CABH-SEC-MIB
AI MIB Summary
The CABH-SEC-MIB module provides management objects for monitoring Security Portal Services, specifically tracking authentication states, session establishment metrics, and access control policy enforcement on CABH security gateways.
This MIB module supplies the basic management objects for the Security Portal Services.
Main OID:
cabhSecMib.1.3.6.1.4.1.4491.2.4.2
116
Objects
Active
Status
10
Dependencies
Imported Objects
Objects
116 total| Object Name |
|---|
cabhSecMibThis MIB module supplies the basic management
objects for the Security Portal Services. MODULE-IDENTITY .1.3.6.1.4.1.4491.2.4.2 |
cabhSecFwObjects OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.1 |
cabhSecFwBase OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.1.1 |
cabhSecFwPolicyFileEnableThis parameter indicates whether or not to enable
the firewall functionality.rwdeprecated Enumeration .1.3.6.1.4.1.4491.2.4.2.1.1.1 |
cabhSecFwPolicyFileURLA policy rule set file download is triggered when the
value used to SET this object is different than the value
in the cabhSecFwPolicySuccessfulFileURL object.rwdeprecated SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.4491.2.4.2.1.1.2 |
cabhSecFwPolicyFileHashHash of the contents of the rules set file,
calculated and sent to the PS prior to sending
the rules set file. For the SHA-1 authentication
algorithm the length of the hash is 160 bits.
This hash value is encoded in binary format.rwdeprecated OCTET STRING .1.3.6.1.4.1.4491.2.4.2.1.1.3 |
cabhSecFwPolicyFileOperStatusinProgress(1) indicates a firewall configuration
file download is underway.
complete (2) indicates the firewall configuration
file downloaded and configured successfully.
completeFromMgt(3) This state is deprecated.
failed(4) indicates the last attempted firewall
configuration file download or processing
failed ordinarily due to TFTP timeout.rodeprecated Enumeration .1.3.6.1.4.1.4491.2.4.2.1.1.4 |
cabhSecFwPolicyFileCurrentVersionThe rule set version currently operating in the
PS device. This object should be in the syntax
used by the individual vendor to identify software
versions. Any PS element MUST return a string
descriptive of the current rule set file load.
If this is not applicable, this object MUST
contain an empty string.rodeprecated SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.4491.2.4.2.1.1.5 |
cabhSecFwPolicySuccessfulFileURLContains the location of the last successful downloaded
policy rule set file in the format pointed in the
reference. If a successful download has never occurred,
this MIB object MUST report empty string.rodeprecated SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.4491.2.4.2.1.1.6 |
cabhSecFwLogCtl OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.1.2 |
cabhSecFwEventType1EnableThis object enables or disables logging of type 1
firewall event messages. Type 1 event messages report
attempts from both private and public clients to
traverse the firewall that violate the Security
Policy.rwdeprecated Enumeration .1.3.6.1.4.1.4491.2.4.2.1.2.1 |
cabhSecFwEventType2EnableThis object enables or disables logging of
type 2 firewall event messages. Type 2 event
messages report identified Denial of Service
attack attempts.rwdeprecated Enumeration .1.3.6.1.4.1.4491.2.4.2.1.2.2 |
cabhSecFwEventType3EnableEnables or disables logging of type 3 firewall
event messages. Type 3 event messages report
changes made to the following firewall management
parameters: cabhSecFwPolicyFileURL,
cabhSecFwPolicyFileCurrentVersion,
cabhSecFwPolicyFileEnablerwdeprecated Enumeration .1.3.6.1.4.1.4491.2.4.2.1.2.3 |
cabhSecFwEventAttackAlertThresholdIf the number of type 1 or 2 hacker attacks
exceeds this threshold in the period define
by cabhSecFwEventAttackAlertPeriod, a firewall
message event MUST be logged with priority
level 4.rwdeprecated INTEGER .1.3.6.1.4.1.4491.2.4.2.1.2.4 |
cabhSecFwEventAttackAlertPeriodIndicates the period to be used (in hours) for
the cabhSecFwEventAttackAlertThreshold. This MIB
variable should always keep track of the last x
hours of events meaning that if the variable is
set to track events for 10 hours then when the
11th hour is reached, the 1st hour of events is
deleted from the tracking log. A default value
