CISCO-ACL-MIB

All MIBs › CISCO-ACL-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2013-03-27

Category: Cisco Devices, VPN and Security

Description: Manages IP and MAC access control list configuration and statistics on Cisco devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-ACL-MIB?

CISCO-ACL-MIB is a Cisco-proprietary module for configuring and monitoring Access Control Lists (ACLs) on Cisco routers and switches, part of the security/traffic-filtering technology area. It exposes configuration data (ACL name, address type, ordered permit/deny rule entries) as well as runtime statistics such as per-rule hit/match counters used to see which filtering rules are actually being triggered by traffic. In terms of device status monitoring, this MIB is primarily useful for verifying that security policy is active and functioning correctly (row status of ACL entries, whether an ACL is correctly bound to an interface) rather than for hardware health, giving operators visibility into software-level policy enforcement state. It is a self-contained Cisco enterprise MIB but conceptually parallels IETF ACL/policy MIB work and depends on standard SNMP conventions like RowStatus and InetAddressType. It is typically deployed in enterprise and service-provider networks to audit and troubleshoot Cisco IOS/IOS-XE ACL configuration and usage across many interfaces, where reviewing each Cisco ACL ACE entry helps confirm security policy is enforced as intended.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco routers
Cisco switches

Monitoring Examples

An administrator would poll caAclIPV4ACECfgTable (indexed by caAclIndex and caAclIPV4ACESequenceNumber) to review each rule's caAclIPV4ACEAction, caAclIPV4ACEProtocol and caAclIPV4ACESourceAddress, confirming the ACL matches intended security policy. Cross-referencing caAclCfgTable's caAclName and caAclRowStatus with per-rule hit counters lets the admin spot ACLs that never match any traffic (suggesting a misconfigured source address or unused rule) or rules generating unexpectedly high hit counts (suggesting an attack or misrouted traffic). A sudden change in caAclRowStatus from active to notInService would flag an ACL that was accidentally disabled.

What Can Be Monitored

ACL configuration status
per-rule hit/match counts
ACL rule action (permit/deny)
protocol and source address filters
ACL interface binding
row/administrative status of ACL entries

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TC

CiscoIpProtocol

From IF-MIB

ifIndex

OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using caAclIntfStatsPackets OID:

