CIENA-CES-ACL-MIB

All MIBs › CIENA-CES-ACL-MIB

Organization: Ciena, Inc

Last Updated: 2012-11-21

Category: Vendor: Ciena

Description: Provides ACL configuration and statistics for Ciena CES Carrier Ethernet switch platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CIENA-CES-ACL-MIB?

CIENA-CES-ACL-MIB is a Ciena vendor MIB for the Carrier Ethernet Solutions (CES) switch/service platform, defining access control list (ACL) configuration objects and associated notifications. It exposes ACL rule definitions, rule statistics (match/permit/deny counters), and traps signaling ACL-related events such as rule violations or resource limits. Its monitoring value is primarily around security/software configuration status and traffic filtering counters, letting an operator confirm ACLs are correctly applied and see how much traffic each rule is matching, plus be alerted via traps to ACL resource exhaustion or policy violations. It depends on Ciena's broader CES platform MIB framework for interface and system context. It is deployed on Ciena Carrier Ethernet switches in metro/access networks where service providers enforce and audit traffic filtering policies per customer or service, and network engineers can download the CIENA-CES-ACL-MIB file to load it into a MIB browser for these switches.

IPNetwork Monitor allows you to monitor SNMP objects defined in CIENA-CES-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Ciena Carrier Ethernet Solutions (CES) switch

Monitoring Examples

No object names were captured for this module, so specific OIDs cannot be cited; based on the module description, an admin would typically poll per-rule ACL match/permit/deny counters and subscribe to the module's notifications to detect a misconfigured or over-triggering ACL rule affecting customer traffic.

What Can Be Monitored

ACL rule match counters
ACL permit/deny statistics
ACL-related trap/notification events
ACL resource utilization