is set to zero, meaning zero time, so that this
MIB variable will not track any events unless
configured.rwdeprecated INTEGER .1.3.6.1.4.1.4491.2.4.2.1.2.5 |
cabhSecCertObjects OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.2 |
cabhSecCertPsCertThe X509 DER-encoded PS certificate.ro X509Certificate .1.3.6.1.4.1.4491.2.4.2.2.1 |
cabhSecNotification OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.3 |
cabhSecConformance OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.4 |
cabhSecCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.4.1 |
cabhSecGroups OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.4.2 |
cabhSecMibObjects OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5 |
cabhSecKerbObjects OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5.3 |
cabhSecKerbBase OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5.3.1 |
cabhSecKerbPKINITGracePeriodThe PKINIT Grace Period is needed by the PS
to know when it should start retrying to get
a new ticket. The PS MUST obtain a new Kerberos
ticket (with a PKINIT exchange)this many minutes
before the old ticket expires.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.3.1.1 |
cabhSecKerbTGSGracePeriodThe TGS Grace Period is needed by the PS to
know when it should start retrying to get a new
ticket. The PS MUST obtain a new Kerberos ticket
(with a TGS Request) this many minutes before the
old ticket expires.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.3.1.2 |
cabhSecKerbUnsolicitedKeyMaxTimeoutThis timeout applies to PS initiated AP-REQ/REP
key management exchange with NMS. The maximum
timeout is the value which may not be exceeded in
the exponential backoff algorithm.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.3.1.3 |
cabhSecKerbUnsolicitedKeyMaxRetriesThe number of retries the PS is allowed for
AP-REQ/REP key management exchange initiation
with the NMS. This is the maximum number of
retries before the PS gives up attempting to
establish an SNMPv3 security association
with NMS.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.3.1.4 |
cabhSec2FwObjects OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5.4 |
cabhSec2FwBase OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5.4.1 |
cabhSec2FwEnableThis parameter indicates whether to enable or disable the
firewall.rw Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.1.1 |
cabhSec2FwPolicyFileURLA policy rule set file download is triggered when the
value used to SET this object is different than the value
in the cabhSec2FwPolicySuccessfulFileURL object.rw SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.1.2 |
cabhSec2FwPolicyFileHashHash of the contents of the firewall
configuration file. For the SHA-1 authentication
algorithm the length of the hash is 160 bits.
This hash value is encoded in binary format.rw OCTET STRING .1.3.6.1.4.1.4491.2.4.2.5.4.1.3 |
cabhSec2FwPolicyFileOperStatusInProgress(1) indicates a firewall configuration
file download is underway. Complete(2) indicates
the firewall configuration file was downloaded
and processed successfully. Failed(3) indicates
that the last attempted firewall configuration
file download or processing failed.ro Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.1.4 |
cabhSec2FwPolicyFileCurrentVersionA label set by the cable operator that can be
used to track various versions of configured
rulesets. Once the label is set and configured
rules are changed, it may not accurately reflect
the version of configured rules running on the box.
If this object has never been configured, it MUST
contain an empty string.rw SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.1.5 |
cabhSec2FwClearPreviousRulesetIf set to 'true', the PS MUST clear all entries in the
docsDevFilterIpTable. Reading this value always returns
false.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.1.6 |
cabhSec2FwPolicySelectionThis object allows for selection of the filtering policy
as defined by the following options:
factoryDefault (1) The firewall filters against the Factory
Default Ruleset in the cabhSec2FwFactoryDefaultFilterTable.
configuredRulesetBoth (2) The firewall filters against the
Configured Ruleset defined by both the
docsDevFilterIpTable and the cabhSec2FwLocalFilterIpTable.
