A3COM0021-PORT-SECURITY

All MIBs › A3COM0021-PORT-SECURITY

Category: Security

Description: Manages port security settings on 3Com switches including MAC address filtering and lockdown.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is A3COM0021-PORT-SECURITY?

A3COM0021-PORT-SECURITY is a private 3Com MIB for configuring and monitoring port security on 3Com switches, a Layer 2 feature that restricts which MAC addresses may communicate through a switch port. It exposes per-port security mode, intrusion-action policy, maximum allowed address count, and a table of the actual learned/secured MAC addresses per port. Its monitoring value is software/security-status oriented: an operator checks whether a port has reached its maximum secured-address limit or has triggered its configured intrusion action (such as shutting the port down or discarding frames) in response to an unauthorized MAC address appearing. It has no explicit external MIB dependency beyond the vendor's own bridge/port model, though it is conceptually related to the standards-based IEEE 802.1X port-access-control framework. It is deployed on 3Com access-layer switches in environments where physical port access must be restricted to known devices. Engineers can download the A3COM0021-PORT-SECURITY file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in A3COM0021-PORT-SECURITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

3Com Layer 2 access switches

Monitoring Examples

An operator walks securePortTable/securePortEntry (indexed by secureSlotIndex and securePortIndex) to compare secureNumberAddressesStored against secureMaximumAddresses, revealing a port that has hit its secured-address cap and is now rejecting new devices. Checking secureIntrusionAction alongside secureAddressTable/secureAddressEntry shows whether an unauthorized MAC address triggered a shutdown or logging action on a given port, and secureNeedToKnowMode confirms whether the port is restricted to only explicitly configured addresses.

What Can Be Monitored

secured MAC address count per port
maximum allowed addresses per port
intrusion action triggered
port security mode
learned secure address list

