FOUNDRY-SN-IP-ACL-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE,IpAddress,Counter64, Unsigned32,Integer32 FROM SNMPv2-SMI DisplayString, MacAddress, TruthValue, RowStatus, TEXTUAL-CONVENTION FROM SNMPv2-TC router FROM FOUNDRY-SN-ROOT-MIB InterfaceIndex, ifIndex FROM IF-MIB RtrStatus FROM FOUNDRY-SN-IP-MIB PortQosTC, FdryVlanIdOrNoneTC FROM FOUNDRY-SN-SWITCH-GROUP-MIB; snAgAcl MODULE-IDENTITY LAST-UPDATED "201103020000Z" -- 03 March 2011 ORGANIZATION "Brocade Communications Systems, Inc." CONTACT-INFO "Technical Support Center 130 Holger Way, San Jose, CA 95134 Email: ipsupport@brocade.com Phone: 1-800-752-8061 URL: www.brocade.com" DESCRIPTION "Copyright 1996-2010 Brocade Communications Systems, Inc. All rights reserved. This Brocade Communications Systems SNMP Management Information Base Specification embodies Brocade Communications Systems' confidential and proprietary intellectual property. Brocade Communications Systems retains all title and ownership in the Specification, including any revisions. This Specification is supplied AS IS, and Brocade Communications Systems makes no warranty, either express or implied, as to the use, operation, condition, or performance of the specification, and any unintended consequence it may on the user environment." REVISION "201103020000Z" -- 02 March 2011 DESCRIPTION "Updated range of AclNumber from (1..499) to (1..599)." REVISION "201006020000Z" -- 04 June 2010 DESCRIPTION "Changed the ORGANIZATION, CONTACT-INFO and DESCRIPTION fields." REVISION "200909300000Z" -- September 30, 2009 DESCRIPTION "" ::= {router 2 15} -- Textual Conventions SnRowStatus ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The status of a given row in the table." SYNTAX INTEGER {other(1), valid(2), delete(3), create(4)} Action ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The action to be taken on the packet after filtering is done." SYNTAX INTEGER { deny(0), permit(1) } TruthVal ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "Boolean value." SYNTAX INTEGER { false (0), true (1) } FdryClauseIndexTC ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "One-based clause index value within a given ACL number." SYNTAX Unsigned32 AclNumber ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The Access control list number for an entry. The standard Access list is in the range <1..99>. The extended Access list is in the range <100-199>. The named standard Access list is in the range <200..299>. The named extended Access list is in the range <300-399>. The L2 Access list is in the range <400-599>." SYNTAX INTEGER (1..599) AclNameString ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The optional name for a given access-list. In general, the ACL number for a named ACL is in the range of 200 and 399." SYNTAX OCTET STRING (SIZE (0..255)) Operator ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The operation used within a given ACL filter to determine permit or deny." SYNTAX INTEGER { eq(0), neq(1), lt(2), gt(3), range(4), undefined(7) } IpProtocol ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The IP protocol number on which ACL can be applied." SYNTAX Integer32 (0..255) PrecedenceValue ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The IP precedence value on which ACL can be applied." SYNTAX INTEGER { routine(0), priority(1), immediate(2), flash(3), flashoverride(4), critical(5), internet(6), network(7), undefined(8) } TosValue ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The IP TOS value on which ACL can be applied." SYNTAX INTEGER { normal(0), minMonetaryCost(1), maxReliability(2), tosValue3(3), maxThroughput(4), tosValue5(5), tosValue6(6), tosValue7(7), minDelay(8), tosValue9(9), tosValue10(10), tosValue11(11), tosValue12(12), tosValue13(13), tosValue14(14), tosValue15(15), undefined(16) } Direction ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "The packet flow direction within an interface for which ACL needs to be applied." SYNTAX INTEGER { inbound(0), outbound(1) } FdryEnetTypeOrZeroTC ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "Ethernet Type field within the Ethernet-II frame" SYNTAX INTEGER { invalid(0), ipv4(1), arp(2), ipv6(3) } snAgAclGlobal OBJECT IDENTIFIER ::= { snAgAcl 1 } snAgAclGblCurRowIndex OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "The current row index of the ACL table entry." ::= { snAgAclGlobal 1 } -- -- ACL Table -- snAgAclTable OBJECT-TYPE SYNTAX SEQUENCE OF SnAgAclEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of Access Control List" ::= { snAgAcl 2 } snAgAclEntry OBJECT-TYPE SYNTAX SnAgAclEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the IP access control list table." INDEX { snAgAclIndex } ::= { snAgAclTable 1 } SnAgAclEntry ::= SEQUENCE { snAgAclIndex Integer32, snAgAclNumber AclNumber, snAgAclName DisplayString, snAgAclAction Action, snAgAclProtocol IpProtocol, snAgAclSourceIp IpAddress, snAgAclSourceMask IpAddress, snAgAclSourceOperator Operator, snAgAclSourceOperand1 INTEGER, snAgAclSourceOperand2 INTEGER, snAgAclDestinationIp IpAddress, snAgAclDestinationMask IpAddress, snAgAclDestinationOperator Operator, snAgAclDestinationOperand1 INTEGER, snAgAclDestinationOperand2 INTEGER, snAgAclPrecedence PrecedenceValue, snAgAclTos TosValue, snAgAclEstablished RtrStatus, snAgAclLogOption TruthVal, snAgAclStandardFlag TruthVal, snAgAclRowStatus SnRowStatus, snAgAclFlowCounter Counter64, snAgAclPacketCounter Counter64, snAgAclComments DisplayString, snAgAclIpPriority INTEGER, snAgAclPriorityForce INTEGER, snAgAclPriorityMapping INTEGER, snAgAclDscpMarking INTEGER, snAgAclDscpMapping INTEGER, snAgAclIcmpCode INTEGER, snAgAclParameters BITS } snAgAclIndex OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "The Access control list item number for an entry. This is a unique number that identifies different Access list entries combined with the Access list name and Access list number. This one has to be unique even though the name and number are not unique for a given Access list with same or different source address, subnet mask, destination address and destination mask, protocol type, action (permit/deny) type and the operator (neq, eq, gt and, lt) which makes the index a unique tuple (name, number, itemnumber)." ::= { snAgAclEntry 1 } snAgAclNumber OBJECT-TYPE SYNTAX AclNumber MAX-ACCESS read-write STATUS current DESCRIPTION "The access-list number for this entry." ::= { snAgAclEntry 2 } snAgAclName OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-write STATUS current DESCRIPTION "ACL name for an entry." ::= { snAgAclEntry 3 } snAgAclAction OBJECT-TYPE SYNTAX Action MAX-ACCESS read-write STATUS current DESCRIPTION "Action to take if the ip packet matches with this access control list." ::= { snAgAclEntry 4 } snAgAclProtocol OBJECT-TYPE SYNTAX IpProtocol MAX-ACCESS read-write STATUS current DESCRIPTION "Transport protocol. Valid values for the IP protocol are: 0 = any IP protocol 1 = ICMP 2 = IGMP 3 = ggp 4 = ipencap 5 = st2 6 = TCP 7 = cbt 8 = egp 9 = igp 10 = bbn_rcc 11 = nvp 12 = pup 13 = argus 14 = emcon 15 = xnet 16 = chaos 17 = UDP 18 = mux 19 = dcn 20 = hmp 21 = prm 22 = xns_idp 23 = trunk1 24 = trunk2 25 = leaf1 26 = leaf2 27 = rdp 28 = irtp 29 = iso_tp4 30 = netblt 31 = mfe_nsp 32 = merit_inp 33 = sep 34 = threepc 35 = idpr 36 = xtp 37 = ddp 38 = idpr_cmtp 39 = tppp 40 = il 41 = ipv6 42 = sdrp 43 = ipv6_route 44 = ipv6_frag 45 = idrp 46 = rsvp 47 = gre 48 = mhrp 49 = bna 50 = esp 51 = ahp 52 = inlsp 53 = swipe 54 = narp 55 = mobile 56 = tlsp 57 = skip 58 = ipv6_icmp 59 = ipv6_nonxt 60 = ipv6_opts 62 = cftp 64 = sat_expak 65 = kryptolan 66 = rvd 67 = ippc 69 = sat_mon 70 = visa 71 = ipcv 72 = cpnx 73 = cphb 74 = wsn 75 = pvp 76 = br_sat_mon 77 = sun_nd 78 = wb_mon 79 = wb_expak 80 = iso_ip 81 = vmtp 82 = secure_vmtp 83 = vines 84 = ttp 85 = nsfnet_igp 86 = dgp 87 = tcf 88 = IGRP 89 = OSPF 90 = sprite_rpc 91 = larp 92 = mtp 93 = ax25 94 = ipip 95 = micp 96 = scc_sp 97 = etherip 98 = encap 100 = gmtp 101 = ifmp 102 = pnni 103 = pim 104 = aris 105 = scps 106 = qnx 107 = an 108 = ipcomp 109 = snp 110 = compaq_peer 111 = ipxinip 112 = vrrp 113 = pgm 115 = l2tp 116 = ddx 117 = iatp 118 = st 119 = srp 120 = uti 121 = smp 122 = sm 123 = ptp 124 = isis 125 = fire 126 = crtp 127 = crdup 128 = sscopmce 129 = iplt 130 = sps 131 = pipe 132 = sctp 133 = fc 134 = rsvp_e2e_ignore 135 = mobility_header 136 = udplite 137 = mpls_in_ip 138 = manet 139 = hip 140 = shim6 254 = divert " ::= { snAgAclEntry 5 } snAgAclSourceIp OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-write STATUS current DESCRIPTION "Source IP address." ::= { snAgAclEntry 6 } snAgAclSourceMask OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-write STATUS current DESCRIPTION "Source IP subnet mask." ::= { snAgAclEntry 7 } snAgAclSourceOperator OBJECT-TYPE SYNTAX Operator MAX-ACCESS read-write STATUS current DESCRIPTION "Type of comparison to perform. For now, this only applys to tcp or udp to compare the port number" ::= { snAgAclEntry 8 } snAgAclSourceOperand1 OBJECT-TYPE SYNTAX INTEGER(0..65535) MAX-ACCESS read-write STATUS current DESCRIPTION "For now this only refers to transport protocol port number. 