CISCOSB-BRIDGE-SECURITY

All MIBs › CISCOSB-BRIDGE-SECURITY

Organization: Cisco Systems, Inc.

Last Updated: 2006-04-02

Category: VLAN and Bridging, VPN and Security, Vendor: RADLAN/Cisco SB

Description: Manages Cisco Small Business bridge security features including port security and MAC filtering.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCOSB-BRIDGE-SECURITY?

CISCOSB-BRIDGE-SECURITY is a Cisco Small Business private MIB covering Layer 2 security features: DHCP Snooping, Dynamic ARP Inspection, and IP Source Guard. It exposes configuration state and operational counters for these anti-spoofing mechanisms, including enable/disable flags, static binding tables, and VLAN tagging options. Its monitoring value is mainly in configuration/status verification and fault detection—confirming DHCP snooping is enabled, checking the current number of learned/static bindings, and detecting untrusted-port violations that indicate spoofing attempts. It is vendor-specific to Cisco Small Business switches and complements standard bridge/VLAN MIBs rather than replacing them. Typical deployment is on small-business/SMB switches where CISCOSB-BRIDGE-SECURITY SNMP monitoring helps administrators protect against rogue DHCP servers and ARP/IP spoofing at the access layer.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCOSB-BRIDGE-SECURITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Small Business switch

Monitoring Examples

An administrator would check rlIpDhcpSnoopEnable and rlIpDhcpSnoopCurrentEntiresNumber to confirm DHCP snooping is active and see how many client bindings are currently tracked, then inspect rlIpDhcpSnoopStaticTable/rlIpDhcpSnoopStaticEntry for manually configured trusted host bindings. A spike in rlIpDhcpSnoopCurrentEntiresNumber or dropped packets logged via rlIpArpInspect would indicate a potential rogue DHCP server or ARP spoofing attack on the segment. rlIpDhcpOpt82InsertionEnable shows whether DHCP Option 82 relay tagging is turned on for uplinks.

What Can Be Monitored

DHCP snooping enable status
DHCP snooping binding count
static DHCP snooping entries
IP source guard status
ARP inspection status
DHCP option 82 insertion state

