CISCO-ACL-MIB
AI MIB Summary
The CISCO-ACL-MIB enables remote configuration and monitoring of Cisco IPv4 and IPv6 Access Control Lists (ACLs) and their associated Access Control Groups (ACGs) applied to interfaces. It tracks specific packet filtering metrics, including Access Control Entry (ACE) match counts aggregated via counter labels, to quantify traffic permitted or denied by defined filter rules.
This MIB module defines objects that describe Cisco Access Control Lists (ACL).
This MIB describes different objects that enable the network administrator to remotely configure ACLs, apply them to interfaces and monitor their usage statistics.
A typical application of this MIB module will facilitate monitoring of ACL match (sometimes referred as hit) counts. However, by no means does the definition of this MIB module prevent other applications from using it.
An ACL is an ordered list of statements that deny or permit packets based on matching fields contained within the packet header (layer 3 source and destination addresses, layer 4 protocol, layer 4 source and destination port numbers, etc.) In addition there is an implicit *Deny All* at the end of the ACL. ACLs are used to perform packet filtering to control which packets are allowed through the network. Such control can help limit network traffic, and restrict the access of applications and devices on the network. Each one of these statements is referred to as an Access List Control Entry (ACE). Here is an example of an ACL configuration. ipv4 access-list V4Example 10 permit tcp any any ! ipv6 access-list V6Example 10 permit tcp any any !
The mechanism for monitoring ACL usage is by configuring, in the desired ACEs a counter label. A counter label is a name that is given to a counter and is defined in any ACE. ACEs that share the same Counter label name will have their counters aggregated into the same label. Here is an example of how to use counter labels. ipv4 access-list V4CounterExample 10 permit tcp any any counter CountPermits 20 permit udp any any counter CountPermits
The same applies to IPv6 ACLs.
This MIB consists of following tables:
* caAclCfgTable
Defines the ACLs configured in the device.
* caAclIPV4ACECfgTable
Defines the ACEs that make up an IPV4 ACL.
* caAclIPV6ACECfgTable
Defines the ACEs that make up an IPV6 ACL.
* caAclAccessGroupCfgTable
Defines the Access Control Groups (ACG) applied to interfaces on the device.
* caAclLabelIntfStatsTable
Defines the statistics for a specific ACE with counter labels attached to interfaces on the device.
Main OID:
ciscoACLMIB.1.3.6.1.4.1.9.9.808
82
Objects
Active
Status
8
Dependencies
Imported Objects
Objects
82 total| Object Name |
|---|
ciscoACLMIBThis MIB module defines objects that describe Cisco Access
Control Lists (ACL).
This MIB describes different objects that enable the
network administrator to remotely configure ACLs, apply them
to interfaces and monitor their usage statistics.
A typical application of this MIB module will facilitate
monitoring of ACL match (sometimes referred as hit) counts.
However, by no means does the definition of this MIB module
prevent other applications from using it.
An ACL is an ordered list of statements that deny or permit
packets based on matching fields contained within the packet
header (layer 3 source and destination addresses, layer 4
protocol, layer 4 source and destination port numbers, etc.) In
addition there is an implicit *Deny All* at the end of the ACL.
ACLs are used to perform packet filtering to control
which packets are allowed through the network. Such control
can help limit network traffic, and restrict the access of
applications and devices on the network. Each one of these
statements is referred to as an Access List Control Entry
(ACE).
Here is an example of an ACL configuration.
ipv4 access-list V4Example
10 permit tcp any any
!
ipv6 access-list V6Example
10 permit tcp any any
!
The mechanism for monitoring ACL usage is by configuring, in
the desired ACEs a counter label. A counter label is a name
that is given to a counter and is defined in any ACE. ACEs
that share the same Counter label name will have their counters
aggregated into the same label.
Here is an example of how to use counter labels.
ipv4 access-list V4CounterExample
10 permit tcp any any counter CountPermits
20 permit udp any any counter CountPermits
The same applies to IPv6 ACLs.
This MIB consists of following tables:
* caAclCfgTable
Defines the ACLs configured in the device.
* caAclIPV4ACECfgTable
Defines the ACEs that make up an IPV4 ACL.
* caAclIPV6ACECfgTable
Defines the ACEs that make up an IPV6 ACL.
* caAclAccessGroupCfgTable
Defines the Access Control Groups (ACG) applied to
interfaces on the device.
