CISCO-ITP-ACL-MIB

All MIBs › CISCO-ITP-ACL-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2001-08-29

Category: Cisco Devices, SNA and Legacy Protocols

Description: Manages SS7 access control lists on Cisco IP Transfer Point for signaling traffic filtering.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-ITP-ACL-MIB?

CISCO-ITP-ACL-MIB manages access control lists that filter SS7 (Signalling System No. 7) messages transported over IP on Cisco's IP Transfer Point (ITP), a hardware/software platform that functions as an SS7 signaling point. It exposes ACL rule configuration -- entry type, action (permit/deny), and matching parameters such as destination point code (DPC) and originating point code (OPC) with masks -- plus a timestamp of the last configuration change. Its monitoring value is chiefly configuration/security-policy status rather than hardware telemetry: administrators verify which signaling messages are being filtered, confirm ACL definitions haven't drifted, and watch notifications when policy triggers occur. It builds on ITU-T Q.700-series SS7 concepts for point-code addressing. It is deployed on Cisco ITP nodes that route SS7-over-IP traffic in carrier signaling networks, where a CISCO-ITP-ACL-MIB download is typically the first step toward auditing SS7 filtering policy.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-ITP-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco IP Transfer Point (ITP) SS7 signaling routers

Monitoring Examples

An operator polls cItpAclTable/cItpAclEntry, keyed by cItpAclId and cItpAclEntryNumber, to read each rule's cItpAclAction alongside its cItpAclDpc/cItpAclDpcMask and cItpAclOpc/cItpAclOpcMask matching criteria. Watching cItpAclConfigLastChanged lets a monitoring system detect unexpected ACL edits, and cItpAclMIBNotifs can alert when a filtering rule fires or changes -- useful for confirming a signaling security policy is intact.

What Can Be Monitored

ACL rule definitions and actions
destination/originating point code filters
ACL configuration change timestamp
ACL-related notifications

Imported Objects

From CISCO-ITP-TC-MIB

CItpTcAclId
CItpTcEncodingSchemeValue
CItpTcGlobalTitleSelector
CItpTcNAI
CItpTcNumberingPlan
CItpTcPointCode
CItpTcPointCodeMask
CItpTcServiceIndicator
CItpTcSubSystemNumber
CItpTcSubSystemNumberMask
CItpTcTranslationType