Imported Objects

From CISCOSB-MIB

switch001

MODULE-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From Q-BRIDGE-MIB

VlanId

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlBridgeSecurity	1.3.6.1.4.1.9.6.1.101.112			The private MIB module definition for DHCP Snoop, ARP Inspection and Ip source Guard features.
rlIpArpInspect	1.3.6.1.4.1.9.6.1.101.112.3
RLI rlIpArpInspectAssignedListName	1.3.6.1.4.1.9.6.1.101.112.3.6.1.2	RlIpArpInspectListNameType	read-write	An Ip ARP Inspection assigned ACL name.
T/F rlIpArpInspectClearCountersAction	1.3.6.1.4.1.9.6.1.101.112.3.8	TruthValue	read-write	If true, clear (set to zero) on all vlans: all Arp Inspection counters: rlIpArpInspectVlanNumOfArpForwarded , rlIpArpInspectVlanNumOfArpDropped and rlIpArpInspectVlanNumOfArpMismatched
INT rlIpArpInspectEnable	1.3.6.1.4.1.9.6.1.101.112.3.2	INTEGER	read-write	Specifies a system ARP Inspection enable state.
rlIpArpInspectEnableVlanEntry	1.3.6.1.4.1.9.6.1.101.112.3.6.1		not-accessible	An Ip ARP Inspection enabled VLAN entry.
ROW rlIpArpInspectEnableVlanRowStatus	1.3.6.1.4.1.9.6.1.101.112.3.6.1.3	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
rlIpArpInspectEnableVlanTable	1.3.6.1.4.1.9.6.1.101.112.3.6		not-accessible	An Ip ARP Inspection enabled VLAN table.
VLA rlIpArpInspectEnableVlanTag	1.3.6.1.4.1.9.6.1.101.112.3.6.1.1	VlanId	not-accessible	An Ip ARP Inspection entry vlan tag.
rlIpArpInspectListEntry	1.3.6.1.4.1.9.6.1.101.112.3.5.1		not-accessible	The row definition for this table.
IP rlIpArpInspectListIPAddress	1.3.6.1.4.1.9.6.1.101.112.3.5.1.2	IpAddress	not-accessible	ARP Inspection List IP address.
MAC rlIpArpInspectListMACAddress	1.3.6.1.4.1.9.6.1.101.112.3.5.1.3	MacAddress	read-write	ARP Inspection List mac address
RLI rlIpArpInspectListName	1.3.6.1.4.1.9.6.1.101.112.3.5.1.1	RlIpArpInspectListNameType	not-accessible	The Name of the Access List.
ROW rlIpArpInspectListRowStatus	1.3.6.1.4.1.9.6.1.101.112.3.5.1.4	RowStatus	read-write	A status can be destroy, active or createAndGo
rlIpArpInspectListTable	1.3.6.1.4.1.9.6.1.101.112.3.5		not-accessible	The table specifies all ARP Inspection List entries. The entry contains a list name, list IP address, a list Mac address.
U32 rlIpArpInspectLogInterval	1.3.6.1.4.1.9.6.1.101.112.3.3	Unsigned32	read-write	Specify the minimal interval between successive ARP SYSLOG messages. 0 - message is immediately generated. 0xFFFFFFFF - messages would not be generated. A legal range is 0-86400.
INT rlIpArpInspectMibVersion	1.3.6.1.4.1.9.6.1.101.112.3.1	INTEGER	read-only	MIB's version, the current version is 1.
rlIpArpInspectTrustedPortEntry	1.3.6.1.4.1.9.6.1.101.112.3.7.1		not-accessible	The row definition for this table.
ROW rlIpArpInspectTrustedPortRowStatus	1.3.6.1.4.1.9.6.1.101.112.3.7.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpArpInspectTrustedPortTable	1.3.6.1.4.1.9.6.1.101.112.3.7		not-accessible	ARP Inspection Trusted ports entry. The entry created when port is configured as trusted.