Select a Cisco router or switch (ACLs) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type caAclIntfStatsPackets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The total number of packets that match this counter label. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in packets), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
CAA caAclAccessGroupACL	1.3.6.1.4.1.9.9.808.1.1.4.1.1	CaAclACLIndex	read-create	The name of the ACL associated with this entry.
IPt caAclAccessGroupCfgAddressType	1.3.6.1.4.1.9.9.808.1.1.4.1.2	InetAddressType	not-accessible	This entry describes the address family of the access group being applied on the interface.
caAclAccessGroupCfgEntry	1.3.6.1.4.1.9.9.808.1.1.4.1		not-accessible	This entry describes an ACL configured on the device and applied to an interface.
caAclAccessGroupCfgTable	1.3.6.1.4.1.9.9.808.1.1.4		not-accessible	This table lists the ACLs configured on the device and applied on an interface in the ingress or egress direction.
CAA caAclAccessGroupDirection	1.3.6.1.4.1.9.9.808.1.1.4.1.3	CaAclTrafficDirection	not-accessible	This object defines the direction in which the ACL is applied.
ROW caAclAccessGroupRowStatus	1.3.6.1.4.1.9.9.808.1.1.4.1.5	RowStatus	read-create	This object is used to create, modify, or delete an entry in the caAclAccessGroupCfgTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to active by the agent. Once a row becomes active, values in any other column within the row cannot be modified. A row may be deleted by setting the RowStatus for 'destroy'.
CAA caAclAccessGroupSequenceNumber	1.3.6.1.4.1.9.9.808.1.1.4.1.4	CaAclSequenceNumber	not-accessible	This object uniquely identifies the order that Access Group applied to a interface. It can be used by platforms that support applying more than one Access List per address family per direction. For example: interface GigabitEthernet 0/0 ipv4 access-group ACL1 ACL2 ACL2 ingress !
IPt caAclAddressType	1.3.6.1.4.1.9.9.808.1.1.1.1.2	InetAddressType	not-accessible	This object defines the address family of the ACL.
caAclCfgTable	1.3.6.1.4.1.9.9.808.1.1.1		not-accessible	A table of ACL definitions. Each entry in this table defines a unique IPV4 or IPV6 ACL.
caAclCfgTableEntry	1.3.6.1.4.1.9.9.808.1.1.1.1		not-accessible	A conceptual row in the caAclTable. Each entry of this table consists of acl index and the address type. This is so that the table may contain both IPV4 and IPV6 ACLs.
caAclConfiguration	1.3.6.1.4.1.9.9.808.1.1
CAA caAclIndex	1.3.6.1.4.1.9.9.808.1.1.1.1.1	CaAclACLIndex	not-accessible	An arbitrary (system assigned) index for each ACL name. The index is unique for each ACL name in the device, but is further qualified by the address family. For example, consider the following configuration: ipv4 access-list ACL1 10 permit ipv4 any any ! ipv6 access-list ACL1 10 permit ipv6 any any In this case the caAclIndex value for both ACLs will be the same.
STR caAclIntfStatsCounterLabelName	1.3.6.1.4.1.9.9.808.1.2.1.1.1	SnmpAdminString	not-accessible	The counter label index associated with this set of statistics.
C64 caAclIntfStatsOctets	1.3.6.1.4.1.9.9.808.1.2.1.1.3	Counter64	read-only	The total number of octets that match this counter label.
C64 caAclIntfStatsPacketsEx	1.3.6.1.4.1.9.9.808.1.2.1.1.2	Counter64	read-only	The total number of packets that match this counter label.
CAA caAclIPV4ACEAction	1.3.6.1.4.1.9.9.808.1.1.2.1.2	CaAclAction	read-create	This object indicates the type of action to be taken if the packet matches the given criteria. If it is set to permit(1), all packets matching this ACE will be allowed for further processing. If it is set to deny(2), all packets matching this ACE will be discarded.
caAclIPV4ACECfgTable	1.3.6.1.4.1.9.9.808.1.1.2		not-accessible	A table of IPV4 ACE definitions. The ACE definition controls whether packets are accepted or rejected. The access control may be applied before sending the packet to the forwarding engine, or may be applied after the packet is processed by the forwarding engine. If two ACE entries with the same sequence number are configured the latter will overwrite the former.
caAclIPV4ACECfgTableEntry	1.3.6.1.4.1.9.9.808.1.1.2.1		not-accessible	A conceptual row in the caAclIPV4ACLTable. Each entry of this table consists of a set of match criteria for a given ACL.
