This repository has been archived by the owner. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 39
/
Copy pathCTRON-SSR-POLICY-MIB
1622 lines (1421 loc) · 51.1 KB
/
CTRON-SSR-POLICY-MIB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
CTRON-SSR-POLICY-MIB DEFINITIONS ::= BEGIN
-- This module provides authoritative definitions for Enterasys
-- Networks' enterprise-specific Smart Switch Router specific MIB
-- branches.
--
-- This module will be extended, as required.
-- Enterasys Networks reserves the right to make changes in
-- specification and other information contained in this document
-- without prior notice. The reader should consult Enterasys Networks
-- to determine whether any such changes have been made.
--
-- In no event shall Enterasys Networks be liable for any incidental,
-- indirect, special, or consequential damages whatsoever (including
-- but not limited to lost profits) arising out of or related to this
-- document or the information contained in it, even if Enterasys
-- Networks has been advised of, known, or should have known, the
-- possibility of such damages.
--
-- Enterasys Networks grants vendors, end-users, and other interested parties
-- a non-exclusive license to use this Specification in connection
-- with the management of Enterasys products.
-- Copyright 1998-2003 Enterasys Networks, Inc.
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE, TimeTicks, IpAddress, Counter32, Gauge32,
Integer32
FROM SNMPv2-SMI
TEXTUAL-CONVENTION, DisplayString, RowStatus, TruthValue, MacAddress
FROM SNMPv2-TC
MODULE-COMPLIANCE, OBJECT-GROUP
FROM SNMPv2-CONF
dot1qVlanStaticEntry
FROM Q-BRIDGE-MIB
ssrMibs
FROM CTRON-SSR-SMI-MIB;
policyMIB MODULE-IDENTITY
LAST-UPDATED "200312191712Z" -- Fri Dec 19 17:12 GMT 2003
ORGANIZATION "Enterasys Networks, Inc"
CONTACT-INFO
"Postal: Enterasys Networks
50 Minuteman Rd.
Andover, MA 01810-1008
USA
Phone: +1 978 684 1000
E-mail: [email protected]
WWW: http://www.enterasys.com"
DESCRIPTION
"This module defines a schema to control filters on a device capable
of Layer 3 filters also called Access Control Lists (ACLs) and at
layer 2. It may also be used to configure static IP routes that use
other IP header fields in addition to destination IP address."
REVISION "200312191712Z" -- Fri Dec 19 17:12 GMT 2003
DESCRIPTION
"Defined bit 0 of polL2Dot1qVlanStaticProtocols as reserved."
REVISION "200307211501Z" -- Mon Jul 21 15:01 GMT 2003
DESCRIPTION
"Revision #5. Add static VLAN protocol filtering to the polL2Group.
Update contact information."
REVISION "200007150000Z"
DESCRIPTION
"Revision #4. Update contact information."
REVISION "9908110000Z"
DESCRIPTION
"Revision #3. Define Policy Based Routing in polL4Group."
REVISION "9907210000Z"
DESCRIPTION
"Revision #2. Define Layer 2 flow security objects in polL2Group."
REVISION "9808040000Z"
DESCRIPTION
"Revision #1. Define Layer 3 flow objects in polL3Group."
::= { ssrMibs 210 }
-- ### Textual conventions
-- InterfaceIndex contains the semantics of ifIndex and
-- should be used for any objects defined on other MIB
-- modules that need these semantics.
InterfaceIndex ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"A unique value, greater than zero, for each interface
or interface sub-layer in the managed system. It is
recommended that values are assigned contiguously
starting from 1. The value for each interface sub-
layer must remain constant at least from one re-
initialization of the entity's network management
system to the next re-initialization."
SYNTAX Integer32 (1..2147483647)
InterfaceIndexOrZero ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"This textual convention is an extension of the
InterfaceIndex convention. The latter defines a
greater than zero value used to identify an interface
or interface sub-layer in the managed system. This
extension permits the additional value of zero. the
value zero is object-specific and must therefore be
defined as part of the description of any object which
uses this syntax. Examples of the usage of zero might
include situations where interface was unknown, or
when none or all interfaces need to be referenced."
SYNTAX Integer32 (0..2147483647)
SSRPortComparator ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Comparison operator used by ACL's to permit src/dst port addresses."
