cable Modem Termination System Group

docsBpi2CmtsObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 2 }

--
-- The BPI base table for CMTSs, indexed by ifIndex
--

docsBpi2CmtsBaseTable	OBJECT-TYPE
	SYNTAX		SEQUENCE OF	DocsBpi2CmtsBaseEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This table describes the basic Baseline Privacy
	attributes of each CMTS MAC interface."
	::= { docsBpi2CmtsObjects 1 }

docsBpi2CmtsBaseEntry	OBJECT-TYPE
	SYNTAX		DocsBpi2CmtsBaseEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"Each entry contains objects describing attributes of
	one CMTS MAC interface.  An entry in this table exists for each
	ifEntry with an ifType of docsCableMaclayer(127)."
	INDEX	{ ifIndex }
	::= { docsBpi2CmtsBaseTable 1 }

DocsBpi2CmtsBaseEntry ::= SEQUENCE {
	docsBpi2CmtsDefaultAuthLifetime	Integer32,
	docsBpi2CmtsDefaultTEKLifetime	Integer32,
-- docsBpi2CmtsDefaultAuthGraceTime	INTEGER,
-- docsBpi2CmtsDefaultTEKGraceTime	INTEGER,
	docsBpi2CmtsAuthRequests		Counter32,
	docsBpi2CmtsAuthReplies		Counter32,
	docsBpi2CmtsAuthRejects		Counter32,
	docsBpi2CmtsAuthInvalids		Counter32
	}

docsBpi2CmtsDefaultAuthLifetime	OBJECT-TYPE
	SYNTAX		Integer32 (1..6048000)
	UNITS		"seconds"
	MAX-ACCESS	read-write
	STATUS		current
	DESCRIPTION
		"The value of this object is the default lifetime, in
	seconds, the CMTS assigns to a new authorization key."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.2." 
	::= { docsBpi2CmtsBaseEntry 1 }

docsBpi2CmtsDefaultTEKLifetime	OBJECT-TYPE
	SYNTAX		Integer32 (1..604800)
	UNITS		"seconds"
	MAX-ACCESS	read-write
	STATUS		current
	DESCRIPTION
		"The value of this object is the default lifetime, in
	seconds, the CMTS assigns to a new Traffic Encryption Key (TEK)."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.2." 
	::= { docsBpi2CmtsBaseEntry 2 }

-- Note: the following two objects have been removed from this MIB.

-- docsBpi2CmtsDefaultAuthGraceTime	OBJECT-TYPE
-- SYNTAX				INTEGER (1..1800)
-- UNITS				"seconds"
-- MAX-ACCESS			read-write
-- STATUS				current
-- DESCRIPTION
-- "Default grace time, in seconds, the CMTS uses for an authorization
-- key. This controls how far in advance of authorization key expiration
-- that the CMTS is expected to produce the next generation of keying
-- material. This value is expected to agree with the Authorization Grace
-- Time that the provisioning system provides to CMs."
-- ::= { docsBpi2CmtsBaseEntry 3 }

-- docsBpi2CmtsDefaultTEKGraceTime	OBJECT-TYPE
-- SYNTAX				INTEGER (1..1800)
-- UNITS				"seconds"
-- MAX-ACCESS			read-write
-- STATUS				current
-- DESCRIPTION
-- "Default grace time, in seconds, the CMTS uses for a Traffic
-- Encryption Key (TEK). This controls how far in advance of TEK
-- expiration that the CMTS is expected to produce the next generation
-- of keying material. This value is expected to agree with the TEK Grace
-- Time that the provisioning system provides to CMs. Note that this
-- object is particularly relevant for multicast SIDs, where multiple
-- grace time values cannot be honored."
-- ::= { docsBpi2CmtsBaseEntry 4 }

docsBpi2CmtsAuthRequests	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has received an Authorization Request message from any
	CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.1." 
	::= { docsBpi2CmtsBaseEntry 5 }

docsBpi2CmtsAuthReplies	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted an Authorization Reply message to any
	CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.2." 
	::= { docsBpi2CmtsBaseEntry 6 }

docsBpi2CmtsAuthRejects	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted an Authorization Reject message to any
	CM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.3." 
	::= { docsBpi2CmtsBaseEntry 7 }

docsBpi2CmtsAuthInvalids	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted an Authorization Invalid message to any CM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.7." 
	::= { docsBpi2CmtsBaseEntry 8 }

--
-- The CMTS Authorization Table, indexed by ifIndex and CM MAC address
--

docsBpi2CmtsAuthTable	OBJECT-TYPE
	SYNTAX		SEQUENCE OF	DocsBpi2CmtsAuthEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This table describes the attributes of each CM
	authorization association. The CMTS maintains one
	authorization association with each Baseline Privacy-enabled
	CM on each CMTS MAC interface." 
	::= { docsBpi2CmtsObjects 2 }

docsBpi2CmtsAuthEntry	OBJECT-TYPE
	SYNTAX		DocsBpi2CmtsAuthEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"Each entry contains objects describing attributes of
	one authorization association. The CMTS MUST create one entry
	per CM per MAC interface, based on the receipt of an
	Authorization Request message, and MUST not delete the entry
	before the CM authorization permanently expires."
	INDEX	{ ifIndex, docsBpi2CmtsAuthCmMacAddress }
	::= { docsBpi2CmtsAuthTable 1 }