factoryDefaultAndConfiguredRulesetBoth (3) The firewall
filters against the CableHome specified Factory Default
Ruleset in the cabhSec2FwFactoryDefaultFilterTable and
the Configured Ruleset in the docsDevFilterIpTable and
the cabhSec2FwLocalFilterIpTable.
configuredRulesetDocsDevFilterIpTable(4) The firewall
filters against the Configured Ruleset defined by the
docsDevFilterIpTable.
configuredRulesetCabhSec2FwLocalFilterIpTable (5) The
firewall filters against the Configured Ruleset defined by
the cabhSec2FwLocalFilterIpTable.
factoryDefaultAndDocsDevFilterIpTable (6) The firewall
filters against the Factory Default Ruleset and the
Configured Ruleset defined by the DocsDevFilterIpTable.
factoryDefaultAndCabhSec2FwLocalFilterIpTable (7) The
firewall filters against the Factory Default Ruleset and
the Configured Ruleset defined by the
cabhSec2FwLocalFilterIpTable.rw Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.1.7 |
cabhSec2FwEventSetToFactoryIf set to 'true', entries in cabhSec2FwEventControlEntry
are set to their default values.
Reading this value always returns false.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.1.8 |
cabhSec2FwEventLastSetToFactoryThe value of sysUpTime when cabhSec2FwEventSetToFactory
was Last set to true. Zero if never reset.ro TimeStamp (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.1.9 |
cabhSec2FwPolicySuccessfulFileURLContains the location of the last successful downloaded
policy rule set file in the format pointed in the
reference. If a successful download has not yet
occurred, this MIB object should report empty string.ro SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.1.10 |
cabhSec2FwConfiguredRulesetPriorityThis object defines which Configured Ruleset filter rule
has priority when a conflict exists between a filter rule
in the docsDevFilterIpTable and a filter rule in the
cabhSec2FwLocalFilterIpTable as indicated by the following
options:
docsDevFilterIpTable (1) indicates that filter rules in
the docsDevFilterIpTable have priority over any
conflicting filters that may exist in the
cabhSec2FwLocalFilterIpTable.
cabhSec2FwLocalFilterIpTable (2) indicates that filter
rules in the cabhSec2FwLocalFilterIpTable have priority
over any conflicting filters that may exist in the
docsDevFilterIpTable.rw Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.1.11 |
cabhSec2FwClearLocalRulesetIf set to 'true', the PS MUST clear all entries in the
cabhSec2FwLocalFilterIpTable. Reading this value always
returns false.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.1.12 |
cabhSec2FwEvent OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5.4.2 |
cabhSec2FwEventControlTableThis table controls the reporting of the
Firewall Attacks events SEQUENCE OF CabhSec2FwEventControlEntry .1.3.6.1.4.1.4491.2.4.2.5.4.2.1 |
cabhSec2FwEventControlEntryAllows configuration of the reporting mechanisms
for a particular type of attack. CabhSec2FwEventControlEntry .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1 |
cabhSec2FwEventTypeClassification of the different types of
attacks.
Type 1 logs all attempts from both LAN and WAN
clients to traverse the Firewall that violate the
Security Policy.
Type 2 logs identified Denial of Service attack
attempts.
Type 3 logs all changes made to the
cabhSec2FwPolicyFileURL,
cabhSec2FwPolicyFileCurrentVersion or
cabhSec2FwPolicyFileEnable objects.
Type 4 logs all failed attempts to modify
cabhSec2FwPolicyFileURL and
cabhSec2FwPolicyFileEnable objects.
Type 5 logs allowed inbound packets from the WAN.