* caAclLabelIntfStatsTable
Defines the statistics for a specific ACE with counter
labels attached to interfaces on the device. MODULE-IDENTITY .1.3.6.1.4.1.9.9.808 |
caAclMIBObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.808.1 |
caAclConfiguration OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.808.1.1 |
caAclCfgTableA table of ACL definitions. Each entry in this table defines
a unique IPV4 or IPV6 ACL. SEQUENCE OF CaAclCfgTableEntry .1.3.6.1.4.1.9.9.808.1.1.1 |
caAclCfgTableEntryA conceptual row in the caAclTable. Each entry of this table
consists of acl index and the address type. This is so that
the table may contain both IPV4 and IPV6 ACLs. CaAclCfgTableEntry .1.3.6.1.4.1.9.9.808.1.1.1.1 |
caAclIndexAn arbitrary (system assigned) index for each ACL name. The
index is unique for each ACL name in the device, but is further
qualified by the address family.
For example, consider the following configuration:
ipv4 access-list ACL1
10 permit ipv4 any any
!
ipv6 access-list ACL1
10 permit ipv6 any any
In this case the caAclIndex value for both ACLs will be the
same. CaAclACLIndex .1.3.6.1.4.1.9.9.808.1.1.1.1.1 |
caAclAddressTypeThis object defines the address family of the ACL. InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.1.1.2 |
caAclNameA string that identifies the ACL name.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.1.1.3 |
caAclRowStatusThis object is used to create, modify, or delete an entry
in the caAclTable.
A row can be created using the 'CreateAndGo' option. When the
row is successfully created, the RowStatus will be set to
active by the agent. Once a row becomes active, values in
any other column within the row cannot be modified.
A row may be deleted by setting the RowStatus for 'destroy'.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.9.9.808.1.1.1.1.4 |
caAclIPV4ACECfgTableA table of IPV4 ACE definitions. The ACE definition controls
whether packets are accepted or rejected. The access control
may be applied before sending the packet to the forwarding
engine, or may be applied after the packet is processed by the
forwarding engine.
If two ACE entries with the same sequence number are configured
the latter will overwrite the former. SEQUENCE OF CaAclIPV4ACECfgTableEntry .1.3.6.1.4.1.9.9.808.1.1.2 |
caAclIPV4ACECfgTableEntryA conceptual row in the caAclIPV4ACLTable. Each entry of this
table consists of a set of match criteria for a given ACL. CaAclIPV4ACECfgTableEntry .1.3.6.1.4.1.9.9.808.1.1.2.1 |
caAclIPV4ACESequenceNumberThis object uniquely identifies an ACE within an ACL. Sequence
numbers are assigned to each permit/deny statement, causing the
system to insert the statement in that numbered position within
the ACL. If two ACE entries with the same sequence number are
configured, the latter one will overwrite the former. CaAclSequenceNumber .1.3.6.1.4.1.9.9.808.1.1.2.1.1 |
caAclIPV4ACEActionThis object indicates the type of action to be taken if the
packet matches the given criteria.
If it is set to permit(1), all packets matching this ACE will
be allowed for further processing.
If it is set to deny(2), all packets matching this ACE will
be discarded.rw CaAclAction .1.3.6.1.4.1.9.9.808.1.1.2.1.2 |
caAclIPV4ACEProtocolThis object identifies the layer 3 protocol type to be
filtered by the ACE. Protocol numbers are defined in the
Network Working Group Request For Comment documents.rw CiscoIpProtocol (CISCO-TC) .1.3.6.1.4.1.9.9.808.1.1.2.1.3 |
caAclIPV4ACESourceAddressThis object determines the address of the network or host from
which the packet is being sent. If this object value is 0.0.0.0
and the value of caAclIPV4ACESourceWildCardMask object in the
same entry is 255.255.255.255, this entry matches any source
address.
If this object value is not 0.0.0.0 and the value of
caAclIPV4ACESourceWildCardMask is 0.0.0.0, this entry matches
specific host address defined in this object.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.4 |
caAclIPV4ACESourceWildCardMaskThis object determines the mask of wild card address bits
for caAclIPV4ACESourceAddress. Wild card masking is to indicate
to the system whether to check or ignore the corresponding
IP address bits when comparing the address bits in an ACL
to a packet being submitted to the ACL. The default wild card
mask is 0.0.0.0. The wild card mask is the inverse of a
regular subnet mask. If the mask value 0.0.0.255 is applied to
1.2.3.0.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.5 |
caAclIPV4ACESourceNetworkGroupThis object defines the Source Network Object Group from
which the packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.2.1.6 |
caAclIPV4ACESourcePortOperatorThis object defines the operation to be performed to the layer
source port field. Source port fields are present only for
IGMP, ICMP, SCTP, TCP, and UDP protocols.