DocsBpi2CmtsAuthEntry ::= SEQUENCE {
	docsBpi2CmtsAuthCmMacAddress		MacAddress,
	docsBpi2CmtsAuthCmPublicKey		OCTET STRING,
	docsBpi2CmtsAuthCmKeySequenceNumber	Integer32,
	docsBpi2CmtsAuthCmExpires		DateAndTime,
	docsBpi2CmtsAuthCmLifetime		Integer32,
	docsBpi2CmtsAuthCmGraceTime		Integer32,
	docsBpi2CmtsAuthCmReset			INTEGER,
	docsBpi2CmtsAuthCmRequests		Counter32,
	docsBpi2CmtsAuthCmReplies		Counter32,
	docsBpi2CmtsAuthCmRejects		Counter32,
	docsBpi2CmtsAuthCmInvalids		Counter32,
	docsBpi2CmtsAuthRejectErrorCode		INTEGER,
	docsBpi2CmtsAuthRejectErrorString	DisplayString,
	docsBpi2CmtsAuthInvalidErrorCode		INTEGER,
	docsBpi2CmtsAuthInvalidErrorString	DisplayString
	}

docsBpi2CmtsAuthCmMacAddress	OBJECT-TYPE
	SYNTAX		MacAddress
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"The value of this object is the physical address of
	the CM to which the authorization association applies."
	::= { docsBpi2CmtsAuthEntry 1 }

docsBpi2CmtsAuthCmPublicKey	OBJECT-TYPE
	SYNTAX		OCTET STRING (SIZE (0 | 74 | 106 | 140 | 270))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is a DER-encoded
	RSAPublicKey ASN.1 type string, as defined in the RSA
	Encryption Standard (PKCS #1) [10], corresponding to the
	public key of the CM. The 74, 106, 140, and 270 byte key
	encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and
	2048 public moduli respectively. This is a zero-length string
	if the CMTS does not retain the public key."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.2.4." 
	::= { docsBpi2CmtsAuthEntry 2 }

docsBpi2CmtsAuthCmKeySequenceNumber	OBJECT-TYPE
	SYNTAX		Integer32 (0..15)
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the authorization key
	sequence number for this CM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.2 and 4.2.2.10."
	::= { docsBpi2CmtsAuthEntry 3 }

docsBpi2CmtsAuthCmExpires	OBJECT-TYPE
	SYNTAX		DateAndTime
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the actual clock time
	when the current authorization for this CM expires. If this CM
	does not have an active authorization, then the value is of
	the expiration date and time of the last active
	authorization." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.2 and 4.2.2.9."
	::= { docsBpi2CmtsAuthEntry 4 }

docsBpi2CmtsAuthCmLifetime	OBJECT-TYPE
	SYNTAX		Integer32 (1..6048000)
	UNITS		"seconds"
	MAX-ACCESS	read-write
	STATUS		current
	DESCRIPTION
		"The value of this object is the lifetime, in seconds,
	the CMTS assigns to an authorization key for this CM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.2 and Appendix A.2."
	::= { docsBpi2CmtsAuthEntry 5 }

docsBpi2CmtsAuthCmGraceTime	OBJECT-TYPE
	SYNTAX		Integer32 (1..1800)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the grace time for the
	authorization key in seconds.  The CM is expected to start
	trying to get a new authorization key beginning AuthGraceTime
	seconds before the authorization key actually expires."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.3." 
	::= { docsBpi2CmtsAuthEntry 6 }

docsBpi2CmtsAuthCmReset	OBJECT-TYPE
	SYNTAX	INTEGER	{
			noResetRequested(1),
			invalidateAuth(2),
			sendAuthInvalid(3),
			invalidateTeks(4)
			}
	MAX-ACCESS	read-write
	STATUS		current
	DESCRIPTION
		"Setting this object to invalidateAuth(2) causes the
	CMTS to invalidate the current CM authorization key, but not
	to transmit an Authorization Invalid message nor to invalidate
	unicast TEKs.  Setting this object to sendAuthInvalid(3)
	causes the CMTS to invalidate the current CM authorization
	key, and to transmit an Authorization Invalid message to the
	CM, but not to invalidate unicast TEKs.  Setting this object
	to invalidateTeks(4) causes the CMTS to invalidate the current
	CM authorization key, to transmit an Authorization Invalid
	message to the CM, and to invalidate all unicast TEKs
	associated with this CM authorization. Reading this object
	returns the most-recently-set value of this object, or returns
	noResetRequested(1) if the object has not been set since the
	last CMTS reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5."
	::= { docsBpi2CmtsAuthEntry 7 }

docsBpi2CmtsAuthCmRequests	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has received an Authorization Request message from this
	CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.1." 
	::= { docsBpi2CmtsAuthEntry 8 }

docsBpi2CmtsAuthCmReplies	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted an Authorization Reply message to this CM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.2." 
	::= { docsBpi2CmtsAuthEntry 9 }

docsBpi2CmtsAuthCmRejects	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted an Authorization Reject message to this
	CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.3." 
	::= { docsBpi2CmtsAuthEntry 10 }

docsBpi2CmtsAuthCmInvalids	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted an Authorization Invalid message to this
	CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.7." 
	::= { docsBpi2CmtsAuthEntry 11 }

docsBpi2CmtsAuthRejectErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				unauthorizedCm(3),
				unauthorizedSid(4)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in most recent Authorization
	Reject message transmitted to the CM.  This has value
	unknown(2) if the last Error-Code value was 0, and none(1) if
	no Authorization Reject message has been transmitted to the
	CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.3 and 4.2.2.16."
	::= { docsBpi2CmtsAuthEntry 12 }

docsBpi2CmtsAuthRejectErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in
	most recent Authorization Reject message transmitted to the
	CM.  This is a zero length string if no Authorization Reject
	message has been transmitted to the CM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.3 and 4.2.2.6."
	::= { docsBpi2CmtsAuthEntry 13 }

docsBpi2CmtsAuthInvalidErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				unauthorizedCm(3),
				unsolicited(5),
				invalidKeySequence(6),
				keyRequestAuthenticationFailure(7)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in most recent Authorization
	Invalid message transmitted to the CM.  This has value
	unknown(2) if the last Error-Code value was 0, and none(1) if
	no Authorization Invalid message has been transmitted to the
	CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.7 and 4.2.2.16."
	::= { docsBpi2CmtsAuthEntry 14 }

docsBpi2CmtsAuthInvalidErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in
	most recent Authorization Invalid message transmitted to the
	CM.  This is a zero length string if no Authorization Invalid
	message has been transmitted to the CM." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.7 and 4.2.2.6."
	::= { docsBpi2CmtsAuthEntry 15 }