STR caAclIPV4ACECounterLabel	1.3.6.1.4.1.9.9.808.1.1.2.1.25	SnmpAdminString	read-create	This object defines the counter label name for this ACE. ACEs that share the same counter label name will have their hit counts aggregated into the same counter label name.
IP caAclIPV4ACEDestinationAddress	1.3.6.1.4.1.9.9.808.1.1.2.1.11	InetAddress	read-create	This object determines the address of the network or host to which the packet is being sent. If this object value is 0.0.0.0 and the value of caAclIPV4ACLDestinationWildCardMask object in the same entry is 255.255.255.255, this entry matches any source IP address. If this object value is not 0.0.0.0 and the value of caAclIPV4ACLDestinationWildCardMask is 0.0.0.0, this entry matches the specific host address defined in this object.
STR caAclIPV4ACEDestinationNetworkGroup	1.3.6.1.4.1.9.9.808.1.1.2.1.13	SnmpAdminString	read-create	This object defines the Destination Network Object Group to which the packet is being sent.
INE caAclIPV4ACEDestinationPort	1.3.6.1.4.1.9.9.808.1.1.2.1.15	InetPortNumber	read-create	This object defines the destination port number of the layer 4 protocol. This is the field to be matched with the specified destination port based on the caAclIPV4ACLSourceOperator. If caAclIPV4ACLDestinationOperator is range(5) then this object will have the inclusive lower bound of the destination port range that is to be matched.
STR caAclIPV4ACEDestinationPortGroup	1.3.6.1.4.1.9.9.808.1.1.2.1.17	SnmpAdminString	read-create	This object defines the Source Port Object Group to which the packet is being sent.
CAA caAclIPV4ACEDestinationPortOperator	1.3.6.1.4.1.9.9.808.1.1.2.1.14	CaAclPortOperator	read-create	This object defines the operation to be performed to the layer destination port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV4ACLProtocol is none of the ones listed above, this field should set to noOperator(1), which means not comparison is to be performed. If this field is set to range(5) then two port numbers are necessary. I.e., Both caAclIPV4ACEDestinationPort and caAclIPV4ACEDestinationPortUpper need to be provided.
INE caAclIPV4ACEDestinationPortUpper	1.3.6.1.4.1.9.9.808.1.1.2.1.16	InetPortNumber	read-create	This object defines the inclusive upper bound of the layer 4 destination port range that is to be matched.
IP caAclIPV4ACEDestinationWildCardMask	1.3.6.1.4.1.9.9.808.1.1.2.1.12	InetAddress	read-create	This object determines the mask of wild card address bits for caAclIPV4ACLDestinationAddress. Wild card masking is to indicate to the system whether to check or ignore the corresponding IP address bits when comparing the address bits in an ACE to a packet being submitted to the ACE. The default wild card mask is 0.0.0.0. The wild card mask is the inverse of a regular subnet mask. If the mask value 0.0.0.255 is applied to the address 1.2.3.4, it will match all traffic from subnet 1.2.3.0.
U32 caAclIPV4ACEDscpValue	1.3.6.1.4.1.9.9.808.1.1.2.1.18	Unsigned32	read-create	This object defines the dscp value that will be considered in the match criteria against the value in the packet.
CAA caAclIPV4ACELogOption	1.3.6.1.4.1.9.9.808.1.1.2.1.24	CaAclLogOption	read-create	This object defines the value of the log option field to be applied to packets that match this ACE entry.
CAA caAclIPV4ACEPrecedenceValue	1.3.6.1.4.1.9.9.808.1.1.2.1.23	CaAclPrecedenceValue	read-create	This object indicates the value of the precedence field to be filtered.
CIS caAclIPV4ACEProtocol	1.3.6.1.4.1.9.9.808.1.1.2.1.3	CiscoIpProtocol	read-create	This object identifies the layer 3 protocol type to be filtered by the ACE. Protocol numbers are defined in the Network Working Group Request For Comment documents.
STR caAclIPV4ACERemark	1.3.6.1.4.1.9.9.808.1.1.2.1.26	SnmpAdminString	read-create	This object defines a comment in the ACL. It helps the user to define some meaningful comment to identify the ACE quickly, or to know the purpose of a set of ACEs. This field is not used during packet matching.