If caAclIPV4ACEProtocol is none of the ones listed above, this
field should set to noOperator(1), which means not comparison
is to be performed.
If this field is set to range(5) then two port numbers are
necessary. I.e., Both caAclIPV4ACESourcePort and
caAclIPV4ACESourcePortUpper need to be provided.rw CaAclPortOperator .1.3.6.1.4.1.9.9.808.1.1.2.1.7 |
caAclIPV4ACESourcePortThis object defines the source port number of the layer 4
protocol. This is the field to be matched with the specified
source port based on the caAclIPV4ACESourcePortOperator. If
caAclIPV4ACESourcePortOperator is range(5) then this object
will have the inclusive lower bound of the source port range
that is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.8 |
caAclIPV4ACESourcePortUpperThis object defines the inclusive upper bound of the layer 4
source port range that is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.9 |
caAclIPV4ACESourcePortGroupThis object defines the Source Port Object Group from which
the packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.2.1.10 |
caAclIPV4ACEDestinationAddressThis object determines the address of the network or host to
which the packet is being sent. If this object value is 0.0.0.0
and the value of caAclIPV4ACLDestinationWildCardMask object in
the same entry is 255.255.255.255, this entry matches any
source IP address.
If this object value is not 0.0.0.0 and the value of
caAclIPV4ACLDestinationWildCardMask is 0.0.0.0, this entry
matches the specific host address defined in this object.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.11 |
caAclIPV4ACEDestinationWildCardMaskThis object determines the mask of wild card address bits
for caAclIPV4ACLDestinationAddress. Wild card masking is to
indicate to the system whether to check or ignore the
corresponding IP address bits when comparing the address
bits in an ACE to a packet being submitted to the ACE. The
default wild card mask is 0.0.0.0. The wild card mask is the
inverse of a regular subnet mask. If the mask value 0.0.0.255
is applied to the address 1.2.3.4, it will match all traffic
from subnet 1.2.3.0.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.12 |
caAclIPV4ACEDestinationNetworkGroupThis object defines the Destination Network Object Group to
which the packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.2.1.13 |
caAclIPV4ACEDestinationPortOperatorThis object defines the operation to be performed to the layer
destination port field. Source port fields are present only for
IGMP, ICMP, SCTP, TCP, and UDP protocols.
If caAclIPV4ACLProtocol is none of the ones listed above, this
field should set to noOperator(1), which means not comparison
is to be performed.
If this field is set to range(5) then two port numbers are
necessary. I.e., Both caAclIPV4ACEDestinationPort and
caAclIPV4ACEDestinationPortUpper need to be provided.rw CaAclPortOperator .1.3.6.1.4.1.9.9.808.1.1.2.1.14 |
caAclIPV4ACEDestinationPortThis object defines the destination port number of the layer
4 protocol. This is the field to be matched with the specified
destination port based on the caAclIPV4ACLSourceOperator. If
caAclIPV4ACLDestinationOperator is range(5) then this object
will have the inclusive lower bound of the destination port
range that is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.15 |
caAclIPV4ACEDestinationPortUpperThis object defines the inclusive upper bound of the layer 4
destination port range that is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.2.1.16 |
caAclIPV4ACEDestinationPortGroupThis object defines the Source Port Object Group to which the
packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.2.1.17 |
caAclIPV4ACEDscpValueThis object defines the dscp value that will be considered
in the match criteria against the value in the packet.rw Unsigned32 .1.3.6.1.4.1.9.9.808.1.1.2.1.18 |
caAclIPV4ACETcpFlagsValueThis object defines the value of the TCP flags which will
be considered in the match criteria based on
caAclIPV4ACLTcpFlagsMatchType.
Users can select any desired combination of the TCP flags
on which to filter TCP packets.rw Unsigned32 .1.3.6.1.4.1.9.9.808.1.1.2.1.19 |
caAclIPV4ACETcpFlagsMaskThis object defines the mask value of the TCP flags field.rw Unsigned32 .1.3.6.1.4.1.9.9.808.1.1.2.1.20 |
caAclIPV4ACETcpFlagsMatchTypeThis object defines the type of matching to be done on the
TCP flags field.rw CaAclTcpFlagsMatch .1.3.6.1.4.1.9.9.808.1.1.2.1.21 |
caAclIPV4ACETosValueThis object defines the value of the TOS field to be filtered.