--
-- The CMTS TEK Table, indexed by ifIndex and BPI SID
--

docsBpi2CmtsTEKTable	OBJECT-TYPE
	SYNTAX		SEQUENCE OF	DocsBpi2CmtsTEKEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This table describes the attributes of each CM
	Traffic Encryption Key (TEK) association. The CMTS maintains
	one TEK association per BPI SID on each CMTS MAC interface."
	::= { docsBpi2CmtsObjects 3 }

docsBpi2CmtsTEKEntry	OBJECT-TYPE
	SYNTAX		DocsBpi2CmtsTEKEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"Each entry contains objects describing attributes of
	one TEK association on a particular CMTS MAC interface. The
	CMTS MUST create one entry per BPI SID per MAC interface,
	based on the receipt of an Key Request message, and MUST not
	delete the entry before the CM authorization for the BPI SID
	permanently expires." 
-- INDEX			{ ifIndex, docsIfCmtsServiceId }
	INDEX	{ ifIndex, docsBpi2CmtsTEKServiceId }
	::= { docsBpi2CmtsTEKTable 1 }

DocsBpi2CmtsTEKEntry ::= SEQUENCE {
	docsBpi2CmtsTEKServiceId			Integer32,
	docsBpi2CmtsTEKLifetime			Integer32,
	docsBpi2CmtsTEKGraceTime			Integer32,
	docsBpi2CmtsTEKExpiresOld		DateAndTime,
	docsBpi2CmtsTEKExpiresNew		DateAndTime,
	docsBpi2CmtsTEKReset			TruthValue,
	docsBpi2CmtsKeyRequests			Counter32,
	docsBpi2CmtsKeyReplies			Counter32,
	docsBpi2CmtsKeyRejects			Counter32,
	docsBpi2CmtsTEKInvalids			Counter32,
	docsBpi2CmtsKeyRejectErrorCode		INTEGER,
	docsBpi2CmtsKeyRejectErrorString		DisplayString,
	docsBpi2CmtsTEKInvalidErrorCode		INTEGER,
	docsBpi2CmtsTEKInvalidErrorString	DisplayString
}

docsBpi2CmtsTEKServiceId	OBJECT-TYPE
	SYNTAX		Integer32 (1..16383)
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"The value of this object is the DOCSIS Service ID
	(SID), as extended by Baseline Privacy. There is a one-to-one
	correspondence between this object and the docsIfCmtsServiceId
	object in the Radio Frequency Interface MIB [5] for unicast
	SIDs." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.2.12." 
-- Should I renumber this table for this new object???
::= { docsBpi2CmtsTEKEntry 14 }

docsBpi2CmtsTEKLifetime	OBJECT-TYPE
	SYNTAX		Integer32 (1..604800)
	UNITS		"seconds"
	MAX-ACCESS	read-write
	STATUS		current
	DESCRIPTION
		"The value of this object is the lifetime, in seconds,
	the CMTS assigns to keys for this TEK association."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.5 and Appendix A.2."
	::= { docsBpi2CmtsTEKEntry 1 }

docsBpi2CmtsTEKGraceTime	OBJECT-TYPE
	SYNTAX		Integer32 (1..1800)
	UNITS		"seconds"
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the grace time for the
	TEK in seconds. The CM is expected to start trying to get a
	new TEK beginning TEKGraceTime seconds before the TEK actually
	expires." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Appendix A.1.1.1.6." 
	::= { docsBpi2CmtsTEKEntry 2 }

docsBpi2CmtsTEKExpiresOld	OBJECT-TYPE
	SYNTAX		DateAndTime
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the actual clock time for
	expiration of the immediate predecessor of the most recent TEK
	for this FSM. If this FSM has only one TEK, then the value is
	the time of activation of this FSM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.5 and 4.2.2.9."
	::= { docsBpi2CmtsTEKEntry 3 }

docsBpi2CmtsTEKExpiresNew	OBJECT-TYPE
	SYNTAX		DateAndTime
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the actual clock time for
	expiration of the most recent TEK for this FSM."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.5 and 4.2.2.9."
	::= { docsBpi2CmtsTEKEntry 4 }

docsBpi2CmtsTEKReset	OBJECT-TYPE
	SYNTAX		TruthValue
	MAX-ACCESS	read-write
	STATUS		current
	DESCRIPTION
		"Setting this object to TRUE causes the CMTS to
	invalidate the current active TEK(s) (plural due to key
	transition periods), and to generate a new TEK for the
	associated SID; the CMTS MAY also generate an unsolicited TEK
	Invalid message, to optimize the TEK synchronization between
	the CMTS and the CM. Reading this object always returns
	FALSE." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.1.3.3.5." 
	::= { docsBpi2CmtsTEKEntry 5 }

docsBpi2CmtsKeyRequests	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has received a Key Request message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.4." 
	::= { docsBpi2CmtsTEKEntry 6 }

docsBpi2CmtsKeyReplies	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted a Key Reply message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.5." 
	::= { docsBpi2CmtsTEKEntry 7 }

docsBpi2CmtsKeyRejects	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted a Key Reject message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.6." 
	::= { docsBpi2CmtsTEKEntry 8 }