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TimeStamp

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoItpAclMIB	1.3.6.1.4.1.9.9.227			The MIB for managing access lists that control messages transported over Signalling System No. 7 (SS7) Network via Cisco IP Transfer Point. The Cisco IP Transfer Point (ITP) is a hardware and software solution that transports SS7 traffic using IP. Each ITP node provides function similar to SS7 signaling point. The relevant ITU documents describing this technology is the ITU Q series, including ITU Q.700: Introduction to CCITT Signalling System No. 7 and ITU Q.701 Functional description of the message transfer part (MTP) of Signalling System No. 7.
cItpAclMIBNotifs	1.3.6.1.4.1.9.9.227.0
cItpAclMIBObjects	1.3.6.1.4.1.9.9.227.1
cItpAclScalars	1.3.6.1.4.1.9.9.227.1.1
TIM cItpAclConfigLastChanged	1.3.6.1.4.1.9.9.227.1.1.1	TimeStamp	read-only	The value of sysUpTime at the time of the last creation or deletion of an entry in the cItpAclTable. If the local network management subsystem is re-initialization, then this object contains the sysUpTime at the time when this occurred. This value can be used to prevent unnecessary walks of the cItpAclTable.
cItpAclConfig	1.3.6.1.4.1.9.9.227.1.2
cItpAclTable	1.3.6.1.4.1.9.9.227.1.2.1		not-accessible	A table of SP access controls. The access control definition controls which packets are accepted or rejected. The access control may be applied before sending the packet to the routing table or may be applied after the packet is processed by the routing table. Entries are added to this table via cItpAclRowStatus in accordance with the RowStatus convention.
cItpAclTableEntry	1.3.6.1.4.1.9.9.227.1.2.1.1		not-accessible	A list of Signalling Point access control attributes.
CIT cItpAclId	1.3.6.1.4.1.9.9.227.1.2.1.1.1	CItpTcAclId	not-accessible	The identifier used to select a list of access list entries. The administrator will select an valid identifier within the specified range defined for SS7 access lists.
INT cItpAclEntryType	1.3.6.1.4.1.9.9.227.1.2.1.1.2	INTEGER	not-accessible	The list of possible entry types. 'comments' : A statement used to describe and document access list entries. 'entry' : A access list entry.
U32 cItpAclEntryNumber	1.3.6.1.4.1.9.9.227.1.2.1.1.3	Unsigned32	not-accessible	An numeric value assigned to each access list entry. The entries of the same type must be unique. Entries will be tested in ascending order.
CIT cItpAclAction	1.3.6.1.4.1.9.9.227.1.2.1.1.4	CItpAclAction	read-create	The action to be performed on the packet that matched this access control.
BIT cItpAclParameters	1.3.6.1.4.1.9.9.227.1.2.1.1.5	Bits	read-create	The cItpAclType object indicates which types of tests will be processed on the each access list entry. Each may contain one or more filters. The filter will be processed ascending order(si,dpc...all). Each test is evaluated and if true the packet is processed according to cItpAclAction. 'si' : The cItpAclSi is the relevant column. The packet is compared to cItpAclSi to determine if the packet matches this filter. 'dpc' : The cItpAclDpc and cItpAclDpcMask are the relevant columns. The packet is compared to cItpAclDpc in conjunction with cItpAclDpcMask to determine if the packet matches this access control. The mask is first negated (~mask) and bitwise AND is perform with mask and dpc. 'dpcMask' : Indicates that a mask is to be applied when the dpc filter is specified. If the mask is not specified then the mask is assumed to be all zeros. 'opc' : cItpAclOpc and cItpAclOpcMask are the relevant columns. The packet is compared to cItpAclOpc in conjunction with cItpAclOpcMask to determine if the packet matches this access control. The mask is first negated (~mask) and bitwise AND is perform with mask and opc. 'opcMask' : Indicates that a mask is to be applied when the opc filter is specified. If the mask is not specified then the mask is assumed to be all zeros. 'pattern' : cItpAclPattern and cItpAclOffset are the relevant columns. The matching criteria is based on matching the pattern specified by cItpAclPattern at offset cItpAclOffset from the start of the packet. 'comment' : The cItpAclComment object provides an entry that can be used to describe filters. 'cgpa' : The cItpAclCgpa, cItpAclCgpaMask, cItpAclCgpaSsn and cItpAclCgpaSsnMask are the relevant columns. The Calling Party Point code is compare with cItpAclCgpaPC using the ItpAclCgpaMask. Also, the cItpAclCgpaSsn and cItpAclCgpaSsnMask are compared if specified. 'cgpaMask': Indicates that a mask is to be applied when the cgpa filter is specified. If the mask is not specified then the mask is assumed to be all zeros. 