-- ======================================================================= -- File : macscr.mib -- Description : Private MIB for NBase Switch Communications -- Ethernet Switches MAC-based port security -- By : Olga Bronshteyn -- Version : $Revision: 1.1 $ -- Date : $Date: 23 June 1999 8:50:44 $ -- ======================================================================= -- -- -- Copyright (c) 1995 NBase Switch Communications. All Rights Reserved. -- -- Reproduction of this document is authorized on condition that this -- copyright notice is included. This NBase SNMP MIB Specification -- embodies NBase's proprietary intellectual property. NBase -- retains all title and ownership in the specification, including any -- revisions. -- -- It is NBase's intent to encourage the widespread use of this -- specification in connection with the management of NBase's -- products. NBase grants vendor, end-users, and other interested -- parties a non-exclusive license to use this specification in -- connection with the management of NBase's products. -- -- This specification is supplied "AS IS," and NBase makes no -- warranty, either express or implied, as to the use, operation, -- condition, or performance of the specification. -- -- Copyright text courtesy of S. Rotenstein. -- -- If you have any questions about this MIB, please call NBase -- Technical Support Center at 1-800-858-7815 from inside USA or -- 1-818-773-0900 from outside USA. -- -- -- NBase retains the right to change this MIB without notification. -- -- MSCR-MIB DEFINITIONS ::= BEGIN IMPORTS enterprises FROM RFC1155-SMI OBJECT-TYPE FROM RFC-1212 TRAP-TYPE FROM RFC-1215; MacAddress ::= OCTET STRING(SIZE(6)) -- ************************************************************ -- Object Identifiers Definition -- ************************************************************ nbase OBJECT IDENTIFIER ::= { enterprises 629 } nbSwitchG1 OBJECT IDENTIFIER ::= { nbase 1 } nbSwitchG1Il OBJECT IDENTIFIER ::= { nbSwitchG1 50} nbMacScr OBJECT IDENTIFIER ::= { nbSwitchG1Il 1 } -- GROUPS in VLAN-MIB nbMacScrRun OBJECT IDENTIFIER ::= { nbMacScr 1 } nbMacScrPerm OBJECT IDENTIFIER ::= { nbMacScr 2 } -- nbMacScrRun group nbMacScrRunSecurityLevel OBJECT-TYPE SYNTAX INTEGER { none (1), perPort (2), perSwitch (3) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security Level" ::= { nbMacScrRun 1 } nbMacScrRunSaveMS OBJECT-TYPE SYNTAX INTEGER { manual (1), save (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address learning: 'manual' - user updates the MAC security table manually; 'save' - user wants 'to freeze' current learned addresses as runtime MAC security table. This object always returns 'manual'." ::= { nbMacScrRun 2 } nbMacScrRunClearMS OBJECT-TYPE SYNTAX INTEGER { running (1), clear (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address clearing: 'running' - the MAC security table acts as is; 'clear' - user wants 'to clear' all security addresses from runtime MAC security table. This object always returns 'running'." ::= { nbMacScrRun 3 } nbMacScrRunPortsTable OBJECT-TYPE SYNTAX SEQUENCE OF NbMacScrRunPortsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A table that contains MAC security Ports configuration." ::= { nbMacScrRun 4 } nbMacScrRunPortsEntry OBJECT-TYPE SYNTAX NbMacScrRunPortsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The entry describes MAC security Port Configuration." INDEX { nbMacScrRunPort } ::= { nbMacScrRunPortsTable 1 } NbMacScrRunPortsEntry ::= SEQUENCE { nbMacScrRunPort INTEGER, nbMacScrRunPortScrStatus INTEGER, nbMacScrRunPortSaveMS INTEGER, nbMacScrRunPortClearMS INTEGER, nbMacScrRunPortLockingMAC MacAddress } nbMacScrRunPort OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "Number