Packets can be filtered by the TOS level as specified by a
number from 0 to 15. Use the value 16 to indicate that the
TOS field should be ignored during matching.rw Unsigned32 .1.3.6.1.4.1.9.9.808.1.1.2.1.22 |
caAclIPV4ACEPrecedenceValueThis object indicates the value of the precedence field to be
filtered.rw CaAclPrecedenceValue .1.3.6.1.4.1.9.9.808.1.1.2.1.23 |
caAclIPV4ACELogOptionThis object defines the value of the log option field to be
applied to packets that match this ACE entry.rw CaAclLogOption .1.3.6.1.4.1.9.9.808.1.1.2.1.24 |
caAclIPV4ACECounterLabelThis object defines the counter label name for this ACE.
ACEs that share the same counter label name will have their
hit counts aggregated into the same counter label name.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.2.1.25 |
caAclIPV4ACERemarkThis object defines a comment in the ACL. It helps the user
to define some meaningful comment to identify the ACE
quickly, or to know the purpose of a set of ACEs.
This field is not used during packet matching.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.2.1.26 |
caAclIPV4ACERowStatusThis object is used to create, modify, or delete an entry
in the caAclIPV4ACLTable.
A row can be created using the 'CreateAndGo' option. When the
row is successfully created, the RowStatus will be set to
active by the agent.
A row may be deleted by setting the RowStatus for 'destroy'.
The minimum objects required to delete a row in this table
is simply the sequence number (caAclIPV4ACESequenceNumber).rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.9.9.808.1.1.2.1.27 |
caAclIPV6ACECfgTableA table of IPV6 ACE definitions. The ACE definition controls
whether packets are accepted or rejected. The access control
may be applied before sending the packet to the forwarding
engine, or may be applied after the packet is processed by the
forwarding engine. SEQUENCE OF CaAclIPV6ACECfgTableEntry .1.3.6.1.4.1.9.9.808.1.1.3 |
caAclIPV6ACECfgTableEntryA conceptual row in the caAclIPV6ACLTable. Each entry of this
table consists of a set of match criteria for a given ACL. CaAclIPV6ACECfgTableEntry .1.3.6.1.4.1.9.9.808.1.1.3.1 |
caAclIPV6ACESequenceNumberThis object uniquely identifies an ACE within an ACL. Sequence
numbers are assigned to each permit/deny statement, causing the
system to insert the statement in that numbered position within
the ACL. CaAclSequenceNumber .1.3.6.1.4.1.9.9.808.1.1.3.1.1 |
caAclIPV6ACEActionThis object indicates the type of action to be taken if the
packet matches the given criteria.
If it is set to permit(1), all packets matching this ACE will
be allowed for further processing.
If it is set to deny(2), all packets matching this ACE will
be discarded.rw CaAclAction .1.3.6.1.4.1.9.9.808.1.1.3.1.2 |
caAclIPV6ACEProtocolThis object identifies the protocol type to be filtered by
the ACE. Protocol numbers are defined in the Network Working
Group Request For Comment (RFC) documents.rw CiscoIpProtocol (CISCO-TC) .1.3.6.1.4.1.9.9.808.1.1.3.1.3 |
caAclIPV6ACESourceAddressThis object determines the address of the network or host from
which the packet is being sent. If this object value is 0::0
and the value of caAclIPV6ACLSourcePrefixLength is 0 then this
matches any source address.
If this object value is not 0::0 and the value of
caAclIPV6ACLSourcePrefixLength is less than 128, this entry
matches the all the addresses that are in the sub-net.
If this object value is 0::0 and the value of
caAclIPV6ACLSourcePrefixLength is also 0, this entry matches
all hosts.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.3.1.4 |
caAclIPV6ACESourcePrefixLengthThis object determines the number of bits in the field
caAclIPV6ACLSourceAddress to be checked.
If the value of this object is 0, then the source address
in the packet must match caAclIPV6ACESourceAddress exactly
for the ACE action to be taken.rw Integer32 .1.3.6.1.4.1.9.9.808.1.1.3.1.5 |
caAclIPV6ACESourceNetworkGroupThis object defines the Source Network Object Group from
which the packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.3.1.6 |
caAclIPV6ACESourcePortOperatorThis object defines the operation to be performed to the layer
source port field. Source port fields are present only for
IGMP, ICMP, SCTP, TCP, and UDP protocols.
