All MIBs › CISCO-UNIFIED-COMPUTING-DPSEC-MIB
Organization: Cisco Systems Inc.
Last Updated: 2016-01-18
Description: MIB for data path security policy management on Cisco UCS, controlling forged MAC transmit permissions for vNIC interfaces to enforce Layer 2 security at the virtual port level
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is CISCO-UNIFIED-COMPUTING-DPSEC-MIB?
CISCO-UNIFIED-COMPUTING-DPSEC-MIB is a Cisco UCS management-model MIB covering data path security (DPSEC) policy, specifically controlling whether forged MAC address transmission is permitted on virtual network interfaces (vNICs) to enforce Layer 2 security at the virtual port level. It exposes configuration data -- per-vNIC MAC-forging policy settings, descriptions, and policy ownership -- rather than traffic or performance counters. Its monitoring value is configuration/software-status oriented: confirming that MAC anti-spoofing policy (cucsDpsecMacForge) is set as intended on each virtual interface, which is a security-hardening check rather than a hardware health check. It is meaningful only in the context of the broader Cisco UCS vNIC/networking object model it references. It is deployed on Cisco UCS blade and rack servers using virtualized network interfaces managed through UCS Manager. Engineers can download the CISCO-UNIFIED-COMPUTING-DPSEC-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-UNIFIED-COMPUTING-DPSEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Cisco UCS blade servers
- Cisco UCS rack servers
Monitoring Examples
An administrator would poll cucsDpsecMacTable/cucsDpsecMacEntry, checking cucsDpsecMacForge for each vNIC (identified via cucsDpsecMacDn) to confirm forged-MAC-address transmission is disabled per security policy. If cucsDpsecMacForge shows 'allowed' on an interface expected to be locked down, it flags a security policy drift that could enable MAC spoofing on that vNIC. Reviewing cucsDpsecMacPolicyOwner and cucsDpsecMacPropAcl helps confirm which UCS policy is enforcing (or failing to enforce) the setting.
What Can Be Monitored
- per-vNIC forged-MAC transmit policy
- data path security policy ownership
- vNIC security configuration status
Imported Objects
From CISCO-SMI
| ciscoMgmt | OBJECT-IDENTITY |
From CISCO-TC
| CiscoAlarmSeverity | |
| CiscoInetAddressMask | |
| CiscoNetworkAddress | |
| TimeIntervalSec | |
| Unsigned64 |
From CISCO-UNIFIED-COMPUTING-MIB
| CucsManagedObjectDn | |
| CucsManagedObjectId | |
| ciscoUnifiedComputingMIBObjects | OBJECT-IDENTITY |
From CISCO-UNIFIED-COMPUTING-TC-MIB
| CucsDpsecForgedTransmit | |
| CucsPolicyPolicyOwner |
From INET-ADDRESS-MIB
| InetAddressIPv4 | |
| InetAddressIPv6 |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-SMI
| Counter32 | |
| Counter64 | |
| Gauge32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| TimeTicks | |
| Unsigned32 |
From SNMPv2-TC
| DateAndTime | |
| DisplayString | |
| MacAddress | |
| RowPointer | |
| TEXTUAL-CONVENTION | |
| TimeInterval | |
| TimeStamp | |
| TruthValue |
OIDs
RFC description
Manages data plane security (DPSEC) for Cisco Unified Computing System including MAC forging and policy ownership configuration.
Start monitoring Cisco UCS blade/rack servers (data path security) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.