of port to be managed." ::= { nbMacScrRunPortsEntry 1 } nbMacScrRunPortScrStatus OBJECT-TYPE SYNTAX INTEGER { enable (1), disable (2) } ACCESS read-write STATUS mandatory DESCRIPTION "The MAC security status of the port. If port's status is 'disable', it works as regular port. If port's status is 'enable' and [nbMacScrRunSecurityLevel] is not 'none', all ingoing to this port frames will be checked on security. If the frames are not allowed - they will be dropped and port will be really disabled." ::= { nbMacScrRunPortsEntry 2 } nbMacScrRunPortSaveMS OBJECT-TYPE SYNTAX INTEGER { manual (1), save (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address learning: 'manual' - user updates the MAC security table manually; 'save' - user wants 'to freeze' current learned addresses for port [nbMacScrRunPort] as runtime MAC security table. This object always returns 'manual'." ::= { nbMacScrRunPortsEntry 3 } nbMacScrRunPortClearMS OBJECT-TYPE SYNTAX INTEGER { running (1), clear (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address clearing: 'running' - the MAC security table acts as is; 'clear' - user wants 'to clear' all security addresses for port [nbMacScrRunPort] from runtime MAC security table. This object always returns 'running'." ::= { nbMacScrRunPortsEntry 4 } nbMacScrRunPortLockingMAC OBJECT-TYPE SYNTAX MacAddress ACCESS read-only STATUS mandatory DESCRIPTION "Last MAC address which locked this Port (prohibited access). In this case Agent will Disable this Port and will send 'unresolvedMAC' TRAP. To improve this situation, manager must: to add the locking MAC Address for the MAC Addresses list alowed for this Port in the MAC Security Data Base or to prevent coming of the prohibited MAC Address on this Port in the future and then to Enable this Port." ::= { nbMacScrRunPortsEntry 5 } -- The MAC-based port security Runtime Database nbMacScrRunMsTable OBJECT-TYPE SYNTAX SEQUENCE OF NbMacScrRunMsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A table that contains information about MAC addresses for ports which the user has entered. This information is used by the MAC security mechanism in determining how to learn a new address of received frame." ::= { nbMacScrRun 5 } nbMacScrRunMsEntry OBJECT-TYPE SYNTAX NbMacScrRunMsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Information about a specific MAC security address. While the MAC table is implemented as a hash table, for 'next' and 'get' operations the index is [nbMacScrRunMsIndex], but for 'set' operations the PDU must contain the [nbMacScrRunMsAddress] and [nbMacScrRunMsPort] fields (see [nbMacScrRunMsState] DESCRIPTION)." INDEX { nbMacScrRunMsIndex } ::= { nbMacScrRunMsTable 1 } NbMacScrRunMsEntry ::= SEQUENCE { nbMacScrRunMsIndex INTEGER, nbMacScrRunMsAddress MacAddress, nbMacScrRunMsPort INTEGER, nbMacScrRunMsState INTEGER } nbMacScrRunMsIndex OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "Index of the entry." ::= { nbMacScrRunMsEntry 1 } nbMacScrRunMsAddress OBJECT-TYPE SYNTAX MacAddress ACCESS read-write STATUS mandatory DESCRIPTION "MAC address which will be learned." ::= { nbMacScrRunMsEntry 2 } nbMacScrRunMsPort OBJECT-TYPE SYNTAX INTEGER (0..65535) ACCESS read-write STATUS mandatory DESCRIPTION "Port of the entry. '0' value indicates that the MAC address of the entry applies to all device ports and not to particular one." ::= { nbMacScrRunMsEntry 3 } nbMacScrRunMsState OBJECT-TYPE SYNTAX INTEGER { valid (1), invalid (2) } ACCESS read-write STATUS mandatory DESCRIPTION "State of the entry: Only 'valid' entries participate in the MAC security process. The new entry is created when PDU with [nbMacScrRunMsState]='valid'(1), [nbMacScrRunMsAddress], and optionally [nbMacScrRunMsPort] (default='0') comes. If [nbMacScrRunMsAddress] and [nbMacScrRunMsPort] exists, the switch replaces it. The old entry is deleted when PDU with [nbMacScrRunMsState]='invalid'(2), [nbMacScrRunMsAddress], [nbMacScrRunMsPort] comes. The old entry is modified when PDU with [nbMacScrRunMsAddress] and new value of field [nbMacScrRunMsPort] comes." ::= { nbMacScrRunMsEntry 4 } nbMacScrRunMsMaxNum OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "MAX possible quantity of entries in the MAC Security Running Table." ::= { nbMacScrRun 6 } nbMacScrRunTableSize OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "Real quantity of entries in the MAC Security Running Table." ::= { nbMacScrRun 7 } -- nbMacScrPerm group nbMacScrPermSecurityLevel OBJECT-TYPE SYNTAX INTEGER { none (1), perPort (2), perSwitch (3) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security Level" ::= { nbMacScrPerm 1 } nbMacScrPermSaveMS OBJECT-TYPE SYNTAX INTEGER { manual (1), save (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address learning: 'manual' - user updates the MAC security table manually; 'save' - user wants 'to freeze' current learned addresses as permanent MAC security table. This object always returns 'manual'." ::= { nbMacScrPerm 2 } nbMacScrPermClearMS OBJECT-TYPE SYNTAX INTEGER { running (1), clear (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address clearing: 'running' - the MAC security table acts as is; 'clear' - user wants 'to clear' all security addresses from permanent MAC security table. This object always returns 'running'." ::= { nbMacScrPerm 3 } nbMacScrPermPortsTable OBJECT-TYPE SYNTAX SEQUENCE OF NbMacScrPermPortsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A table that contains MAC security Ports configuration." ::= { nbMacScrPerm 4 } nbMacScrPermPortsEntry OBJECT-TYPE SYNTAX NbMacScrPermPortsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The entry describes MAC security Port Configuration." INDEX { nbMacScrPermPort } ::= { nbMacScrPermPortsTable 1 } NbMacScrPermPortsEntry ::= SEQUENCE { nbMacScrPermPort INTEGER, nbMacScrPermPortScrStatus INTEGER, nbMacScrPermPortSaveMS INTEGER, nbMacScrPermPortClearMS INTEGER } nbMacScrPermPort OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "Number of port to be managed." ::= { nbMacScrPermPortsEntry 1 } nbMacScrPermPortScrStatus OBJECT-TYPE SYNTAX INTEGER { enable (1), disable (2) } ACCESS read-write STATUS mandatory DESCRIPTION "The MAC security status of the port. If port's status is 'disable', it works as regular port. If port's status is 'enable' and [nbMacScrPermSecurityLevel] is not 'none', all ingoing to this port frames will be checked on security. If the frames are not allowed - they will be dropped and port will be really disabled." ::= { nbMacScrPermPortsEntry 2 } nbMacScrPermPortSaveMS OBJECT-TYPE SYNTAX INTEGER { manual (1), save (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address learning: 'manual' - user updates the MAC security table manually; 'save' - user wants 'to freeze' current learned addresses for port [nbMacScrRunPort] as permanent MAC security table. The set is for DRAM data base only. The updating of NVRAM data base executes after set to the object [nbMacScrPermLoadMS]. This object always returns 'manual'." ::= { nbMacScrPermPortsEntry 3 } nbMacScrPermPortClearMS OBJECT-TYPE SYNTAX INTEGER { running (1), clear (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address clearing: 'running' - the MAC security table acts as is; 'clear' - user wants 'to clear' all security addresses for port [nbMacScrPermPort] from permanent MAC security table. The set is for DRAM data base only. The updating of NVRAM data base executes after set to the object [nbMacScrPermLoadMS]. This