CTRON-SSR-POLICY-MIB
AI MIB Summary
The CTRON-SSR-POLICY-MIB enables management of Layer 2 and Layer 3 Access Control List (ACL) filters and the configuration of static IP routes utilizing extended IP header field matching on Ctron SSR devices.
This module defines a schema to control filters on a device capable of Layer 3 filters also called Access Control Lists (ACLs) and at layer 2. It may also be used to configure static IP routes that use other IP header fields in addition to destination IP address.
Main OID:
policyMIB.1.3.6.1.4.1.52.2501.1.210
99
Objects
Active
Status
5
Dependencies
Imported Objects
Objects
99 total| Object Name |
|---|
polL3Group OBJECT IDENTIFIER .1.3.6.1.4.1.52.2501.1.12 |
polAclServerThis is true when Access Control Lists (ACLs) are defined by a
Policy Server else false.
At boot, this value is false. After the first valid set of any
policy object, the value changes to true.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.12.1 |
polAclNumberThe number of Layer 3 Access Control Lists defined in the SSR.ro INTEGER .1.3.6.1.4.1.52.2501.1.12.2 |
polAclLastChangedThe time the Access Control List were last changed.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.12.3 |
polAclTableA list of Access Control List entries. SEQUENCE OF PolAclEntry .1.3.6.1.4.1.52.2501.1.12.4 |
polAclEntryA record containing a Access Control List. PolAclEntry .1.3.6.1.4.1.52.2501.1.12.4.1 |
polAclNameThe administratively assigned name to this static route entry.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.12.4.1.1 |
polAclItemThis row's unique identifier within a given ACL set. Member of the ACL set
are numbered from 1 to 256. If Item is set to 0, and rowStatus is destroy,
all rows for this set are destroyed.ro INTEGER .1.3.6.1.4.1.52.2501.1.12.4.1.2 |
polAclRestrictionThe permissions/restrictions given to this static route entry.rw Enumeration .1.3.6.1.4.1.52.2501.1.12.4.1.3 |
polAclProtocolThe IETF protocol this ACL applies to.rw SSRProtocol .1.3.6.1.4.1.52.2501.1.12.4.1.4 |
polAclSrcIpThe source L3 IP Address this ACL applies to.rw IpAddress .1.3.6.1.4.1.52.2501.1.12.4.1.5 |
polAclSrcMaskThe source L3 IP Mask this ACL Applies to.rw IpAddress .1.3.6.1.4.1.52.2501.1.12.4.1.6 |
polAclDstIpThe source L3 IP Address this ACL applies to.rw IpAddress .1.3.6.1.4.1.52.2501.1.12.4.1.7 |
polAclDstMaskThe source L3 IP Mask this ACL Applies to.rw IpAddress .1.3.6.1.4.1.52.2501.1.12.4.1.8 |
polAclTOSThe source L3 IP Type of Service field.rw INTEGER .1.3.6.1.4.1.52.2501.1.12.4.1.9 |
polAclSrcPortThe source L3 IP source port/socket ACL applies to.rw SSRsocketId .1.3.6.1.4.1.52.2501.1.12.4.1.10 |
polAclDstPortThe source L3 IP destination port/socket ACL applies to.rw SSRsocketId .1.3.6.1.4.1.52.2501.1.12.4.1.11 |
polAclSrcOperatorpolAclSrcPort is compared using this operator.rw SSRPortComparator .1.3.6.1.4.1.52.2501.1.12.4.1.12 |
polAclDstOperatorpolAclDstPort is compared using this operator.rw SSRPortComparator .1.3.6.1.4.1.52.2501.1.12.4.1.13 |
polAclSrcHighRangeThe high range source L3 IP port. Used
only when SrcOperator == range. polAclSrcPort is
used as the lower bounds of the range.rw INTEGER (-1..65535) .1.3.6.1.4.1.52.2501.1.12.4.1.14 |
polAclDstHighRangeThe high range destination L3 IP port. Used
only when SrcOperator == range. polAclDstPort is
used as the lower bounds of the range.rw INTEGER (-1..65535) .1.3.6.1.4.1.52.2501.1.12.4.1.15 |
polAclAuditTrailFlows matching this ACL are logged for Accounting when true.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.12.4.1.16 |
polAclCheckpointHow long to keep flow at which point a checkpoint should be done.
