-- This file is corresponding to Release 5.2.1.100 from 2000/11/08 00:00:00 -- (C)opyright 1991-1999 BinTec Communications AG, All Rights Reserved -- $RCSfile: mibip_old,v $ -- $Revision: 1.3 $ BIANCA-BRICK-IP-OLDACCESS-MIB DEFINITIONS ::= BEGIN IMPORTS IpAddress, Counter, TimeTicks FROM RFC1155-SMI OBJECT-TYPE FROM RFC-1212; org OBJECT IDENTIFIER ::= { iso 3 } dod OBJECT IDENTIFIER ::= { org 6 } internet OBJECT IDENTIFIER ::= { dod 1 } private OBJECT IDENTIFIER ::= { internet 4 } enterprises OBJECT IDENTIFIER ::= { private 1 } bintec OBJECT IDENTIFIER ::= { enterprises 272 } bibo OBJECT IDENTIFIER ::= { bintec 4 } biboipold OBJECT IDENTIFIER ::= { bibo 5 } -- IP Group -- OLD (!) Access Tables -- An IP datagram may not be processed (forwarded or received) if -- The datagram is member of the set of denied datagrams and *not* -- member of the set of allowed datagrams. In any other cases the -- datagram will be processed. ipAllowTable OBJECT-TYPE SYNTAX SEQUENCE OF IpAllowEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The ipAllowTable defines all allowed IP packets. Each entry describes a subset of IP Packets, which are allowed to be processed. The overall set of allowed IP packets is the union of all subsets that are described in this table. If at least one entry is defined in the ipAllowTable, only IP datagrams which are allowed by the ipAllowTable are processed by the BRICK. All other packets are refused. Please note that the ipDenyTable overwrites the ipAllowTable. IP datagrams specified in the ipDenyTable are always refused, even if they are allowed by the ipAllowTable. Creating entries: Entries are created by setting the ipAllowProtocolMode and ipAllowSrcIfIndexMode objects in one operation (on one command line). Deleting entries: Entries are deleted by setting the ipAllowProtocolMode object to 'delete'." ::= { biboipold 1 } ipAllowEntry OBJECT-TYPE SYNTAX IpAllowEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "" INDEX { ipAllowProtocolMode, ipAllowSrcIfIndexMode } ::= { ipAllowTable 1 } IpAllowEntry ::= SEQUENCE { ipAllowProtocolMode INTEGER, ipAllowProtocol INTEGER, ipAllowSrcIfIndexMode INTEGER, ipAllowSrcIfIndex INTEGER, ipAllowSrcAddr IpAddress, ipAllowSrcMask IpAddress, ipAllowSrcPortMode INTEGER, ipAllowSrcPort INTEGER, ipAllowDstAddr IpAddress, ipAllowDstMask IpAddress, ipAllowDstPortMode INTEGER, ipAllowDstPort INTEGER, ipAllowSrcPortRange INTEGER, ipAllowDstPortRange INTEGER } ipAllowProtocolMode OBJECT-TYPE SYNTAX INTEGER { dont-verify(1), -- don't check the protocol field verify(2), -- check the protocol field delete(3) -- delete the entry from the table } ACCESS not-accessible STATUS mandatory DESCRIPTION "Specifies whether or not the protocol field of the IP datagram header should be used to determine if the datagram belongs to the subset of the entry. dont-verify(1) = don't check the protocol field; verify(2) = check the protocol field; delete(3) = delete the entry from the table" ::= { ipAllowEntry 1 } ipAllowProtocol OBJECT-TYPE SYNTAX INTEGER { icmp(1), ggp(3), tcp(6), egp(8), pup(12), udp(17), hmp(20), xns-idp(22), rdp(27), ospf(89) } ACCESS not-accessible STATUS mandatory DESCRIPTION "If the ipAllowProtocolMode is set to 'verify', this object specifies the protocol of IP datagrams belonging to the subset described by this entry. Otherwise, this field has no meaning." ::= { ipAllowEntry 2 } ipAllowSrcIfIndexMode OBJECT-TYPE SYNTAX INTEGER { dont-verify(1), verify(2) } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies whether or not the originating interface of the IP datagram should be checked to determine whether a datagram belongs to the subset." ::= { ipAllowEntry 3 } ipAllowSrcIfIndex OBJECT-TYPE SYNTAX INTEGER ACCESS not-accessible STATUS mandatory DESCRIPTION "If ipAllowSrcIfIndexMode is set to 'verify', then this object specifies the ifIndex of the datagrams belonging to the subset defined by this entry." ::= { ipAllowEntry 4 } ipAllowSrcAddr OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the set of IP addresses of datagrams that belong to the subset defined by this entry." ::= { ipAllowEntry 5 } ipAllowSrcMask OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the set of IP addresses of data grams that belong to the subset defined by this entry." ::= { ipAllowEntry 6 } ipAllowSrcPortMode OBJECT-TYPE SYNTAX INTEGER { ignore(1), -- All ports: 0 ..65535 specific(2), -- a specific port number -- i.e. ipAllowScrPort clients(3), -- clientports: 1024 .. 4999, -- 32768..65535 server(4), -- server ports: 0..1023 -- 5000..32767 unpriv(5), -- unprivileged ports: -- 1024..65535 priv(6) -- privileged ports: -- 0..1023 } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the range of source port numbers of IP datagrams belonging to the subset. ignore(1) = All ports: 0 ..65535; specific(2) = a specific port number i.e. ipAllowScrPort; clients(3) = clientports: 1024 .. 