CIE1000-PSEC-MIB

All MIBs › CIE1000-PSEC-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2016-06-02

Category: Cisco Devices, VPN and Security

Description: Manages port security (802.1X and MAC-based) configuration and violation actions on Cisco IE1000 industrial Ethernet switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CIE1000-PSEC-MIB?

CIE1000-PSEC-MIB is Cisco's private port-security MIB for the IE1000 series industrial Ethernet switches, covering classic MAC-based port security enforcement. It exposes global security enable/aging settings and per-port configuration for maximum allowed MAC addresses, violation action, and port enable state, along with a status table reflecting current per-port security state. Its monitoring value is primarily software/configuration-status oriented, confirming whether port security is enabled, whether aging is active, and whether ports are in violation which triggers the configured action such as shutdown or restrict, important in industrial networks where unauthorized device connections to field-level switches are a security concern. It is a Cisco private MIB, conceptually parallel to but independent from the IETF/Cisco standard port-security MIBs used on enterprise switches. It's deployed in industrial automation environments using Cisco IE1000 switches to prevent unauthorized devices from joining factory-floor network segments. Engineers can download the CIE1000-PSEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CIE1000-PSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco IE1000 industrial Ethernet switch

Monitoring Examples

An administrator checks cie1000PsecConfigPortTable entries, cie1000PsecConfigPortEnabled, cie1000PsecConfigPortLimit, and cie1000PsecConfigPortAction, to confirm a port allows only the expected number of MAC addresses and has the correct violation action configured. cie1000PsecStatusPortTable is then polled to see the live security state for that port, revealing whether a violation has already been triggered. cie1000PsecConfigGlobalsAgingPeriodSecs is checked when a port unexpectedly re-learns a MAC address, to confirm whether the port-security aging timer, rather than an actual new device, explains the change.

What Can Be Monitored

port security enable state
MAC address aging period
per-port MAC address limit
port security violation action
port security violation status