Imported Objects

From CIENA-SMI

cienaCesConfig

OBJECT-IDENTITY

From CIENA-TC

CienaGlobalState

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE

OIDs

OID symbolic	OID numeric	Type	Access	Description
cienaCesAclMIB	1.3.6.1.4.1.1271.2.1.25			This module defines the ACL details and the associated notifications.
cienaCesAclMIBObjects	1.3.6.1.4.1.1271.2.1.25.1
cienaCesAclGlobal	1.3.6.1.4.1.1271.2.1.25.1.1
CIE cienaCesAclAdminState	1.3.6.1.4.1.1271.2.1.25.1.1.1	CienaGlobalState	read-only	This object indicates the global IP ACL state.
C32 cienaCesAclCacheHit	1.3.6.1.4.1.1271.2.1.25.1.1.2	Counter32	read-only	This object indicates the number of lookups satisfied by a cache hit.
C32 cienaCesAclNoHit	1.3.6.1.4.1.1271.2.1.25.1.1.3	Counter32	read-only	This object indicates the number of lookups that failed because the source ip address did not match a table entry.
C32 cienaCesAclBadPort	1.3.6.1.4.1.1271.2.1.25.1.1.4	Counter32	read-only	This object indicates the number of lookups that failed because the ingress port was disallowed by a table entry.
C32 cienaCesAclBadDscp	1.3.6.1.4.1.1271.2.1.25.1.1.5	Counter32	read-only	This object indicates the number of lookups that failed because the ingress DSCP value was disallowed by a table entry.
CIE cienaCesAclOperState	1.3.6.1.4.1.1271.2.1.25.1.1.6	CienaGlobalState	read-only	This object indicates the current operational state of the IP ACL system.
C32 cienaCesAclInUseEntries	1.3.6.1.4.1.1271.2.1.25.1.1.7	Counter32	read-only	This object indicates the number of IP ACL rules that are currently configured.
C32 cienaCesAclMaxEntries	1.3.6.1.4.1.1271.2.1.25.1.1.8	Counter32	read-only	This object indicates the maximum number of IP ACL rules that can be configured.
C32 cienaCesAclBadProtocol	1.3.6.1.4.1.1271.2.1.25.1.1.9	Counter32	read-only	This object indicates the number of lookups that failed because protocol didn't match protocol allowed for matching src/dst subnet
cienaCesAclRules	1.3.6.1.4.1.1271.2.1.25.1.2
cienaCesAclTable	1.3.6.1.4.1.1271.2.1.25.1.2.1		not-accessible	The (conceptual) table listing the parameters for the IP ACL table.
cienaCesAclEntry	1.3.6.1.4.1.1271.2.1.25.1.2.1.1		not-accessible	An entry (conceptual row) in the cienaCesAclTable.
IPt cienaCesAclEntryInetAddrType	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.1	InetAddressType	not-accessible	This object indicates the IP network type which will be authorized. This OID specifies the Inet address type of the OIDs cienaCesAclEntryInetAddr and cienaCesAclEntryInetPrefixLength. When representing: ipv4 : cienaCesAclEntryInetAddr should be compliant with InetAddressIPv4 from RFC 4001 ipv6 : cienaCesAclEntryInetAddr should be compliant with InetAddressIPv6 from RFC 4001
IP cienaCesAclEntryInetAddr	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.2	InetAddress	read-only	This object indicates the source IP network address that will be authorized. This OID should be used in conjunction with cienaCesAclEntryInetAddrType and should be compliant with RFC 4001 InetAddressType.
ADR cienaCesAclEntryInetPrefixLength	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.3	InetAddressPrefixLength	not-accessible	This object indicates the prefix length for the source IP network that will be authorized. This OID should be used in conjunction with cienaCesAclEntryInetAddrType.
C32 cienaCesAclEntryHits	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.4	Counter32	read-only	This object indicates the number of lookups that matched the table entry.
C32 cienaCesAclEntryBadPort	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.5	Counter32	read-only	This object indicates the number of lookups that failed because the ingress port was disallowed by the table entry.
OCT cienaCesAclEntryDscpMask	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.6	OCTET STRING	read-only	This object indicates the DSCP values for which IP packets are allowed to ingress. The mask is big endian and each bit, numbered from 0 to 63, represents a DSCP value numbered from 0 to 63. A value of 0xFFFFFFFFFFFFFFFF may be used to specify all.
C32 cienaCesAclEntryBadDscp	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.7	Counter32	read-only	This object indicates the number of lookups that failed because the ingress DSCP value was disallowed by the table entry.
OCT cienaCesAclEntryPortBitMask	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.8	OCTET STRING	read-only	This object indicates the physical ports on which frames will be allowed to ingress from. The mask is big endian and each bit, numbered from 0 to 63, represents a physical port numbered from 1 to 64. A value of 0xFFFFFFFFFFFFFFFF may be used to specify all ports.
IPt cienaCesAclEntryNotifInetAddrType	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.9	InetAddressType	read-only	This object indicates the IP network type which will be authorized. This OID specifies the Inet address type of the OIDs cienaCesAclEntryNotifInetAddr and cienaCesAclEntryNotifInetPrefixLength. When representing: ipv4 : cienaCesAclEntryInetAddr should be compliant with InetAddressIPv4 from RFC 4001 ipv6 : cienaCesAclEntryInetAddr should be compliant with InetAddressIPv6 from RFC 4001
IP cienaCesAclEntryNotifInetAddr	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.10	InetAddress	read-only	This object indicates the IP network address that will be authorized. This OID should be used in conjunction with cienaCesAclEntryNotifInetAddrType and should be compliant with RFC 4001 InetAddressType.
ADR cienaCesAclEntryNotifInetPrefixLength	1.3.6.1.4.1.1271.2.1.25.1.2.1.1.11	InetAddressPrefixLength	read-only	This object indicates the prefix length for the IP network that will be authorized. This OID should be used in conjunction with cienaCesAclEntryNotifInetAddrType.
cienaCesExtAclTable	1.3.6.1.4.1.1271.2.1.25.1.2.2		not-accessible	The (conceptual) table listing the parameters for the extended IP ACL table.
cienaCesExtAclEntry	1.3.6.1.4.1.1271.2.1.25.1.2.2.1		not-accessible	An entry (conceptual row) in the cienaCesExtAclTable.
IPt cienaCesExtAclEntrySrcInetAddrType	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.1	InetAddressType	not-accessible	This object indicates the IP network type which will be authorized. This OID specifies the Inet address type of the OIDs cienaCesExtAclEntrySrcInetAddr and cienaCesExtAclEntrySrcInetPrefixLen. When representing: ipv4 : cienaCesExtAclEntrySrcInetAddr should be compliant with InetAddressIPv4 from RFC 4001 ipv6 : cienaCesExtAclEntrySrcInetAddr should be compliant with InetAddressIPv6 from RFC 4001