0 means NA" ::= { snAgAclEntry 9 } snAgAclSourceOperand2 OBJECT-TYPE SYNTAX INTEGER(0..65535) MAX-ACCESS read-write STATUS current DESCRIPTION "For now this only refers to transport protocol port number. Used in ICMP Protocol to convey the ICMP Type value. 0 means NA. Valid values for ICMP Type: 1 = Echo reply 4 = Destination unreachable 5 = Source quench 6 = Redirect 9 = Echo request 10=Router advertisement 11=Router solicitation 12=Time exceeded 13=Parameter problem 14=Timestamp request 15=Timestamp reply 16=Information request 17=Information reply 18=Address mask request 19=Address mask reply. " ::= { snAgAclEntry 10 } snAgAclDestinationIp OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-write STATUS current DESCRIPTION "Destination IP address." ::= { snAgAclEntry 11 } snAgAclDestinationMask OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS read-write STATUS current DESCRIPTION "Destination IP subnet mask." ::= { snAgAclEntry 12 } snAgAclDestinationOperator OBJECT-TYPE SYNTAX Operator MAX-ACCESS read-write STATUS current DESCRIPTION "Type of comparison to perform. For now, this only applys to tcp or udp to compare the port number" ::= { snAgAclEntry 13 } snAgAclDestinationOperand1 OBJECT-TYPE SYNTAX INTEGER(0..65535) MAX-ACCESS read-write STATUS current DESCRIPTION "For now this only refers to transport protocol port number. 0 means NA" ::= { snAgAclEntry 14 } snAgAclDestinationOperand2 OBJECT-TYPE SYNTAX INTEGER(0..65535) MAX-ACCESS read-write STATUS current DESCRIPTION "For now this only refers to transport protocol port number. 0 means NA" ::= { snAgAclEntry 15 } snAgAclPrecedence OBJECT-TYPE SYNTAX PrecedenceValue MAX-ACCESS read-write STATUS current DESCRIPTION "This refers to IP precedence value in the range <0-7> critical(5), flash(3), flash-override(4), immediate(2), internet(6), network(7), priority(1), routine(0)" ::= { snAgAclEntry 16 } snAgAclTos OBJECT-TYPE SYNTAX TosValue MAX-ACCESS read-write STATUS current DESCRIPTION "This refers to the IP type of service value in range <0-15>, which is the sum of numeric vlaues of the following options - match packets with maximum reliability TOS (2) match packets with maximum throughput TOS (4) match packets with minimum delay (8) match packets with minimum monetary cost TOS (1) match packets with normal TOS (0)" ::= { snAgAclEntry 17 } snAgAclEstablished OBJECT-TYPE SYNTAX RtrStatus MAX-ACCESS read-write STATUS current DESCRIPTION "Enable/Disable the filtering of established TCP packets of which the ACK or RESET flag is on. This additional filter only applies to TCP transport protocol." ::= { snAgAclEntry 18 } snAgAclLogOption OBJECT-TYPE SYNTAX TruthVal MAX-ACCESS read-write STATUS current DESCRIPTION "Log flag" ::= { snAgAclEntry 19 } snAgAclStandardFlag OBJECT-TYPE SYNTAX TruthVal MAX-ACCESS read-write STATUS current DESCRIPTION "Return whether the ACL is standard or extended, 1 for standard ACL" ::= { snAgAclEntry 20 } snAgAclRowStatus OBJECT-TYPE SYNTAX SnRowStatus MAX-ACCESS read-write STATUS current DESCRIPTION "To create or delete a access list entry." ::= { snAgAclEntry 21 } snAgAclFlowCounter OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Approximate count of flows matching individual ACL entry." ::= { snAgAclEntry 22 } snAgAclPacketCounter OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Accurate count of packets matching individual ACL entry." ::= { snAgAclEntry 23 } snAgAclComments OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-write STATUS current DESCRIPTION "Remark description of individual ACL entry." ::= { snAgAclEntry 24 } snAgAclIpPriority OBJECT-TYPE SYNTAX INTEGER(0..3) MAX-ACCESS read-write STATUS current DESCRIPTION "QoS priority option for IP ACL entry." ::= { snAgAclEntry 25 } snAgAclPriorityForce OBJECT-TYPE SYNTAX INTEGER(0..4) MAX-ACCESS read-write STATUS current DESCRIPTION "Force packet outgoing priority. Not defined(4)" ::= { snAgAclEntry 26 } snAgAclPriorityMapping OBJECT-TYPE SYNTAX INTEGER(0..8) MAX-ACCESS read-write STATUS current DESCRIPTION "Map incoming packet priority. Not defined(8)" ::= { snAgAclEntry 27 } snAgAclDscpMarking OBJECT-TYPE SYNTAX INTEGER(0..64) MAX-ACCESS read-write STATUS current DESCRIPTION "Mark packets with given DSCP value. Not defined(64)" ::= { snAgAclEntry 28 } snAgAclDscpMapping OBJECT-TYPE SYNTAX INTEGER(0..64) MAX-ACCESS read-write STATUS current DESCRIPTION "Map incoming DSCP value. Not defined(64)" ::= { snAgAclEntry 29 } snAgAclIcmpCode OBJECT-TYPE SYNTAX INTEGER(0..255) MAX-ACCESS read-write STATUS current DESCRIPTION "ICMP Message Code value. Used in combination with ICMP Message Type (use snAgAclSourceOperand2) to setup an ICMP filter. This object is not used with any other protocol. 