docsBpi2CmtsTEKInvalids	OBJECT-TYPE
	SYNTAX		Counter32
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the count of times the
	CMTS has transmitted a TEK Invalid message."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Section 4.2.1.8." 
	::= { docsBpi2CmtsTEKEntry 9 }

docsBpi2CmtsKeyRejectErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				unauthorizedSid(4)
				}
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in the most recent Key Reject
	message sent in response to a Key Request for this BPI
	SID. This has value unknown(2) if the last Error-Code value
	was 0, and none(1) if no Key Reject message has been received
	since reboot." 
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.6 and 4.2.2.16."
	::= { docsBpi2CmtsTEKEntry 10 }

docsBpi2CmtsKeyRejectErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in the
	most recent Key Reject message sent in response to a Key
	Request for this BPI SID. This is a zero length string if no
	Key Reject message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.6 and 4.2.2.6."
	::= { docsBpi2CmtsTEKEntry 11 }

docsBpi2CmtsTEKInvalidErrorCode	OBJECT-TYPE
	SYNTAX		INTEGER {
				none(1),
				unknown(2),
				invalidKeySequence(6)
				}
	MAX-ACCESS		read-only
	STATUS			current
	DESCRIPTION
		"The value of this object is the enumerated
	description of the Error-Code in the most recent TEK Invalid
	message sent in association with this BPI SID.  This has value
	unknown(2) if the last Error-Code value was 0, and none(1) if
	no TEK Invalid message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.8 and 4.2.2.16."
	::= { docsBpi2CmtsTEKEntry 12 }

docsBpi2CmtsTEKInvalidErrorString	OBJECT-TYPE
	SYNTAX		DisplayString (SIZE (0..128))
	MAX-ACCESS	read-only
	STATUS		current
	DESCRIPTION
		"The value of this object is the Display-String in the
	most recent TEK Invalid message sent in association with this
	BPI SID.  This is a zero length string if no TEK Invalid
	message has been received since reboot."
	REFERENCE
		"DOCSIS Baseline Privacy Interface Specification,
	Sections 4.2.1.8 and 4.2.2.6."
	::= { docsBpi2CmtsTEKEntry 13 }

--
-- The CMTS Multicast Control Group
--

docsBpi2MulticastControl OBJECT IDENTIFIER ::= { docsBpi2CmtsObjects 4 }

--
-- The CMTS IP Multicast Mapping Table, indexed by IP multicast
-- address and prefix, and by ifindex
--

docsBpi2IpMulticastMapTable	OBJECT-TYPE
	SYNTAX		SEQUENCE OF DocsBpi2IpMulticastMapEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This table describes the mapping of IP multicast
	address prefixes to multicast SIDs on each CMTS MAC
	interface." 
	::= { docsBpi2MulticastControl 1 }

docsBpi2IpMulticastMapEntry	OBJECT-TYPE
	SYNTAX		DocsBpi2IpMulticastMapEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"Each entry contains objects describing the mapping of
	one IP multicast address prefix to one multicast SID on one
	CMTS MAC interface. The CMTS uses the mapping when forwarding
	downstream IP multicast traffic."
	INDEX	{ ifIndex, docsBpi2IpMulticastAddress,
		  docsBpi2IpMulticastPrefixLength }
	::= { docsBpi2IpMulticastMapTable 1 }

DocsBpi2IpMulticastMapEntry ::= SEQUENCE {
	docsBpi2IpMulticastAddress	IpAddress,
	docsBpi2IpMulticastPrefixLength	Integer32,
	docsBpi2IpMulticastServiceId	Integer32,
	docsBpi2IpMulticastMapControl	RowStatus
	}

docsBpi2IpMulticastAddress	OBJECT-TYPE
	SYNTAX		IpAddress
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This object represents the IP multicast address
	(prefix) to be mapped."
	::= { docsBpi2IpMulticastMapEntry 1 }

docsBpi2IpMulticastPrefixLength	OBJECT-TYPE
	SYNTAX		Integer32 (0..32)
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This object represents the IP multicast address
	prefix length to be mapped."
	::= { docsBpi2IpMulticastMapEntry 2 }

docsBpi2IpMulticastServiceId	OBJECT-TYPE
	SYNTAX		Integer32 (8192..16368)
	MAX-ACCESS	read-create
	STATUS		current
	DESCRIPTION
		"This object represents the multicast BPI SID to be
	used in this IP multicast address prefix mapping entry."
-- DEFVAL is an unused multicast SID value chosen by CMTS.
	::= { docsBpi2IpMulticastMapEntry 3 }

docsBpi2IpMulticastMapControl	OBJECT-TYPE
	SYNTAX		RowStatus
	MAX-ACCESS	read-create
	STATUS		current
	DESCRIPTION
		"This object controls and reflects the IP multicast
	address prefix mapping entry."
	::= { docsBpi2IpMulticastMapEntry 4 }

--
-- The CMTS Multicast SID Authorization Table, indexed by ifIndex by
-- multicast BPI SID by CM MAC address
--

docsBpi2MulticastAuthTable	OBJECT-TYPE
	SYNTAX		SEQUENCE OF DocsBpi2MulticastAuthEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This table describes the multicast BPI SID
	authorization for each CM on each CMTS MAC interface."
	::= { docsBpi2MulticastControl 2 }

docsBpi2MulticastAuthEntry	OBJECT-TYPE
	SYNTAX		DocsBpi2MulticastAuthEntry
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"Each entry contains objects describing the key
	authorization of one cable modem for one multicast BPI SID for
	one CMTS MAC interface." 
	INDEX	{ ifIndex, docsBpi2MulticastServiceId,
		  docsBpi2MulticastCmMacAddress }
	::= { docsBpi2MulticastAuthTable 1 }