SYNTAX INTEGER {
notused(1), -- no port comparison to be made
eq(2), -- equals
neq(3), -- not equals
lt(4), -- less than
gt(5), -- greater than
range(6) -- contains X-Y inclusive
}
SSRProtocol ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Protocols supported by L3 ACLs."
SYNTAX INTEGER {
ip(1), -- Internet Protocol Version 4
tcp(2), -- Transmission Control Protocol
udp(3), -- User Datagram Protocol
icmp(4), -- Internet Control Management Protocol
igmp(5), -- Internet Group Management Protocol (Multicast)
ipx(6), -- Novell IPX protocol
ipxsap(7), -- Novell IPX SAP protocol
ipxrip(8) -- Novell IPX RIP protocol
}
SSRsocketId ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A TCP or UDP port or socket end point."
SYNTAX INTEGER (0..65535)
SSRVlanIndex ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"An 802.1Q VLAN Identifier with same semantics as Q-BRIDGE-MIB VlanId.
SSR uses Vid 1 for the default VLAN. All ports by default belong to this VLAN
unless assigned to one or more user defined VLANs. A value of 4100 is used to match
all VLANs. 4094 to 4099 are reserved local VLAN ids on the SSR."
SYNTAX INTEGER (1..4100)
SSRPortList ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"List of ifIndexes that make up the ports to apply a layer 2 filter to.
The ifIndexes are numbered sparsely starting from 1. An example string
might be:
1,2,32
1,6,9,
Each ifIndex must represent a physical port or link aggregation aka Smart
Trunk ifType of propMultiplexor(54). Note ifIndexes may change across
system resets per RFC 2233."
SYNTAX OCTET STRING (SIZE (0..255))
SSRFlowPolicyType ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Type of Flow Policy. permitFlow allows matching traffic to be forwarded. denyFlow
causes matching traffic to be discarded."
SYNTAX INTEGER { permitFlow(1), denyFlow(2) }
SSRFlowPolicyAction ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"When deciding when to apply policy there are three potential methods.
policyBeforeRouteLookup provides a way to special case normal traffic patterns
so that certain traffic can be routed according to policy.
policyAfterRouteLookup is useful when a default route does not exist and the traffic
to route does not match existing route tables.
useOnlyPolicyLookup bypasses normal route lookup altogether."
SYNTAX INTEGER { policyBeforeRouteLookup(1), policyAfterRouteLookup(2), useOnlyPolicyLookup(3) }
SSRFlowPolicyAclList ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A blank separated list of ACL names used to match flows against from the polAclTable.
The keyword, everything, may be used to match all traffic. ASCII printable characters only"
SYNTAX OCTET STRING (SIZE(1..4096))
SSRFlowNextHopList ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A blank separated list of from one to four l4fNextHopRouter ipaddresses or
the keyword null. Null represents the null interface"
SYNTAX OCTET STRING (SIZE(1..4096))
SSRFlowLoadPolicy ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"round robin evenly distributes flows among the next hops. firstAvailable
will make flows go to the first available next hop in the ordered list."
SYNTAX INTEGER { firstAvailable(2), roundRobin(3) }
-- ### groups ###
-- Layer 3 Policy Group
polL3Group OBJECT IDENTIFIER ::= { ssrMibs 12 }
polAclServer OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This is true when Access Control Lists (ACLs) are defined by a
Policy Server else false.
At boot, this value is false. After the first valid set of any
policy object, the value changes to true."
::= { polL3Group 1 }
polAclNumber OBJECT-TYPE
SYNTAX INTEGER (0..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of Layer 3 Access Control Lists defined in the SSR."
::= { polL3Group 2 }
polAclLastChanged OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time the Access Control List were last changed."
::= { polL3Group 3 }
-- The Layer 3 Access Control List Configuration Table
polAclTable OBJECT-TYPE
SYNTAX SEQUENCE OF PolAclEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A list of Access Control List entries."
::= { polL3Group 4 }
polAclEntry OBJECT-TYPE
SYNTAX PolAclEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A record containing a Access Control List."