0 means NA. Supported values Type: Echo reply -------------- 1 = Echo reply Type: Destination unreachable ------------------------- 1 = Network unreachable 2 = Host unreachable 3 = Protocol unreachable 4 = Port unreachable 5 = Fragmentation needed by don't fragment bit set 6 = Source route failed 7 = Destination network unknown 8 = Destination host unknown 9 = Source host isolated 10 = Destination network administratively prohibited 11=Destination host administratively prohibited 12=Network unreachable for TOS 13=Host unreachable for TOS 14=Communication administratively prohibited by filter 15=Host precedence violation 16=Precedence cutoff in effect Type: Source quench ------------------ 1 = Source quench Type: Redirect ------------ 1 = Redirect for network 2 = Redirect for host 3 = Redirect for TOS and network 4 = Redirect for TOS and host Type: Echo request ----------------- 1 = Echo request Type: Router advertisement ------------------------ 1 = Router advertisement Type: Router solicitation --------------------- 1 = Router solicitation Type: Time exceeded ------------------ 1 = Time to live equals 0 during transmit 2 = Time to live equals 0 during reassembly Type: Parameter problem --------------------- 1 = IP header bad (catchall error) 2 = Required option missing Type: Timestamp request ---------------------- 1 = Timestamp request Type: Timestamp reply ------------------- 1 = Timestamp reply Type: Information request ---------------------- 1 = Information request Type: Information reply -------------------- 1 = Information reply Type: Address mask request ------------------------ 1 = Address mask request Type: Address mask reply ---------------------- 1 = Address mask reply" ::= { snAgAclEntry 30 } snAgAclParameters OBJECT-TYPE SYNTAX BITS { matchFragmentedPackets (0), matchNonFragmentedPackets (1), matchTcpSynSetPackets (2), permitFailedRPFCheckPackets (3), mirrorPermitPackets (4), sendPermitPacketsToSflowCollector (5), dscpMappingFlagSet (6), dscpMarkingFlagSet (7) } MAX-ACCESS read-write STATUS current DESCRIPTION "This mask represents multiple parameters configured for this ACL. Bit 0 specified in the BITS construct is the MS bit of the first octet. Bit 0: Match fragmented IP packets Bit 1: Match non-fragmented IP packets Bit 2: Match only TCP packets with SYN Bit set. Valid only if snAgAclSourceOperator or snAgAclDestinationOperator is set to TCP. Bit 3: Permit packets that fail RPF check Bit 4: Mirror packets matching ACL permit clause Bit 5: Send packets matching ACL permit clause to sFlow collector Bit 6: Set dscp-mapping. The value is given by snAgAclDscpMarking Bit 7: Set dscp-marking. The value is given by snAgAclDscpMapping " ::= { snAgAclEntry 31 } -- -- Acl Port Table -- -- snAgAclIfBindTable replaces snAgAclBindToPortTable snAgAclBindToPortTable OBJECT-TYPE SYNTAX SEQUENCE OF SnAgAclBindToPortEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of ACL binding to port for router" ::= { snAgAcl 3 } snAgAclBindToPortEntry OBJECT-TYPE SYNTAX SnAgAclBindToPortEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the ACL-binding-to-port table." INDEX { snAgAclPortNum, snAgAclPortBindDirection } ::= { snAgAclBindToPortTable 1 } SnAgAclBindToPortEntry ::= SEQUENCE { snAgAclPortNum Integer32, snAgAclPortBindDirection Direction, snAgAclNum Integer32, snAgAclNameString DisplayString, snAgBindPortListInVirtualInterface OCTET STRING, snAgAclPortRowStatus SnRowStatus } snAgAclPortNum OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "Binding-to port num, either physical port or virtual interface." ::= { snAgAclBindToPortEntry 1 } snAgAclPortBindDirection OBJECT-TYPE SYNTAX Direction MAX-ACCESS read-only STATUS current DESCRIPTION "ACL port direction, inbound or outbound" ::= { snAgAclBindToPortEntry 2 } snAgAclNum OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-write STATUS current DESCRIPTION "Defined ACL number" ::= { snAgAclBindToPortEntry 