BROCADE-ACL-MIB

All MIBs › BROCADE-ACL-MIB

Organization: Extreme Networks, Inc.

Last Updated: 2018-05-29

Description: Extreme Networks (Brocade) MIB for managing Access Control Lists on network switches, covering ACL definitions, per-interface inbound/outbound assignment, and packet counters

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BROCADE-ACL-MIB?

BROCADE-ACL-MIB is a Brocade SNMP module for managing Access Control Lists on Brocade switches and routers. It exposes configuration data mapping ACL names to internal ACL IDs and types, per-rule Layer 2 ACL definitions such as sequence number, name, and action, and the notification/compliance objects tied to ACL events. Its monitoring role is primarily configuration and policy-state visibility rather than hardware health: it lets an operator confirm which named ACLs exist, their type/level, and the specific permit/deny rules and sequence ordering applied to interfaces, plus receive notifications when ACL-related events occur. It is a vendor-specific extension built on standard SNMPv2 SMI/table conventions, independent of other IETF ACL standards. It is deployed in enterprise and service-provider network environments using Brocade switches where security or QoS policy is enforced via named ACLs. Engineers can download the BROCADE-ACL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in BROCADE-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Brocade/Extreme Networks switch or router

Monitoring Examples

An administrator would poll bcsiAclNameToIdMappingTable/bcsiAclNameToAclIdMappingEntry to resolve a bcsiAclNametoAclIdMappingAclName to its internal bcsiAclNametoAclIdMappingAclId and check bcsiAclNametoAclIdMappingAclType/AclLevel. To audit rule content, bcsiL2NamedAclRuleTable/bcsiL2NamedAclRuleEntry rows keyed by bcsiL2NamedAclId and bcsiL2NamedAclSequenceNumber expose bcsiL2NamedAclAction, letting an operator verify whether a given rule permits or denies traffic and in what order rules are evaluated. Unexpected changes to bcsiL2NamedAclAction values or missing ACL name-to-ID mappings would reveal a misapplied or drifted security policy.

What Can Be Monitored

ACL name-to-ID mappings
ACL type and level
per-rule sequence number and action
ACL-related notifications