DocsBpi2MulticastAuthEntry ::= SEQUENCE 
	{
	docsBpi2MulticastServiceId	Integer32,
	docsBpi2MulticastCmMacAddress	MacAddress,
	docsBpi2MulticastAuthControl	RowStatus
	}

docsBpi2MulticastServiceId	OBJECT-TYPE
	SYNTAX		Integer32 (8192..16368)
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This object represents the multicast BPI SID for
	authorization." 
	::= { docsBpi2MulticastAuthEntry 1 }

docsBpi2MulticastCmMacAddress	OBJECT-TYPE
	SYNTAX		MacAddress
	MAX-ACCESS	not-accessible
	STATUS		current
	DESCRIPTION
		"This object represents the MAC address of the CM to
	which the multicast BPI SID authorization applies."
	::= { docsBpi2MulticastAuthEntry 2 }

docsBpi2MulticastAuthControl	OBJECT-TYPE
	SYNTAX		RowStatus
	MAX-ACCESS	read-create
	STATUS		current
	DESCRIPTION
		"This object controls and reflects the CM
	authorization for each multicast BPI SID."
	::= { docsBpi2MulticastAuthEntry 3 }

docsBpi2Certs OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 3 }

docsBpi2DeviceCert OBJECT-TYPE
    SYNTAX  	X509Certificate
    MAX-ACCESS 	read-write
    STATUS  	current
    DESCRIPTION
	"The X509 certificate for this device.  This object may only
    be written to with a valid certificate which contains the public
    key of this device.  This object MUST be written to permanent
    storage and must not be erased on power off, or factory reset.  To
    be valid, this certificate MUST chain to a trusted root in the
    docsBpi2CACertTable.  In other words, populate the docsBpi2CACertTable
    before trying to update this object.  It is compliant to implement
    this object as read-only - see the compliance statements."
    ::= { docsBpi2Certs 1 }

docsBpi2CACertTable OBJECT-TYPE
    SYNTAX  	SEQUENCE OF DocsBpi2CACertEntry
    MAX-ACCESS 	not-accessible
    STATUS  	current
    DESCRIPTION
	"The table of known certificate authority certificates at this
    device. For a cable modem, this is generally only the DOCSIS root
    CA certificate and its manufacturers CA certificate(s).  This
    table exists in both CMs and CMTSs" 
    ::= { docsBpi2Certs 2 }

docsBpi2CACertEntry OBJECT-TYPE
    SYNTAX  	DocsBpi2CACertEntry
    MAX-ACCESS 	not-accessible
    STATUS  	current
    DESCRIPTION
	"A row in the Certificate Authority certificate table."
    INDEX   { docsBpi2CACertIndex }
    ::= {docsBpi2CACertTable 1 }

DocsBpi2CACertEntry ::= SEQUENCE {
	docsBpi2CACertIndex	Integer32,
	docsBpi2CACertValue	X509Certificate,
	docsBpi2CACertTag      	SnmpAdminString,
	docsBpi2CACertTrust	INTEGER,
	docsBpi2CACertValid	INTEGER,
	docsBpi2CACertSource	INTEGER,
	docsBpi2CACertStatus	RowStatus
}

docsBpi2CACertIndex OBJECT-TYPE
    SYNTAX  	Integer32 (1..1000)
    MAX-ACCESS 	not-accessible
    STATUS  	current
    DESCRIPTION
	"The index for this row."
    ::= { docsBpi2CACertEntry 1 }

docsBpi2CACertValue OBJECT-TYPE
    SYNTAX  	X509Certificate
    MAX-ACCESS 	read-create
    STATUS  	current
    DESCRIPTION
	"An X509 DER-encoded certificate authority certificate."
    ::= { docsBpi2CACertEntry 2 }

docsBpi2CACertTag OBJECT-TYPE 
    SYNTAX	SnmpAdminString 
    MAX-ACCESS 	read-only
    STATUS 	current 
    DESCRIPTION 
	"For DOCSIS Manufacturer's certificates, this is the printable
    representation of the company name and manufacturing location
    extracted from the certificate's subjectName.  (E.g. if at least
    one of the organizationalUnitName's is DOCSIS, this is the
    concatenated value of the organizationName and the second
    organizationalUnitName).  For all other certificates, this is the
    printable representation of the commonName extracted from the
    subjectName."
    ::= { docsBpi2CACertEntry 3 }

docsBpi2CACertTrust OBJECT-TYPE
    SYNTAX  	INTEGER {
    			trust (1),
			chain (2),
			untrusted (3)
			}
    MAX-ACCESS 	read-create
    STATUS  	current
    DESCRIPTION
	"This object controls the trust status of this certificate.
    Trust means this certificate (and the certificates it has issued) are
    trusted. Chain means this certificate is trusted if and only if
    its issuers' certificate is trusted - either directly or
    transitively if it is also marked as 'chain'. Untrusted means this
    certificate is explictly untrusted regardless of the trust status
    of its issuer." 
    DEFVAL { chain  }
    ::= { docsBpi2CACertEntry 4 }
    