3 } snAgAclNameString OBJECT-TYPE SYNTAX DisplayString MAX-ACCESS read-write STATUS current DESCRIPTION "Defined ACL name" ::= { snAgAclBindToPortEntry 4 } snAgBindPortListInVirtualInterface OBJECT-TYPE SYNTAX OCTET STRING MAX-ACCESS read-write STATUS current DESCRIPTION "Port list for binding virtual interface" ::= { snAgAclBindToPortEntry 5 } snAgAclPortRowStatus OBJECT-TYPE SYNTAX SnRowStatus MAX-ACCESS read-write STATUS current DESCRIPTION "To create or delete a ACL port entry." ::= { snAgAclBindToPortEntry 6 } -- -- Acl Port Table -- snAgAclIfBindTable OBJECT-TYPE SYNTAX SEQUENCE OF SnAgAclIfBindEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of ACL binding to port for router" ::= { snAgAcl 4 } snAgAclIfBindEntry OBJECT-TYPE SYNTAX SnAgAclIfBindEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the ACL-binding-to-port table." INDEX {snAgAclIfBindIndex, snAgAclIfBindDirection} ::= { snAgAclIfBindTable 1 } SnAgAclIfBindEntry ::= SEQUENCE { snAgAclIfBindIndex InterfaceIndex, snAgAclIfBindDirection Direction, snAgAclIfBindNum INTEGER, snAgAclIfBindName DisplayString, snAgAclIfBindVifPortList OCTET STRING, snAgAclIfBindRowStatus SnRowStatus, snAgAclIfBindDenyLogging INTEGER } snAgAclIfBindIndex OBJECT-TYPE SYNTAX InterfaceIndex MAX-ACCESS read-only STATUS current DESCRIPTION "Binding-to port num, either physical port or virtual interface." ::= { snAgAclIfBindEntry 1 } snAgAclIfBindDirection OBJECT-TYPE SYNTAX Direction MAX-ACCESS read-only STATUS current DESCRIPTION "ACL port direction, inbound or outbound" ::= { snAgAclIfBindEntry 2 } snAgAclIfBindNum OBJECT-TYPE SYNTAX INTEGER (0..199) MAX-ACCESS read-write STATUS current DESCRIPTION "Defined ACL number (0 represents named ACL)" ::= { snAgAclIfBindEntry 3 } snAgAclIfBindName OBJECT-TYPE SYNTAX DisplayString (SIZE (0..255)) MAX-ACCESS read-write STATUS current DESCRIPTION "Defined ACL name" ::= { snAgAclIfBindEntry 4 } snAgAclIfBindVifPortList OBJECT-TYPE SYNTAX OCTET STRING MAX-ACCESS read-write STATUS current DESCRIPTION "This object specifies the port list for binding virtual interface. Each port index is an ifIndex, if there are consecutive 4 or more ifIndex then, they will be encoded like below. Encoding and decoding scheme is range based: Each range prefix with 0000 (2 octets) where 0000 is not valid ifIndex. Next 2 octets indicates lower range ifIndex, followed by 2 octets of higher range ifIndex. Individual(non range) ones will be displayed as it is. Ex: port list: 0001..0005 0015 0032..0047 Port list in PDU: 0000 0001 0005 000f 0000 0020 002f." ::= { snAgAclIfBindEntry 5 } snAgAclIfBindRowStatus OBJECT-TYPE SYNTAX SnRowStatus MAX-ACCESS read-write STATUS current DESCRIPTION "To create or delete a ACL port entry." ::= { snAgAclIfBindEntry 6 } snAgAclIfBindDenyLogging OBJECT-TYPE SYNTAX INTEGER { disable(0), enable(1) } MAX-ACCESS read-write STATUS current DESCRIPTION "Enable or disable deny logging." ::= { snAgAclIfBindEntry 7 } -- -- Acl Accounting Table -- agAclAccntTable OBJECT-TYPE SYNTAX SEQUENCE OF AgAclAccntEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of ACL Accounting Statistics for router" ::= { snAgAcl 5 } agAclAccntEntry OBJECT-TYPE SYNTAX AgAclAccntEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the ACL-binding-to-port table." INDEX { agAclAccntKind, agAclAccntIfIndex, agAclAccntDirection, agAclAccntAclNumber, agAclAccntFilterId} ::= { agAclAccntTable 1 } AgAclAccntEntry ::= SEQUENCE { agAclAccntKind INTEGER, agAclAccntIfIndex InterfaceIndex, agAclAccntDirection Direction, agAclAccntAclNumber AclNumber, agAclAccntFilterId Unsigned32, agAclAccntAclName AclNameString, agAclAccntOneSecond Counter64, agAclAccntOneMinute Counter64, agAclAccntFiveMinute Counter64, agAclAccntCumulative Counter64, agAclAccntRaclDropCnt Counter64, agAclAccntRaclFwdCnt Counter64, agAclAccntRaclRemarkCnt Counter64, agAclAccntRaclTotalCnt Counter64, agAclAccntRaclTotalSWHitCountCnt Counter64 } agAclAccntKind OBJECT-TYPE SYNTAX INTEGER { ipv4(0), l2(1), policyBasedRouting(2), rateLimit(3), receiveAcl(4) } MAX-ACCESS not-accessible STATUS current DESCRIPTION "Kind of ACL Accounting statistics needed." ::= { agAclAccntEntry 1 } agAclAccntIfIndex OBJECT-TYPE SYNTAX InterfaceIndex MAX-ACCESS not-accessible STATUS current DESCRIPTION "Physical or virtual interface on which ACL accounting is desired. For Receive ACL, we use the lowest port of the management module as value for this object." ::= { agAclAccntEntry 