A checkpoint may trigger earlier than this time should the maximum
batch size be reached.rw Enumeration .1.3.6.1.4.1.52.2501.1.12.4.1.17 |
polAclRowStatusSNMP V2 RowStatus control for this table.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.12.4.1.18 |
polAclServiceNumberThe number of Layer 3 Access Control Lists in service in the SSR.ro INTEGER .1.3.6.1.4.1.52.2501.1.12.5 |
polAclServiceLastChangedThe time the ACLs in service were last changed.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.12.6 |
polAclServiceTableA list of ACL's currently in service. SEQUENCE OF PolAclServiceEntry .1.3.6.1.4.1.52.2501.1.12.7 |
polAclServiceEntryA record containing a Access Control Lists applied to Interfaces. PolAclServiceEntry .1.3.6.1.4.1.52.2501.1.12.7.1 |
polAclServiceIfIndexThe ifIndex of the IP Interface the ACL is applied to.
An SSR IP Interface has ifType 142ro InterfaceIndex .1.3.6.1.4.1.52.2501.1.12.7.1.1 |
polAclName2The name of the ACL applied to the particular port.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.12.7.1.2 |
polAclServiceDirectionThe direction the ACL is applied to the particular port.rw Enumeration .1.3.6.1.4.1.52.2501.1.12.7.1.3 |
polAclServiceRowStatusSNMP V2 RowStatus control for this table.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.12.7.1.6 |
polAclRemoteAllowedRemote Policy Configuration is allowed when true only
local (to SSR) policy may be applied.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.12.9 |
polAclInterfaceNumberThe number of Layer 3 Interfaces in service in the SSR.ro INTEGER .1.3.6.1.4.1.52.2501.1.12.10 |
polAclInterfaceLastChangedThe time the Interfaces in service were last changed with regard to policy.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.12.11 |
polAclInterfaceTableA list of IP Interfaces in service and their policy status. Each IP Interface can be
defined to use local static policy or remote dynamic policy in the config. SEQUENCE OF PolAclInterfaceEntry .1.3.6.1.4.1.52.2501.1.12.12 |
polAclInterfaceEntryA record containing a Access Control Lists applied to Interfaces. PolAclInterfaceEntry .1.3.6.1.4.1.52.2501.1.12.12.1 |
polAclInterfaceIfIndexThe ifIndex of the IP Interface the ACL is applied to.ro InterfaceIndex .1.3.6.1.4.1.52.2501.1.12.12.1.1 |
polAclInterfaceDirectionThe direction the ACL is applied to the particular port.ro Enumeration .1.3.6.1.4.1.52.2501.1.12.12.1.2 |
polAclPolicyStatusRules for what type of management can apply ACLs to a particular interface. If set to remote,
then a Policy Manager via SNMP may change dynamically the ACLs applied to an interface. Note,
ACLs applied dynamically are not maintained across system reboot. Use local ACLs to setup the basic
rules then apply dynamic rules as necessary.ro Enumeration .1.3.6.1.4.1.52.2501.1.12.12.1.3 |
polL4Group OBJECT IDENTIFIER .1.3.6.1.4.1.52.2501.1.15 |
polL4PolicyBasedRoutingEnabledThe state of Policy Based Routing on this network element.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.15.1 |
polL4NumRoutersThe number of next hop routers currently available.ro INTEGER .1.3.6.1.4.1.52.2501.1.15.5 |
polL4NextHopTableLastChangeThe value of sysUpTime when a row was last added
or deleted from polL4NextHopTable.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.15.10 |
polL4NextHopTableA list of next hop IP routers. SEQUENCE OF PolL4NextHopEntry .1.3.6.1.4.1.52.2501.1.15.20 |
polL4NextHopEntryAn entry contains the status of a next hop router. PolL4NextHopEntry .1.3.6.1.4.1.52.2501.1.15.20.1 |
polL4NextHopRouterThe IP Address of the next hop router flow will be sent to.ro IpAddress .1.3.6.1.4.1.52.2501.1.15.20.1.1 |
polL4NextHopStateThe current status of the polL4NextHopRouter.