docsBpi2CACertValid OBJECT-TYPE
    SYNTAX  	INTEGER {
    		        valid (1),  -- Valid sig and issuer
			badsig (2), -- Couldn't validate signature
			noissuer (3),  -- Couldn't find the issuer
			unsupportedsigalg (4),  -- Can't handle algorithm
			untrustedchain (5), -- any issuer in chain untrusted
			invalidchain (6) -- Any issuer in chain invalid
			}
    MAX-ACCESS 	read-only
    STATUS  	current
    DESCRIPTION
	"This object describes the validity status of a certificate.
    A certificate is valid if and only if its signature is valid and
    it chains to a valid and trusted CA certificate.  A
    signature must be validated against its issuer's public key.  A
    self-signed certificate's signature is validated against its own
    public key.  Valid means the issuer of the signature was
    available, and that the signature could be verified.  Badsig
    means that the issuer was available, but the signature was
    invalid.  Noissuer means that the issuer of this certificate
    could not be found and therefore the signature could not be
    verified.  Unsupportedsigalg means that either the device did
    not have the cryptographic libaries available to verify the
    signature, or that there was a mismatch between the signature
    algorithm type and the algorithm type of the public key that was
    supposed to be used to verify the signature.  Untrustedchain
    means that the certificate was valid, but it did not chain to a
    trusted certificate.  Invalidchain means that the certificate was
    valid, but one of the CAs in its chain was invalid."
    ::= { docsBpi2CACertEntry 5 }

docsBpi2CACertSource OBJECT-TYPE
    SYNTAX  	INTEGER {
    			permanent (1),  -- Compiled into the code
			learned (2),  -- learned automatically
			snmp (3), -- set via SNMP
			config (4), -- in the config file
			other (5) -- any other source
			}
    MAX-ACCESS 	read-only
    STATUS  	current
    DESCRIPTION
	"This object indicates how this certificate got into this
    table.  Permanent means it was compiled into the code and may not
    be deleted.  Learned means that it was added via the BPI
    information management messages and only applies to manufacturer's
    certificates - these entries may be deleted.  Viamgt means that
    the certificate was added by an SNMP action.  Config means that it
    was included as an object in the CM or CMTS configuration file.
    Other means it originated from a source not identified above."
    ::= { docsBpi2CACertEntry 6 }

docsBpi2CACertStatus OBJECT-TYPE
    SYNTAX  	RowStatus
    MAX-ACCESS 	read-create
    STATUS  	current
    DESCRIPTION
	"Standard RowStatus object for creating and deleting entries
    in this table.  Of the objects in the row controlled by this
    object, only docsBpi2CACertTrust may be modified while the row is
    active." 
    ::= { docsBpi2CACertEntry 7 }

--
-- CMTS Only objects
--

docsBpi2CmtsCert OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 4 }

docsBpi2CmtsCmCertTable OBJECT-TYPE
    SYNTAX  	SEQUENCE OF DocsBpi2CmtsCmCertEntry
    MAX-ACCESS 	not-accessible
    STATUS  	current
    DESCRIPTION
	"A table of CM certificates known by this CMTS.  This table
    includes certificates associated with registered CMs, certificates
    added to be hotlisted, and certificates previsiously associated
    with certificates."
    ::= { docsBpi2CmtsCert 1 }

docsBpi2CmtsCmCertEntry OBJECT-TYPE
    SYNTAX  	DocsBpi2CmtsCmCertEntry
    MAX-ACCESS 	not-accessible
    STATUS  	current
    DESCRIPTION
	"An entry in the CM certificate table."
    INDEX { docsBpi2CmtsCmCertIndex }
    ::= { docsBpi2CmtsCmCertTable 1 }

DocsBpi2CmtsCmCertEntry ::= SEQUENCE 
    { 
    docsBpi2CmtsCmCertIndex		Integer32,
    docsBpi2CmtsCmCert			X509Certificate,
    docsBpi2CmtsCmCertFingerPrint 	OCTET STRING,
    docsBpi2CmtsCmCertValidStat		INTEGER,
    docsBpi2CmtsCmCertSource		INTEGER,
    docsBpi2CmtsCmCertStatus		RowStatus
    }

docsBpi2CmtsCmCertIndex OBJECT-TYPE
    SYNTAX  Integer32  (1..25000)
    MAX-ACCESS not-accessible
    STATUS  current
    DESCRIPTION
	"The index of this row."
    ::= { docsBpi2CmtsCmCertEntry 1 }

docsBpi2CmtsCmCert OBJECT-TYPE
    SYNTAX  	X509Certificate
    MAX-ACCESS 	read-only
    STATUS  	current
    DESCRIPTION
	"The DER encoded X509 certificate associated with this row.
    The agent may reap this data associated with this value and return
    a zero length OCTET STRING.  The agent MUST ..."
    ::= { docsBpi2CmtsCmCertEntry 2 }

docsBpi2CmtsCmCertFingerPrint OBJECT-TYPE
    SYNTAX  	OCTET STRING ( SIZE (0 | 20) )
    MAX-ACCESS 	read-create
    STATUS  	current
    DESCRIPTION
	"The SHA1 hash of the docsBpi2CmtsCmCert of this entry.  Any time
    a certificate is added to this table, this value is calculated
    from the certificate.  It can be set manually.  "
    ::= { docsBpi2CmtsCmCertEntry 3 }

docsBpi2CmtsCmCertValidStat OBJECT-TYPE
    SYNTAX  	INTEGER {
    			hotlisted (1),
    			forcevalid (2),
			chainvalid (3),
			chaininvalid (4),
			chainuntrusted (5)
			}
    MAX-ACCESS 	read-create
    STATUS  	current
    DESCRIPTION
	"This object indicates the validity status of the indicated
    certificate at this CMTS.  Hotlisted means that the manager has
    indicated this modem may not register.  Forcevalid means that
    this modem certificate should be accepted regardless of the
    validity of its issuers.  Chainvalid means that the certificate
    is valid and its chain is valid and trusted - the associated modem
    may be registered. Chaininvalid means that at least one
    certificate along this cert's chain is invalid - the associated
    modem may not be registered.  Chainuntrusted means that at least
    one certificate along this certs chain is marked as untrusted -
    the associated modem may not be registered.  This object may not
    be set to chaininvalid or chainuntrusted by a management agent,
    but may end up in this state if the object is set to
    chainvalid.  Certificates in the chaininvalid or chainuntrusted
    state may end up in the chainvalid state if the certificates
    along their chain become valid or trusted.  Certificates learned
    from modem registration are added as chainvalid if their chains
    are valid and trusted." 
    DEFVAL { chainvalid  }
    ::= { docsBpi2CmtsCmCertEntry 4 }