4999, 32768..65535; server(4) = server ports: 0..1023 5000..32767; unpriv(5) = unprivileged ports: 1024..65535; priv(6) = privileged ports: 0..1023" ::= { ipAllowEntry 7 } ipAllowSrcPort OBJECT-TYPE SYNTAX INTEGER (0..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "If ipAllowSrcPortMode is set to 'specific', then this object contains a specific port number. Otherwise this object is not used." ::= { ipAllowEntry 8 } ipAllowDstAddr OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the set of IP addresses of datagrams that belong to the subset defined by this entry." ::= { ipAllowEntry 9 } ipAllowDstMask OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION " This object specifies the set of IP addresses of datagrams that belong to the subset defined by this entry." ::= { ipAllowEntry 10 } ipAllowDstPortMode OBJECT-TYPE SYNTAX INTEGER { ignore(1), -- All ports: 0..65535 specific(2), -- a specific port number -- i.e. ipAllowDstPort clients(3), -- client ports: 1024..4999, -- 32768..65535 server(4), -- server ports. 0..1023, -- 5000..32767 unpriv(5), -- unprivileged ports: -- 1024..65535 priv(6) -- privileged ports: -- 0..1023 } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the range of destination port numbers of IP datagrams belonging to the subset. ignore(1) = All ports: 0..65535; specific(2) = a specific port number i.e. ipAllowDstPort; clients(3) = client ports: 1024..4999, 32768..65535; server(4) = server ports. 0..1023, 5000..32767; unpriv(5) = unprivileged ports: 1024..65535; priv(6) = privileged ports: 0..1023" ::= { ipAllowEntry 11 } ipAllowDstPort OBJECT-TYPE SYNTAX INTEGER (0..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "If ipAllowDstPortMode is set to 'specific', then this object contains a specific port number. Otherwise this object is not used." ::= { ipAllowEntry 12 } ipAllowSrcPortRange OBJECT-TYPE SYNTAX INTEGER (-1..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "This object can be used together with ipAllowSrcPort to apply the rule to a port range, instead of a single port. When ipAllowSrcPortMode is set to specific and this object is not set to -1, than the rule applies to the Range of ports from ipAllowSrcPort to ipAllowSrcPortRange. When this object is set to -1, the rule applies only to port ipAllowSrcPort." ::= { ipAllowEntry 13 } ipAllowDstPortRange OBJECT-TYPE SYNTAX INTEGER (-1..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "This object can be used together with ipAllowDstPort to apply the rule to a port range, instead of a single port. When ipAllowDstPortMode is set to specific and this object is not set to -1, than the rule applies to the Range of ports from ipAllowDstPort to ipAllowDstPortRange. When this object is set to -1, the rule applies only to port ipAllowDstPort." ::= { ipAllowEntry 14 } ipDenyTable OBJECT-TYPE SYNTAX SEQUENCE OF IpDenyEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The ipDenyTable defines all IP packets to be denied. Each entry describes a subset of IP Packets, which are denied processing. The overall set of denied IP packets is the union of all subsets that are described in this table. The ipDenyTable overwrites the ipAllowTable. IP datagrams specified in the ipDenyTable are always refused, even if they are allowed by the ipAllowTable. Creating entries: Entries are created by setting the ipDenyProtocolMode and ipDenySrcIfIndexMode objects in one operation (i.e. on one command line). Deleting entries: Entries are deleted by setting the ipDenyProtocolMode object to 'delete'." ::= { biboipold 2 } ipDenyEntry OBJECT-TYPE SYNTAX IpDenyEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "" INDEX { ipDenyProtocolMode, ipDenySrcIfIndexMode } ::= { ipDenyTable 1 } IpDenyEntry ::= SEQUENCE { ipDenyProtocolMode INTEGER, ipDenyProtocol INTEGER, ipDenySrcIfIndexMode INTEGER, ipDenySrcIfIndex INTEGER, ipDenySrcAddr IpAddress, ipDenySrcMask IpAddress, ipDenySrcPortMode INTEGER, ipDenySrcPort INTEGER, ipDenyDstAddr IpAddress, ipDenyDstMask IpAddress, ipDenyDstPortMode INTEGER, ipDenyDstPort INTEGER, ipDenySrcPortRange INTEGER, ipDenyDstPortRange INTEGER } ipDenyProtocolMode OBJECT-TYPE SYNTAX INTEGER { dont-verify(1), -- don't check the protcol field verify(2), -- check the protocol field delete(3) -- delete the entry from the table } ACCESS not-accessible STATUS mandatory DESCRIPTION "Specifies whether or not the protocol field of the IP datagram header should be used to determine if the datagram belongs to the subset of this entry. dont-verify(1) = don't check the protocol field; verify(2) = check the protocol field; delete(3) = delete the entry from the table" ::= { ipDenyEntry 1 } ipDenyProtocol OBJECT-TYPE