2 } agAclAccntDirection OBJECT-TYPE SYNTAX Direction MAX-ACCESS not-accessible STATUS current DESCRIPTION "ACL port direction, inbound or outbound. For receive-acl kind, direction cannot be outbound." ::= { agAclAccntEntry 3 } agAclAccntAclNumber OBJECT-TYPE SYNTAX AclNumber MAX-ACCESS not-accessible STATUS current DESCRIPTION "The access-list number for this entry." ::= { agAclAccntEntry 4 } agAclAccntFilterId OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS not-accessible STATUS current DESCRIPTION "FilterId within a given ACL. This is a zero based value." ::= { agAclAccntEntry 5 } agAclAccntAclName OBJECT-TYPE SYNTAX AclNameString MAX-ACCESS read-only STATUS current DESCRIPTION "ACL name for an entry, if applicable. Otherwise, null string is returned." ::= { agAclAccntEntry 6 } agAclAccntOneSecond OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Last one second accounting data." ::= { agAclAccntEntry 7 } agAclAccntOneMinute OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Last one minute accounting data." ::= { agAclAccntEntry 8 } agAclAccntFiveMinute OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Last five minute accounting data." ::= { agAclAccntEntry 9 } agAclAccntCumulative OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Cummulative accounting data since the ACL was installed." ::= { agAclAccntEntry 10 } agAclAccntRaclDropCnt OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Receive-ACL drop counter used for rate limiting. Not used for other ACL kind. The value returned is per ACL, instead of per filter within the ACL." ::= { agAclAccntEntry 11 } agAclAccntRaclFwdCnt OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Receive-ACL forward counter used for rate limiting. Not used for other ACL kind. The value returned is per ACL, instead of per filter within the ACL." ::= { agAclAccntEntry 12 } agAclAccntRaclRemarkCnt OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Receive-ACL remark counter used for rate limiting. Not used for other ACL kind. The value returned is per ACL, instead of per filter within the ACL." ::= { agAclAccntEntry 13 } agAclAccntRaclTotalCnt OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Receive-ACL total counter used for rate limiting. Not used for other ACL kind. The value returned is per ACL, instead of per filter within the ACL." ::= { agAclAccntEntry 14 } agAclAccntRaclTotalSWHitCountCnt OBJECT-TYPE SYNTAX Counter64 MAX-ACCESS read-only STATUS current DESCRIPTION "Receive-ACL cumulative software hit counter. Not used for other ACL kind. The value returned is per ACL, instead of per filter within the ACL." ::= { agAclAccntEntry 15 } -- -- L2 ACL Next Clause Table -- fdryL2AclNextClauseTable OBJECT-TYPE SYNTAX SEQUENCE OF FdryL2AclNextClauseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This read-only table contains the list of next lowest available clause index that can be used for creating a new instance in the fdryL2AclTable. The clause index values will not change as a result of switchovers or hitless upgrades, but may change as a result of a device reload (though the relative order of persistent entries would remain the same). " ::= { snAgAcl 6 } fdryL2AclNextClauseEntry OBJECT-TYPE SYNTAX FdryL2AclNextClauseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry specifying the next lowest available clause index for this ACL number." INDEX { fdryL2AclNumber } ::= { fdryL2AclNextClauseTable 1 } FdryL2AclNextClauseEntry ::= SEQUENCE { fdryL2AclNextClauseIndex FdryClauseIndexTC } fdryL2AclNextClauseIndex OBJECT-TYPE SYNTAX FdryClauseIndexTC MAX-ACCESS read-only STATUS current DESCRIPTION "The next lowest available clause index for a given ACL number. The maximum value of this object is the configured maximum number of clauses for a L2 ACL." ::= { fdryL2AclNextClauseEntry 1 } -- -- L2 ACL Configuration Table -- fdryL2AclTable OBJECT-TYPE SYNTAX SEQUENCE OF FdryL2AclEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of Layer 2 Access Control Lists. Layer 2 ACLs filter traffic based on any of the following fields: - Source MAC address and source MAC mask - Destination MAC address and destination MAC mask - VLAN ID - Ethernet type. For a given ACL number, one can have 64 (default) to 256 clauses. The clause index values will not change as a result of switchovers or hitless upgrades, but may change as a result of a device reload (though the relative order of persistent entries