Type 6 logs allowed outbound packets from the
LAN. Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.1 |
cabhSec2FwEventEnableEnables or disables counting and logging of
firewall events by type as assigned by
cabhSec2FwEventType.rw Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.2 |
cabhSec2FwEventThresholdNumber of attacks to count before sending the
appropriate event by type as assigned by
cabhSec2FwEventType.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.3 |
cabhSec2FwEventIntervalIndicates the time interval in hours to count and log
occurrences of a firewall event type as assigned in
cabhSec2FwEventType. If this MIB has a value of zero
then there is no interval assigned and the PS will not
count or log events.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.4 |
cabhSec2FwEventCountIndicates the current count up to the
cabhSec2FwEventThreshold value by type as
assigned by cabhSec2FwEventType.ro ZeroBasedCounter32 (RMON2-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.5 |
cabhSec2FwEventLogResetSetting this object to true clears the log table
for the specified event type. Reading this object
always returns false.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.6 |
cabhSec2FwEventLogLastResetThe value of sysUpTime when cabhSec2FwEventLogReset was
last set to true. Zero if never reset.ro TimeStamp (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.7 |
cabhSec2FwLog OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5.4.3 |
cabhSec2FwLogTableContains a log of packet information as related
to events enabled by the cable operator. The types
are defined in the CableHome 1.1 specification and
require various objects to be included in the log.
The following is a description for what is
expected in the log for each type Type 1, Type 2,
Type 5 and Type 6 table MUST include
cabhSec2FwEventType, cabhSec2FwEventPriority,
cabhSec2FwEventId, cabhSec2FwLogTime,
cabhSec2FwIpProtocol, cabhSec2FwIpSourceAddr,
cabhSec2FwIpDestAddr, cabhSec2FwIpSourcePort,
cabhSec2FwIpDestPort, cabhSec2Fw,
cabhSec2FwReplayCount. The other values not used
by Types 1, 2, 5 and 6 are default values. Type 3
and Type 4 MUST include cabhSec2FwEventType,
cabhSec2FwEventPriority, cabhSec2FwEventId,
cabhSec2FwLogTime, cabhSec2FwIpSourceAddr,
cabhSec2FwLogMIBPointer. The other values not used
by type 3 and 4 are default values. When applicable,
Type 1, Type 5,and Type 6 MUST also include
cabhSec2FwLogMatchingFilterTableName,
cabhSec2FwLogMatchingFilterTableIndex,
cabhSec2FwLogMatchingFilterDescr. SEQUENCE OF CabhSec2FwLogEntry .1.3.6.1.4.1.4491.2.4.2.5.4.3.1 |
cabhSec2FwLogEntryEach entry contains the log of firewall events CabhSec2FwLogEntry .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1 |
cabhSec2FwLogIndexA sequence number for the specific events
under a cabhSec2FwEventType. Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.1 |
cabhSec2FwLogEventTypeClassification of the different types of
attacks.
Type 1 logs all attempts from both LAN and WAN
clients to traverse the Firewall that violate
the Security Policy.
Type 2 logs identified Denial of Service attack
attempts.
Type 3 logs all changes made to the
cabhSec2FwPolicyFileURL,
cabhSec2FwPolicyFileCurrentVersion or
cabhSec2FwPolicyFileEnable objects.
Type 4 logs all failed attempts to modify
cabhSec2FwPolicyFileURL and
cabhSec2FwPolicyFileEnable objects.
Type 5 logs allowed inbound packets from the WAN.