If caAclIPV6ACLProtocol is none of the ones listed above, this
field should set to noOperator(1), which means not comparison
is to be performed.
If this field is set to range(5) then two port numbers are
necessary. I.e., Both caAclIPV6ACLSourcePort and
caAclIPV6ACLSourcePortUpper need to be provided.rw CaAclPortOperator .1.3.6.1.4.1.9.9.808.1.1.3.1.7 |
caAclIPV6ACESourcePortThis object defines the source port number of the layer 4
protocol. This is the field to be matched with the specified
source port based on the caAclIPV6ACLSourceOperator. If
caAclIPV6ACLSourceOperator is range(5) then this object wail
have the inclusive lower bound of the source port range that
is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.3.1.8 |
caAclIPV6ACESourcePortUpperThis object defines the inclusive upper bound of the layer 4
source port range that is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.3.1.9 |
caAclIPV6ACESourcePortGroupThis object defines the Source Port Object Group from which
the packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.3.1.10 |
caAclIPV6ACEDestinationAddressThis object determines the address of the network or host to
which the packet is being sent. If this object value is 0::0
and the value of caAclIPV6ACLSourcePrefixLength is 0 then this
matches any source address.
If this object value is not 0::0 and the value of
caAclIPV6ACLSourcePrefixLength is less than 128, this entry
matches the all the addresses that are in the sub-net.
If this object value is 0::0 and the value of
caAclIPV6ACLSourcePrefixLength is also 0, this entry matches
all osts.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.3.1.11 |
caAclIPV6ACEDestinationPrefixLengthThis object determines the number of bits in the field
caAclIPV6ACLDestinationAddress to be checked.
If the value of this object is 0, then the source address
in the packet must match caAclIPV6ACEDestinationAddress exactly
for the ACE action to be taken.rw Integer32 .1.3.6.1.4.1.9.9.808.1.1.3.1.12 |
caAclIPV6ACEDestinationNetworkGroupThis object defines the Source Network Object Group to which
the packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.3.1.13 |
caAclIPV6ACEDestinationPortOperatorThis object defines the operation to be performed to the layer
destination port field. Source port fields are present only for
IGMP, ICMP, SCTP, TCP, and UDP protocols.
If caAclIPV6ACLProtocol is none of the ones listed above, this
field should set to noOperator(1), which means no comparison
is to be performed.
If this field is set to range(5) then two port numbers are
necessary. I.e., Both caAclIPV6ACLDestinationPort and
caAclIPV6ACLDestinationPortUpper need to be provided.rw CaAclPortOperator .1.3.6.1.4.1.9.9.808.1.1.3.1.14 |
caAclIPV6ACEDestinationPortThis object defines the destination port number of the layer
4 protocol. This is the field to be matched with the specified
destination port based on the caAclIPV6ACLSourceOperator. If
caAclIPV6ACLDestinationOperator is range(5) then this object
will have the inclusive lower bound of the destination port
range that is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.3.1.15 |
caAclIPV6ACEDestinationPortUpperThis object defines the inclusive upper bound of the layer 4
destination port range that is to be matched.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.3.1.16 |
caAclIPV6ACEDestinationPortGroupThis object defines the Source Port Object Group to which the
packet is being sent.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.3.1.17 |
caAclIPV6ACETrafficClassValueThis object defines the traffic class value that will be
considered in the match criteria against the value in the
packet.rw Unsigned32 .1.3.6.1.4.1.9.9.808.1.1.3.1.18 |
caAclIPV6ACETcpFlagsValueThis object defines the value of the TCP flags which will
be considered in the match criteria based on
caAclIPV6ACLTcpFlagsMatchType.
Users can select any desired combination of the TCP flags
on which to filter TCP packets.rw Unsigned32 .1.3.6.1.4.1.9.9.808.1.1.3.1.19 |
caAclIPV6ACETcpFlagsMaskThis object defines the mask value of the TCP flags field.rw Unsigned32 .1.3.6.1.4.1.9.9.808.1.1.3.1.20 |
caAclIPV6ACETcpFlagsMatchTypeThis object defines the type of matching to be done on the
TCP flags field.rw CaAclTcpFlagsMatch .1.3.6.1.4.1.9.9.808.1.1.3.1.21 |
caAclIPV6ACELogOptionThis object defines the value of the log option field to be
applied to packets that match this ACE entry.rw CaAclLogOption .1.3.6.1.4.1.9.9.808.1.1.3.1.22 |
caAclIPV6ACECounterLabelThis object defines the counter label name for this ACE.