would remain the same). " ::= { snAgAcl 7 } fdryL2AclEntry OBJECT-TYPE SYNTAX FdryL2AclEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the L2 Access Control List table." INDEX { fdryL2AclNumber, fdryL2AclClauseIndex } ::= { fdryL2AclTable 1 } FdryL2AclEntry ::= SEQUENCE { fdryL2AclNumber AclNumber, fdryL2AclClauseIndex FdryClauseIndexTC, fdryL2AclAction Action, fdryL2AclSourceMac MacAddress, fdryL2AclSourceMacMask MacAddress, fdryL2AclDestinationMac MacAddress, fdryL2AclDestinationMacMask MacAddress, fdryL2AclVlanId FdryVlanIdOrNoneTC, fdryL2AclEthernetType FdryEnetTypeOrZeroTC, fdryL2AclDot1pPriority PortQosTC, fdryL2AclDot1pPriorityForce PortQosTC, fdryL2AclDot1pPriorityMapping PortQosTC, fdryL2AclMirrorPackets TruthValue, fdryL2AclLogEnable TruthValue, fdryL2AclRowStatus RowStatus } fdryL2AclNumber OBJECT-TYPE SYNTAX AclNumber MAX-ACCESS not-accessible STATUS current DESCRIPTION "The access-list number for this entry. For L2ACL, the valid values are between 400 and 599." ::= { fdryL2AclEntry 1 } fdryL2AclClauseIndex OBJECT-TYPE SYNTAX FdryClauseIndexTC MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of the clause within a given ACL number. During row creation, the clause index value should match with the next available clause index for a given ACL number. It is advisable to first do a Get operation on the fdryL2AclNextClauseTable for a given ACL number, and use the value of fdryL2AclNextClauseIndex returned by the agent." ::= { fdryL2AclEntry 2 } fdryL2AclAction OBJECT-TYPE SYNTAX Action MAX-ACCESS read-create STATUS current DESCRIPTION "Action to take if the ingress L2 packet matches this ACL." ::= { fdryL2AclEntry 3 } fdryL2AclSourceMac OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS read-create STATUS current DESCRIPTION "Optional Source MAC address. By default, it matches with any source MAC within a packet." DEFVAL { '000000000000'H } ::= { fdryL2AclEntry 4 } fdryL2AclSourceMacMask OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS read-create STATUS current DESCRIPTION "Optional Source MAC address mask. For Set operation, this object can only be used in conjunction with fdryL2AclSourceMac. By default, it matches with any source MAC within a packet. it matches with any source MAC within a packet. To match on the first two bytes of the address aabb.ccdd.eeff, use the mask ffff.0000.0000. In this case, the clause matches all source MAC addresses that contain 'aabb' as the first two bytes and any values in the remaining bytes of the MAC address." DEFVAL { '000000000000'H } ::= { fdryL2AclEntry 5 } fdryL2AclDestinationMac OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS read-create STATUS current DESCRIPTION "Optional destination MAC address. By default, it matches with any destination MAC within a packet." DEFVAL { '000000000000'H } ::= { fdryL2AclEntry 6 } fdryL2AclDestinationMacMask OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS read-create STATUS current DESCRIPTION "Optional destination MAC address mask. For Set operation, this object can only be used in conjunction with fdryL2AclDestinationMac. By default, it matches with any destination MAC within a packet. To match on the first two bytes of the address aabb.ccdd.eeff, use the mask ffff.0000.0000. In this case, the clause matches all destination MAC addresses that contain 'aabb' as the first two bytes and any values in the remaining bytes of the MAC address." DEFVAL { '000000000000'H } ::= { fdryL2AclEntry 7 } fdryL2AclVlanId OBJECT-TYPE SYNTAX FdryVlanIdOrNoneTC MAX-ACCESS read-create STATUS current DESCRIPTION "Optional VLAN ID to match against that of the incoming packet. By default, the VLAN ID field is ignored during the match. In this case, value 0 is returned." DEFVAL { 0 } ::= { fdryL2AclEntry 8 } fdryL2AclEthernetType OBJECT-TYPE SYNTAX FdryEnetTypeOrZeroTC MAX-ACCESS read-create STATUS current DESCRIPTION "Optional Ethernet Type to match against the etype field of the incoming packet. By default, etype field is ignored during the match." DEFVAL { invalid } ::= { fdryL2AclEntry 9 } fdryL2AclDot1pPriority OBJECT-TYPE SYNTAX PortQosTC MAX-ACCESS read-create STATUS current DESCRIPTION "The priority option assigns traffic that matches the ACL to a hardware forwarding queue. In addition to changing the internal forwarding priority, if the outgoing interface is an 802.1q interface, this option maps the specified priority to its equivalent 802.1p (QoS) priority and marks