BAY-STACK-SOURCE-GUARD-MIB

All MIBs › BAY-STACK-SOURCE-GUARD-MIB

Organization: Nortel Ltd.

Last Updated: 2008-10-30

Category: VPN and Security, Vendor: Avaya

Description: Manages IP Source Guard configuration and binding table enforcement on Avaya/Nortel BayStack ERS switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BAY-STACK-SOURCE-GUARD-MIB?

BAY-STACK-SOURCE-GUARD-MIB manages IP Source Guard, a Layer-2 security feature on Avaya/Nortel BayStack/ERS switches that restricts traffic on an interface to only IP/MAC address bindings learned via DHCP snooping or configured statically. It exposes per-interface enable mode, a binding table of allowed address/MAC pairs and their learning source, and statistics/notification objects for violations. Its primary monitoring value is security and software state: verifying which ports are protected and catching violation traps when an unauthorized IP address appears, rather than reporting physical hardware faults. It complements the switch's DHCP snooping feature and the companion BAY-STACK-ARP-INSPECTION-MIB, sharing the same interface/VLAN indexing model. It is typically deployed on Avaya/Nortel enterprise access switches to prevent IP address spoofing on untrusted ports. Engineers can download the BAY-STACK-SOURCE-GUARD-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in BAY-STACK-SOURCE-GUARD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Avaya/Nortel BayStack switch
Ethernet Routing Switch (ERS)

Monitoring Examples

An operator checks bsSourceGuardConfigTable/bsSourceGuardConfigEntry for bsSourceGuardConfigMode on each access port, then inspects bsSourceGuardAddrTable/bsSourceGuardAddrEntry to see which bsSourceGuardAddrAddress/bsSourceGuardAddrMACAddr pairs are permitted and their bsSourceGuardAddrSource (dynamic vs. static). A rise in bsSourceGuardStatsTable violation counts or a bsSourceGuardNotifications trap indicates a host attempting to send traffic with a spoofed or unbound IP address.

What Can Be Monitored

per-interface source guard mode
IP/MAC binding table
binding source (dynamic/static)
source guard violation statistics

Imported Objects

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress

From SYNOPTICS-ROOT-MIB

bayStackMibs

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using bsSourceGuardStatsDroppedPackets OID:

Select an Avaya/Nortel BayStack switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type bsSourceGuardStatsDroppedPackets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of received packets on this interface that were dropped due to IP source guard filtering. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
bayStackSourceGuardMib	1.3.6.1.4.1.45.5.20			This MIB module is used for IP Source Guard settings in Nortel's software and products.
bsSourceGuardNotifications	1.3.6.1.4.1.45.5.20.0
NTF bsSourceGuardReachedMaxIpEntries	1.3.6.1.4.1.45.5.20.0.1			This notification is generated when the maximum number of IP entries on a port has been reached. The port is identified by the instance of bssourceGuardConfigMode included in the notification.
NTF bsSourceGuardCannotEnablePort	1.3.6.1.4.1.45.5.20.0.2			This notification is generated when there are insufficient resources available to enable IP source guard checking on a port. Note that this notification will not be generated as the result of a management operation, but rather only as a result of internal state changes within the system (for example, system initialization). The port for which the notification is generated is identified by the instance of bsSourceGuardConfigMode included in the notification.
bsSourceGuardObjects	1.3.6.1.4.1.45.5.20.1
bsSourceGuardConfigTable	1.3.6.1.4.1.45.5.20.1.1		not-accessible	This table is used to configure IP Source Guard per port.
bsSourceGuardConfigEntry	1.3.6.1.4.1.45.5.20.1.1.1		not-accessible	An entry containing objects for configuring IP Source Guard settings for a port.
NUM bsSourceGuardConfigIfIndex	1.3.6.1.4.1.45.5.20.1.1.1.1	InterfaceIndex	not-accessible	The interface on which Source Guard configuration setting apply.
INT bsSourceGuardConfigMode	1.3.6.1.4.1.45.5.20.1.1.1.2	INTEGER	read-write	This object is used to control the Source Guard mode on an interface. The values are as follows: disabled(1) - Source Guard is disabled on this interface. ip(2) - Source Guard only allows traffic from a list of IP addresses on this interface.
bsSourceGuardAddrTable	1.3.6.1.4.1.45.5.20.1.2		not-accessible	This table contains a list of internet and/or MAC addresses allowed by Source Guard on an interface. An entry in this table must indicate either a valid internet address and/or a valid MAC address. This means that an entry may not exist where the value of bsSourceGuardAddrType is unknown(0) and the value of bsSourceGuardAddrMACAddr is 00:00:00:00:00:00. If an entry indicates only an internet address, Source Guard will allow that address regardless of MAC address. Note that currently, MAC addresses are not supported. This means that currently, the value of bsSourceGuardAddrMACAddr must always by 00:00:00:00:00:00, and the value of bsSourceGuardAddrType must not be unknown(0).
bsSourceGuardAddrEntry	1.3.6.1.4.1.45.5.20.1.2.1		not-accessible	An entry containing an address allowed by Source Guard on an interface.
NUM bsSourceGuardAddrIndex	1.3.6.1.4.1.45.5.20.1.2.1.1	InterfaceIndex	not-accessible	The ifIndex value of the interface.
IPt bsSourceGuardAddrType	1.3.6.1.4.1.45.5.20.1.2.1.2	InetAddressType	not-accessible	The type of internet address contained in the corresponding instance of bsSourceGuardAddrAddress. If the value of this object is other(0), then the corresponding instance of bsSourceGuardAddrAddress must be a zero length value.
IP bsSourceGuardAddrAddress	1.3.6.1.4.1.45.5.20.1.2.1.3	InetAddress	not-accessible	The internet address allowed by Source Guard on this interface. If this object contains a zero length value, then the Source Guard feature will not use the value.
MAC bsSourceGuardAddrMACAddr	1.3.6.1.4.1.45.5.20.1.2.1.4	MacAddress	not-accessible	The ethernet MAC address allowed by Source Guard on this interface. If this object contains the value 00:00:00:00:00:00, then the Source Guard feature will not use the value.
INT bsSourceGuardAddrSource	1.3.6.1.4.1.45.5.20.1.2.1.5	INTEGER	read-only	The source of the address(es). Currently, the only source is from dhcp snooping. In the future, static addresses will be allowed.
bsSourceGuardStatsTable	1.3.6.1.4.1.45.5.20.1.3		not-accessible	Per-interface IP Source Guard statistics.
bsSourceGuardStatsEntry	1.3.6.1.4.1.45.5.20.1.3.1		not-accessible	An entry containing Source Guard statistics for an interface.
NUM bsSourceGuardStatsIfIndex	1.3.6.1.4.1.45.5.20.1.3.1.1	InterfaceIndex	not-accessible	The ifIndex value of the interface.
C32 bsSourceGuardStatsDroppedPacketsEx	1.3.6.1.4.1.45.5.20.1.3.1.2	Counter32	read-only	The number of received packets on this interface that were dropped due to IP source guard filtering.

RFC description

Vendor-private MIB for Bay Networks/Nortel Bay Stack switches; manages Dynamic Host Configuration Protocol (DHCP) Snooping and IP Source Guard features.

Start monitoring Avaya/Nortel BayStack switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BAY-STACK-SOURCE-GUARD-MIB