SYNTAX INTEGER { icmp(1), ggp(3), tcp(6), egp(8), pup(12), udp(17), hmp(20), xns-idp(22), rdp(27), ospf(89) } ACCESS not-accessible STATUS mandatory DESCRIPTION "If the ipDenyProtocolMode is set to 'verify', this object specifies the protocol of IP datagrams belonging to the subset described by this entry. Otherwise, this field has no meaning." ::= { ipDenyEntry 2 } ipDenySrcIfIndexMode OBJECT-TYPE SYNTAX INTEGER { dont-verify(1), verify(2) } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies whether or not the originating interface of the IP datagram should be checked to determine whether a datagram belongs to this subset." ::= { ipDenyEntry 3 } ipDenySrcIfIndex OBJECT-TYPE SYNTAX INTEGER ACCESS not-accessible STATUS mandatory DESCRIPTION "If ipDenySrcIfIndexMode is set to 'verify', then this object specifies the ifIndex of the datagrams belonging to the subset defined by this entry." ::= { ipDenyEntry 4 } ipDenySrcAddr OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION "If ipDenySrcIfIndexMode is set to 'verify', then this object specifies the ifIndex of the datagrams belonging to the subset defined by this entry." ::= { ipDenyEntry 5 } ipDenySrcMask OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the set of IP addresses of datagrams that belong to the subset defined by this entry." ::= { ipDenyEntry 6 } ipDenySrcPortMode OBJECT-TYPE SYNTAX INTEGER { ignore(1), -- All ports: 0..65535 specific(2), -- a specific port number -- i.e. ipAllowDstPort clients(3), -- client ports: 1024..4999, -- 32768..65535 server(4), -- server ports. 0..1023, -- 5000..32767 unpriv(5), -- unprivileged ports: -- 1024..65535 priv(6) -- privileged ports: -- 0..1023 } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the range of source port numbers of IP datagrams belonging to this subset. ignore(1) = All ports: 0..65535; specific(2) = a specific port number i.e. ipAllowDstPort; clients(3) = client ports: 1024..4999, 32768..65535; server(4) = server ports. 0..1023, 5000..32767; unpriv(5) = unprivileged ports: 1024..65535; priv(6) = privileged ports: 0..1023" ::= { ipDenyEntry 7 } ipDenySrcPort OBJECT-TYPE SYNTAX INTEGER (0..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "If ipDenySrcPortMode is set to 'specific', then this object contains a specific port number. Otherwise this object is not used." ::= { ipDenyEntry 8 } ipDenyDstAddr OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the set of IP addresses of datagrams that belong to the subset defined by this entry." ::= { ipDenyEntry 9 } ipDenyDstMask OBJECT-TYPE SYNTAX IpAddress ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the set of IP addresses of datagrams that belong to the subset defined by this entry." ::= { ipDenyEntry 10 } ipDenyDstPortMode OBJECT-TYPE SYNTAX INTEGER { ignore(1), -- All ports: 0..65535 specific(2), -- a specific port number -- i.e. ipAllowDstPort clients(3), -- client ports: 1024..4999, -- 32768..65535 server(4), -- server ports. 0..1023, -- 5000..32767 unpriv(5), -- unprivileged ports: -- 1024..65535 priv(6) -- privileged ports: -- 0..1023 } ACCESS not-accessible STATUS mandatory DESCRIPTION "This object specifies the range of destination port numbers of IP datagrams belonging to the subset. ignore(1) = All ports: 0..65535; specific(2) = a specific port number i.e. ipAllowDstPort; clients(3) = client ports: 1024..4999, 32768..65535; server(4) = server ports. 0..1023, 5000..32767; unpriv(5) = unprivileged ports: 1024..65535; priv(6) = privileged ports: 0..1023" ::= { ipDenyEntry 11 } ipDenyDstPort OBJECT-TYPE SYNTAX INTEGER (0..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "If ipDenyDstPortMode is set to 'specific', then this object contains a specific port number. Otherwise this object is not used." ::= { ipDenyEntry 12 } ipDenySrcPortRange OBJECT-TYPE SYNTAX INTEGER (-1..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "This object can be used together with ipDenySrcPort to apply the rule to a port range, instead of a single port. When ipDenySrcPortMode is set to specific and this object is not set to -1, than the rule applies to the Range of ports from ipDenySrcPort to ipDenySrcPortRange. When this object is set to -1, the rule applies only to port ipDenySrcPort." ::= { ipDenyEntry 13 } ipDenyDstPortRange OBJECT-TYPE SYNTAX INTEGER (-1..65535) ACCESS not-accessible STATUS mandatory DESCRIPTION "This object can be used together with ipDenyDstPort to apply the rule to a port range, instead of a single port. When ipDenyDstPortMode is set to specific and this object is not set to -1, than the rule applies to the Range of ports from ipDenyDstPort to ipDenyDstPortRange. When this object is set to -1, the rule applies only to port ipDenyDstPort." ::= { ipDenyEntry 14 } END -- of BIANCA-BRICK definitions