docsBpi2CmtsCmCertSource OBJECT-TYPE
    SYNTAX  INTEGER { 
    		    registration (1),
		    snmp (2),
		    permanent (3),
		    database (4)
		    }
    MAX-ACCESS read-only
    STATUS  current
    DESCRIPTION
	"How this certificate got in the CMTS. Registration means it
    was learned during cable mode registration.  Config means it was
    added manually, either via snmp, or via some other configuration
    mechanism. Permanent means it is compiled into the code.  Database
    means that is was derived from an external but associated database
    and represents a caching of permission."
    ::= { docsBpi2CmtsCmCertEntry 5 }

docsBpi2CmtsCmCertStatus OBJECT-TYPE
    SYNTAX  RowStatus
    MAX-ACCESS read-create
    STATUS  current
    DESCRIPTION
	"Standard RowStatus object for creating and deleting this
    row.  Only the validity status of the certificate may be changed
    by SNMP when this row is active."
    ::= { docsBpi2CmtsCmCertEntry 6 }

docsBpi2CmtsCmLinkTable OBJECT-TYPE
    SYNTAX  SEQUENCE OF DocsBpi2CmtsCmLinkEntry
    MAX-ACCESS not-accessible
    STATUS  current
    DESCRIPTION
	"This table augments the docsIfCmtsCmStatusTable and provides
    one additional column which points to the certificate associated with
    CM identified by the associated row."
    ::= { docsBpi2CmtsCert 2 }

docsBpi2CmtsCmLinkEntry OBJECT-TYPE
    SYNTAX  DocsBpi2CmtsCmLinkEntry
    MAX-ACCESS not-accessible
    STATUS  current
    DESCRIPTION
	"An entry in the certificate link table."
    AUGMENTS { docsIfCmtsCmStatusEntry }
    ::= {docsBpi2CmtsCmLinkTable 1 }

DocsBpi2CmtsCmLinkEntry ::= SEQUENCE {
    docsBpi2CmtsCmLinkPointer	RowPointer
}

docsBpi2CmtsCmLinkPointer OBJECT-TYPE
    SYNTAX  RowPointer
    MAX-ACCESS read-only
    STATUS  current
    DESCRIPTION
	"This entry is either the NULL OID or points to a row in the
    docsBpi2CmtsCmCertTable that describes the certificate used by the
    CM to register for BPI services."
    ::= { docsBpi2CmtsCmLinkEntry 1 }

--
-- The BPI MIB Conformance Statements (with a placeholder for
-- notifications)
--

docsBpi2Notification	OBJECT IDENTIFIER ::= { docsBpi2MIB 2 }
docsBpi2Conformance	OBJECT IDENTIFIER ::= { docsBpi2MIB 3 }
docsBpi2Compliances	OBJECT IDENTIFIER ::= { docsBpi2Conformance 1 }
docsBpi2Groups		OBJECT IDENTIFIER ::= { docsBpi2Conformance 2 }

docsBpi2BasicCompliance MODULE-COMPLIANCE
	STATUS		current
	DESCRIPTION
		"This is the compliance statement for devices which
	implement the DOCSIS Baseline Privacy Interface."

	MODULE  -- docsBpi2MIB

	-- conditionally mandatory group
GROUP	docsBpi2CmGroup
	DESCRIPTION
	"This group is implemented only in CMs, not in CMTSs."

-- conditionally mandatory group
GROUP	docsBpi2CmtsGroup
	DESCRIPTION
	"This group is implemented only in CMTSs, not in CMs."

GROUP 	docsBpi2CertGroup
        DESCRIPTION
	    ""

GROUP   docsBpi2CertCmtsGroup
        DESCRIPTION
	    ""

-- relaxation on mandatory range
OBJECT	docsBpi2CmAuthGraceTime
	SYNTAX	Integer32 (300..1800)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in
	[7]." 

-- relaxation on mandatory range
OBJECT	docsBpi2CmTEKGraceTime
	SYNTAX	Integer32 (300..1800)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in
	[7]." 

-- relaxation on mandatory range
OBJECT	docsBpi2CmtsDefaultAuthLifetime
	SYNTAX	Integer32 (86400..6048000)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in
	[7]." 

-- relaxation on mandatory range
OBJECT	docsBpi2CmtsDefaultTEKLifetime
	SYNTAX	Integer32 (1800..604800)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in [7]."

-- relaxation on mandatory range
-- OBJECT	docsBpi2CmtsDefaultAuthGraceTime
-- SYNTAX	INTEGER (300..1800)
-- DESCRIPTION
-- "The refined range corresponds to the minimum and maximum values in
-- operational networks, according to Appendix A.2 in [7]."

-- relaxation on mandatory range
-- OBJECT	docsBpi2CmtsDefaultTEKGraceTime
-- SYNTAX	INTEGER (300..1800)
-- DESCRIPTION
-- "The refined range corresponds to the minimum and maximum values in
-- operational networks, according to Appendix A.2 in [7]."

-- relaxation on mandatory range
OBJECT	docsBpi2CmtsAuthCmLifetime
	SYNTAX	Integer32 (86400..6048000)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in
	[7]." 

-- relaxation on mandatory range
OBJECT	docsBpi2CmtsAuthCmGraceTime
	SYNTAX	Integer32 (300..1800)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in
	[7]."