Imported Objects

From CIE1000-TC

CIE1000DisplayString
CIE1000InterfaceIndex
CIE1000Unsigned16

From CISCO-IE1000-MIB

cie1000SwitchMgmt

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
cie1000PsecMib	1.3.6.1.4.1.9.9.832.1.66			This is a private version of the Port Security MIB
cie1000PsecMibObjects	1.3.6.1.4.1.9.9.832.1.66.1
cie1000PsecConfig	1.3.6.1.4.1.9.9.832.1.66.1.2
cie1000PsecConfigGlobals	1.3.6.1.4.1.9.9.832.1.66.1.2.1
T/F cie1000PsecConfigGlobalsEnabled	1.3.6.1.4.1.9.9.832.1.66.1.2.1.1	TruthValue	read-write	Globally enable/disable aging of secured entries. This doesn't affect aging of addresses secured by other modules.
T/F cie1000PsecConfigGlobalsEnableAging	1.3.6.1.4.1.9.9.832.1.66.1.2.1.2	TruthValue	read-write	If aging is globally enabled, this is the aging period in seconds. Valid range is [10; 10000000] seconds(max is around 115 days).
U32 cie1000PsecConfigGlobalsAgingPeriodSecs	1.3.6.1.4.1.9.9.832.1.66.1.2.1.3	Unsigned32	read-write	If aging is globally enabled, this is the aging period in seconds. Valid range is [10; 10000000] seconds(max is around 115 days).
cie1000PsecConfigPortTable	1.3.6.1.4.1.9.9.832.1.66.1.2.2		not-accessible	This is a table of port configuration per session
cie1000PsecConfigPortEntry	1.3.6.1.4.1.9.9.832.1.66.1.2.2.1		not-accessible	Each session has a set of parameters
NUM cie1000PsecConfigPortIfIndex	1.3.6.1.4.1.9.9.832.1.66.1.2.2.1.1	CIE1000InterfaceIndex	accessible-for-notify	Logical interface number of the physical port.
T/F cie1000PsecConfigPortEnabled	1.3.6.1.4.1.9.9.832.1.66.1.2.2.1.2	TruthValue	read-write	Controls whether Port Security Limit Control is enabled for this port.
U32 cie1000PsecConfigPortLimit	1.3.6.1.4.1.9.9.832.1.66.1.2.2.1.3	Unsigned32	read-write	Maximum number of MAC addresses allowed on this port.Valid values = [PSEC_LIMIT_MIN; PSEC_LIMIT_MAX].
CIE cie1000PsecConfigPortAction	1.3.6.1.4.1.9.9.832.1.66.1.2.2.1.4	CIE1000PsecLimitActionType	read-write	Action to take if number of MAC addresses exceeds the limit. NONE(0) Do nothing, except disallowing further clients. TRAP(1) Send an SNMP trap notification. SHUTDOWN(2) Shut-down the port. TRAP_AND_SHUTDOWN(3) Send an SNMP trap notification and shut-down the port.
cie1000PsecStatus	1.3.6.1.4.1.9.9.832.1.66.1.3
cie1000PsecStatusPortTable	1.3.6.1.4.1.9.9.832.1.66.1.3.1		not-accessible	This is a table of port configuration per session
cie1000PsecStatusPortEntry	1.3.6.1.4.1.9.9.832.1.66.1.3.1.1		not-accessible	Each session has a set of parameters
NUM cie1000PsecStatusPortIfIndex	1.3.6.1.4.1.9.9.832.1.66.1.3.1.1.1	CIE1000InterfaceIndex	accessible-for-notify	Logical interface number of the physical port.
U32 cie1000PsecStatusPortUsers	1.3.6.1.4.1.9.9.832.1.66.1.3.1.1.2	Unsigned32	read-only	Bit masks to indicate what users currently use port security on this port. Where bit 0 - port security limit, bit 1 - 802.1x, bit 2 - voice VLAN.
T/F cie1000PsecStatusPortLimitReached	1.3.6.1.4.1.9.9.832.1.66.1.3.1.1.3	TruthValue	read-only	TRUE if the limit is reached on the port, FALSE otherwise.
T/F cie1000PsecStatusPortShutdown	1.3.6.1.4.1.9.9.832.1.66.1.3.1.1.4	TruthValue	read-only	TRUE if the port is shut down, FALSE otherwise.
U32 cie1000PsecStatusPortMacCount	1.3.6.1.4.1.9.9.832.1.66.1.3.1.1.5	Unsigned32	read-only	Number of MAC addresses currently assigned to this port. The number does NOT include the number of entries that are held due to a H/W failure or S/W failure.
cie1000PsecStatusPortTrapsTable	1.3.6.1.4.1.9.9.832.1.66.1.3.2		not-accessible	This is a table of port configuration per session
cie1000PsecStatusPortTrapsEntry	1.3.6.1.4.1.9.9.832.1.66.1.3.2.1		not-accessible	Each session has a set of parameters
NUM cie1000PsecStatusPortTrapsIfIndex	1.3.6.1.4.1.9.9.832.1.66.1.3.2.1.1	CIE1000InterfaceIndex	accessible-for-notify	Logical interface number of the physical port.
U32 cie1000PsecStatusPortTrapsUsers	1.3.6.1.4.1.9.9.832.1.66.1.3.2.1.2	Unsigned32	read-only	Bit masks to indicate what users currently use port security on this port. Where bit 0 - port security limit, bit 1 - 802.1x, bit 2 - voice VLAN.
T/F cie1000PsecStatusPortTrapsLimitReached	1.3.6.1.4.1.9.9.832.1.66.1.3.2.1.3	TruthValue	read-only	TRUE if the limit is reached on the port, FALSE otherwise.
T/F cie1000PsecStatusPortTrapsShutdown	1.3.6.1.4.1.9.9.832.1.66.1.3.2.1.4	TruthValue	read-only	TRUE if the port is shut down, FALSE otherwise.