INT rlIpArpInspectValidation	1.3.6.1.4.1.9.6.1.101.112.3.4	INTEGER	read-write	Defined a specific check on incoming ARP packets: Source MAC: Compare the source MAC address in the Ethernet header against the sender MAC address in the ARP body. This check is performed on both ARP requests and responses. Destination MAC: Compare the destination MAC address in the Ethernet header against the target MAC address in ARP body. This check is performed for ARP responses. IP addresses: Compare the ARP body for invalid and unexpected IP addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
T/F rlIpArpInspectVlanClearCountersAction	1.3.6.1.4.1.9.6.1.101.112.3.6.1.7	TruthValue	read-write	If true, clear (set to zero) all Arp Inspection counters: rlIpArpInspectVlanNumOfArpForwarded , rlIpArpInspectVlanNumOfArpDropped and rlIpArpInspectVlanNumOfArpMismatched
C32 rlIpArpInspectVlanNumOfArpDropped	1.3.6.1.4.1.9.6.1.101.112.3.6.1.5	Counter32	read-only	Number of dropped ARP packets, which were validated by ARP inspection (mismatch , not-found and dropped for any reason)
C32 rlIpArpInspectVlanNumOfArpForwarded	1.3.6.1.4.1.9.6.1.101.112.3.6.1.4	Counter32	read-only	Total number of forwarded ARP packets, packets which were validated by ARP inspection
C32 rlIpArpInspectVlanNumOfArpMismatched	1.3.6.1.4.1.9.6.1.101.112.3.6.1.6	Counter32	read-only	Number of dropped ARP packets, which were validated by ARP inspection and inconsistency was found for IP and MAC (mismatch)
INT rlIpDhcpOpt82InsertionEnable	1.3.6.1.4.1.9.6.1.101.112.1.8	INTEGER	read-write	Specifies a DHCP option 82 insertion enable state.
INT rlIpDhcpOpt82RxOnUntrustedEnable	1.3.6.1.4.1.9.6.1.101.112.1.9	INTEGER	read-write	Specifies a DHCP option 82 receive on untrusted port enable state.
rlIpDhcpSnoop	1.3.6.1.4.1.9.6.1.101.112.1
INT rlIpDhcpSnoopClearAction	1.3.6.1.4.1.9.6.1.101.112.1.4	INTEGER	read-write	Used to clear DHCP Snoop Table.
INT rlIpDhcpSnoopCurrentEntiresNumber	1.3.6.1.4.1.9.6.1.101.112.1.7	INTEGER	read-only	Contain the current number of DHCP snooping entries for all types.
INT rlIpDhcpSnoopEnable	1.3.6.1.4.1.9.6.1.101.112.1.2	INTEGER	read-write	Specifies a system DHCP Snoop enable state.
rlIpDhcpSnoopEnableVlanEntry	1.3.6.1.4.1.9.6.1.101.112.1.12.1		not-accessible	An Ip Dhcp Snooping enabled VLAN entry.
ROW rlIpDhcpSnoopEnableVlanRowStatus	1.3.6.1.4.1.9.6.1.101.112.1.12.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
rlIpDhcpSnoopEnableVlanTable	1.3.6.1.4.1.9.6.1.101.112.1.12		not-accessible	An Ip Dhcp Snooping enabled VLAN table.
VLA rlIpDhcpSnoopEnableVlanTag	1.3.6.1.4.1.9.6.1.101.112.1.12.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
rlIpDhcpSnoopEntry	1.3.6.1.4.1.9.6.1.101.112.1.11.1		not-accessible	The row definition for this table.
INT rlIpDhcpSnoopFileEnable	1.3.6.1.4.1.9.6.1.101.112.1.3	INTEGER	read-write	Specifies a system DHCP Snoop file enable state.
INT rlIpDhcpSnoopFileUpdateTime	1.3.6.1.4.1.9.6.1.101.112.1.5	INTEGER	read-write	Configures in seconds the period of time between file updates. The valid range is 600 - 86400.
IP rlIpDhcpSnoopIPAddress	1.3.6.1.4.1.9.6.1.101.112.1.11.1.5	IpAddress	read-write	The IP address of the DHCP client referred to in this table entry.
U32 rlIpDhcpSnoopLeaseTime	1.3.6.1.4.1.9.6.1.101.112.1.11.1.4	Unsigned32	read-write	A DHCP Snoop lease time. For static entry the lease time is 0xFFFFFFFF
MAC rlIpDhcpSnoopMACAddress	1.3.6.1.4.1.9.6.1.101.112.1.11.1.2	MacAddress	not-accessible	A DHCP Snoop entry mac address