'cgpaSsn' : Indicates that a Subsystem Number(SSN) is to be checked when the cgpa filter is specified. 'cgpaSsnMask': Indicates that SSN mask is to be applied when checking the SSN number for the cgpa filter is specified. If the mask is not specified then the mask is assumed to be all zeros. 'cdpa' : The cItpAclCdpa, cItpAclCdpaMask, cItpAclCdpaSsn and cItpAclCdpaSsnMask are the relevant columns. The Called Party Point code is compared with cItpAclCcpa using the ItpAclCcpaMask. Also, the cItpAclCcpaSsn and cItpAclCcpaSsnMask are compared if specified. 'cdpaMask': Indicates that a mask is to be applied when the cdpa filter is specified. If the mask is not specified then the mask is assumed to be all zeros. 'cdpaSsn' : Indicates that a SSN is to be checked when the cdpa filter is specified. 'cdpaSsnMask': Indicates that SSN mask is to be applied when checking the SSN number for the cdpa filter is specified. If the mask is not specified then the mask is assumed to be all zeros. 'selector': The Global Title Selector is used to select which objects will be tested and in what order the tests will be applied as follows. x The types of translations are different based on the variant. In both, variants the translation type and other parameters are used to provide the following types of translations. - Intermediate GTT resulting in MSUs routed to a solitary point code - Intermediate GTT resulting in MSUs load balanced across two or more point codes - Final GTT routed to a solitary point code - Final GTT routed to a primary and backup point-code and SSN (dominant mode) - Final GTT load balanced across a group of point-codes and subsystems For ANSI the translation types are defined in TABLE B.1/T1.112.3 of TR-NWT-000246. The ANSI selector table may be a simple flat table/array of 256 Translation Types(0-255). In this method of translation tables can be directly accessed using the translation type from the Called Party Point Code. For ITU section 2.4.5 of ITU-T Q.714, defines the use of the Global Tile Indicator(GTI), along with Translation Type(TT), Network Plan(NP), and Nature of Address Indicator(NAI), as selectors for the table to perform the Global Title Translation(GTT). In this cae the selector table must be searched using a combination oF GTI, TT, NP and NAI. The objects cItpAclGtiSelector, cItpAclGtiTranslateType, cItpAclGtiNumberingPlan, cItpAclGtiNai, and cItpAclGtiEsv are the relevant columns. These object will be used in the following order based on variant and translation type. 1 => cItpAclGtiNai 2 => cItpAclGtiTranslateType 3 => cItpAclGtiTranslateType cItpAclGtiNumberingPlan cItpAclGtiEsv 4 => cItpAclGtiTranslateType cItpAclGtiNumberingPlan cItpAclGtiNai cItpAclGtiEsv 'aft' : The cItpAclAft, cItpAclAftMask, cItpAclAftSsn and cItpAclAftSsnMask are the relevant columns. The affected point code is compared with cItpAclAftPC using the ItpAclAftMask. Also, the cItpAclAftSsn and cItpAclAftSsnMask are compared if specified. 'aftMask': Indicates that a mask is to be applied when the aft filter is specified. If the mask is not specified then the mask is assumed to be all zeros. 'all' : Used in conjunction with cItpAclAction to specify defaults for packet that did not match any specified access list entry.
NUM cItpAclDpc	1.3.6.1.4.1.9.9.227.1.2.1.1.6	CItpTcPointCode	read-create	The destination point code specified for this ACL. The 'dpc' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclDpcMask	1.3.6.1.4.1.9.9.227.1.2.1.1.7	CItpTcPointCodeMask	read-create	The mask used to define which part of the point code in the packet is significant when comparing the destination point code with cItpAclDpc. The 'dpcMask' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclOpc	1.3.6.1.4.1.9.9.227.1.2.1.1.8	CItpTcPointCode	read-create	The origin point code specified in this ACL. The 'opc' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclOpcMask	1.3.6.1.4.1.9.9.227.1.2.1.1.9	CItpTcPointCodeMask	read-create	The mask used to define which part of the origin point code in the packet is significant when comparing the origin point code with cItpAclDpc. The 'opcMask' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclSi	1.3.6.1.4.1.9.9.227.1.2.1.1.10	CItpTcServiceIndicator	read-create	The Service Indicator Octet. The 'si' bit in the cItpAclParameters object is used indicate whether this object has been specified.
STR cItpAclPattern	1.3.6.1.4.1.9.9.227.1.2.1.1.11	SnmpAdminString	read-create	The pattern used to match a packet at offset cItpAclOffset. The 'pattern' bit in the cItpAclParameters object is used indicate whether this object has been specified.