ROW caAclIPV4ACERowStatus	1.3.6.1.4.1.9.9.808.1.1.2.1.27	RowStatus	read-create	This object is used to create, modify, or delete an entry in the caAclIPV4ACLTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to active by the agent. A row may be deleted by setting the RowStatus for 'destroy'. The minimum objects required to delete a row in this table is simply the sequence number (caAclIPV4ACESequenceNumber).
CAA caAclIPV4ACESequenceNumber	1.3.6.1.4.1.9.9.808.1.1.2.1.1	CaAclSequenceNumber	not-accessible	This object uniquely identifies an ACE within an ACL. Sequence numbers are assigned to each permit/deny statement, causing the system to insert the statement in that numbered position within the ACL. If two ACE entries with the same sequence number are configured, the latter one will overwrite the former.
IP caAclIPV4ACESourceAddress	1.3.6.1.4.1.9.9.808.1.1.2.1.4	InetAddress	read-create	This object determines the address of the network or host from which the packet is being sent. If this object value is 0.0.0.0 and the value of caAclIPV4ACESourceWildCardMask object in the same entry is 255.255.255.255, this entry matches any source address. If this object value is not 0.0.0.0 and the value of caAclIPV4ACESourceWildCardMask is 0.0.0.0, this entry matches specific host address defined in this object.
STR caAclIPV4ACESourceNetworkGroup	1.3.6.1.4.1.9.9.808.1.1.2.1.6	SnmpAdminString	read-create	This object defines the Source Network Object Group from which the packet is being sent.
INE caAclIPV4ACESourcePort	1.3.6.1.4.1.9.9.808.1.1.2.1.8	InetPortNumber	read-create	This object defines the source port number of the layer 4 protocol. This is the field to be matched with the specified source port based on the caAclIPV4ACESourcePortOperator. If caAclIPV4ACESourcePortOperator is range(5) then this object will have the inclusive lower bound of the source port range that is to be matched.
STR caAclIPV4ACESourcePortGroup	1.3.6.1.4.1.9.9.808.1.1.2.1.10	SnmpAdminString	read-create	This object defines the Source Port Object Group from which the packet is being sent.
CAA caAclIPV4ACESourcePortOperator	1.3.6.1.4.1.9.9.808.1.1.2.1.7	CaAclPortOperator	read-create	This object defines the operation to be performed to the layer source port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV4ACEProtocol is none of the ones listed above, this field should set to noOperator(1), which means not comparison is to be performed. If this field is set to range(5) then two port numbers are necessary. I.e., Both caAclIPV4ACESourcePort and caAclIPV4ACESourcePortUpper need to be provided.
INE caAclIPV4ACESourcePortUpper	1.3.6.1.4.1.9.9.808.1.1.2.1.9	InetPortNumber	read-create	This object defines the inclusive upper bound of the layer 4 source port range that is to be matched.
IP caAclIPV4ACESourceWildCardMask	1.3.6.1.4.1.9.9.808.1.1.2.1.5	InetAddress	read-create	This object determines the mask of wild card address bits for caAclIPV4ACESourceAddress. Wild card masking is to indicate to the system whether to check or ignore the corresponding IP address bits when comparing the address bits in an ACL to a packet being submitted to the ACL. The default wild card mask is 0.0.0.0. The wild card mask is the inverse of a regular subnet mask. If the mask value 0.0.0.255 is applied to 1.2.3.0.
U32 caAclIPV4ACETcpFlagsMask	1.3.6.1.4.1.9.9.808.1.1.2.1.20	Unsigned32	read-create	This object defines the mask value of the TCP flags field.
CAA caAclIPV4ACETcpFlagsMatchType	1.3.6.1.4.1.9.9.808.1.1.2.1.21	CaAclTcpFlagsMatch	read-create	This object defines the type of matching to be done on the TCP flags field.
U32 caAclIPV4ACETcpFlagsValue	1.3.6.1.4.1.9.9.808.1.1.2.1.19	Unsigned32	read-create	This object defines the value of the TCP flags which will be considered in the match criteria based on caAclIPV4ACLTcpFlagsMatchType. Users can select any desired combination of the TCP flags on which to filter TCP packets.
U32 caAclIPV4ACETosValue	1.3.6.1.4.1.9.9.808.1.1.2.1.22	Unsigned32	read-create	This object defines the value of the TOS field to be filtered. Packets can be filtered by the TOS level as specified by a number from 0 to 15. Use the value 16 to indicate that the TOS field should be ignored during matching.
caAclIPV4ACLMIBACEGroup	1.3.6.1.4.1.9.9.808.2.1.2.2			This group is a collection of objects providing IPV4 ACE feature.