INT rlIpDhcpSnoopMibVersion	1.3.6.1.4.1.9.6.1.101.112.1.1	INTEGER	read-only	MIB's version, the current version is 1.
NUM rlIpDhcpSnoopPortInterface	1.3.6.1.4.1.9.6.1.101.112.1.11.1.6	InterfaceIndex	read-write	Identifies the port Interface ifindex, which connected to DHCP client identified with the entry.
ROW rlIpDhcpSnoopRowStatus	1.3.6.1.4.1.9.6.1.101.112.1.11.1.7	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpDhcpSnoopStaticEntry	1.3.6.1.4.1.9.6.1.101.112.1.10.1		not-accessible	The row definition for this table.
IP rlIpDhcpSnoopStaticIPAddress	1.3.6.1.4.1.9.6.1.101.112.1.10.1.3	IpAddress	read-write	A DHCP Snoop Static entry IP address.
MAC rlIpDhcpSnoopStaticMACAddress	1.3.6.1.4.1.9.6.1.101.112.1.10.1.2	MacAddress	not-accessible	A DHCP Snoop Static entry mac address
NUM rlIpDhcpSnoopStaticPortInterface	1.3.6.1.4.1.9.6.1.101.112.1.10.1.4	InterfaceIndex	read-write	A DHCP Snoop Static entry Port interface.
ROW rlIpDhcpSnoopStaticRowStatus	1.3.6.1.4.1.9.6.1.101.112.1.10.1.5	RowStatus	read-write	A status can be destroy, active or createAndGo
rlIpDhcpSnoopStaticTable	1.3.6.1.4.1.9.6.1.101.112.1.10		not-accessible	The table specifies all DHCP Snoop Static (configured by user) entries. The entry contains a local IP address of the DHCP client, a Port interface to which a DHCP client is connected to the switch.
VLA rlIpDhcpSnoopStaticVLANTag	1.3.6.1.4.1.9.6.1.101.112.1.10.1.1	VlanId	not-accessible	A DHCP Snoop Static entry vlan tag.
rlIpDhcpSnoopTable	1.3.6.1.4.1.9.6.1.101.112.1.11		not-accessible	DHCP Snoop entry. Use to add/delete a dynamic entries and to view all entries (dynamic and static)
rlIpDhcpSnoopTrustedPortEntry	1.3.6.1.4.1.9.6.1.101.112.1.13.1		not-accessible	The row definition for this table.
ROW rlIpDhcpSnoopTrustedPortRowStatus	1.3.6.1.4.1.9.6.1.101.112.1.13.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpDhcpSnoopTrustedPortTable	1.3.6.1.4.1.9.6.1.101.112.1.13		not-accessible	DHCP Snoop Trusted ports entry. The entry created when port is configured as trusted.
RLI rlIpDhcpSnoopType	1.3.6.1.4.1.9.6.1.101.112.1.11.1.3	RlIpDhcpSnoopType	read-write	A DHCP Snoop entry type: static or dynamic.
INT rlIpDhcpSnoopVerifyMacAddress	1.3.6.1.4.1.9.6.1.101.112.1.6	INTEGER	read-write	Configures on an un-trusted port whether the source MAC address in a DHCP packet matches the client hardware address.
VLA rlIpDhcpSnoopVLANTag	1.3.6.1.4.1.9.6.1.101.112.1.11.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
rlIpSourceGuard	1.3.6.1.4.1.9.6.1.101.112.2
INT rlIpSourceGuardEnable	1.3.6.1.4.1.9.6.1.101.112.2.2	INTEGER	read-write	FALSE - There is no Ip Source Guard in the system. TRUE - Ip Source Guard is enabled on system.
rlIpSourceGuardEntry	1.3.6.1.4.1.9.6.1.101.112.2.6.1		not-accessible	The row definition for this table.
RLI rlIpSourceGuardFailReason	1.3.6.1.4.1.9.6.1.101.112.2.6.1.6	RlIpSourceGuardFailReason	read-only	Identifies the reason for in-activity of Ip Source Guard entry.
IP rlIpSourceGuardIPAddress	1.3.6.1.4.1.9.6.1.101.112.2.6.1.1	IpAddress	not-accessible	The IP address of the Ip Source Guard entry.
MAC rlIpSourceGuardMACAddress	1.3.6.1.4.1.9.6.1.101.112.2.6.1.3	MacAddress	read-only	A Ip Source Guard entry mac address