If no entry found when a policy route is activated,
then arp for the request the state will be waitingForArp(2).
If a reply is found the state will go to macAcquired(3)
else noArpReply(4). If NextHop is not local, mac is actual
nexthop router.ro Enumeration .1.3.6.1.4.1.52.2501.1.15.20.1.2 |
polL4NextHopPortOfExitIfIndex of port we learned this router on or else zero if not known.ro InterfaceIndexOrZero .1.3.6.1.4.1.52.2501.1.15.20.1.3 |
polL4NextHopMacAddressMAC Address of next hop router learned from ARP.ro MacAddress (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.15.20.1.4 |
polL4NextHopLastChangeThe value of sysUpTime when this polL4NextHopState changed.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.15.20.1.5 |
polL4lowControlTableLastChangeThe value of sysUpTime when a row was last added or deleted from polL4lowControlTable.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.15.25 |
polL4NumPoliciesThe number of policies currently available.ro INTEGER .1.3.6.1.4.1.52.2501.1.15.26 |
polL4lowControlTableContains Control rows that indicate which flows have been redirected. As flows
are aged out and recreated, these rules will enforce flow redirection policy. SEQUENCE OF PolL4lowControlEntry .1.3.6.1.4.1.52.2501.1.15.30 |
polL4lowControlEntryThis table is an ordered collection of route policies. For SSR, this maps
to the command: ip-policy Name [permit|deny] acl acl-list PolL4lowControlEntry .1.3.6.1.4.1.52.2501.1.15.30.1 |
polL4PolicyNameA unique name for this flow policy. DisplayString (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.15.30.1.1 |
polL4PolicySequenceThe evaluation order of this object. When two objects have the same value,
the value of the instance value decides which is evaluated first.
than higher numbers. Integer32 .1.3.6.1.4.1.52.2501.1.15.30.1.2 |
polL4PolicyInstanceThe sequence of this policy based route. Lower numbers have higher precedence
than higher numbers. Integer32 .1.3.6.1.4.1.52.2501.1.15.30.1.3 |
polL4PolicyTypeControls if packets are forwarded or not for this policy.rw SSRFlowPolicyType .1.3.6.1.4.1.52.2501.1.15.30.1.4 |
polL4PolicyActionDefine when this policy should be used during normal packet forwarding process.rw SSRFlowPolicyAction .1.3.6.1.4.1.52.2501.1.15.30.1.5 |
polL4PolicyMatchUp to twenty (20) separate ACLs may be defined to match for this policy.
This object is mandatory. Use active row from polAclTable.rw SSRFlowPolicyAclList .1.3.6.1.4.1.52.2501.1.15.30.1.6 |
polL4PolicyNextHopsUp to for IpAddresses may be specified to route data to next. Load balancing
If more than one next hop ip address is specified, the default load balancing
scheme is round robin. This object is mandatory. Use objects from polL4NextHopTable.rw SSRFlowNextHopList .1.3.6.1.4.1.52.2501.1.15.30.1.7 |
polL4PolicyLoadingWhen more than one next hop is defined and available, set loading policy here.rw SSRFlowLoadPolicy .1.3.6.1.4.1.52.2501.1.15.30.1.8 |
polL4PolicyWatchWhen True, use icmp echo to actively maintain status of next hop. This
is useful to prevent data sinks with static routes.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.15.30.1.9 |
polL4lowCreationTimeThe value of sysUpTime when policy went was created then activated.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.15.30.1.10 |
polL4lowActiveGatesThe number of currently active nexthop gateways.ro Gauge32 .1.3.6.1.4.1.52.2501.1.15.30.1.11 |
polL4lowAppliedTimesThe number of times this policy was used.ro Counter32 .1.3.6.1.4.1.52.2501.1.15.30.1.12 |
polL4lowControlStatusEntries in active state cause a flow to remain programmed with the next hop router specified.
If the next hop router goes down, the rowStatus will become inactive. New flows that match this
specification will assume this next hop router over any other route directive.