IP cienaCesExtAclEntrySrcInetAddr	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.2	InetAddress	not-accessible	This object indicates the source IP network address that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntrySrcInetAddrType and should be compliant with RFC 4001 InetAddressType.
ADR cienaCesExtAclEntrySrcInetPrefixLen	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.3	InetAddressPrefixLength	not-accessible	This object indicates the prefix length for the source IP network that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntrySrcInetAddrType.
IPt cienaCesExtAclEntryDstInetAddrType	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.4	InetAddressType	not-accessible	This object indicates the IP network type which will be authorized. This OID specifies the Inet address type of the OIDs cienaCesExtAclEntryDstInetAddr and cienaCesExtAclEntryDstInetPrefixLen. When representing: ipv4 : cienaCesExtAclEntryDstInetAddr should be compliant with InetAddressIPv4 from RFC 4001 ipv6 : cienaCesExtAclEntryDstInetAddr should be compliant with InetAddressIPv6 from RFC 4001
IP cienaCesExtAclEntryDstInetAddr	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.5	InetAddress	not-accessible	This object indicates the destination IP network address that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntryDstInetAddrType and should be compliant with RFC 4001 InetAddressType.
ADR cienaCesExtAclEntryDstInetPrefixLen	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.6	InetAddressPrefixLength	not-accessible	This object indicates the prefix length for the destination IP network that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntryDstInetAddrType.
IPt cienaCesExtAclEntryNotifSrcInetAddrType	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.7	InetAddressType	read-only	Duplicate of cienaCesExtAclEntrySrcInetAddrType for display purposes. This object indicates the IP network type which will be authorized. This OID specifies the Inet address type of the OIDs cienaCesExtAclEntrySrcInetAddr and cienaCesExtAclEntrySrcInetPrefixLen. When representing: ipv4 : cienaCesExtAclEntrySrcInetAddr should be compliant with InetAddressIPv4 from RFC 4001 ipv6 : cienaCesExtAclEntrySrcInetAddr should be compliant with InetAddressIPv6 from RFC 4001
IP cienaCesExtAclEntryNotifSrcInetAddr	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.8	InetAddress	read-only	Duplicate of cienaCesExtAclEntrySrcInetAddr for display purposes. This object indicates the source IP network address that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntryNotifSrcInetAddrType and should be compliant with RFC 4001 InetAddressType.
ADR cienaCesExtAclEntryNotifSrcInetPrefixLen	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.9	InetAddressPrefixLength	read-only	Duplicate of cienaCesExtAclEntrySrcInetPrefixLen for display purposes. This object indicates the prefix length for the source IP network that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntryNotifSrcInetAddrType.
IPt cienaCesExtAclEntryNotifDstInetAddrType	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.10	InetAddressType	read-only	Duplicate of cienaCesExtAclEntryDstInetAddrType for display purposes. This object indicates the IP network type which will be authorized. This OID specifies the Inet address type of the OIDs cienaCesExtAclEntryNotifDstInetAddr and cienaCesExtAclEntryNotifDstInetPrefixLen. When representing: ipv4 : cienaCesExtAclEntryNotifDstInetAddr should be compliant with InetAddressIPv4 from RFC 4001 ipv6 : cienaCesExtAclEntryNotifDstInetAddr should be compliant with InetAddressIPv6 from RFC 4001
IP cienaCesExtAclEntryNotifDstInetAddr	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.11	InetAddress	read-only	Duplicate of cienaCesExtAclEntryDstInetAddr for display purposes. This object indicates the destination IP network address that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntryNotifDstInetAddrType and should be compliant with RFC 4001 InetAddressType.
ADR cienaCesExtAclEntryNotifDstInetPrefixLen	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.12	InetAddressPrefixLength	read-only	Duplicate of cienaCesExtAclEntryDstInetPrefixLen for display purposes. This object indicates the prefix length for the destination IP network that will be authorized. This OID should be used in conjunction with cienaCesExtAclEntryNotifDstInetAddrType.
C32 cienaCesExtAclEntryHits	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.13	Counter32	read-only	This object indicates the number of lookups that matched the table entry.
C32 cienaCesExtAclEntryBadPort	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.14	Counter32	read-only	This object indicates the number of lookups that failed because the ingress port was disallowed by the table entry.
OCT cienaCesExtAclEntryDscpMask	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.15	OCTET STRING	read-only	This object indicates the DSCP values for which IP packets are allowed to ingress. The mask is big endian and each bit, numbered from 0 to 63, represents a DSCP value numbered from 0 to 63. A value of 0xFFFFFFFFFFFFFFFF may be used to specify all.
C32 cienaCesExtAclEntryBadDscp	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.16	Counter32	read-only	This object indicates the number of lookups that failed because the ingress DSCP value was disallowed by the table entry.
OCT cienaCesExtAclEntryPortBitMask	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.17	OCTET STRING	read-only	This object indicates the physical ports on which frames will be allowed to ingress from. The mask is big endian and each bit, numbered from 0 to 63, represents a physical port numbered from 1 to 64. A value of 0xFFFFFFFFFFFFFFFF may be used to specify all ports.
BIT cienaCesExtAclEntryProtocol	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.18	Bits	read-only	List of protocols allowed for the ACL entry.
C32 cienaCesExtAclEntryBadProtocol	1.3.6.1.4.1.1271.2.1.25.1.2.2.1.19	Counter32	read-only	This object indicates the number of lookups that failed because the protocol value did't match what was in the ACL entry with IP address(es) matching
cienaCesAclMIBConformance	1.3.6.1.4.1.1271.2.1.25.3
cienaCesAclMIBCompliances	1.3.6.1.4.1.1271.2.1.25.3.1
cienaCesAclMIBGroups	1.3.6.1.4.1.1271.2.1.25.3.2

RFC description

Access Control List (ACL) configuration and rule management for Ciena packet services.

Start monitoring Ciena CES (Carrier Ethernet Switch) platforms with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CIENA-CES-ACL-MIB

What Is CIENA-CES-ACL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description