Imported Objects

From A3COM0004-GENERIC

securePort

OBJECT-IDENTITY

From RFC-1212

OBJECT-TYPE

From RFC-1215

TRAP-TYPE

From SNMP-REPEATER-MIB

rptrPortAdminStatus

OBJECT-TYPE

OIDs

OID symbolic	OID numeric	Type	Access	Description
securePortTable	1.3.6.1.4.1.43.10.22.1		not-accessible	This table defines the security status of each secure port. Each port can have a number of authorised MAC addresses, and these are stored in the secureAddressTable.
securePortEntry	1.3.6.1.4.1.43.10.22.1.1		not-accessible	There is a row in this table for each secure port, and allows repeater ports to be configured for security on a per port basis. It is indexed using the objects secureSlotIndex and securePortIndex.
INT secureSlotIndex	1.3.6.1.4.1.43.10.22.1.1.1	INTEGER	read-only	The slot or unit number of the secure port. This is the first index into the securePortTable.
INT securePortIndex	1.3.6.1.4.1.43.10.22.1.1.2	INTEGER	read-only	The port number of the secure port. This is the second index into the securePortTable.
INT securePortMode	1.3.6.1.4.1.43.10.22.1.1.3	INTEGER	read-write	Determines the learning and security modes of the port. See secureNeedToKnowMode and secureIntrusionAction to configure Need To Know and Intrusion Action on each port. (When in a learning mode, secureNumberAddresses determines the maximum number of addresses that can be learned on the port. This is set by the user.) noRestrictions(1) All learning and security are disabled. continuousLearning(2) Addresses are learned continually. If more addresses are learned than are permitted on the port, then one of the older entries will be aged out. Need To Know and Intrusion Action depends on secureNeedToKnowMode and secureIntrusionAction respectively. autoLearn(3) All addresses for this port are deleted, and then addresses are learned up to the number permitted. securePortMode is then set to secure. Need To Know and Intrusion Action depends on secureNeedToKnowMode and secureIntrusionAction respectively. secure(4) Learning is disabled. Need To Know and Intrusion Action depends on secureNeedToKnowMode and secureIntrusionAction respectively. The secureAddressLearned trap is sent whenever a station has been learned. The secureViolation trap is sent whenever a packet is received from an unauthorised station.
INT secureNeedToKnowMode	1.3.6.1.4.1.43.10.22.1.1.4	INTEGER	read-write	Attribute to determine which frames are to be forwarded to this port intact. 1 - Need To Know is not available. 2 - All frames. 3 - Frames addressed to the authorised devices only. 4 - Frames addressed to the authorised devices, plus all broadcast frames. 5 - Frames addressed to the authorised devices, plus all broadcast and multicast frames. 6 - As 3 and cannot be changed. 7 - As 4 and cannot be changed. 8 - As 5 and cannot be changed. If this object returns 1,6,7 or 8, it means that the Need To Know configuration cannot be changed, and any attempt to write to this object will cause an error.
INT secureIntrusionAction	1.3.6.1.4.1.43.10.22.1.1.5	INTEGER	read-write	Attribute to determine the action if an unauthorised device tranmsits on this port.
INT secureNumberAddresses	1.3.6.1.4.1.43.10.22.1.1.6	INTEGER	read-write	The maximum number of addresses that the port can learn or store. Reducing this number may cause some addresses to be deleted. This value is set by the user and cannot be automatically changed by the agent. The following relationship must be preserved. secureNumberAddressesStored <= secureNumberAddresses <= secureMaximumAddresses
INT secureNumberAddressesStored	1.3.6.1.4.1.43.10.22.1.1.7	INTEGER	read-only	The number of addresses that are currently in the AddressTable for this port. If this object has the same value as secureNumberAddresses, then no more addresses can be authorised on this port. The following relationship must allows be preserved. secureNumberAddressesStored <= secureNumberAddresses <= secureMaximumAddresses
INT secureMaximumAddresses	1.3.6.1.4.1.43.10.22.1.1.8	INTEGER	read-only	This indicates the maximum value that secureNumberAddresses can be set to. It is dependent on the resources available so may change, eg. if resources are shared between ports, then this value can both increase and decrease. This object must be read before setting secureNumberAddresses. The following relationship must allows be preserved. secureNumberAddressesStored <= secureNumberAddresses <= secureMaximumAddresses
secureAddressTable	1.3.6.1.4.1.43.10.22.2		not-accessible	This table which stores the MAC addresses assigned to each port. Addresses will normally defined as authorised, and describe the devices which are permitted to transmit and receive on the corresponding port. This table can be written to by the agent as well as the management station.
secureAddressEntry	1.3.6.1.4.1.43.10.22.2.1		not-accessible	This table allows multiple addresses to be assigned to each secure port. It is indexed using the objects secureAddrSlotIndex, secureAddrPortIndex and secureAddrMAC.
INT secureAddrSlotIndex	1.3.6.1.4.1.43.10.22.2.1.1	INTEGER	read-only	The slot or unit number of the secure port. This is the first index into the secureAddressTable.
INT secureAddrPortIndex	1.3.6.1.4.1.43.10.22.2.1.2	INTEGER	read-only	The port number of the secure port. This is the second index into the secureAddressTable.
OCT secureAddrMAC	1.3.6.1.4.1.43.10.22.2.1.3	OCTET STRING	read-only	The MAC address of a station assigned to this port. This is the third index into the secureAddressTable.
INT secureAddrRowStatus	1.3.6.1.4.1.43.10.22.2.1.4	INTEGER	read-write	This manages the creation and deletion or rows, and shows the current status of the indexed MAC address. This object has the following values. 1 - The indexed MAC address is authorised on this port. 2 - The indexed MAC address is not authorised on this port. 3 - Not applicable. (This value indicates an incomplete row.) 4 - Assign a new MAC address to the port and authorise immediately. 5 - Assign a new MAC address to the port, but do not authorise until active(1) is written to this object. 6 - Delete this entry. When creating a new entry, index a new row and use createAndGo(4) or createAndWait(5). Some hardware will not allow the address to be unauthorised, and will automatically switch the row to active(1). When reading this object, only active(1) and notInService(2) will be returned. Only the values active(1) and destroy(6) will be allowed for an existing row, or createAndGo(4) and createAndWait(5) for a new row.
INT secureStop	1.3.6.1.4.1.43.10.22.3	INTEGER	read-only	A MIB object to speed up access to the security tables. When performing a get-next through the table, this object is accessed as soon as the table is passed and allows the management to quickly determine the end of the table.

RFC description

Configures port-level security policies including MAC address learning, intrusion detection, and access control on 3Com network devices.

Start monitoring Legacy 3Com access switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download A3COM0021-PORT-SECURITY

What Is A3COM0021-PORT-SECURITY?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description