This assumes polL4PolicyBasedRouteState value is true.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.15.30.1.13 |
polL4GroupStats OBJECT IDENTIFIER .1.3.6.1.4.1.52.2501.1.15.35 |
polL4lowLostRoutersThe count of times routers were disabled from NextHopTable due to lost contact.ro Counter32 .1.3.6.1.4.1.52.2501.1.15.35.1 |
polL4lowControlTableActivatesThe count of successful activations of flow control policies made.ro Counter32 .1.3.6.1.4.1.52.2501.1.15.35.2 |
polL4lowControlTableActivateFailsThe count of unsuccessful flow control policies made.ro Counter32 .1.3.6.1.4.1.52.2501.1.15.35.3 |
polL4lowArpMappingChangesThe count of mac to next hop IP address mapping changes
affecting policy based route tables.ro Counter32 .1.3.6.1.4.1.52.2501.1.15.35.4 |
polL4lowIcmpRedirectsThe count of next hop route redirects received that
match a policy in the polL4lowControlTable.
This can help to determine if bad route policies are in effect.ro Counter32 .1.3.6.1.4.1.52.2501.1.15.35.16 |
polL4lowMatchAttemptsThe count of total number of policy based flow lookups
made against policy based route table.ro Counter32 .1.3.6.1.4.1.52.2501.1.15.35.17 |
polL2Group OBJECT IDENTIFIER .1.3.6.1.4.1.52.2501.1.16 |
polL2FilterNumberThe number of Layer 3 Access Control Lists defined in the SSR.ro INTEGER .1.3.6.1.4.1.52.2501.1.16.1 |
polL2FilterLastChangedThe time the Access Control List were last changed.ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.16.2 |
polL2FilterTableA list of Layer 2 filters. SEQUENCE OF PolL2FilterEntry .1.3.6.1.4.1.52.2501.1.16.3 |
polL2FilterEntryAn entry containing a layer 2 filter. PolL2FilterEntry .1.3.6.1.4.1.52.2501.1.16.3.1 |
polL2FilterIndexA unique index into the table representing a single filter entry. This value
will remain unique and the relationship between the index and the underlying filter
is valid until the next reboot. INTEGER .1.3.6.1.4.1.52.2501.1.16.3.1.1 |
polL2FilterDescA string used to describe the filter. It should contain
the creator IP address, and other descriptive information about the filter.
It is recommended that names be unique within a given filter type.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1).rw DisplayString .1.3.6.1.4.1.52.2501.1.16.3.1.2 |
polL2FilterTypeThe types of filters, as explained below.
static-entry
Based on the restrictions and the presence of
source, destination MAC address they can be of
three types :
source-static-entry - All frames with a source
address equal to srcMAC, coming through any of
the inPorts will be allowed/disallowed to go
to any port that is a member of the outPorts
list.
destination-static-entry - All frames with a
destination address equal to dstMAC, coming
through any of the inPorts will be allowed/
disallowed/forced to go to any port that is a
member of the outPorts list.
flow-static-entry - All frames with a source
address equal to srcMAC and a destination address
equal to dstMAC, coming through any of the inPorts
list will be allowed/disallowed to go to any port
that is a member of the outPorts list. Ports
must be in flow-bridging mode in order to use
filters with both src and dst mac specified.
address-filter
Based on the restrictions and the presence of
source, destination MAC address they can be of
three types :
source-address-filter - All frames with a source
address equal to srcMAC, coming through any of
the inPorts will be filtered out.
destination-address-filter - All frames with a
destination address equal to dstMAC, coming through
any of the inPorts will be filtered out.
flow-filter - All frames with a source address equal
to srcMAC and a destination address equal to dstMAC,
coming through any of the inPorts list will be
filtered out. Ports must be in flow mode in order
to set a filter using both source and destination
address.
port-address-lock
This locks a source address to a port. It allows
learning of srcMAC addresses only on any of the ports
in inPorts. The following objects are mandatory
and must be set by mgmt station to activate a row:
polL2FilterDesc, polL2FilterSrcMacAddr, polL2FilterInPorts
secure-port
This blocks all traffic in a given direction to a port.
Used with static entries, it is effective in allowing only
certain well defined source/destination mac addresses.