U32 cItpAclOffset	1.3.6.1.4.1.9.9.227.1.2.1.1.12	Unsigned32	read-create	The offset into the packet were we begin matching the pattern specified by cItpAclPattern is to start. The 'pattern' bit in the cItpAclParameters object is used indicate whether this object has been specified.
STR cItpAclComment	1.3.6.1.4.1.9.9.227.1.2.1.1.13	SnmpAdminString	read-create	A brief description used to document access list entries. The 'comment' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclCgpa	1.3.6.1.4.1.9.9.227.1.2.1.1.14	CItpTcPointCode	read-create	The Calling Party Point Code. The 'cgpa' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclCgpaMask	1.3.6.1.4.1.9.9.227.1.2.1.1.15	CItpTcPointCodeMask	read-create	The Calling Party Point Code mask. The 'cgpaMask' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclCgpaSsn	1.3.6.1.4.1.9.9.227.1.2.1.1.16	CItpTcSubSystemNumber	read-create	The Calling Party Point Code subsystem number. The 'cgpa' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclCgpaSsnMask	1.3.6.1.4.1.9.9.227.1.2.1.1.17	CItpTcSubSystemNumberMask	read-create	The Calling Party Point Code subsystem number Mask. The 'cgpa' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclCdpa	1.3.6.1.4.1.9.9.227.1.2.1.1.18	CItpTcPointCode	read-create	The Called Party Point Code. The 'cdpa' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclCdpaMask	1.3.6.1.4.1.9.9.227.1.2.1.1.19	CItpTcPointCodeMask	read-create	The Called Party Point Code mask. The 'cdpaMask' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclCdpaSsn	1.3.6.1.4.1.9.9.227.1.2.1.1.20	CItpTcSubSystemNumber	read-create	The Called Party Point Code subsystem number. The 'cdpa' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclCdpaSsnMask	1.3.6.1.4.1.9.9.227.1.2.1.1.21	CItpTcSubSystemNumberMask	read-create	The Called Party Point Code subsystem number Mask. The 'cdpa' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclGtiSelector	1.3.6.1.4.1.9.9.227.1.2.1.1.22	CItpTcGlobalTitleSelector	read-create	The Global Title Selector. The 'selector' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclGtiTranslateType	1.3.6.1.4.1.9.9.227.1.2.1.1.23	CItpTcTranslationType	read-create	The Global Title Translate Type. The 'selector' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclGtiNumberingPlan	1.3.6.1.4.1.9.9.227.1.2.1.1.24	CItpTcNumberingPlan	read-create	The Global Title Numbering Plan. The 'selector' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclGtiNai	1.3.6.1.4.1.9.9.227.1.2.1.1.25	CItpTcNAI	read-create	The Global Title nature of address indicator. The 'selector' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclGtiEsv	1.3.6.1.4.1.9.9.227.1.2.1.1.26	CItpTcEncodingSchemeValue	read-create	The Global Title encoding scheme value. The 'selector' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclAft	1.3.6.1.4.1.9.9.227.1.2.1.1.27	CItpTcPointCode	read-create	The Affected Point Code. The 'aft' bit in the cItpAclParameters object is used indicate whether this object has been specified.
NUM cItpAclAftMask	1.3.6.1.4.1.9.9.227.1.2.1.1.28	CItpTcPointCodeMask	read-create	The Affected Point Code mask. The 'aftMask' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclAftSsn	1.3.6.1.4.1.9.9.227.1.2.1.1.29	CItpTcSubSystemNumber	read-create	The Affected Point Code subsystem number. The 'aft' bit in the cItpAclParameters object is used indicate whether this object has been specified.
CIT cItpAclAftSsnMask	1.3.6.1.4.1.9.9.227.1.2.1.1.30	CItpTcSubSystemNumberMask	read-create	The Affected Point Code subsystem number Mask. The 'aft' bit in the cItpAclParameters object is used indicate whether this object has been specified.
ROW cItpAclRowStatus	1.3.6.1.4.1.9.9.227.1.2.1.1.31	RowStatus	read-create	The object is used by a management station to create or delete the row entry in cItpAcl following the RowStatus textual convention.
cItpAclMIBConformance	1.3.6.1.4.1.9.9.227.2
cItpAclMIBCompliances	1.3.6.1.4.1.9.9.227.2.1
cItpAclMIBCompliance	1.3.6.1.4.1.9.9.227.2.1.1			The compliance statement for entities which implement the Cisco SP MIB
cItpAclMIBGroups	1.3.6.1.4.1.9.9.227.2.2
cItpAclScalarGroup	1.3.6.1.4.1.9.9.227.2.2.1			SP main objects.
cItpAclAccessListGroup	1.3.6.1.4.1.9.9.227.2.2.2			Signaling Point access control list objects.

RFC description

Controls SS7 signaling message access lists for Cisco IP Transfer Point (ITP) nodes.

Start monitoring Cisco IP Transfer Point (ITP) SS7 signaling gateway (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-ITP-ACL-MIB

What Is CISCO-ITP-ACL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description