Type 6 logs allowed outbound packets from the
LAN.ro Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.2 |
cabhSec2FwLogEventPriorityThe priority level of this event as defined
by CableHome Specification. If a priority is
not assigned in the CableHome specification for
a particular event then the vendor or cable
operator may assign priorities. These are
ordered from most serious (emergency)to least
serious (debug).ro Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.3 |
cabhSec2FwLogEventIdThe assigned event ID.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.4 |
cabhSec2FwLogTimeThe time that this entry was created by the PS.ro DateAndTime (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.5 |
cabhSec2FwLogIpProtocolThe IP Protocol.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.6 |
cabhSec2FwLogIpSourceAddrThe Source IP Address of the packet logged.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.7 |
cabhSec2FwLogIpDestAddrThe Destination IP Address of the packet logged.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.8 |
cabhSec2FwLogIpSourcePortThe Source IP Port of the packet logged.ro InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.9 |
cabhSec2FwLogIpDestPortThe Source IP Port of the packet logged.ro InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.10 |
cabhSec2FwLogMessageTypeThe ICMP defined types.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.11 |
cabhSec2FwLogReplayCountThe number of identical attack packets that
were seen by the firewall based on
cabhSec2FwLogIpProtocol, cabhSec2FwLogIpSourceAddr,
cabhSec2FwLogIpDestAddr, cabhSec2FwLogIpSourcePort,
cabhSec2FwLogIpDestPort and cabhSec2FwLogMessageType.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.12 |
cabhSec2FwLogMIBPointerIdentifies if the cabhSec2FwPolicyFileURL or the
cabhSec2FwEnable MIB object changed or an attempt
was made to change it.ro VariablePointer (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.13 |
cabhSec2FwLogMatchingFilterTableNameWhen applicable, cabhSec2FwLogMatchingFilterTableName
indicates the filter table name containing the last filter
rule matched that caused the event to be generated.ro Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.14 |
cabhSec2FwLogMatchingFilterTableIndexWhen applicable, cabhSec2FwLogMatchingFilterTableIndex
indicates the filter table index if the last filter
rule matched that caused the event to be generated. If
the value is 0, the event was not caused by a filter
rule match.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.15 |
cabhSec2FwLogMatchingFilterDescrWhen applicable, cabhSec2FwLogMatchingFilterDesc
contains the description value found in the
cabhSec2FwFilterScheduleDesc MIB object or the
cabhSec2FwLocalFilterIpDesc MIB object of the last
filter rule matched that caused the event to be
generated.ro SnmpAdminString .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.16 |
cabhSec2FwFilter OBJECT IDENTIFIER .1.3.6.1.4.1.4491.2.4.2.5.4.4 |
cabhSec2FwFilterScheduleTableExtends the filtering matching parameters of
docsDevFilterIpTable defined in RFC 2669 for CableHome
Residential Gateways to include time day intervals and days
of the week. SEQUENCE OF CabhSec2FwFilterScheduleEntry .1.3.6.1.4.1.4491.2.4.2.5.4.4.1 |
cabhSec2FwFilterScheduleEntryExtended values for entries of docsDevFilterIpTable.
If the PS has not aqcuire ToD the entire
docsDevFilterIpEntry rule set is ignored.
Note: A filter time period may include two days
(e.g from 10 PM to 4 AM). A filter time period that
includes two days is identified by the absolute value
of the cabhSec2FwFilterScheduleEndTime being less than the
absolute value of the cabhSec2FwFilterScheduleStartTime.
The cabhSec2FwFilterScheduleDOW setting and the
cabhSec2FwFilterScheduleStartTime value indicate what day
and time the filter becomes active. The
cabhSec2FwFilterScheduleEndTime indicates when the filter
becomes inactive on the second day. The maximum filter
time period that includes two days is 24 hours.
If cabhSec2FwFilterScheduleStartTime is less than or
equal to the cabhSec2FwFilterScheduleEndTime the time
period of the filter falls in the same day. CabhSec2FwFilterScheduleEntry .1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1 |
cabhSec2FwFilterScheduleStartTimeThe start time for matching the filter ruleset in the
specified days indicated in cabhSec2FwFilterScheduleDOW.
Time is represented in Military Time, e.g., 8:30 AM is
represented as 830 and 11:45 PM as 2345. An attempt to set
this object to an invalid military time value, e.g., 1182,
returns 'wrongValue' error.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.1 |
cabhSec2FwFilterScheduleEndTimeThe end time for matching the filter rule for the
days indicated in cabhSec2FwFilterScheduleDOW. The filter
rule associated with this end time MUST not be disabled
until the minute following the time indicated by this
MIB object. If the time period is for two days,
identified by cabhSec2FwFilterScheduleEndTime being
less than cabhSec2FwFilterScheduleStartTime, then
the cabhSec2FwFilterScheduleDOW settings
do not apply to this MIB object.