-- relaxation on mandatory range
OBJECT	docsBpi2CmtsTEKLifetime
	SYNTAX	Integer32 (1800..604800)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in
	[7]." 

-- relaxation on mandatory range
OBJECT	docsBpi2CmtsTEKGraceTime
	SYNTAX	Integer32 (300..1800)
	DESCRIPTION
	"The refined range corresponds to the minimum and maximum
	values in operational networks, according to Appendix A.2 in
	[7]."

::= { docsBpi2Compliances 1 }

docsBpi2CmGroup	OBJECT-GROUP
	OBJECTS	{
		docsBpi2CmPrivacyEnable,
		docsBpi2CmPublicKey,
		docsBpi2CmAuthState,
		docsBpi2CmAuthKeySequenceNumber,
		docsBpi2CmAuthExpires,
		docsBpi2CmAuthReset,
		docsBpi2CmAuthGraceTime,
		docsBpi2CmTEKGraceTime,
		docsBpi2CmAuthWaitTimeout,
		docsBpi2CmReauthWaitTimeout,
		docsBpi2CmOpWaitTimeout,
		docsBpi2CmRekeyWaitTimeout,
		docsBpi2CmAuthRejectWaitTimeout,
		docsBpi2CmAuthRequests,
		docsBpi2CmAuthReplies,
		docsBpi2CmAuthRejects,
		docsBpi2CmAuthInvalids,
		docsBpi2CmAuthRejectErrorCode,
		docsBpi2CmAuthRejectErrorString,
		docsBpi2CmAuthInvalidErrorCode,
		docsBpi2CmAuthInvalidErrorString,
--		docsBpi2CmTEKServiceId,
		docsBpi2CmTEKPrivacyEnable,
		docsBpi2CmTEKState,
		docsBpi2CmTEKExpiresOld,
		docsBpi2CmTEKExpiresNew,
		docsBpi2CmTEKKeyRequests,
		docsBpi2CmTEKKeyReplies,
		docsBpi2CmTEKKeyRejects,
		docsBpi2CmTEKInvalids,
		docsBpi2CmTEKAuthPends,
		docsBpi2CmTEKKeyRejectErrorCode,
		docsBpi2CmTEKKeyRejectErrorString,
		docsBpi2CmTEKInvalidErrorCode,
		docsBpi2CmTEKInvalidErrorString
		}
	STATUS		current
	DESCRIPTION
	"This collection of objects provides CM BPI status and
	control." 
::= { docsBpi2Groups 1 }

docsBpi2CmtsGroup	OBJECT-GROUP
	OBJECTS {
		docsBpi2CmtsDefaultAuthLifetime,
		docsBpi2CmtsDefaultTEKLifetime,
-- docsBpi2CmtsDefaultAuthGraceTime,
-- docsBpi2CmtsDefaultTEKGraceTime,
		docsBpi2CmtsAuthRequests,
		docsBpi2CmtsAuthReplies,
		docsBpi2CmtsAuthRejects,
		docsBpi2CmtsAuthInvalids,
		docsBpi2CmtsAuthCmPublicKey,
		docsBpi2CmtsAuthCmKeySequenceNumber,
		docsBpi2CmtsAuthCmExpires,
		docsBpi2CmtsAuthCmLifetime,
		docsBpi2CmtsAuthCmGraceTime,
		docsBpi2CmtsAuthCmReset,
		docsBpi2CmtsAuthCmRequests,
		docsBpi2CmtsAuthCmReplies,
		docsBpi2CmtsAuthCmRejects,
		docsBpi2CmtsAuthCmInvalids,
		docsBpi2CmtsAuthRejectErrorCode,
		docsBpi2CmtsAuthRejectErrorString,
		docsBpi2CmtsAuthInvalidErrorCode,
		docsBpi2CmtsAuthInvalidErrorString,
--		docsBpi2CmtsTEKServiceId,
		docsBpi2CmtsTEKLifetime,
		docsBpi2CmtsTEKGraceTime,
		docsBpi2CmtsTEKExpiresOld,
		docsBpi2CmtsTEKExpiresNew,
		docsBpi2CmtsTEKReset,
		docsBpi2CmtsKeyRequests,
		docsBpi2CmtsKeyReplies,
		docsBpi2CmtsKeyRejects,
		docsBpi2CmtsTEKInvalids,
		docsBpi2CmtsKeyRejectErrorCode,
		docsBpi2CmtsKeyRejectErrorString,
		docsBpi2CmtsTEKInvalidErrorCode,
		docsBpi2CmtsTEKInvalidErrorString,
		docsBpi2IpMulticastServiceId,
		docsBpi2IpMulticastMapControl,
		docsBpi2MulticastAuthControl
		}
	STATUS		current
	DESCRIPTION
	"This collection of objects provides CMTS BPI status and
	control." 
::= { docsBpi2Groups 2 }

docsBpi2CertGroup OBJECT-GROUP
        OBJECTS {
	        docsBpi2DeviceCert,
		docsBpi2CACertValue,
		docsBpi2CACertTag,
		docsBpi2CACertTrust,
		docsBpi2CACertValid,
		docsBpi2CACertSource,
		docsBpi2CACertStatus
		}
	STATUS		current
	DESCRIPTION
	    ""
::= { docsBpi2Groups 3 }

docsBpi2CertCmtsGroup OBJECT-GROUP
        OBJECTS {
	        docsBpi2CmtsCmCert,
		docsBpi2CmtsCmCertFingerPrint,
		docsBpi2CmtsCmCertValidStat,
		docsBpi2CmtsCmCertSource,
		docsBpi2CmtsCmCertStatus,
		docsBpi2CmtsCmLinkPointer
		}
	STATUS		current
	DESCRIPTION
	    ""
::= { docsBpi2Groups 4 }

END