INDEX { polAclName, polAclItem }
::= { polAclTable 1 }
PolAclEntry ::=
SEQUENCE {
polAclName DisplayString,
polAclItem INTEGER,
polAclRestriction INTEGER,
polAclProtocol SSRProtocol,
polAclSrcIp IpAddress,
polAclSrcMask IpAddress,
polAclDstIp IpAddress,
polAclDstMask IpAddress,
polAclTOS INTEGER,
polAclSrcPort SSRsocketId,
polAclDstPort SSRsocketId,
polAclSrcOperator SSRPortComparator,
polAclDstOperator SSRPortComparator,
polAclSrcHighRange INTEGER,
polAclDstHighRange INTEGER,
polAclAuditTrail TruthValue,
polAclCheckpoint INTEGER,
polAclRowStatus RowStatus
}
polAclName OBJECT-TYPE
SYNTAX DisplayString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The administratively assigned name to this static route entry."
::= { polAclEntry 1 }
polAclItem OBJECT-TYPE
SYNTAX INTEGER (0..256)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This row's unique identifier within a given ACL set. Member of the ACL set
are numbered from 1 to 256. If Item is set to 0, and rowStatus is destroy,
all rows for this set are destroyed."
::= { polAclEntry 2 }
polAclRestriction OBJECT-TYPE
SYNTAX INTEGER {
permit(1),
deny(2)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The permissions/restrictions given to this static route entry."
::= { polAclEntry 3 }
polAclProtocol OBJECT-TYPE
SYNTAX SSRProtocol
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The IETF protocol this ACL applies to."
::= { polAclEntry 4 }
polAclSrcIp OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The source L3 IP Address this ACL applies to."
::= { polAclEntry 5 }
polAclSrcMask OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The source L3 IP Mask this ACL Applies to."
::= { polAclEntry 6 }
polAclDstIp OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The source L3 IP Address this ACL applies to."
::= { polAclEntry 7 }
polAclDstMask OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The source L3 IP Mask this ACL Applies to."
::= { polAclEntry 8 }
polAclTOS OBJECT-TYPE
SYNTAX INTEGER (0..15)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The source L3 IP Type of Service field."
::= { polAclEntry 9 }
polAclSrcPort OBJECT-TYPE
SYNTAX SSRsocketId
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The source L3 IP source port/socket ACL applies to."
::= { polAclEntry 10 }
polAclDstPort OBJECT-TYPE
SYNTAX SSRsocketId
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The source L3 IP destination port/socket ACL applies to."
::= { polAclEntry 11 }
polAclSrcOperator OBJECT-TYPE
SYNTAX SSRPortComparator
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"polAclSrcPort is compared using this operator."
DEFVAL { eq }
::= { polAclEntry 12 }
polAclDstOperator OBJECT-TYPE
SYNTAX SSRPortComparator
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"polAclDstPort is compared using this operator."
DEFVAL { eq }
::= { polAclEntry 13 }
polAclSrcHighRange OBJECT-TYPE
SYNTAX INTEGER (-1..65535)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The high range source L3 IP port. Used
only when SrcOperator == range. polAclSrcPort is
used as the lower bounds of the range."
DEFVAL { -1 }
::= { polAclEntry 14 }
polAclDstHighRange OBJECT-TYPE
SYNTAX INTEGER (-1..65535)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The high range destination L3 IP port. Used
only when SrcOperator == range. polAclDstPort is
used as the lower bounds of the range."
DEFVAL { -1 }
::= { polAclEntry 15 }
polAclAuditTrail OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Flows matching this ACL are logged for Accounting when true."
::= { polAclEntry 16 }
polAclCheckpoint OBJECT-TYPE
SYNTAX INTEGER {
hourly(1),
daily(2),
weekly(3),
monthly(4),
endofcall(5)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"How long to keep flow at which point a checkpoint should be done.
A checkpoint may trigger earlier than this time should the maximum
batch size be reached."
::= { polAclEntry 17 }
polAclRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"SNMP V2 RowStatus control for this table."
::= { polAclEntry 18 }
-- ACL's created must be applied to either an Interface or service
polAclServiceNumber OBJECT-TYPE
SYNTAX INTEGER (0..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of Layer 3 Access Control Lists in service in the SSR."
::= { polL3Group 5 }
polAclServiceLastChanged OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time the ACLs in service were last changed."