Time is represented in the same manner as in
cabhSec2FwFilterScheduleStartTime. An attempt to set
this object to an invalid military time value, e.g., 1182,
returns 'wrongValue' error.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.2 |
cabhSec2FwFilterScheduleDOWIf the day of week bit associated with the PS given day
is '1', this object criteria matches.rw Bits .1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.3 |
cabhSec2FwFilterScheduleDescrA filter rule description configured by the
cable operator or subscriber.rw SnmpAdminString .1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.4 |
cabhSec2FwFactoryDefaultFilterTableContains the firewall factory default ruleset as
defined by the CableLabs CableHome 1.1 Specification. SEQUENCE OF CabhSec2FwFactoryDefaultFilterEntry .1.3.6.1.4.1.4491.2.4.2.5.4.4.2 |
cabhSec2FwFactoryDefaultFilterEntryContains the firewall factory default ruleset. CabhSec2FwFactoryDefaultFilterEntry .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1 |
cabhSec2FwFactoryDefaultFilterIndexIndex used to order the application of filters.
The filter with the lowest index is always applied
first. Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.1 |
cabhSec2FwFactoryDefaultFilterControlIf set to deny(1), all packets matching this filter
will be discarded. If set to allow(2), all
packets matching this filter will be accepted.
The cabhSec2FwFactoryDefaultFilterContinue object is
Set to true, and therefore the PS MUST continue to
scan the table for other matches to apply the match
with the highest cabhSec2FwFactoryDefaultFilterIndex
value.ro Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.2 |
cabhSec2FwFactoryDefaultFilterIfIndexThe index number assigned to this object MUST
match to the IfIndex numbering assigned in the
ifTable from the Interfaces Group MIB [RFC 2863],
and as specified in CH 1.1 Spec, Table 6-16
Numbering Interfaces in the ifTable. If the value
is zero, the filter applies to all interfaces.
This object MUST be specified to create a row in
this table.ro InterfaceIndexOrZero (IF-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.3 |
cabhSec2FwFactoryDefaultFilterDirectionThis value represents direction in relationship
to the assigned
cabhSec2FwFactoryDefaultFilterIfIndex
in this particular rule, meaning that the PS
MUST represent traffic direction as follows:
inbound(1)traffic, outbound(2) traffic, or
both(3)inbound and outbound traffic.ro Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.4 |
cabhSec2FwFactoryDefaultFilterSaddrThe source IP address, or portion thereof, that is
to be matched for this filter. The source address
is first masked (and'ed) against
cabhSec2FwFactoryDefaultFilterSmask
before being compared to this value. A value of 0
for this object and 0 for the mask matches all IP
addresses.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.5 |
cabhSec2FwFactoryDefaultFilterSmaskA bit mask that is to be applied to the source
address prior to matching. This mask is not
necessarily the same as a subnet mask, but 1's
bits must be leftmost and contiguous.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.6 |
cabhSec2FwFactoryDefaultFilterDaddrThe destination IP address, or portion thereof, that
is to be matched for this filter. The destination
address is first masked (and'ed) against
cabhSec2FwFactoryDefaultFilterDmask
before being compared to this value. A value of 0
for this object and 0 for the mask matches all
IP addresses.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.7 |
cabhSec2FwFactoryDefaultFilterDmaskA bit mask that is to be applied to the destination
address prior to matching. This mask is not necessarily
