All MIBs › CISCO-FILTER-GROUP-MIB
Category: Cisco Devices, VPN and Security
Description:
Provides management objects for defining and managing named traffic filter groups applied to network interfaces on Cisco devices.
Imported Objects
From CISCO-SMI
| ciscoMgmt | OBJECT-IDENTITY |
From CISCO-TC
| CiscoIpProtocol |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType | |
| InetPortNumber |
From RFC-1212
| OBJECT-TYPE |
From RFC1155-SMI
| Gauge |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-TC-v1
| RowStatus | |
| StorageType |
What Is CISCO-FILTER-GROUP-MIB?
CISCO-FILTER-GROUP-MIB lets a management station create and configure reusable 'filter groups' -- named collections of match criteria -- that Cisco IOS devices use to build access-control lists for packet filtering across IP and other protocols. Each group is typed as network (IP address plus wildcard-mask entries), IP protocol (protocol numbers such as TCP, UDP, GRE, OSPF, EIGRP), IP service (TCP/UDP port ranges), or ICMP (type/code pairs), and a group's type is fixed once it is created. A separate nested-group table lets one filter group reference another, so complex filtering policies can be built up from smaller, reusable building blocks rather than duplicated inline. Because the module defines no counters or traps of its own, it represents pure configuration state -- the actual packet-matching and permit/deny decisions happen in whatever ACL feature, not defined in this MIB, consumes these named groups. It is a supporting building-block MIB rather than a stand-alone monitoring tool, best explored via a CISCO-FILTER-GROUP-MIB MIB Browser when auditing or programmatically managing the reusable object groups behind a device's access-control policy.
IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-FILTER-GROUP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
What Can Be Monitored
- configured filter group names and types
- IP network/wildcard-mask entries per group
- IP protocol number entries per group
- TCP/UDP port range entries per group
- ICMP type/code entries per group
- nested filter-group relationships
Supported Devices
- Cisco IOS routers/switches supporting object-group-based ACL configuration
Monitoring Examples
A network engineer could read cfgFilterGroupTable to enumerate every named filter group configured on a router and its type, then walk cfgFilterIpServiceGroupTable to confirm a 'web-ports' service group actually contains TCP 80 and 443 as intended. To build a policy that blocks a set of subnets except for HTTP/HTTPS, the engineer would populate a network-type group in cfgFilterNetworkGroupTable with the address/wildcard-mask pairs, then reference an existing service group inside it via cfgFilterNestedGroupTable rather than re-entering the port ranges. Comparing the actual group contents against an intended security policy this way is a straightforward SNMP-based configuration-audit check.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ciscoFilterGroupMIB | 1.3.6.1.4.1.9.9.474 | |||
| ciscoFilterGroupMIBNotifs | 1.3.6.1.4.1.9.9.474.0 | |||
| ciscoFilterGroupMIBObjects | 1.3.6.1.4.1.9.9.474.1 | |||
| cfgFilterConfig | 1.3.6.1.4.1.9.9.474.1.1 | |||
| cfgFilterGroupTable | 1.3.6.1.4.1.9.9.474.1.1.1 | not-accessible | This table is used for creating/deleting filter groups. A filter group allows grouping of filter objects of same type. Filter group is identified by a name and this group can be used in other tables to simplify filter creation. Filter objects are Internet addresses, Internet Address masks, protocols, ports(services) and ICMP types. | |
| cfgFilterGroupEntry | 1.3.6.1.4.1.9.9.474.1.1.1.1 | not-accessible | An entry in filter group table. Each entry contains information such as filter group type, filter description. | |
| CFG cfgFilterGroupName | 1.3.6.1.4.1.9.9.474.1.1.1.1.1 | CfgFilterGroupName | not-accessible | This object identifies unique name for the filter group. |