::= { polL3Group 6 }
-- The Layer 3 Access Control List Configuration Table
polAclServiceTable OBJECT-TYPE
SYNTAX SEQUENCE OF PolAclServiceEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A list of ACL's currently in service."
::= { polL3Group 7 }
polAclServiceEntry OBJECT-TYPE
SYNTAX PolAclServiceEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A record containing a Access Control Lists applied to Interfaces."
INDEX { polAclServiceIfIndex, polAclName2 }
::= { polAclServiceTable 1 }
PolAclServiceEntry ::=
SEQUENCE {
polAclServiceIfIndex InterfaceIndex,
polAclName2 DisplayString,
polAclServiceDirection INTEGER,
polAclServiceRowStatus RowStatus
}
polAclServiceIfIndex OBJECT-TYPE
SYNTAX InterfaceIndex
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The ifIndex of the IP Interface the ACL is applied to.
An SSR IP Interface has ifType 142"
::= { polAclServiceEntry 1 }
polAclName2 OBJECT-TYPE
SYNTAX DisplayString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The name of the ACL applied to the particular port."
::= { polAclServiceEntry 2 }
polAclServiceDirection OBJECT-TYPE
SYNTAX INTEGER {
ingress(1),
egress(2),
both(3)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The direction the ACL is applied to the particular port."
::= { polAclServiceEntry 3 }
polAclServiceRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"SNMP V2 RowStatus control for this table."
::= { polAclServiceEntry 6 }
-- List of IP Interfaces and their policy status
polAclRemoteAllowed OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Remote Policy Configuration is allowed when true only
local (to SSR) policy may be applied."
::= { polL3Group 9 }
polAclInterfaceNumber OBJECT-TYPE
SYNTAX INTEGER (0..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of Layer 3 Interfaces in service in the SSR."
::= { polL3Group 10 }
polAclInterfaceLastChanged OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time the Interfaces in service were last changed with regard to policy."
::= { polL3Group 11 }
polAclInterfaceTable OBJECT-TYPE
SYNTAX SEQUENCE OF PolAclInterfaceEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A list of IP Interfaces in service and their policy status. Each IP Interface can be
defined to use local static policy or remote dynamic policy in the config."
::= { polL3Group 12 }
polAclInterfaceEntry OBJECT-TYPE
SYNTAX PolAclInterfaceEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A record containing a Access Control Lists applied to Interfaces."
INDEX { polAclInterfaceIfIndex, polAclInterfaceDirection }
::= { polAclInterfaceTable 1 }
PolAclInterfaceEntry ::=
SEQUENCE {
polAclInterfaceIfIndex InterfaceIndex,
polAclInterfaceDirection INTEGER,
polAclPolicyStatus INTEGER
}
polAclInterfaceIfIndex OBJECT-TYPE
SYNTAX InterfaceIndex
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The ifIndex of the IP Interface the ACL is applied to."
::= { polAclInterfaceEntry 1 }
polAclInterfaceDirection OBJECT-TYPE
SYNTAX INTEGER { -- TBD: Make into TC
ingress(1),
egress(2),
both(3)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The direction the ACL is applied to the particular port."
::= { polAclInterfaceEntry 2 }
polAclPolicyStatus OBJECT-TYPE
SYNTAX INTEGER {
local(1), -- ACLs can be applied via local mgmt only
remote(2) -- ACLs can be applied via local or remote
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Rules for what type of management can apply ACLs to a particular interface. If set to remote,
then a Policy Manager via SNMP may change dynamically the ACLs applied to an interface. Note,
ACLs applied dynamically are not maintained across system reboot. Use local ACLs to setup the basic
rules then apply dynamic rules as necessary."
::= { polAclInterfaceEntry 3 }
--
-- L2 Policy Policy Group
--
polL2Group OBJECT IDENTIFIER ::= { ssrMibs 16 }
polL2FilterNumber OBJECT-TYPE
SYNTAX INTEGER (0..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of Layer 3 Access Control Lists defined in the SSR."
::= { polL2Group 1 }
polL2FilterLastChanged OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time the Access Control List were last changed."
::= { polL2Group 2 }
polL2FilterTable OBJECT-TYPE
SYNTAX SEQUENCE OF PolL2FilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A list of Layer 2 filters."