the same as a subnet mask, but 1's bits must be leftmost
and contiguous.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.8 |
cabhSec2FwFactoryDefaultFilterProtocolThe protocol value that is to be matched. For example:
icmp is 1, tcp is 6, udp is 17. A value of 65535 matches
ANY protocol.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.9 |
cabhSec2FwFactoryDefaultFilterSourcePortLowIf cabhSec2FwFactoryDefaultFilterProtocol is udp
or tcp, this is the inclusive lower bound of the
transport-layer source port range that is to be
matched, otherwise it is ignored during matching.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.10 |
cabhSec2FwFactoryDefaultFilterSourcePortHighIf cabhSec2FwFactoryDefaultFilterProtocol is
udp or tcp, this is the inclusive upper bound
of the transport-layer source port range that
is to be matched, otherwise it is ignored
during matching.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.11 |
cabhSec2FwFactoryDefaultFilterDestPortLowIf cabhSec2FwFactoryDefaultFilterProtocol is
udp or tcp, this is the inclusive lower bound
of the transport-layer destination port range
that is to be matched, otherwise it is ignored
during matching.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.12 |
cabhSec2FwFactoryDefaultFilterDestPortHighIf cabhSec2FwFactoryDefaultFilterProtocol is
udp or tcp, this is the inclusive upper bound
of the transport-layer destination port range
that is to be matched, otherwise it is ignored
during matching.ro Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.13 |
cabhSec2FwFactoryDefaultFilterContinueThis value is always set to true so the PS MUST continue
scanning and applying rules.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.14 |
cabhSec2FwLocalFilterIpTableContains a configured filtering Ruleset for the
PS firewall. SEQUENCE OF CabhSec2FwLocalFilterIpEntry .1.3.6.1.4.1.4491.2.4.2.5.4.4.3 |
cabhSec2FwLocalFilterIpEntryContains a configured filter rule for the PS
firewall.
If the PS has not aqcuired ToD, entries that do not have
default time settings are ignored.
Note, that a filter time period may include two days
(e.g from 10 PM to 4 AM). A filter time period that
includes two days is identified by the absolute value of
the cabhSec2FwLocalFilterIpEndTime being less then the
absolute value of the cabhSec2FwLocalFilterIpStartTime.
The cabhSec2FwLocalFilterIpDOW setting and the
cabhSec2FwLocalFilterIpStartTime value indicate what day
and time the filter becomes active. The
cabhSec2FwLocalFilterIpEndTime indicates when the filter
becomes inactive on the second day. The maximum filter time
period that includes two days is 24 hours.
If cabhSec2FwLocalFilterIpStartTime is less than or equal
to the cabhSec2FwLocalFilterIpEndTime the time period
of the filter falls in the same day. CabhSec2FwLocalFilterIpEntry .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1 |
cabhSec2FwLocalFilterIpIndexIndex used to order the application of filters.
The filter with the lowest index is always applied
first. Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.1 |
cabhSec2FwLocalFilterIpStatusControls and reflects the status of rows in this
table. Creation of the
rows may be done via either create-and-wait or
create-and-go, but the filter is not applied until this
object is set to (or changes to) active. There is no
restriction in changing any object in a row while this
object is set to active.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.2 |
cabhSec2FwLocalFilterIpControlIf set to deny(1), all packets matching this filter
will be discarded. If set to allow(2), all
packets matching this filter will be accepted.