| INT cfgFilterGroupType | 1.3.6.1.4.1.9.9.474.1.1.1.1.2 | INTEGER | read-write | This object identifies the type of the filter group. The possible values are: network (1) : specifies network group. This group contains information on the IP address and address mask. This information is available in cfgFilterNetworkGroupTable. ipProtocol (2) : specifies IP protocol group. This group contains protocol value. This information is available in cfgFilterIpProtocolGroupTable. ipService (3) : specifies IP service group. This group contains information on UDP/TCP port. This information is available in cfgFilterIpServiceGroupTable. icmp (4) : specifies the ICMP group. This group contains information on ICMP Message Type and ICMP message code. This information is available in cfgFilterICMPGroupTable. The value of this object cannot be changed when cfgFilterGroupRowStatus is 'active'. |
| STR cfgFilterGroupDescription | 1.3.6.1.4.1.9.9.474.1.1.1.1.3 | SnmpAdminString | read-write | This object is used for configuring description for the filter group. |
| STO cfgFilterGroupStorageType | 1.3.6.1.4.1.9.9.474.1.1.1.1.4 | StorageType | read-write | The storage type for this conceptual row. |
| ROW cfgFilterGroupRowStatus | 1.3.6.1.4.1.9.9.474.1.1.1.1.5 | RowStatus | read-write | This object is used for adding/deleting entries in this table. This object can be set to 'active' only if cfgFilterGroupType is configured for the row. |
| cfgFilterNetworkGroupTable | 1.3.6.1.4.1.9.9.474.1.1.2 | not-accessible | This table is used for adding/deleting network filter group. A network filter group is used to specify host IP addresses or subnet ranges. This is applicable only for the cfgFilterGroupType value of 'network'. | |
| cfgFilterNetworkGroupEntry | 1.3.6.1.4.1.9.9.474.1.1.2.1 | not-accessible | An entry in network filter group table. Each entry contains information on the IP address and the mask value that can be used in filtering the packet. Multiple entries with the same value of cfgFilterGroupName belong to the same network filter group. | |
| GAU cfgFilterNetworkGroupIndex | 1.3.6.1.4.1.9.9.474.1.1.2.1.1 | Gauge | not-accessible | This object identifies an unique entry for a network filter group. |
| IPt cfgFilterNetworkAddressType | 1.3.6.1.4.1.9.9.474.1.1.2.1.2 | InetAddressType | read-write | This is the internet address type of for the cfgFilterNetworkAddress and cfgFilterNetworkMask. The value of this object cannot be changed when cfgFilterGroupRowStatus is 'active'. |
| IP cfgFilterNetworkAddress | 1.3.6.1.4.1.9.9.474.1.1.2.1.3 | InetAddress | read-write | The source/destination internet address to be configured. A value of zero causes all source/destination address to match in an IP filter where this group is used. The object value has to be consistent with the type specified in cfgFilterNetworkAddressType. |
| IP cfgFilterNetworkMask | 1.3.6.1.4.1.9.9.474.1.1.2.1.4 | InetAddress | read-write | This is the wild card mask for the cfgFilterNetworkAddress bits that must match. Presence of 0 bits in the mask indicate that corresponding bits in the cfgFilterNetworkAddress must match in order for the matching to be successful, and 1 bits are don't care bits in the matching. A value of zero causes only IP packets of source and destination address the same as cfgFilterNetworkAddress to match. This object value has to be consistent with the type specified in cfgFilterNetworkAddressType. |
| STO cfgFilterNetworkStorageType | 1.3.6.1.4.1.9.9.474.1.1.2.1.5 | StorageType | read-write | The storage type for this conceptual row. |
| ROW cfgFilterNetworkRowStatus | 1.3.6.1.4.1.9.9.474.1.1.2.1.6 | RowStatus | read-write | This object is used for adding/deleting entries in this table. This object can be set to 'active' only with valid value for cfgFilterNetworkAddressType object. |
| cfgFilterIpProtocolGroupTable | 1.3.6.1.4.1.9.9.474.1.1.3 | not-accessible | This table is used for adding/deleting protocol filter group. A protocol filter group is used to specify protocol(s). This is applicable only for the cfgFilterGroupType value of 'ipProtocol'. | |
| cfgFilterIpProtocolGroupEntry | 1.3.6.1.4.1.9.9.474.1.1.3.1 | not-accessible | Each entry is an IP Protocol traffic filter within an IP filter profile. Entries with the same cfgFilterGroupName belong to the same protocol filter group. | |