::= { polL2Group 3 }
polL2FilterEntry OBJECT-TYPE
SYNTAX PolL2FilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry containing a layer 2 filter."
INDEX { polL2FilterIndex }
::= { polL2FilterTable 1 }
PolL2FilterEntry ::=
SEQUENCE {
polL2FilterIndex INTEGER,
polL2FilterDesc DisplayString,
polL2FilterType INTEGER,
polL2FilterRestrictions INTEGER,
polL2FilterDstMacAddr MacAddress,
polL2FilterSrcMacAddr MacAddress,
polL2FilterVlanId SSRVlanIndex,
polL2FilterInPorts SSRPortList,
polL2FilterOutPorts SSRPortList,
polL2FilterCreationTime TimeTicks,
polL2FilterStatus RowStatus
}
polL2FilterIndex OBJECT-TYPE
SYNTAX INTEGER (1..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A unique index into the table representing a single filter entry. This value
will remain unique and the relationship between the index and the underlying filter
is valid until the next reboot."
::= { polL2FilterEntry 1 }
polL2FilterDesc OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..25))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A string used to describe the filter. It should contain
the creator IP address, and other descriptive information about the filter.
It is recommended that names be unique within a given filter type.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1)."
::= { polL2FilterEntry 2 }
polL2FilterType OBJECT-TYPE
SYNTAX INTEGER {
staticEntry(1),
addressFilter(2),
portAddressLock(3),
securePort(4)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The types of filters, as explained below.
static-entry
Based on the restrictions and the presence of
source, destination MAC address they can be of
three types :
source-static-entry - All frames with a source
address equal to srcMAC, coming through any of
the inPorts will be allowed/disallowed to go
to any port that is a member of the outPorts
list.
destination-static-entry - All frames with a
destination address equal to dstMAC, coming
through any of the inPorts will be allowed/
disallowed/forced to go to any port that is a
member of the outPorts list.
flow-static-entry - All frames with a source
address equal to srcMAC and a destination address
equal to dstMAC, coming through any of the inPorts
list will be allowed/disallowed to go to any port
that is a member of the outPorts list. Ports
must be in flow-bridging mode in order to use
filters with both src and dst mac specified.
address-filter
Based on the restrictions and the presence of
source, destination MAC address they can be of
three types :
source-address-filter - All frames with a source
address equal to srcMAC, coming through any of
the inPorts will be filtered out.
destination-address-filter - All frames with a
destination address equal to dstMAC, coming through
any of the inPorts will be filtered out.
flow-filter - All frames with a source address equal
to srcMAC and a destination address equal to dstMAC,
coming through any of the inPorts list will be
filtered out. Ports must be in flow mode in order
to set a filter using both source and destination
address.
port-address-lock
This locks a source address to a port. It allows
learning of srcMAC addresses only on any of the ports
in inPorts. The following objects are mandatory
and must be set by mgmt station to activate a row:
polL2FilterDesc, polL2FilterSrcMacAddr, polL2FilterInPorts
secure-port
This blocks all traffic in a given direction to a port.
Used with static entries, it is effective in allowing only
certain well defined source/destination mac addresses.
The following objects must be set by mgmt station to
activate an entry:
polL2FilterDesc, r, polL2FilterInPorts
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1)."
DEFVAL { staticEntry }
::= { polL2FilterEntry 3 }
polL2FilterRestrictions OBJECT-TYPE
SYNTAX INTEGER {
allow(1),
disallow(2),
force(3),
none(4),
blockIngress(5),
blockEgress(6)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The first 3 restrictions, allow, disallow, force apply when the filterType
is static-entry. When polL2FilterType is addressFilter or portAddressLock,
this object does not apply. For securePort, the blockIngress, blockEgress
values apply.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1)."
DEFVAL { none }
::= { polL2FilterEntry 4 }
polL2FilterSrcMacAddr OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The source MAC address, which is present in case
of a Flow, that has been learned by the switch."
::= { polL2FilterEntry 5 }
polL2FilterDstMacAddr OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The destination MAC address which has been learned.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1)."
::= { polL2FilterEntry 6 }
polL2FilterVlanId OBJECT-TYPE
SYNTAX SSRVlanIndex
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The VLAN the destination MAC address belongs to. The default VLAN
is id 1 on SSR.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1)."