The cabhSec2FwLocalFilterIpContinue object is
Set to true, and therefore the PS MUST continue to
scan the table for other matches to apply the match
with the highest cabhSec2FwLocalFilterIpIndex
value.rw Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.3 |
cabhSec2FwLocalFilterIpIfIndexThe index number assigned to this object MUST
match to the IfIndex numbering assigned in the
ifTable from the Interfaces Group MIB [RFC 2863],
and as specified in CH 1.1 Spec, Table 6-16
Numbering Interfaces in the ifTable.rw InterfaceIndexOrZero (IF-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.4 |
cabhSec2FwLocalFilterIpDirectionThis value represents direction in relationship
to the assigned cabhSec2FwLocalFilterIpIfIndex
in this particular rule, meaning that the PS
MUST represent traffic direction as follows:
inbound(1)traffic, outbound(2) traffic, or
both(3)inbound and outbound traffic.rw Enumeration .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.5 |
cabhSec2FwLocalFilterIpSaddrThe source IP address, or portion thereof, that is
to be matched for this filter. The source address
is first masked (and'ed) against
cabhSec2FwLocalFilterIpSmask before being compared to this
value. A value of 0 for this object and 0 for the mask
matches all IP addresses.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.6 |
cabhSec2FwLocalFilterIpSmaskA bit mask that is to be applied to the source
address prior to matching. This mask is not
necessarily the same as a subnet mask, but 1's
bits must be leftmost and contiguous.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.7 |
cabhSec2FwLocalFilterIpDaddrThe destination IP address, or portion thereof, that
is to be matched for this filter. The destination
address is first masked (and'ed) against
cabhSec2FwLocalFilterIpDmask
before being compared to this value. A value of 0
for this object and 0 for the mask matches all
IP addresses.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.8 |
cabhSec2FwLocalFilterIpDmaskA bit mask that is to be applied to the destination
address prior to matching. This mask is not necessarily
the same as a subnet mask, but 1's bits must be leftmost
and contiguous.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.9 |
cabhSec2FwLocalFilterIpProtocolThe protocol value that is to be matched. For example:
icmp is 1, tcp is 6, udp is 17. A value of 65535 matches
ANY protocol.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.10 |
cabhSec2FwLocalFilterIpSourcePortLowIf cabhSec2FwLocalFilterIpProtocol is udp
or tcp, this is the inclusive lower bound of the
transport-layer source port range that is to be
matched, otherwise it is ignored during matching.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.11 |
cabhSec2FwLocalFilterIpSourcePortHighIf cabhSec2FwLocalFilterIpProtocol is
udp or tcp, this is the inclusive upper bound
of the transport-layer source port range that
is to be matched, otherwise it is ignored
during matching.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.12 |
cabhSec2FwLocalFilterIpDestPortLowIf cabhSec2FwLocalFilterIpProtocol is
udp or tcp, this is the inclusive lower bound
of the transport-layer destination port range
that is to be matched, otherwise it is ignored
during matching.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.13 |
cabhSec2FwLocalFilterIpDestPortHighIf cabhSec2FwLocalFilterIpProtocol is
udp or tcp, this is the inclusive upper bound
of the transport-layer destination port range
that is to be matched, otherwise it is ignored
during matching.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.14 |
cabhSec2FwLocalFilterIpMatchesCounts the number of times this filter was matched.
This object is initialized to 0 at boot, or at row
creation, and is reset only upon reboot.ro Counter32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.15 |
cabhSec2FwLocalFilterIpContinueThis value is always set to true so the PS MUST continue
scanning and applying rules.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.16 |
cabhSec2FwLocalFilterIpStartTimeThe start time for matching the filter ruleset in the
specified days indicated in cabhSec2FwLocalFilterIpDOW.
Time is represented in Military Time, e.g., 8:30 AM is
represented as 830 and 11:45 PM as 2345. An attempt to set
this object to an invalid military time value, e.g., 1182,
returns 'wrongValue' error.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.17 |
cabhSec2FwLocalFilterIpEndTimeThe end time for matching the filter ruleset for the
days indicated in cabhSec2FwLocalFilterIpDOW. The filter
rule associated with this end time MUST not be disabled
until the minute following the time indicated by this
MIB object. If the time period is for two days, identified
by cabhSec2FwLocalFilterIpEndTime being less than
cabhSec2FwLocalFilterIpStartTime, then the
cabhSec2FwLocalFilterIpDOW settings do not apply to this
MIB object. Time is represented in the same manner as in
cabhSec2FwLocalFilterIpStartTime. An attempt to set
this object to an invalid military time value, e.g., 1182,
returns 'wrongValue' error.rw Unsigned32 .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.18 |
cabhSec2FwLocalFilterIpDOWIf the day of week bit associated with the PS given day
is '1', this object criteria matches.rw Bits .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.19 |
cabhSec2FwLocalFilterIpDescrA filter rule description configured by the
cable operator or subscriber.rw SnmpAdminString .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.20 |