U32 cie1000PsecStatusPortTrapsMacCount	1.3.6.1.4.1.9.9.832.1.66.1.3.2.1.5	Unsigned32	read-only	Number of MAC addresses currently assigned to this port. The number does NOT include the number of entries that are held due to a H/W failure or S/W failure.
cie1000PsecControl	1.3.6.1.4.1.9.9.832.1.66.1.4
cie1000PsecControlPortReopenTable	1.3.6.1.4.1.9.9.832.1.66.1.4.1		not-accessible	This is a table to re-open port and move it to ready state, if it was being disabled after limit was reached.
cie1000PsecControlPortReopenEntry	1.3.6.1.4.1.9.9.832.1.66.1.4.1.1		not-accessible	Each session has a set of parameters
NUM cie1000PsecControlPortReopenIfIndex	1.3.6.1.4.1.9.9.832.1.66.1.4.1.1.1	CIE1000InterfaceIndex	accessible-for-notify	Logical interface number of the physical port.
T/F cie1000PsecControlPortReopenPortReOpen	1.3.6.1.4.1.9.9.832.1.66.1.4.1.1.2	TruthValue	read-write	Set to true to reopen after it is shutdown
cie1000PsecStatistics	1.3.6.1.4.1.9.9.832.1.66.1.5
cie1000PsecStatisticsPortTable	1.3.6.1.4.1.9.9.832.1.66.1.5.1		not-accessible	This is a table of port statistics per session
cie1000PsecStatisticsPortEntry	1.3.6.1.4.1.9.9.832.1.66.1.5.1.1		not-accessible	Each session has a set of parameters
NUM cie1000PsecStatisticsPortIfIndex	1.3.6.1.4.1.9.9.832.1.66.1.5.1.1.1	CIE1000InterfaceIndex	accessible-for-notify	Logical interface number of the physical port.
STR cie1000PsecStatisticsPortAgeOrHold	1.3.6.1.4.1.9.9.832.1.66.1.5.1.1.5	CIE1000DisplayString	read-only	Down-counter used in block and ageing process.
STR cie1000PsecStatisticsPortCreationTime	1.3.6.1.4.1.9.9.832.1.66.1.5.1.1.6	CIE1000DisplayString	read-only	Time when this entry was orignally added.
CIE cie1000PsecStatisticsPortState	1.3.6.1.4.1.9.9.832.1.66.1.5.1.1.7	CIE1000PsecStateType	read-only	Current State of a entry, expected state can be either FORWARDING or BLOCKED.
MAC cie1000PsecStatisticsPortMacId	1.3.6.1.4.1.9.9.832.1.66.1.5.1.1.8	MacAddress	read-only	The MAC address that this is all about.
CIE cie1000PsecStatisticsPortVlanId	1.3.6.1.4.1.9.9.832.1.66.1.5.1.1.9	CIE1000Unsigned16	read-only	The VID that this is all about.
cie1000PsecTrap	1.3.6.1.4.1.9.9.832.1.66.1.6
NTF cie1000PsecTrapLimitExceeded	1.3.6.1.4.1.9.9.832.1.66.1.6.1			This trap signals that a row has been added. The index(es) and value(s) of the row is included in the trap.
NTF cie1000PsecTrapMod	1.3.6.1.4.1.9.9.832.1.66.1.6.2			This trap signals that one or more of the objects included in the trap has been updated.
NTF cie1000PsecTrapLimitRecovered	1.3.6.1.4.1.9.9.832.1.66.1.6.3			This trap signals that a row has been deleted. The index(es) of the row is included in the trap.
cie1000PsecMibConformance	1.3.6.1.4.1.9.9.832.1.66.2
cie1000PsecMibCompliances	1.3.6.1.4.1.9.9.832.1.66.2.1
cie1000PsecMibCompliance	1.3.6.1.4.1.9.9.832.1.66.2.1.1			The compliance statement for the implementation.
cie1000PsecMibGroups	1.3.6.1.4.1.9.9.832.1.66.2.2
cie1000PsecConfigGlobalsInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.1			A collection of objects.
cie1000PsecConfigPortTableInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.2			A collection of objects.
cie1000PsecStatusPortTableInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.3			A collection of objects.
cie1000PsecStatusPortTrapsInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.4			A collection of objects.
cie1000PsecControlPortReopenTableInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.5			A collection of objects.
cie1000PsecStatisticsPortTableInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.6			A collection of objects.
cie1000PsecTrapLimitExceededInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.7			Information group containing a trap.
cie1000PsecTrapModInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.8			Information group containing a trap.
cie1000PsecTrapLimitRecoveredInfoGroup	1.3.6.1.4.1.9.9.832.1.66.2.2.9			Information group containing a trap.

RFC description

Port security functionality for Cisco IE1000 switches including aging of secured MAC addresses and port security actions.

Start monitoring Cisco industrial Ethernet switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CIE1000-PSEC-MIB

What Is CIE1000-PSEC-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description