CAA caAclIPV6ACEAction	1.3.6.1.4.1.9.9.808.1.1.3.1.2	CaAclAction	read-create	This object indicates the type of action to be taken if the packet matches the given criteria. If it is set to permit(1), all packets matching this ACE will be allowed for further processing. If it is set to deny(2), all packets matching this ACE will be discarded.
caAclIPV6ACECfgTable	1.3.6.1.4.1.9.9.808.1.1.3		not-accessible	A table of IPV6 ACE definitions. The ACE definition controls whether packets are accepted or rejected. The access control may be applied before sending the packet to the forwarding engine, or may be applied after the packet is processed by the forwarding engine.
caAclIPV6ACECfgTableEntry	1.3.6.1.4.1.9.9.808.1.1.3.1		not-accessible	A conceptual row in the caAclIPV6ACLTable. Each entry of this table consists of a set of match criteria for a given ACL.
STR caAclIPV6ACECounterLabel	1.3.6.1.4.1.9.9.808.1.1.3.1.23	SnmpAdminString	read-create	This object defines the counter label name for this ACE. ACEs that share the same counter label name will have their hit counts aggregated into the same counter label name.
IP caAclIPV6ACEDestinationAddress	1.3.6.1.4.1.9.9.808.1.1.3.1.11	InetAddress	read-create	This object determines the address of the network or host to which the packet is being sent. If this object value is 0::0 and the value of caAclIPV6ACLSourcePrefixLength is 0 then this matches any source address. If this object value is not 0::0 and the value of caAclIPV6ACLSourcePrefixLength is less than 128, this entry matches the all the addresses that are in the sub-net. If this object value is 0::0 and the value of caAclIPV6ACLSourcePrefixLength is also 0, this entry matches all osts.
STR caAclIPV6ACEDestinationNetworkGroup	1.3.6.1.4.1.9.9.808.1.1.3.1.13	SnmpAdminString	read-create	This object defines the Source Network Object Group to which the packet is being sent.
INE caAclIPV6ACEDestinationPort	1.3.6.1.4.1.9.9.808.1.1.3.1.15	InetPortNumber	read-create	This object defines the destination port number of the layer 4 protocol. This is the field to be matched with the specified destination port based on the caAclIPV6ACLSourceOperator. If caAclIPV6ACLDestinationOperator is range(5) then this object will have the inclusive lower bound of the destination port range that is to be matched.
STR caAclIPV6ACEDestinationPortGroup	1.3.6.1.4.1.9.9.808.1.1.3.1.17	SnmpAdminString	read-create	This object defines the Source Port Object Group to which the packet is being sent.
CAA caAclIPV6ACEDestinationPortOperator	1.3.6.1.4.1.9.9.808.1.1.3.1.14	CaAclPortOperator	read-create	This object defines the operation to be performed to the layer destination port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV6ACLProtocol is none of the ones listed above, this field should set to noOperator(1), which means no comparison is to be performed. If this field is set to range(5) then two port numbers are necessary. I.e., Both caAclIPV6ACLDestinationPort and caAclIPV6ACLDestinationPortUpper need to be provided.
INE caAclIPV6ACEDestinationPortUpper	1.3.6.1.4.1.9.9.808.1.1.3.1.16	InetPortNumber	read-create	This object defines the inclusive upper bound of the layer 4 destination port range that is to be matched.
I32 caAclIPV6ACEDestinationPrefixLength	1.3.6.1.4.1.9.9.808.1.1.3.1.12	Integer32	read-create	This object determines the number of bits in the field caAclIPV6ACLDestinationAddress to be checked. If the value of this object is 0, then the source address in the packet must match caAclIPV6ACEDestinationAddress exactly for the ACE action to be taken.
CAA caAclIPV6ACELogOption	1.3.6.1.4.1.9.9.808.1.1.3.1.22	CaAclLogOption	read-create	This object defines the value of the log option field to be applied to packets that match this ACE entry.
CIS caAclIPV6ACEProtocol	1.3.6.1.4.1.9.9.808.1.1.3.1.3	CiscoIpProtocol	read-create	This object identifies the protocol type to be filtered by the ACE. Protocol numbers are defined in the Network Working Group Request For Comment (RFC) documents.
STR caAclIPV6ACERemark	1.3.6.1.4.1.9.9.808.1.1.3.1.24	SnmpAdminString	read-create	This object defines a comment in the ACL. It helps the user to define some meaningful comment to identify the ACE quickly, or to know the purpose of a set of ACEs. This field is not used during packet matching.