Imported Objects

From Brocade-REG-MIB

bcsiModules

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
brocadeACLMIB	1.3.6.1.4.1.1588.3.1.16			MIB module for management of ACLs.
bcsiACLNotifications	1.3.6.1.4.1.1588.3.1.16.0
bcsiACLObjects	1.3.6.1.4.1.1588.3.1.16.1
bcsiAclNameToIdMappingTable	1.3.6.1.4.1.1588.3.1.16.1.1		not-accessible	This table maps the string name of an ACL to its numeric ACL ID for both L2 and L3 ACLs.
bcsiAclNameToAclIdMappingEntry	1.3.6.1.4.1.1588.3.1.16.1.1.1		not-accessible	An entry in the bcsiAclNameToIdMappingTable which lists the ACl-ID for ACL-Names.
STR bcsiAclNametoAclIdMappingAclName	1.3.6.1.4.1.1588.3.1.16.1.1.1.1	BcsiAclNameString	not-accessible	Name of the ACL.
U32 bcsiAclNametoAclIdMappingAclId	1.3.6.1.4.1.1588.3.1.16.1.1.1.2	Unsigned32	read-only	Numeric ID of the ACL.
BCS bcsiAclNametoAclIdMappingAclType	1.3.6.1.4.1.1588.3.1.16.1.1.1.3	BcsiAclType	read-only	ACL can be of two types, namely standard and extended ACL.
BCS bcsiAclNametoAclIdMappingAclLevel	1.3.6.1.4.1.1588.3.1.16.1.1.1.4	BcsiAclLevel	read-only	Protocol Layer at which ACLs are applied. L2 and L3 are the supported levels.
bcsiL2NamedAclRuleTable	1.3.6.1.4.1.1588.3.1.16.1.2		not-accessible	Table to display the L2 Named Access Control List Information listed below among others: - Source MAC address - Source MAC mask - Destination MAC address - Destination MAC mask - VLAN ID - Ethernet type
bcsiL2NamedAclRuleEntry	1.3.6.1.4.1.1588.3.1.16.1.2.1		not-accessible	An entry in the L2 Access Control List table.
U32 bcsiL2NamedAclId	1.3.6.1.4.1.1588.3.1.16.1.2.1.1	Unsigned32	not-accessible	Unique Numeric ID of ACL. It is the same as bcsiAclNametoAclIdMappingAclId in bcsiAclNameToIdMappingTable
U32 bcsiL2NamedAclSequenceNumber	1.3.6.1.4.1.1588.3.1.16.1.2.1.2	Unsigned32	not-accessible	Sequence number is the number associated with rules of ACL
STR bcsiL2NamedAclName	1.3.6.1.4.1.1588.3.1.16.1.2.1.3	BcsiAclNameString	read-only	Represents the name of each configured L2 named ACL. It is the same as bcsiAclNametoAclIdMappingAclName in bcsiAclNameToIdMappingTable
BCS bcsiL2NamedAclAction	1.3.6.1.4.1.1588.3.1.16.1.2.1.4	BcsiAclAction	read-only	Action to take if the ingress L2 packet matches this ACL.
BCS bcsiL2NamedAclSourceType	1.3.6.1.4.1.1588.3.1.16.1.2.1.5	BcsiAclMacType	read-only	Source can be represented in three ways: 1. Mac address in HHHH.HHHH.HHHH format. 2. Any source mac address 3. Host specific mac address Interpretation of bcsiL2NamedAclSourceMacMask depends on the value of this object
MAC bcsiL2NamedAclSourceMac	1.3.6.1.4.1.1588.3.1.16.1.2.1.6	MacAddress	read-write	Optional Source MAC address. It depends on the value of bcsiL2NamedAclSourceType. For standard(1) value of bcsiL2NamedAclSourceType, bcsiL2NamedAclSourceMac is user specified value. For any(2) value of bcsiL2NamedAclSourceType, bcsiL2NamedAclSourceMac is 0. For host(3) value of bcsiL2NamedAclSourceType, bcsiL2NamedAclSourceMac is user specified value.
MAC bcsiL2NamedAclSourceMacMask	1.3.6.1.4.1.1588.3.1.16.1.2.1.7	MacAddress	read-write	Optional Source MAC address mask. By default, it matches with any source MAC within a packet. To match on the first two bytes of the address aabb.ccdd.eeff, use the mask ffff.0000.0000. In this case, the clause matches all source MAC addresses that contain 'aabb' as the first two bytes and any values in the remaining bytes of the MAC address. Applicable for Extended ACLs only.
BCS bcsiL2NamedAclDestinationType	1.3.6.1.4.1.1588.3.1.16.1.2.1.8	BcsiAclMacType	read-write	Destination can be represented in three ways. 1. Mac address in HHHH.HHHH.HHHH format. 2. Any destination mac address 3. Host specific mac address Interpretation of bcsiL2NamedAclDestinationMacMask depends on the value of this object
MAC bcsiL2NamedAclDestinationMac	1.3.6.1.4.1.1588.3.1.16.1.2.1.9	MacAddress	read-write	Optional destination MAC address. By default, it matches with any destination MAC within a packet. It depends on the value of bcsiL2NamedAclDestinationType. For standard(1) value of bcsiL2NamedAclDestinationType, bcsiL2NamedAclDestinationMac is user specified value. For any(2) value of bcsiL2NamedAclDestinationType, bcsiL2NamedAclDestinationMac is 0. For host(3) value of bcsiL2NamedAclDestinationType, bcsiL2NamedAclDestinationMac is user specified value. Applicable for Extended ACLs only.
MAC bcsiL2NamedAclDestinationMacMask	1.3.6.1.4.1.1588.3.1.16.1.2.1.10	MacAddress	read-write	Optional destination MAC address mask. By default, it matches with any destination MAC within a packet. To match on the first two bytes of the address aabb.ccdd.eeff, use the mask ffff.0000.0000. In this case, the clause matches all destination MAC addresses that contain 'aabb' as the first two bytes and any values in the remaining bytes of the MAC address. Applicable for Extended ACLs only.
T/F bcsiL2NamedAclCount	1.3.6.1.4.1.1588.3.1.16.1.2.1.11	TruthValue	read-write	Indicates if the user has enabled/disabled count for number of packets against which the configured action is taken, for a given rule