| GAU cfgFilterIpProtocolGroupIndex | 1.3.6.1.4.1.9.9.474.1.1.3.1.1 | Gauge | not-accessible | This index uniquely identifies the entries in this table. |
| CIS cfgFilterIpProtocolNumber | 1.3.6.1.4.1.9.9.474.1.1.3.1.2 | CiscoIpProtocol | read-write | This object identifies the internet protocol number in the packets. These IP protocol numbers are defined in the Network Group Request For Comments(RFC) documents. For example, Cisco commonly used protocol includes: 1 - Internet Control Message Protocol (ICMP) 2 - Internet Gateway Message Protocol (IGMP) 4 - IP in IP tunneling 6 - Transmission Control Protocol (TCP) 9 - Cisco's IGRP routing protocol (IGRP) 17 - User Datagram Protocol (UDP) 47 - Cisco's GRE tunneling (GRE) 50 - Encapsulation Security Payload 51 - Authentication Header Protocol 88 - Cisco's EIGRP routing protocol 89 - OSPF routing protocol 94 - KA9Q NOS compatible IP over IP tunneling 103 - Protocol Independent Multicast 108 - Payload Compression Protocol. |
| STO cfgFilterIpProtocolStorageType | 1.3.6.1.4.1.9.9.474.1.1.3.1.3 | StorageType | read-write | The storage type for this conceptual row. |
| ROW cfgFilterIpProtocolGroupRowStatus | 1.3.6.1.4.1.9.9.474.1.1.3.1.4 | RowStatus | read-write | This object is used for adding/deleting entries in this table. This object can be set to 'active' only with valid value for cfgFilterIpProtocolNumber object. |
| cfgFilterIpServiceGroupTable | 1.3.6.1.4.1.9.9.474.1.1.4 | not-accessible | This table is used for adding/deleting service filter group. A service filter group is used to specify specific or ranges of TCP/UDP ports to be defined. This filter group can be used as either the source port(s) or destination port(s) in the associated cfgFilterExtTable. This is applicable only for the cfgFilterGroupType value of 'ipService'. | |
| cfgFilterIpServiceGroupEntry | 1.3.6.1.4.1.9.9.474.1.1.4.1 | not-accessible | Each entry is an IP Protocol traffic filter within an IP filter profile. Entries with the same cfgFilterGroupName belong to the same protocol filter group. | |
| GAU cfgFilterIpServiceGroupIndex | 1.3.6.1.4.1.9.9.474.1.1.4.1.1 | Gauge | not-accessible | This index uniquely identifies the entries in this table. |
| INT cfgFilterIpServiceType | 1.3.6.1.4.1.9.9.474.1.1.4.1.2 | INTEGER | read-write | This object identifies the protocol type of the port for this group. The possible value(s) are : tcp(1) : TCP port. udp(2) : UDP port. tcpUdp(3) : TCP/UDP port. This value is applicable for a port which is same for both TCP and UDP. |
| INE cfgFilterIpServicePortLow | 1.3.6.1.4.1.9.9.474.1.1.4.1.3 | InetPortNumber | read-write | This object identifies the source or destination port number. This is the inclusive lower bound of the transport-layer source/destination port range that is to be matched in the filter where this group is defined. This value must be equal to or less than the value specified for this entry in cfgFilterServicePortHigh. |
| INE cfgFilterIpServicePortHigh | 1.3.6.1.4.1.9.9.474.1.1.4.1.4 | InetPortNumber | read-write | This object identifies the source or destination port number. This is the inclusive upper bound of the transport-layer source/destination port range that is to be matched in the filter where this group is defined. This value must be equal to or greater than the value specified for this entry in cfgFilterServicePortLow. If this value is '0', the udp or tcp port number is ignored during matching. |
| STO cfgFilterIpServiceStorageType | 1.3.6.1.4.1.9.9.474.1.1.4.1.5 | StorageType | read-write | The storage type for this conceptual row. |
| ROW cfgFilterIpServiceGroupRowStatus | 1.3.6.1.4.1.9.9.474.1.1.4.1.6 | RowStatus | read-write | This object is used for adding/deleting entries in this table. This object can be set to 'active' only with valid value for cfgFilterIpServiceType object. |
| cfgFilterICMPGroupTable | 1.3.6.1.4.1.9.9.474.1.1.5 | not-accessible | This table contains lists of filters for ICMP Type filter group. An ICMP Type filter group can be configured with multiple entries each representing the ICMP message types and ICMP message code. This is applicable only for the cfgFilterGroupType value of 'icmp'. | |