ACEs that share the same counter label name will have their
hit counts aggregated into the same counter label name.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.3.1.23 |
caAclIPV6ACERemarkThis object defines a comment in the ACL. It helps the user
to define some meaningful comment to identify the ACE
quickly, or to know the purpose of a set of ACEs.
This field is not used during packet matching.rw SnmpAdminString .1.3.6.1.4.1.9.9.808.1.1.3.1.24 |
caAclIPV6ACERowStatusThis object is used to create, modify, or delete an entry
in the caAclIPV6ACLTable.
A row can be created using the 'CreateAndGo' option. When the
row is successfully created, the RowStatus will be set to
active by the agent.
A row may be deleted by setting the RowStatus for 'destroy'.
The minimum objects required to delete a row in this table
is simply the sequence number (caAclIPV6ACESequenceNumber).rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.9.9.808.1.1.3.1.25 |
caAclAccessGroupCfgTableThis table lists the ACLs configured on the device and
applied on an interface in the ingress or egress direction. SEQUENCE OF CaAclAccessGroupCfgEntry .1.3.6.1.4.1.9.9.808.1.1.4 |
caAclAccessGroupCfgEntryThis entry describes an ACL configured on the device and
applied to an interface. CaAclAccessGroupCfgEntry .1.3.6.1.4.1.9.9.808.1.1.4.1 |
caAclAccessGroupACLThe name of the ACL associated with this entry.rw CaAclACLIndex .1.3.6.1.4.1.9.9.808.1.1.4.1.1 |
caAclAccessGroupCfgAddressTypeThis entry describes the address family of the access group
being applied on the interface. InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.808.1.1.4.1.2 |
caAclAccessGroupDirectionThis object defines the direction in which the ACL is
applied. CaAclTrafficDirection .1.3.6.1.4.1.9.9.808.1.1.4.1.3 |
caAclAccessGroupSequenceNumberThis object uniquely identifies the order that Access Group
applied to a interface. It can be used by platforms that
support applying more than one Access List per address
family per direction.
For example:
interface GigabitEthernet 0/0
ipv4 access-group ACL1 ACL2 ACL2 ingress
! CaAclSequenceNumber .1.3.6.1.4.1.9.9.808.1.1.4.1.4 |
caAclAccessGroupRowStatusThis object is used to create, modify, or delete an entry in
the caAclAccessGroupCfgTable.
A row can be created using the 'CreateAndGo' option. When the
row is successfully created, the RowStatus will be set to
active by the agent. Once a row becomes active, values in
any other column within the row cannot be modified.
A row may be deleted by setting the RowStatus for 'destroy'.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.9.9.808.1.1.4.1.5 |
caAclStats OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.808.1.2 |
caAclLabelIntfStatsTableThis table describes the statistics for all ACEs with assigned
counter labels, attached to interfaces on the device.
An entry in this table is created when an ACL containing an ACE
that references the specified counter label name is applied to
an interface.
An entry in this table is deleted when an ACL containing an ACE
that references the specified counter lable name is removed
from an interface. SEQUENCE OF CaAclLabelIntfStatsEntry .1.3.6.1.4.1.9.9.808.1.2.1 |
caAclLabelIntfStatsEntryEach entry in this table provides the aggregated counters for
all ACEs applied on the given interface/direction that have
been assigned the same counter label. CaAclLabelIntfStatsEntry .1.3.6.1.4.1.9.9.808.1.2.1.1 |
caAclIntfStatsCounterLabelNameThe counter label index associated with this set of
statistics. SnmpAdminString .1.3.6.1.4.1.9.9.808.1.2.1.1.1 |
caAclIntfStatsPacketsThe total number of packets that match this counter label.ro Counter64 UNITS "packets" .1.3.6.1.4.1.9.9.808.1.2.1.1.2 |
caAclIntfStatsOctetsThe total number of octets that match this counter label.ro Counter64 UNITS "bytes" .1.3.6.1.4.1.9.9.808.1.2.1.1.3 |
caAclMIBConformance OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.808.2 |
caAclMIBACEConform OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.808.2.1 |
caAclMIBACECompliances OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.808.2.1.1 |
caAclMIBCfgGroups OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.808.2.1.2 |