T/F bcsiL2NamedAclCopySflow	1.3.6.1.4.1.1588.3.1.16.1.2.1.12	TruthValue	read-write	Indicates whether to sample the packet for sflow collection or not
BCS bcsiL2NamedAclDropPrecedenceForce	1.3.6.1.4.1.1588.3.1.16.1.2.1.13	BcsiDropPrecedenceForce	read-write	Force ingress drop precedence
BCS bcsiL2NamedAclVlanTagFormat	1.3.6.1.4.1.1588.3.1.16.1.2.1.14	BcsiVlanTagFormat	read-write	Vlan tag format can be of 3 types, namely single-tagged, double-tagged and untagged. When neither of these 3 types of tag are used, the feild is represented by 0. When the value of this field is single-tagged(1),bcsiL2NamedAclVlanId represents the Vlan ID.
BCS bcsiL2NamedAclInnerVlanId	1.3.6.1.4.1.1588.3.1.16.1.2.1.15	BcsiVlanIdOrNoneTC	read-write	vlan ID of the tagged inner vlan. If bcsiL2NamedAclVlanTagFormat is double-tagged(2), then 0 value of this field indicates any.
BCS bcsiL2NamedAclOuterVlanId	1.3.6.1.4.1.1588.3.1.16.1.2.1.16	BcsiVlanIdOrNoneTC	read-write	Vlan ID of the tagged outer vlan. If bcsiL2NamedAclVlanTagFormat is double-tagged(2), then 0 value of bcsiL2NamedAclInnerVlanId indicates any.
BCS bcsiL2NamedAclVlanId	1.3.6.1.4.1.1588.3.1.16.1.2.1.17	BcsiVlanIdOrNoneTC	read-write	Optional VLAN ID to match against that of the incoming packet. By default, the VLAN ID field is ignored during the match. In this case, value 0 is returned. This field is interpreted as Vlan ID when bcsiL2NamedAclVlanTagFormat is either 0(not tagged) or 1(single-tagged). Supported for Extended ACL only.
U32 bcsiL2NamedAclEthernetType	1.3.6.1.4.1.1588.3.1.16.1.2.1.18	Unsigned32	read-write	Ethernet Type to match against the 'Ethertype' field in the L2 header of the incoming packet. By default, etype field is ignored during the match. Applicable for Extended ACLs only.
T/F bcsiL2NamedAclArpGuard	1.3.6.1.4.1.1588.3.1.16.1.2.1.19	TruthValue	read-write	Represents enabling/disabling of arp-gurad for a given ACL
BCS bcsiL2NamedAclDot1Priority	1.3.6.1.4.1.1588.3.1.16.1.2.1.20	BcsiPortQosTC	read-write	The priority option assigns traffic that matches the ACL to a hardware forwarding queue. In addition to changing the internal forwarding priority, if the outgoing interface is an 802.1q interface, this option maps the specified priority to its equivalent 802.1p (QoS) priority and marks the packet with the new 802.1p priority. This option is applicable for inbound ACLs only. NOTE: bcsiL2NamedAclDot1Priority following bcsiL2NamedAclDot1PriorityForce cannot be used together in an ACL entry. Applicable for Extended ACLs only.
BCS bcsiL2NamedAclDot1PriorityForce	1.3.6.1.4.1.1588.3.1.16.1.2.1.21	BcsiPortQosTC	read-write	The priority-force option assigns packets of outgoing traffic that match the ACL to a specific hardware forwarding queue, even though the incoming packet may be assigned to another queue. This option is applicable for inbound ACLs only. NOTE: bcsiL2NamedAclDot1Priority following bcsiL2NamedAclDot1PriorityForce cannot be used together in an ACL entry. Applicable for Extended ACL only
T/F bcsiL2NamedAclMirrorPackets	1.3.6.1.4.1.1588.3.1.16.1.2.1.22	TruthValue	read-write	Mirror packets matching ACL permit clause. Applicable for Extended ACLs only
T/F bcsiL2NamedAclLogEnable	1.3.6.1.4.1.1588.3.1.16.1.2.1.23	TruthValue	read-write	Optional parameter to enable logging only when deny clause is specified. Note that traffic denied by implicit deny mechanism is not subject to logging. The implicit deny kicks in when the traffic does not match any of the clauses and there is no 'permit any any' clause specified at the end.
bcsiAclIfBindTable	1.3.6.1.4.1.1588.3.1.16.1.3		not-accessible	Table for binding L2 and L3 ACLs to interfaces. - One cannot bind Layer 2 ACLs and Layer 3 ACLs to the same port. However, configuration can be made on one port to use Layer 2 ACLs, and another port on the same device to use Layer 3 ACLs. - In general, Layer 2 ACLs cannot be bound to virtual interfaces, unlike L3 ACLs. - One can not modify an existing Layer 2 ACL clause. For that, one must unbind the ACL, delete it and make a new clause.
bcsiAclIfBindEntry	1.3.6.1.4.1.1588.3.1.16.1.3.1		not-accessible	An entry in the L2 and L3 ACL binding table which lists the ACL bindings to an interface.
BCS bcsiAclIfBindDirection	1.3.6.1.4.1.1588.3.1.16.1.3.1.1	BcsiTrafficDirection	not-accessible	Direction in which this ACL should be applied on this port.
STR bcsiAclIfBindAclName	1.3.6.1.4.1.1588.3.1.16.1.3.1.2	BcsiAclNameString	read-create	Represents the Name of each configured L2 or L3 named ACL. It is the same as bcsiAclNametoAclIdMappingAclName in bcsiAclNameToIdMappingTable
bcsiACLConformance	1.3.6.1.4.1.1588.3.1.16.2

RFC description

Manages Access Control List (ACL) configuration and monitoring on Extreme/Brocade switches.

Start monitoring Brocade/Extreme Networks switches and routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BROCADE-ACL-MIB

What Is BROCADE-ACL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description