CISCO-DYNAMIC-ARP-INSPECTION-MIB
AI MIB Summary
The CISCO-DYNAMIC-ARP-INSPECTION-MIB manages Cisco IOS security policies for Dynamic ARP Inspection on access ports, enabling the configuration and monitoring of ARP packet validation rules, trusted port states, and associated violation counters to prevent ARP spoofing attacks.
The MIB module is for configuration of Dynamic ARP Inspection feature. Dynamic ARP Inspection is a security mechanism which validate ARP packets seen on access ports.
Main OID:
ciscoDynamicArpInspectionMIB.1.3.6.1.4.1.9.9.374
63
Objects
Active
Status
9
Dependencies
Imported Objects
Objects
63 total| Object Name |
|---|
ciscoDynamicArpInspectionMIBThe MIB module is for configuration of Dynamic ARP Inspection
feature. Dynamic ARP Inspection is a security mechanism which
validate ARP packets seen on access ports. MODULE-IDENTITY .1.3.6.1.4.1.9.9.374 |
cdaiMIBNotifs OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.0 |
cdaiMIBObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.1 |
cdaiGlobal OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.1.1 |
cdaiLoggingEnableThis object indicates whether the Dynamic ARP Inspection
logging is enabled on the device.
If this object is set to 'true', Dynamic ARP Inspection
logging is enabled.
If this object is set to 'false', Dynamic ARP Inspection
logging is disabled.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.1.1 |
cdaiAddressValidateThis object specifies address validation criteria
used by Dynamic ARP Inspection feature.
'srcMacAddress' indicates that source MAC address in
ethernet header is checked against the sender MAC address
in ARP packet. When this bit is on, packets with different
MAC addresses are classified as invalid packets and are
dropped. This checking is done for both ARP request and
ARP response packet.
'dstMacAddress' indicates that the destination MAC address
in ethernet header is checked against the target MAC address
in ARP packet. When this bit is on, packets with different
addresses are classified as invalid packets and are dropped.
This checking is done for ARP response packet only.
'ip' indicates that the IP addresses in ARP packet are checked
for invalid or unexpected IP addresses. Addresses such as
0.0.0.0, 255.255.255.255 and all IP multicast addresses are
considered invalid. When this bit is on, both the sender
and target IP addresses in the ARP packet are checked. This
checking is done for both ARP request and response packet.
'ipAllowZeros' works the same as 'ip' but address 0.0.0.0
is allowed.
'ip' and 'ipAllowZeros' are mutually exclusive.rw Bits .1.3.6.1.4.1.9.9.374.1.1.2 |
cdaiLogBufferSizeThis object specifies the size of the logging buffer.rw Unsigned32 UNITS "entries" .1.3.6.1.4.1.9.9.374.1.1.3 |
cdaiLoggingRateThis object specifies the maximum number of logging entries
will be logged during the time period denoted by
cdaiLoggingInterval object for system message generation purpose.
Zero value indicates that entry is placed in the log buffer,
but a system message is not generated.rw Unsigned32 UNITS "entries" .1.3.6.1.4.1.9.9.374.1.1.4 |
cdaiLoggingIntervalThis object specifies the logging interval for system
message generation purpose. Zero value indicates that
system message is immediately generated (and the log
buffer is always empty). Value of this object and value
of cdaiLoggingRate object cannot be zero at the same time.rw Unsigned32 UNITS "seconds" .1.3.6.1.4.1.9.9.374.1.1.5 |
cdaiLogBufferActionThis objects specifies the action can be taken with
respect to logging buffer.
'none' indicates that no operation is performed. This
object always return value 'none' when read.
