ARUBAWIRED-PORTSECURITY-MIB

All MIBs › ARUBAWIRED-PORTSECURITY-MIB

Organization: HPE/Aruba Networking Division

Last Updated: 2021-10-20

Category: VPN and Security, Vendor: Aruba

Description: Manages MAC-based port security policies and violation actions on Aruba CX switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ARUBAWIRED-PORTSECURITY-MIB?

ARUBAWIRED-PORTSECURITY-MIB is an HPE/Aruba Networking Division proprietary MIB implementing Port Security on Aruba wired switches. Its objects cover a global enable flag, a port table (enable, client limit, current secure-MAC count, violation action, client-violation status/reason, violation counts, recovery timer, shutdown-recovery flag, sticky enable), a client table (port name, MAC, authorization state, MAC type), and a static-MAC-configuration table. As a configuration/security MIB it lets an administrator confirm per-port MAC-address limits and violation handling on an Aruba wired switch. It is deployed on HPE/Aruba wired switches. Engineers can download the ARUBAWIRED-PORTSECURITY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ARUBAWIRED-PORTSECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HPE/Aruba wired switches

Monitoring Examples

An administrator checks arubaWiredClientViolationReason and arubaWiredClientLimitViolationCount to diagnose a port-security violation on an Aruba wired switch.

What Can Be Monitored

per-port MAC-address limit and violation status

Imported Objects

From ARUBAWIRED-NETWORKING-OID

wndFeatures

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using arubaWiredClientLimitViolationCount OID:

Select an Aruba (HPE) ArubaOS-CX wired switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type arubaWiredClientLimitViolationCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of client limit violations that have occurred on this port since system boot. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
arubaWiredPortSecurityMIB	1.3.6.1.4.1.47196.4.1.1.3.21			This MIB module for Port Security
arubaWiredPortSecurityNotifications	1.3.6.1.4.1.47196.4.1.1.3.21.0
NTF arubaWiredPortSecurityViolationStatusChange	1.3.6.1.4.1.47196.4.1.1.3.21.0.1			This notification is generated when a violation is triggered.
arubaWiredPortSecurityObjects	1.3.6.1.4.1.47196.4.1.1.3.21.1
arubaWiredPortSecurityGlobalObjects	1.3.6.1.4.1.47196.4.1.1.3.21.1.1
T/F arubaWiredPortSecurityGlobalEnable	1.3.6.1.4.1.47196.4.1.1.3.21.1.1.1	TruthValue	read-write	Indicates whether Port Security is enabled or disabled. By default this object will have a value of false.
arubaWiredPortSecurityPortObjects	1.3.6.1.4.1.47196.4.1.1.3.21.1.2
arubaWiredPortSecurityPortTable	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1		not-accessible	A list of port security configuration and status entries. The number of entries is determined by the number of ports in the system that can support the port security feature. Ports that are not port security capable will not be displayed in this table. This table includes ports on which port security parameters can be set even if port security feature itself cannot be enabled due to conflict with other features.
arubaWiredPortSecurityPortEntry	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1		not-accessible	Port Security configuration information for a single port.
U32 arubaWiredifIndex	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.1	Unsigned32	read-only	Indicates the unique port index.
T/F arubaWiredPortSecurityEnable	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.2	TruthValue	read-write	This object indicates whether port security feature is enabled on a port. The default value is false.
U32 arubaWiredClientLimit	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.3	Unsigned32	read-write	The maximum number (N) of MAC addresss to be secured on the interface. The first N MAC addresss learned or configured are made secured.
U32 arubaWiredCurrentSecureMacAddrCount	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.4	Unsigned32	read-only	The current number of MAC addresss secured on this interface.
INT arubaWiredViolationAction	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.5	INTEGER	read-write	Determines the action that the device will take if the traffic matches the port security violation. notify(1) - Send an SNMP trap and log an event when a violation occurs. shutdown(2) - Send an SNMP trap, log an event and shutdown the port when a violation occurs.
T/F arubaWiredClientViolationStatus	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.6	TruthValue	read-only	Indicates whether this port is currently in violation state or not.
INT arubaWiredClientViolationReason	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.7	INTEGER	read-only	This object represents the reason for violation. none(0) - None of the violation is triggered. clientLimitExceeded(1) - Indicates whether the port is in a state where its client limit has been violated. This will be reset when the client limit reduces to below the threshold or the link goes down. stickyClientMove(2) - Indicates whether the port is in a state where sticky mac client move has been violated. This will be reset when the link goes down.
C32 arubaWiredClientLimitViolationCountEx	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.8	Counter32	read-only	Number of client limit violations that have occurred on this port since system boot.
C32 arubaWiredStickyClientMoveViolationCount	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.9	Counter32	read-only	Number of sticky mac client move violations that have occurred on this port since system boot.
U32 arubaWiredRecoveryTimer	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.10	Unsigned32	read-write	Time in seconds after which the port will be re-enabled if it was shutdown in response to a violation event. This is only applicable if shutdown recovery is enabled.
T/F arubaWiredShutdownRecovery	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.11	TruthValue	read-write	Enable auto-recovery for the port. This is only relevant when the violation action is set to shutdown. The port is re-enabled after the recovery timer has expired.
T/F arubaWiredStickyEnable	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.1.1.12	TruthValue	read-write	Indicates whether port security sticky MAC learning is enabled on this port. This is only supported on physical ports.
arubaWiredPortSecurityClientTable	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.2		not-accessible	Information describing the port security clients.
arubaWiredPortSecurityClientEntry	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.2.1		not-accessible	Information describing the port security client.
STR arubaWiredClientPortName	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.2.1.1	DisplayString	not-accessible	The port ifIndex of the client
MAC arubaWiredClientMac	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.2.1.2	MacAddress	read-only	MAC address of the client
STR arubaWiredClientAuthorizationState	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.2.1.3	DisplayString	read-only	State of the port security client.
ARU arubaWiredClientMacType	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.2.1.4	ArubaWiredPortSecurityMacAddrType	read-only	The learnt type of the MAC address.
arubaWiredPortSecurityMacCfgTable	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.3		not-accessible	A list of port security static MAC configuration entries.
arubaWiredPortSecurityMacCfgEntry	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.3.1		not-accessible	Information describing the port security static MAC configuration entries.
U32 arubaWiredPortifIndex	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.3.1.1	Unsigned32	not-accessible	Indicates the unique port index.
T/F arubaWiredStaticMacType	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.3.1.2	TruthValue	not-accessible	Determines the type of MAC address. 0 - The non sticky MAC address. 1 - The sticky MAC address.
MAC arubaWiredStaticClientMac	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.3.1.3	MacAddress	not-accessible	MAC address of the client.
VID arubaWiredClientMacVidList	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.3.1.4	VidList	read-create	List of VLANs on which this mac address is configured.
ROW arubaWiredMacAddrRowStatus	1.3.6.1.4.1.47196.4.1.1.3.21.1.2.3.1.5	RowStatus	read-create	This object is a conceptual row entry that allows adding or deleting static port security mac entries on a port.
arubaWiredPortSecurityConformance	1.3.6.1.4.1.47196.4.1.1.3.21.2
arubaWiredPortSecurityGroups	1.3.6.1.4.1.47196.4.1.1.3.21.2.1
arubaWiredPortSecurityPortGroup	1.3.6.1.4.1.47196.4.1.1.3.21.2.1.1			These objects are used for describing Port Security port parameters
arubaWiredPortSecurityClientGroup	1.3.6.1.4.1.47196.4.1.1.3.21.2.1.2			These objects are used for describing Port Security Client parameters
arubaWiredPortSecurityMacCfgGroup	1.3.6.1.4.1.47196.4.1.1.3.21.2.1.3			These objects are used for describing Port Security static mac parameters
arubaWiredPortSecurityGlobalCfgGroup	1.3.6.1.4.1.47196.4.1.1.3.21.2.1.4			These objects are used for describing port security global configuration parameters
arubaWiredPortSecurityNotificationsGroup	1.3.6.1.4.1.47196.4.1.1.3.21.2.1.5			A collection of Port security notification objects.
arubaWiredPortSecurityCompliances	1.3.6.1.4.1.47196.4.1.1.3.21.2.2
arubaWiredPortSecurityCompliance	1.3.6.1.4.1.47196.4.1.1.3.21.2.2.1			The compliance statement for devices with support of Port Access Clients

RFC description

Enforces port security policies, including MAC address filtering and port access control.

Start monitoring Aruba (HPE) ArubaOS-CX wired switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ARUBAWIRED-PORTSECURITY-MIB