INT rlIpSourceGuardMibVersion	1.3.6.1.4.1.9.6.1.101.112.2.1	INTEGER	read-only	MIB's version, the current version is 1.
rlIpSourceGuardPermittedRuleCounterEntry	1.3.6.1.4.1.9.6.1.101.112.2.7.1		not-accessible	The row definition for this table.
C32 rlIpSourceGuardPermittedRuleCounterNumOfDhcpRules	1.3.6.1.4.1.9.6.1.101.112.2.7.1.3	Counter32	read-only	Number of rules added by IP Source Guard for the permitted Hosts, as a result of DHCP Snooping dynamic information.
C32 rlIpSourceGuardPermittedRuleCounterNumOfStaticRules	1.3.6.1.4.1.9.6.1.101.112.2.7.1.2	Counter32	read-only	Number of static rules added by IP Source Guard for the permitted Hosts
rlIpSourceGuardPermittedRuleCounterTable	1.3.6.1.4.1.9.6.1.101.112.2.7		not-accessible	The table includes, per vlan, the IP Source Guard permitted rules counters.
VLA rlIpSourceGuardPermittedRuleCounterVLANTag	1.3.6.1.4.1.9.6.1.101.112.2.7.1.1	VlanId	not-accessible	Ip Source Guard permitted rules counters entry Vlan tag.
rlIpSourceGuardPortEntry	1.3.6.1.4.1.9.6.1.101.112.2.5.1		not-accessible	The row definition for this table.
ROW rlIpSourceGuardPortRowStatus	1.3.6.1.4.1.9.6.1.101.112.2.5.1.2	RowStatus	read-write	Entry status. A valid status is CreateAndGo or Delete.
rlIpSourceGuardPortTable	1.3.6.1.4.1.9.6.1.101.112.2.5		not-accessible	IP Source Guard ports entry. The entry created when IP Source Guard enabled on port.
INT rlIpSourceGuardRetryTime	1.3.6.1.4.1.9.6.1.101.112.2.4	INTEGER	read-write	Configures in seconds the period of time the application retries to insert inactive by resource problem rules. The actual range is 10-600. 0 used to sign that the timer is not active.
INT rlIpSourceGuardRetryToInsert	1.3.6.1.4.1.9.6.1.101.112.2.3	INTEGER	read-write	When setted to retryToInsertNow all IP Source Guard inactive entries due to resource problem reinserted in the Policy. On get always return noAction.
RLI rlIpSourceGuardStatus	1.3.6.1.4.1.9.6.1.101.112.2.6.1.5	RlIpSourceGuardStatus	read-only	Identifies the status of Ip Source Guard entry.
rlIpSourceGuardTable	1.3.6.1.4.1.9.6.1.101.112.2.6		not-accessible	IP Source Guard entry. Use to view all entries (dynamic and static)
RLI rlIpSourceGuardType	1.3.6.1.4.1.9.6.1.101.112.2.6.1.4	RlIpSourceGuardType	read-only	A Ip Source Guard entry type: static or dynamic.
VLA rlIpSourceGuardVLANTag	1.3.6.1.4.1.9.6.1.101.112.2.6.1.2	VlanId	not-accessible	A Ip Source Guard entry vlan tag.
rlProtocolFiltering	1.3.6.1.4.1.9.6.1.101.112.4
rlProtocolFilteringEntry	1.3.6.1.4.1.9.6.1.101.112.4.1.1		not-accessible	The row definition for this table.
PRO rlProtocolFilteringList	1.3.6.1.4.1.9.6.1.101.112.4.1.1.1	ProtocolFilteringMap	read-write	The list of protocol to be filtered.
ROW rlProtocolFilteringRowStatus	1.3.6.1.4.1.9.6.1.101.112.4.1.1.2	RowStatus	read-write	A status can be destroy, active or createAndGo
rlProtocolFilteringTable	1.3.6.1.4.1.9.6.1.101.112.4.1		not-accessible	Protocol filter configuration entry

RFC description

Manages DHCP snooping, ARP inspection, and IP source guard security features on Cisco Small Business switches.

Start monitoring Cisco Small Business managed switch with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCOSB-BRIDGE-SECURITY

What Is CISCOSB-BRIDGE-SECURITY?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description