DEFVAL {1}
::= { polL2FilterEntry 7 }
polL2FilterInPorts OBJECT-TYPE
SYNTAX SSRPortList
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The set of Ports to which this filter applies on input.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1)."
::= { polL2FilterEntry 8 }
polL2FilterOutPorts OBJECT-TYPE
SYNTAX SSRPortList
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The set of ports to which this filter applies on output.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1)."
::= { polL2FilterEntry 9 }
polL2FilterCreationTime OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime when this filter was made active(1)."
::= { polL2FilterEntry 10 }
polL2FilterStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"SMIv2 RowStatus control for this table. Use createAndWait or createAndGo
to create a filter, use destroy to remove an entry or notInService to
disengage a filter without destroying it. A row in the notReady state has
not had all the mandatory objects set."
::= { polL2FilterEntry 11 }
-- VLAN Protocol Filtering
polL2Dot1qVlanStaticTable OBJECT-TYPE
SYNTAX SEQUENCE OF PolL2Dot1qVlanStaticEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing hardware specific VLAN behavior configuration
information for VLANs created with the dot1qVlanStaticTable.
Configuration information for each VLAN configured into the device by (local or
network) management."
::= { polL2Group 4 }
polL2Dot1qVlanStaticEntry OBJECT-TYPE
SYNTAX PolL2Dot1qVlanStaticEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry containing additional hardware
specific objects for a dot1qVlanStaticEntry."
AUGMENTS { dot1qVlanStaticEntry }
::= { polL2Dot1qVlanStaticTable 1 }
PolL2Dot1qVlanStaticEntry ::=
SEQUENCE {
polL2Dot1qVlanStaticProtocols BITS,
polL2Dot1qVlanStaticL4Bridging TruthValue
}
polL2Dot1qVlanStaticProtocols OBJECT-TYPE
SYNTAX BITS {
reserved (0),
bridged-protocols (1),
ip(2),
ipx(3),
appletalk(4),
dec(5),
sna(6),
ipv6(7)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Specifies the types of traffic that will be forwarded on this VLAN.
Protocols not set in this definition will be filtered. The types of protocols
supported on this VLAN corresponds to the type option in the CLI command
vlan create <vlan name> <type>. If no protocols are specified, all
protocols are forwarded. This corresponds to the port-based CLI
option.
reserved(0) - this bit is reserved and has no defined behavior.
bridged-protocols(1) - this VLAN supports all bridged protocols
excluding IP and IPX. Includes appletalk(4), dec(5), sna(6), and
ipv6(7) if none of these protocols are set. If any are set, only
those that are set are included.
ip(2) - this VLAN supports IP protocol.
ipx(3) - this VLAN supports IPX protocol.
appletalk(4) - this VLAN supports Appletalk protocol.
dec(5) - this VLAN supports DEC protocol.
sna(6) - this VLAN supports SNA protocol.
ipv6(7) - this VLAN supports IPv6 protocol."
DEFVAL { { ip } }
::= { polL2Dot1qVlanStaticEntry 1 }
polL2Dot1qVlanStaticL4Bridging OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"If this object has a value of false(2), the L4 Bridging feature is not
enabled on this VLAN. If this object has a value of true(1), the L4 Bridging
feature is enabled for this VLAN. This corresponds to the CLI command
vlan enable l4-bridging."
DEFVAL { true }
::= { polL2Dot1qVlanStaticEntry 2 }
--
-- Layer 4 Flow Management
--
polL4Group OBJECT IDENTIFIER ::= { ssrMibs 15 }
polL4PolicyBasedRoutingEnabled OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The state of Policy Based Routing on this network element."
::= { polL4Group 1 }
polL4NumRouters OBJECT-TYPE
SYNTAX INTEGER (0..10)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of next hop routers currently available."
::= { polL4Group 5 }
polL4NextHopTableLastChange OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime when a row was last added
or deleted from polL4NextHopTable."
::= { polL4Group 10 }
--
-- the Next Hop Control Table
--
-- The Next Hop Control table contains information on
-- what next hop routers can be used to redirect existing L4 IP Flows
polL4NextHopTable OBJECT-TYPE
SYNTAX SEQUENCE OF PolL4NextHopEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A list of next hop IP routers."
::= { polL4Group 20 }