object always returns 'running'." ::= { nbMacScrPermPortsEntry 4 } -- The MAC-based port security Permanent Database nbMacScrPermMsTable OBJECT-TYPE SYNTAX SEQUENCE OF NbMacScrPermMsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A table that contains information about MAC addresses for ports which the user has entered. This information is used by the MAC security mechanism in determining how to learn a new address of received frame." ::= { nbMacScrPerm 5 } nbMacScrPermMsEntry OBJECT-TYPE SYNTAX NbMacScrPermMsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Information about a specific MAC security address. While the MAC table is implemented as a hash table, for 'next' and 'get' operations the index is [nbMacScrPermMsIndex], but for 'set' operations the PDU must contain the [nbMacScrPermMsAddress] and [nbMacScrPermMsPort] fields (see [nbMacScrPermMsState] DESCRIPTION)." INDEX { nbMacScrPermMsIndex } ::= { nbMacScrPermMsTable 1 } NbMacScrPermMsEntry ::= SEQUENCE { nbMacScrPermMsIndex INTEGER, nbMacScrPermMsAddress MacAddress, nbMacScrPermMsPort INTEGER, nbMacScrPermMsState INTEGER } nbMacScrPermMsIndex OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "Index of the entry." ::= { nbMacScrPermMsEntry 1 } nbMacScrPermMsAddress OBJECT-TYPE SYNTAX MacAddress ACCESS read-write STATUS mandatory DESCRIPTION "MAC address which will be learned." ::= { nbMacScrPermMsEntry 2 } nbMacScrPermMsPort OBJECT-TYPE SYNTAX INTEGER (0..65535) ACCESS read-write STATUS mandatory DESCRIPTION "Port of the entry. '0' value indicates that the MAC address of the entry applies to all device ports and not to particular one." ::= { nbMacScrPermMsEntry 3 } nbMacScrPermMsState OBJECT-TYPE SYNTAX INTEGER { valid (1), invalid (2) } ACCESS read-write STATUS mandatory DESCRIPTION "State of the entry: Only 'valid' entries participate in the MAC security process. The new entry is created when PDU with [nbMacScrPermMsState]='valid'(1), [nbMacScrPermMsAddress], and optionally [nbMacScrPermMsPort] (default='0') comes. If [nbMacScrPermMsAddress] and [nbMacScrPermMsPort] exists, the switch replaces it. The old entry is deleted when PDU with [nbMacScrPermMsState]='invalid'(2), [nbMacScrPermMsAddress], [nbMacScrPermMsPort] comes. The old entry is modified when PDU with [nbMacScrPermMsAddress] and new value of field [nbMacScrPermMsPort] comes. The set is for DRAM data base only. The updating of NVRAM data base executes after set to the object [nbMacScrPermLoadMS]." ::= { nbMacScrPermMsEntry 4 } nbMacScrPermMsMaxNum OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "MAX possible quantity of entries in the MAC Security Permanent Table." ::= { nbMacScrPerm 6 } nbMacScrPermTableSize OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "Real quantity of entries in the MAC Security Permanent Table." ::= { nbMacScrPerm 7 } -- ykfix33 - 1.03.00 - begin nbMacScrPermLoadMS OBJECT-TYPE SYNTAX INTEGER { manual (1), load (2) } ACCESS read-write STATUS mandatory DESCRIPTION "MAC security address loading: 'manual' - user updates the MAC security table manually; 'load' - user wants 'to load' permanent MAC security table from the DRAM to the NVRAM. This object always returns 'manual'." ::= { nbMacScrPerm 8 } -- ykfix33 - 1.03.00 - end -- ************************************************************* -- MAC Security Trap -- This definition uses the TRAP-TYPE macro as -- defined in RFC 1215 [10] -- ************************************************************* unresolvedMAC TRAP-TYPE ENTERPRISE nbMacScr VARIABLES { nbMacScrRunPort, nbMacScrRunPortLockingMAC} DESCRIPTION "The SNMP trap that is generated when the Port receives frame with source address not included in this port's MAC security table." ::= 1 END