'clear' indicates that all entries in cdaiLoggingBufferTable
will be cleared.rw Enumeration .1.3.6.1.4.1.9.9.374.1.1.6 |
cdaiLogBufferTableA table provides the information of logged ARP flows
for system message generation. SEQUENCE OF CdaiLogBufferEntry .1.3.6.1.4.1.9.9.374.1.1.7 |
cdaiLogBufferEntryA row instance contains logged ARP flow data for system
message generation. Entries in the log are cleared once
system messages are generated on their behalf. A special
entry will be populated for accounting drops of all flows
that result in exceeding the number of entries of the log
buffer. Special entry only contains packets counter and
timestamps information. The rest of its fields are
irrelevant. CdaiLogBufferEntry .1.3.6.1.4.1.9.9.374.1.1.7.1 |
cdaiLogBufferIndexThis object uniquely identifies a logged ARP flow in the buffer. Unsigned32 .1.3.6.1.4.1.9.9.374.1.1.7.1.1 |
cdaiLogBufferInterfaceThis object indicates the interface which sent the logged
ARP flow. Zero value indicates the special entry.ro InterfaceIndexOrZero (IF-MIB) .1.3.6.1.4.1.9.9.374.1.1.7.1.2 |
cdaiLogBufferVlanThis object indicates the VLAN number which the logged
ARP flow belongs to. Zero value indicates the special entry.ro VlanIndexOrZero .1.3.6.1.4.1.9.9.374.1.1.7.1.3 |
cdaiLogBufferSenderMacAddressThis object indicates the sender MAC address of the logged
ARP flow. All zeros MAC address value indicates the
special entry.ro MacAddress (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.1.7.1.4 |
cdaiLogBufferSenderAddressTypeThis object indicates the sender Internet address type
of the logged ARP flow.ro InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.374.1.1.7.1.5 |
cdaiLogBufferSenderIpAddressThis object indicates the sender Internet address
of the logged ARP flow. The type of this address is
determined by the value of cdaiLogBufferSenderAddressType
object. All zeros IP address value indicates the
special entry.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.374.1.1.7.1.6 |
cdaiLogBufferReasonThis object indicates the reason for logging this ARP flow.
'unknown' indicates unknown reason.
'deny' indicates that this ARP flow is logged because it is
denied by Dynamic ARP Inspection feature.
'aclDeny' indicates that this ARP flow is logged because it is
denied by a configured ARP ACL.
'aclPermit' indicates that this ARP flow is logged because it
is permitted by a configured ARP ACL.
'dhcpDeny' indicates that this ARP flow is logged because it
is denied when comparing with DHCP bindings information.
'dhcpPermit' indicates that this ARP flow is logged because
it is permitted when comparing with DHCP binding information.
'probePermit' indicates that this ARP flow is logged because
it is a permitted ARP-Probe flow.ro Enumeration .1.3.6.1.4.1.9.9.374.1.1.7.1.7 |
cdaiLogBufferLastUpdateThis object indicates the timestamp when the last packet
of this flow was accounted by the system.ro DateAndTime (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.1.7.1.8 |
cdaiLogBufferPacketsCountThis object indicates the number of packets of this ARP flow
was accounted by the system.ro Gauge32 .1.3.6.1.4.1.9.9.374.1.1.7.1.9 |
cdaiVlan OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.1.2 |
cdaiVlanConfigTableA table provides the mechanism to control Dynamic ARP
Inspection per VLAN. When a VLAN is created in a device
supporting this table, a corresponding entry of this table
will be added. SEQUENCE OF CdaiVlanConfigEntry .1.3.6.1.4.1.9.9.374.1.2.1 |
cdaiVlanConfigEntryA row instance contains the configuration to enable
or disable Dynamic ARP Inspection at each existing VLAN. CdaiVlanConfigEntry .1.3.6.1.4.1.9.9.374.1.2.1.1 |
cdaiVlanIndexThis object indicates the VLAN number on which Dynamic ARP
Inspection feature is configured. VlanIndex (Q-BRIDGE-MIB) .1.3.6.1.4.1.9.9.374.1.2.1.1.1 |
cdaiVlanDynArpInspEnableThis object indicates whether Dynamic ARP Inspection is
enabled in this VLAN.
If this object is set to 'true', Dynamic ARP Inspection
is enabled.