The following objects must be set by mgmt station to
activate an entry:
polL2FilterDesc, r, polL2FilterInPorts
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1).rw Enumeration .1.3.6.1.4.1.52.2501.1.16.3.1.3 |
polL2FilterRestrictionsThe first 3 restrictions, allow, disallow, force apply when the filterType
is static-entry. When polL2FilterType is addressFilter or portAddressLock,
this object does not apply. For securePort, the blockIngress, blockEgress
values apply.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1).rw Enumeration .1.3.6.1.4.1.52.2501.1.16.3.1.4 |
polL2FilterSrcMacAddrThe source MAC address, which is present in case
of a Flow, that has been learned by the switch.rw MacAddress (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.16.3.1.5 |
polL2FilterDstMacAddrThe destination MAC address which has been learned.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1).rw MacAddress (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.16.3.1.6 |
polL2FilterVlanIdThe VLAN the destination MAC address belongs to. The default VLAN
is id 1 on SSR.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1).rw SSRVlanIndex .1.3.6.1.4.1.52.2501.1.16.3.1.7 |
polL2FilterInPortsThe set of Ports to which this filter applies on input.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1).rw SSRPortList .1.3.6.1.4.1.52.2501.1.16.3.1.8 |
polL2FilterOutPortsThe set of ports to which this filter applies on output.
This object may not be modified if the associated.
polL2FilterStatus object is equal to active(1).rw SSRPortList .1.3.6.1.4.1.52.2501.1.16.3.1.9 |
polL2FilterCreationTimeThe value of sysUpTime when this filter was made active(1).ro TimeTicks (SNMPv2-SMI) .1.3.6.1.4.1.52.2501.1.16.3.1.10 |
polL2FilterStatusSMIv2 RowStatus control for this table. Use createAndWait or createAndGo
to create a filter, use destroy to remove an entry or notInService to
disengage a filter without destroying it. A row in the notReady state has
not had all the mandatory objects set.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.16.3.1.11 |
polL2Dot1qVlanStaticTableA table containing hardware specific VLAN behavior configuration
information for VLANs created with the dot1qVlanStaticTable.
Configuration information for each VLAN configured into the device by (local or
network) management. SEQUENCE OF PolL2Dot1qVlanStaticEntry .1.3.6.1.4.1.52.2501.1.16.4 |
polL2Dot1qVlanStaticEntryAn entry containing additional hardware
specific objects for a dot1qVlanStaticEntry. PolL2Dot1qVlanStaticEntry .1.3.6.1.4.1.52.2501.1.16.4.1 |
polL2Dot1qVlanStaticProtocolsSpecifies the types of traffic that will be forwarded on this VLAN.
Protocols not set in this definition will be filtered. The types of protocols
supported on this VLAN corresponds to the type option in the CLI command
vlan create <vlan name> <type>. If no protocols are specified, all
protocols are forwarded. This corresponds to the port-based CLI
option.
reserved(0) - this bit is reserved and has no defined behavior.
bridged-protocols(1) - this VLAN supports all bridged protocols
excluding IP and IPX. Includes appletalk(4), dec(5), sna(6), and
ipv6(7) if none of these protocols are set. If any are set, only
those that are set are included.
ip(2) - this VLAN supports IP protocol.
ipx(3) - this VLAN supports IPX protocol.
appletalk(4) - this VLAN supports Appletalk protocol.
dec(5) - this VLAN supports DEC protocol.
sna(6) - this VLAN supports SNA protocol.
ipv6(7) - this VLAN supports IPv6 protocol.rw Bits .1.3.6.1.4.1.52.2501.1.16.4.1.1 |
polL2Dot1qVlanStaticL4BridgingIf this object has a value of false(2), the L4 Bridging feature is not
enabled on this VLAN. If this object has a value of true(1), the L4 Bridging
feature is enabled for this VLAN. This corresponds to the CLI command
vlan enable l4-bridging.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.52.2501.1.16.4.1.2 |
policyMIBThis module defines a schema to control filters on a device capable
of Layer 3 filters also called Access Control Lists (ACLs) and at
layer 2. It may also be used to configure static IP routes that use
other IP header fields in addition to destination IP address. MODULE-IDENTITY .1.3.6.1.4.1.52.2501.1.210 |
polConformance OBJECT IDENTIFIER .1.3.6.1.4.1.52.2501.1.210.2 |
polCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.52.2501.1.210.2.1 |
polGroups OBJECT IDENTIFIER .1.3.6.1.4.1.52.2501.1.210.2.2 |