the packet with the new 802.1p priority. This option is applicable for inbound ACLs only. This object is not supported in RX, where it always returns enum value invalid. NOTE: fdryL2AclDot1pPriority following fdryL2AclDot1pPriorityForce cannot be used together in an ACL entry." DEFVAL { level0 } ::= { fdryL2AclEntry 10 } fdryL2AclDot1pPriorityForce OBJECT-TYPE SYNTAX PortQosTC MAX-ACCESS read-create STATUS current DESCRIPTION "The priority-force option assigns packets of outgoing traffic that match the ACL to a specific hardware forwarding queue, even though the incoming packet may be assigned to another queue. This option is applicable for inbound ACLs only. This object is not supported in RX, where it always returns enum value invalid. NOTE: fdryL2AclDot1pPriority following fdryL2AclDot1pPriorityForce cannot be used together in an ACL entry." DEFVAL { level0 } ::= { fdryL2AclEntry 11 } fdryL2AclDot1pPriorityMapping OBJECT-TYPE SYNTAX PortQosTC MAX-ACCESS read-create STATUS current DESCRIPTION "The priority-mapping option matches on the packets 802.1p value. This option does not change the packets forwarding priority through the device or mark the packet. This keyword is applicable for both inbound and outbound ACLs. This object is not supported in RX, where it always returns enum value invalid." DEFVAL { level0 } ::= { fdryL2AclEntry 12 } fdryL2AclMirrorPackets OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION "Mirror packets matching ACL permit clause." DEFVAL { false } ::= { fdryL2AclEntry 13 } fdryL2AclLogEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-create STATUS current DESCRIPTION "Optional parameter to enable logging only when deny clause is specified. Note that traffic denied by implicit deny mechanism is not subject to logging. The implicit deny kicks in when the traffic does not match any of the clauses and there is no 'permit any any' clause specified at the end." DEFVAL { false } ::= { fdryL2AclEntry 14 } fdryL2AclRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The row status variable, used according to installation and removal conventions for conceptual rows. Setting this object to active(1) or createAndGo(4) results in the addition of a L2 ACL filter in the router. Duplicate entry will be rejected during row creation. As part of row creation, we support only appending to this table. Row insertion may not be supported. Setting this object to destroy(6) removes the associated filter from the router. Other values in the enumeration are not used. " ::= { fdryL2AclEntry 15 } -- -- L2 ACL Binding Configuration Table -- fdryL2AclIfBindTable OBJECT-TYPE SYNTAX SEQUENCE OF FdryL2AclIfBindEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Table of L2 ACL binding to port. - One cannot bind Layer 2 ACLs and Layer 3 ACLs to the same port. However, one can configure a port to use Layer 2 ACLs, and another port on the same device to use Layer 3 ACLs. - In general, Layer 2 ACLs cannot be bound to virtual interfaces, unlike L3 ACLs. - One cannot modify an existing Layer 2 ACL clause. For that, one must unbind the ACL, delete it and make a new clause. " ::= { snAgAcl 8 } fdryL2AclIfBindEntry OBJECT-TYPE SYNTAX FdryL2AclIfBindEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the L2ACL binding table which lists the ACL bindings to a port. " INDEX {ifIndex, fdryL2AclIfBindDirection} ::= { fdryL2AclIfBindTable 1 } FdryL2AclIfBindEntry ::= SEQUENCE { fdryL2AclIfBindDirection Direction, fdryL2AclIfBindAclNumber Unsigned32, fdryL2AclIfBindRowStatus RowStatus } fdryL2AclIfBindDirection OBJECT-TYPE SYNTAX Direction MAX-ACCESS not-accessible STATUS current DESCRIPTION "Direction in which this ACL should be applied on this port." ::= { fdryL2AclIfBindEntry 1 } fdryL2AclIfBindAclNumber OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-create STATUS current DESCRIPTION "The ACL number that is to be bound to given physical interface. The valid values for L2 numbered ACLs are between 400 and 599." ::= { fdryL2AclIfBindEntry 2 } fdryL2AclIfBindRowStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The row status variable, used according to installation and removal conventions for conceptual rows. Setting this object to active(1) or createAndGo(4) results in the binding of a L2 ACL with a given physical port. Setting this object to destroy(6) unbinds this L2 ACL from the port. Other values in the enumeration are not used." ::= { fdryL2AclIfBindEntry 3 } END