ROW caAclIPV6ACERowStatus	1.3.6.1.4.1.9.9.808.1.1.3.1.25	RowStatus	read-create	This object is used to create, modify, or delete an entry in the caAclIPV6ACLTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to active by the agent. A row may be deleted by setting the RowStatus for 'destroy'. The minimum objects required to delete a row in this table is simply the sequence number (caAclIPV6ACESequenceNumber).
CAA caAclIPV6ACESequenceNumber	1.3.6.1.4.1.9.9.808.1.1.3.1.1	CaAclSequenceNumber	not-accessible	This object uniquely identifies an ACE within an ACL. Sequence numbers are assigned to each permit/deny statement, causing the system to insert the statement in that numbered position within the ACL.
IP caAclIPV6ACESourceAddress	1.3.6.1.4.1.9.9.808.1.1.3.1.4	InetAddress	read-create	This object determines the address of the network or host from which the packet is being sent. If this object value is 0::0 and the value of caAclIPV6ACLSourcePrefixLength is 0 then this matches any source address. If this object value is not 0::0 and the value of caAclIPV6ACLSourcePrefixLength is less than 128, this entry matches the all the addresses that are in the sub-net. If this object value is 0::0 and the value of caAclIPV6ACLSourcePrefixLength is also 0, this entry matches all hosts.
STR caAclIPV6ACESourceNetworkGroup	1.3.6.1.4.1.9.9.808.1.1.3.1.6	SnmpAdminString	read-create	This object defines the Source Network Object Group from which the packet is being sent.
INE caAclIPV6ACESourcePort	1.3.6.1.4.1.9.9.808.1.1.3.1.8	InetPortNumber	read-create	This object defines the source port number of the layer 4 protocol. This is the field to be matched with the specified source port based on the caAclIPV6ACLSourceOperator. If caAclIPV6ACLSourceOperator is range(5) then this object wail have the inclusive lower bound of the source port range that is to be matched.
STR caAclIPV6ACESourcePortGroup	1.3.6.1.4.1.9.9.808.1.1.3.1.10	SnmpAdminString	read-create	This object defines the Source Port Object Group from which the packet is being sent.
CAA caAclIPV6ACESourcePortOperator	1.3.6.1.4.1.9.9.808.1.1.3.1.7	CaAclPortOperator	read-create	This object defines the operation to be performed to the layer source port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV6ACLProtocol is none of the ones listed above, this field should set to noOperator(1), which means not comparison is to be performed. If this field is set to range(5) then two port numbers are necessary. I.e., Both caAclIPV6ACLSourcePort and caAclIPV6ACLSourcePortUpper need to be provided.
INE caAclIPV6ACESourcePortUpper	1.3.6.1.4.1.9.9.808.1.1.3.1.9	InetPortNumber	read-create	This object defines the inclusive upper bound of the layer 4 source port range that is to be matched.
I32 caAclIPV6ACESourcePrefixLength	1.3.6.1.4.1.9.9.808.1.1.3.1.5	Integer32	read-create	This object determines the number of bits in the field caAclIPV6ACLSourceAddress to be checked. If the value of this object is 0, then the source address in the packet must match caAclIPV6ACESourceAddress exactly for the ACE action to be taken.
U32 caAclIPV6ACETcpFlagsMask	1.3.6.1.4.1.9.9.808.1.1.3.1.20	Unsigned32	read-create	This object defines the mask value of the TCP flags field.
CAA caAclIPV6ACETcpFlagsMatchType	1.3.6.1.4.1.9.9.808.1.1.3.1.21	CaAclTcpFlagsMatch	read-create	This object defines the type of matching to be done on the TCP flags field.
U32 caAclIPV6ACETcpFlagsValue	1.3.6.1.4.1.9.9.808.1.1.3.1.19	Unsigned32	read-create	This object defines the value of the TCP flags which will be considered in the match criteria based on caAclIPV6ACLTcpFlagsMatchType. Users can select any desired combination of the TCP flags on which to filter TCP packets.
U32 caAclIPV6ACETrafficClassValue	1.3.6.1.4.1.9.9.808.1.1.3.1.18	Unsigned32	read-create	This object defines the traffic class value that will be considered in the match criteria against the value in the packet.
caAclIPV6ACLMIBACEGroup	1.3.6.1.4.1.9.9.808.2.1.2.3			This group is a collection of objects providing IPV6 ACE feature.
caAclLabelIntfStatsEntry	1.3.6.1.4.1.9.9.808.1.2.1.1		not-accessible	Each entry in this table provides the aggregated counters for all ACEs applied on the given interface/direction that have been assigned the same counter label.