If this object is set to 'false', Dynamic ARP Inspection
is disabled.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.2.1.1.2 |
cdaiVlanCfgTableA table provides the mechanism to control Dynamic ARP
Inspection per VLAN. This table is populated for each
existing VLAN in the device as well as non-existing VLANs
which contains the Dynamic ARP Inspection configuration. SEQUENCE OF CdaiVlanCfgEntry .1.3.6.1.4.1.9.9.374.1.2.2 |
cdaiVlanCfgEntryA row instance contains the Dynamic ARP inspection
configuration for a specific VLAN in the device. CdaiVlanCfgEntry .1.3.6.1.4.1.9.9.374.1.2.2.1 |
cdaiVlanIdThis object indicates the VLAN number. VlanIndex (Q-BRIDGE-MIB) .1.3.6.1.4.1.9.9.374.1.2.2.1.1 |
cdaiVlanDynArpInspAdminThis object specifies the administrative status of Dynamic
ARP Inspection feature in this VLAN.
If this object value is 'enable', Dynamic ARP Inspection
is enabled.
If this object value is 'disable', Dynamic ARP Inspection
is disabled.rw Enumeration .1.3.6.1.4.1.9.9.374.1.2.2.1.2 |
cdaiVlanDynArpInspOperThis object indicates the operational status of Dynamic ARP
Inspection feature in this VLAN.
If this object is 'active', Dynamic ARP Inspection
is operationally active.
If this object is 'inactive', Dynamic ARP Inspection
is operationally inactive.ro Enumeration .1.3.6.1.4.1.9.9.374.1.2.2.1.3 |
cdaiVlanFilterArpAclNameThis object specifies an ARP ACL name that Dynamic ARP
Inspection feature uses to check the validity of the bindings
information in ARP body.
An emptry string indicates that no such ARP ACL is
configured for this purpose.rw SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.374.1.2.2.1.4 |
cdaiVlanFilterArpAclStaticThis object specifies whether the ARP ACL denoted by
cdaiVlanFilterArpAclName is statically applied by
Dynamic ARP Inspection feature. This object does not
take effect if value of cdaiVlanFilterArpAclName on
the row is an empty string.
'true' indicates that ARP ACL is applied statically.
The action (denied or permitted) results from applying
the ARP ACL is final and ARP packet is not compared against
DHCP bindings information.
'false' indicates ARP ACL is not applied statically. If
ARP packet is not explicitly classified by ARP ACL, it
will be compared against DHCP bindings information.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.2.2.1.5 |
cdaiVlanAclLoggingThis object specifies the logging configuration that
Dynamic ARP Inspection feature applies to ARP packets
when they are classified by the configured ACL.
'none' indicates that no logging is performed when
packets are classified by the configured ACL.
'aclMatch' indicates that logging is performed when
packets are classified by the configured ACL and the
matched ACE specified a logging action.
'deny' indicates that logging is performed when packets
is denied by the configured ACL.rw Enumeration .1.3.6.1.4.1.9.9.374.1.2.2.1.6 |
cdaiVlanDhcpBindingLoggingThis object specifies packet logging configuration
performed by Dynamic ARP Inspection feature when
ARP packets is compared against DHCP bindings information.
'none' indicates that no packet logging is performed.
'permit' indicates that packet logging is performed only
for packets that are permitted as a result of comparing
with DHCP bindings information.
'deny' indicates that packet logging is performed only
for packets that are denied as a result of comparing with
DHCP bindings information.
'all' indicates that packet logging is performed for all
packets that are permitted or denied as a result of comparing
with DHCP bindings information.rw Enumeration .1.3.6.1.4.1.9.9.374.1.2.2.1.7 |
cdaiVlanArpProbeLoggingThe objects specifies if ARP-Probe packets will be
logged by Dynamic ARP Inspection feature.
'true' indicates ARP-Probe packets will be logged.
'false' indicates ARP-Probe packets will not be logged.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.2.2.1.8 |
cdaiVlanCfgStorageTypeThe objects specifies the storage type for this conceptual
row.rw StorageType (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.2.2.1.9 |
cdaiVlanCfgRowStatusThe status of this conceptual row entry. This object
is used to manage creation and deletion of rows in this
table.