| cfgFilterICMPGroupEntry | 1.3.6.1.4.1.9.9.474.1.1.5.1 | not-accessible | An entry in ICMP filter group table. Each entry contains information on the ICMP message type and ICMP code. Multiple Entries with the same value of cfgFilterGroupName belong to the same ICMP filter group. | |
| GAU cfgFilterICMPGroupIndex | 1.3.6.1.4.1.9.9.474.1.1.5.1.1 | Gauge | not-accessible | This index identifies an unique entry in this table. |
| INT cfgFilterICMPType | 1.3.6.1.4.1.9.9.474.1.1.5.1.2 | INTEGER | read-write | This object specifies the ICMP message type to be configured in ICMP filter group. Setting this object to '-1' will make the filtering match any ICMP message type. Some of the commonly used ICMP Message types are: 0 - Echo Reply 3 - Destination Unreachable 4 - Source Quench 5 - Redirect 8 - Echo 11 - Time Exceeded 12 - Parameter Problem 13 - Timestamp 14 - Timestamp Reply 15 - Information Request 16 - Information Reply 17 - Mask Request 18 - Mask Reply 31 - Conversion Error 32 - Mobile Redirect. |
| INT cfgFilterICMPCode | 1.3.6.1.4.1.9.9.474.1.1.5.1.3 | INTEGER | read-write | This object specifies the ICMP message code to be configured in ICMP filter group. Setting this object to '-1' will make the filtering match any ICMP code. |
| STO cfgFilterICMPStorageType | 1.3.6.1.4.1.9.9.474.1.1.5.1.4 | StorageType | read-write | The storage type for this conceptual row. |
| ROW cfgFilterICMPGroupRowStatus | 1.3.6.1.4.1.9.9.474.1.1.5.1.5 | RowStatus | read-write | This object is used for adding/deleting entries in this table. This object can be set to 'active' only with valid value for cfgFilterICMPType object. |
| cfgFilterNestedGroupTable | 1.3.6.1.4.1.9.9.474.1.1.6 | not-accessible | This table contains lists of filter groups that are configured in other filter group. This table is used for configuring a group as member of another group. | |
| cfgFilterNestedGroupEntry | 1.3.6.1.4.1.9.9.474.1.1.6.1 | not-accessible | An entry in nested filter group table. Each entry contains information on the a group that is configured in another group. | |
| CFG cfgFilterParentGroupName | 1.3.6.1.4.1.9.9.474.1.1.6.1.1 | CfgFilterGroupName | not-accessible | This object identifies the filter group that is previously created and to which another filter group identified by cfgFilterNestedGroupName will be added. The value for this object must correspond to entry in cfgFilterGroupTable. |
| CFG cfgFilterNestedGroupName | 1.3.6.1.4.1.9.9.474.1.1.6.1.2 | CfgFilterGroupName | not-accessible | This object identifies the filter group that is previously created and is being added to another filter group identified by cfgFilterParentGroupName. The value for this object must correspond to entry in cfgFilterGroupTable. The value for this object should not be same as the value of cfgFilterParentGroupName. The value for this object must be unique amongst the multiple instances with the same value of cfgFilterParentGroupName. |
| STO cfgFilterNestedStorageType | 1.3.6.1.4.1.9.9.474.1.1.6.1.3 | StorageType | read-write | The storage type for this conceptual row. |
| ROW cfgFilterNestedGroupRowStatus | 1.3.6.1.4.1.9.9.474.1.1.6.1.4 | RowStatus | read-write | This object is used for adding/deleting entries in this table. |
| ciscoFilterObjectGroup | 1.3.6.1.4.1.9.9.474.1.2 | |||
| ciscoFilterNetworkGroup | 1.3.6.1.4.1.9.9.474.1.3 | |||
| ciscoFilterIpProtocolGroup | 1.3.6.1.4.1.9.9.474.1.4 | |||
| ciscoFilterIpServiceGroup | 1.3.6.1.4.1.9.9.474.1.5 | |||
| ciscoFilterICMPGroup | 1.3.6.1.4.1.9.9.474.1.6 | |||
| ciscoFilterNestedGroup | 1.3.6.1.4.1.9.9.474.1.7 | |||
| ciscoFilterGroupMIBConform | 1.3.6.1.4.1.9.9.474.2 | |||
| ciscoFilterGroupMIBCompl | 1.3.6.1.4.1.9.9.474.2.1 | |||
| ciscoFilterGroupConfigMIBCompliance | 1.3.6.1.4.1.9.9.474.2.1.1 | |||
| ciscoFilterGroupMIBGroups | 1.3.6.1.4.1.9.9.474.2.2 |
RFC description
Packet filtering and access control groups for IP protocols and services on Cisco devices.
Start monitoring Cisco IOS routers/switches (object-group-based ACLs) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.