caAclLabelIntfStatsTable	1.3.6.1.4.1.9.9.808.1.2.1		not-accessible	This table describes the statistics for all ACEs with assigned counter labels, attached to interfaces on the device. An entry in this table is created when an ACL containing an ACE that references the specified counter label name is applied to an interface. An entry in this table is deleted when an ACL containing an ACE that references the specified counter lable name is removed from an interface.
caAclMIBAccessGroupCfgGroup	1.3.6.1.4.1.9.9.808.2.1.2.4			This group contains the objects describing the access group configuration.
caAclMIBACECompliances	1.3.6.1.4.1.9.9.808.2.1.1
caAclMIBACEConform	1.3.6.1.4.1.9.9.808.2.1
caAclMIBCfgGroup	1.3.6.1.4.1.9.9.808.2.1.2.1			This group contains objects describing ACLs.
caAclMIBCfgGroups	1.3.6.1.4.1.9.9.808.2.1.2
caAclMIBCompliance	1.3.6.1.4.1.9.9.808.2.1.1.1			This compliance statement specifies the minimal requirements that an implementation must meet in order to claim full compliance with the definitions of the C-ACL-MIB.
caAclMIBConformance	1.3.6.1.4.1.9.9.808.2
caAclMIBCounterGroup	1.3.6.1.4.1.9.9.808.2.1.2.5			This group contains the objects describing the ACE counter label.
caAclMIBObjects	1.3.6.1.4.1.9.9.808.1
STR caAclName	1.3.6.1.4.1.9.9.808.1.1.1.1.3	SnmpAdminString	read-create	A string that identifies the ACL name.
ROW caAclRowStatus	1.3.6.1.4.1.9.9.808.1.1.1.1.4	RowStatus	read-create	This object is used to create, modify, or delete an entry in the caAclTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to active by the agent. Once a row becomes active, values in any other column within the row cannot be modified. A row may be deleted by setting the RowStatus for 'destroy'.
caAclStats	1.3.6.1.4.1.9.9.808.1.2
ciscoACLMIB	1.3.6.1.4.1.9.9.808			This MIB module defines objects that describe Cisco Access Control Lists (ACL). This MIB describes different objects that enable the network administrator to remotely configure ACLs, apply them to interfaces and monitor their usage statistics. A typical application of this MIB module will facilitate monitoring of ACL match (sometimes referred as hit) counts. However, by no means does the definition of this MIB module prevent other applications from using it. An ACL is an ordered list of statements that deny or permit packets based on matching fields contained within the packet header (layer 3 source and destination addresses, layer 4 protocol, layer 4 source and destination port numbers, etc.) In addition there is an implicit Deny All at the end of the ACL. ACLs are used to perform packet filtering to control which packets are allowed through the network. Such control can help limit network traffic, and restrict the access of applications and devices on the network. Each one of these statements is referred to as an Access List Control Entry (ACE). Here is an example of an ACL configuration. ipv4 access-list V4Example 10 permit tcp any any ! ipv6 access-list V6Example 10 permit tcp any any ! The mechanism for monitoring ACL usage is by configuring, in the desired ACEs a counter label. A counter label is a name that is given to a counter and is defined in any ACE. ACEs that share the same Counter label name will have their counters aggregated into the same label. Here is an example of how to use counter labels. ipv4 access-list V4CounterExample 10 permit tcp any any counter CountPermits 20 permit udp any any counter CountPermits The same applies to IPv6 ACLs. This MIB consists of following tables: * caAclCfgTable Defines the ACLs configured in the device. * caAclIPV4ACECfgTable Defines the ACEs that make up an IPV4 ACL. * caAclIPV6ACECfgTable Defines the ACEs that make up an IPV6 ACL. * caAclAccessGroupCfgTable Defines the Access Control Groups (ACG) applied to interfaces on the device. * caAclLabelIntfStatsTable Defines the statistics for a specific ACE with counter labels attached to interfaces on the device.

RFC description

Access Control List (ACL) management for Cisco devices, enabling remote configuration and monitoring of packet filtering rules.

Start monitoring Cisco routers and switches (ACLs) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-ACL-MIB