Deletion of an entry in this table is only allowed
if the VLAN indicated by its row index object does not
exist in the device. Writable objects can be modified at
any time even while the row is active.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.2.2.1.10 |
cdaiInterface OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.1.3 |
cdaiIfConfigTableA table provides the mechanism to configure the trust
state for Dynamic ARP Inspection purpose at each physical
interface capable of this feature. Some of the interfaces
(but not limited to) for which this feature might be
applicable are: ifType = ethernetCsmacd(6). SEQUENCE OF CdaiIfConfigEntry .1.3.6.1.4.1.9.9.374.1.3.1 |
cdaiIfConfigEntryA row instance contains the configuration to enable or
disable trust state for Dynamic ARP Inspection at each
physical interface capable of this feature. CdaiIfConfigEntry .1.3.6.1.4.1.9.9.374.1.3.1.1 |
cdaiIfTrustEnableThis object indicates whether the interface is trusted for
Dynamic ARP Inspection purpose.
If this object is set to 'true', the interface is trusted.
ARP packets coming to this interface will be forwarded
without checking.
If this object is set to 'false', the interface is not
trusted. ARP packets coming to this interface will be
subjected to ARP inspection.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.374.1.3.1.1.1 |
cdaiIfRateLimitTableA table provides the mechanism to configure the rate limit
for Dynamic ARP Inspection purpose at each physical interface
capable of this feature. SEQUENCE OF CdaiIfRateLimitEntry .1.3.6.1.4.1.9.9.374.1.3.2 |
cdaiIfRateLimitEntryA row instance contains the configuration of rate limit
Dynamic ARP Inspection at each physical interface capable
of this feature. CdaiIfRateLimitEntry .1.3.6.1.4.1.9.9.374.1.3.2.1 |
cdaiIfRateLimitThis object indicates rate limit value for Dynamic ARP
Inspection purpose. If the incoming rate of ARP packets
exceeds the value of this object, ARP packets will be
dropped.rw Unsigned32 UNITS "packet per second" .1.3.6.1.4.1.9.9.374.1.3.2.1.1 |
cdaiStatistics OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.1.4 |
cdaiVlanStatsTableA table lists the Dynamic Arp Inspection statistics per VLAN. SEQUENCE OF CdaiVlanStatsEntry .1.3.6.1.4.1.9.9.374.1.4.1 |
cdaiVlanStatsEntryA row instance contains Dynamic ARP Inspection statistics
information for each VLAN. CdaiVlanStatsEntry .1.3.6.1.4.1.9.9.374.1.4.1.1 |
cdaiVlanStatsIndexThis object indicates the VLAN number. VlanIndex (Q-BRIDGE-MIB) .1.3.6.1.4.1.9.9.374.1.4.1.1.1 |
cdaiVlanForwardedThis object indicates the number of ARP packets forwarded by
Dynamic Arp Inspection feature.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.2 |
cdaiVlanDroppedThis object indicates the number of ARP packets dropped by
Dynamic ARP Inspection feature.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.3 |
cdaiVlanAclPermittedThis object indicates the number of ARP packets permitted by
the configured ACL.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.4 |
cdaiVlanDhcpBindingsPermittedThis object indicates the number of DHCP-binding permitted
ARP packets.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.5 |
cdaiVlanAclDeniedThis object indicates the number of ARP packets denied by the
configured ACL.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.6 |
cdaiVlanDhcpBindingDeniedThis object indicates the number of DHCP-binding denied
ARP packets.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.7 |
cdaiVlanSrcMacValidationFailuresThis object indicates the number of ARP packets that fail
source MAC address validation.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.8 |
cdaiVlanDestMacValidationFailuresThis object indicates the number of ARP packets that fail
destination MAC address validation.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.9 |
cdaiVlanIpValidationFailuresThis object indicates the number of ARP packets that fail
IP validation.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.10 |
cdaiVlanArpProbePermittedThis object indicates the number of ARP Probe packets that
are permitted.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.11 |
cdaiVlanInvalidProtocolDataThis object indicates the number of ARP packets that contain
invalid protocol data.ro Counter32 UNITS "packets" .1.3.6.1.4.1.9.9.374.1.4.1.1.12 |
cdaiMIBConformance OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.2 |
cdaiMIBCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.2.1 |
cdaiMIBGroups OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.374.2.2 |